| CCI: | CCI-000002 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-14 |
| Definition: | Disseminate the organization-level; mission/business process-level; and/or system-level access control policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance to organization-defined personnel or roles. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-1 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-1 a 1 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-1 a 1 (a) | |||
| NIST: NIST SP 800-53A (v1): AC-1.1 (iii) | |||
| CCI: | CCI-000005 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-14 |
| Definition: | Disseminate procedures to facilitate the implementation of the organization-level; mission/business process-level; and/or system-level access control policy and associated access controls to the organization-defined personnel or roles. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-1 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-1 a 2 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-1 a 2 | |||
| NIST: NIST SP 800-53A (v1): AC-1.1 (vi) | |||
| CCI: | CCI-002107 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Defines the personnel or roles to be recipients of the organization-level; mission/business process-level; and/or system-level access control policy necessary to facilitate the implementation of the access control policy and associated access controls. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-1 a 1 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-1 a 1 (a) | |||
| CCI: | CCI-002108 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Defines the personnel or roles to be recipients of the procedures necessary to facilitate the implementation of the organization-level; mission/business process-level; and/or system-level access control policy and associated access controls. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-1 a 1 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-1 a 2 | |||
| CCI: | CCI-003601 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Develop and document an organization-level; mission/business process-level; and/or system-level access control policy that is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-1 a 1 (b) | ||
| CCI: | CCI-003602 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Develop and document an organization-level; mission/business process-level; and/or system-level access control policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-1 a 1 (a) | ||
| CCI: | CCI-003603 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Disseminate the organization-level; mission/business process-level; and/or system-level access control policy that is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines to organization-defined personnel or roles. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-1 a 1 (b) | ||
| CCI: | CCI-003604 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Develop and document procedures to facilitate the implementation of the organization-level; mission/business process-level; and/or system-level access control policy and the associated access control. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-1 a 2 | ||
| CCI: | CCI-003605 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Designate an organization-defined official to manage the development and documentation of the access control policy and procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-1 b | ||
| CCI: | CCI-003606 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Designate an organization-defined official to manage the dissemination of the access control policy and procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-1 b | ||
| CCI: | CCI-003607 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Defines the official designated to manage the development, documentation, and dissemination of the access control policy and procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-1 b | ||
| CCI: | CCI-000003 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-14 |
| Definition: | Review and update the current access control policy on an organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-1 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-1 b 1 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-1 c 1 | |||
| NIST: NIST SP 800-53A (v1): AC-1.2 (ii) | |||
| CCI: | CCI-000006 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-14 |
| Definition: | Review and update the current access control procedures on an organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-1 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-1 b 2 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-1 c 2 | |||
| NIST: NIST SP 800-53A (v1): AC-1.2 (iv) | |||
| CCI: | CCI-001545 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-11 |
| Definition: | Defines a frequency for reviewing and updating the access control policy. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-1 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-1 b 1 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-1 c 1 | |||
| NIST: NIST SP 800-53A (v1): AC-1.2 (i) | |||
| CCI: | CCI-001546 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-11 |
| Definition: | Defines a frequency for reviewing and updating the access control procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-1 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-1 b 2 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-1 c 2 | |||
| NIST: NIST SP 800-53A (v1): AC-1.2 (iii) | |||
| CCI: | CCI-003608 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Review and update the current access control policy following organization-defined events. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-1 c 1 | ||
| CCI: | CCI-003609 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Defines the events following reviewing and updating the current access control policy. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-1 c 1 | ||
| CCI: | CCI-003610 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Review and update the current access control procedures following organization-defined events. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-1 c 2 | ||
| CCI: | CCI-003611 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Defines the events following reviewing and updating the current access control procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-1 c 2 | ||
| CCI: | CCI-003612 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Define and document the types of accounts allowed and specifically prohibited for use within the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-2 a | ||
| CCI: | CCI-002112 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Assign account managers. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-2 b | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-2 b | |||
| CCI: | CCI-003613 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Require organization-defined prerequisites and criteria for group membership. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-2 c | ||
| CCI: | CCI-003614 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Require organization-defined prerequisites and criteria for role membership. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-2 c | ||
| CCI: | CCI-003615 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Defines the prerequisites and criteria for group and role membership. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-2 c | ||
| CCI: | CCI-002115 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Specify authorized users of the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-2 d | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-2 d 1 | |||
| CCI: | CCI-002116 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Specify authorized users of the group. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-2 d | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-2 d 2 | |||
| CCI: | CCI-002117 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Specify authorized users of the role membership. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-2 d | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-2 d 2 | |||
| CCI: | CCI-002118 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Specify authorized access authorizations (i.e., privileges) for each account. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-2 d | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-2 d 3 | |||
| CCI: | CCI-002119 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Specify organization-attributes (as required) for each account on the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-2 d | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-2 d 3 | |||
| CCI: | CCI-003616 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Defines the attributes (as required) for each account. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-2 d 3 | ||
| CCI: | CCI-000010 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-13 |
| Definition: | Require approvals by organization-defined personnel or roles for requests to create accounts. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-2 d | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-2 e | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-2 e | |||
| NIST: NIST SP 800-53A (v1): AC-2.1 (i) | |||
| CCI: | CCI-002120 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Defines the personnel or roles authorized to approve the creation of accounts. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-2 e | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-2 e | |||
| CCI: | CCI-000011 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-13 |
| Definition: | Create, enable, modify, disable, and remove system accounts in accordance with organization-defined procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-2 e | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-2 f | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-2 f | |||
| NIST: NIST SP 800-53A (v1): AC-2.1 (i) | |||
| CCI: | CCI-002121 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Defines the procedures to be employed when creating, enabling, modifying, disabling, and removing information system accounts. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-2 f | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-2 f | |||
| CCI: | CCI-003617 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Create, enable, modify, disable, and remove system accounts in accordance with organization-defined policy. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-2 f | ||
| CCI: | CCI-003618 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Create, enable, modify, disable, and remove system accounts in accordance with organization-defined criteria. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-2 f | ||
| CCI: | CCI-003619 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Create, enable, modify, disable, and remove system accounts in accordance with organization-defined prerequisites. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-2 f | ||
| CCI: | CCI-003620 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Defines the policy to be employed when creating, enabling, modifying, disabling, and removing information system accounts. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-2 f | ||
| CCI: | CCI-003621 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Defines the prerequisites to be employed when creating, enabling, modifying, disabling, and removing information system accounts. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-2 f | ||
| CCI: | CCI-003622 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Defines the criteria to be employed when creating, enabling, modifying, disabling, and removing information system accounts. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-2 f | ||
| CCI: | CCI-002122 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Monitor the use of accounts. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-2 g | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-2 g | |||
| CCI: | CCI-002123 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Notify account managers and organization-defined personnel or roles within an organization-defined time-period when accounts are no longer required. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-2 h 1 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-2 h 1 | |||
| CCI: | CCI-002124 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Notify account managers and organization-defined personnel or roles within an organization-defined time-period when users are terminated or transferred. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-2 h 2 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-2 h 2 | |||
| CCI: | CCI-002125 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Notify account managers and organization-defined personnel or roles within an organization-defined time-period when system usage or need-to-know changes for an individual. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-2 h 3 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-2 h 3 | |||
| CCI: | CCI-003623 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Defines the personnel or roles of whom to notify when accounts are no longer required; when users are terminated or transferred; and when system usage or need-to-know changes for an individual. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-2 h | ||
| CCI: | CCI-003624 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Defines the time period of when to notify account managers for each situation. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-2 h | ||
| CCI: | CCI-002126 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Authorize access to the system based on a valid access authorization. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-2 i 1 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-2 i 1 | |||
| CCI: | CCI-002127 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Authorize access to the system based on intended system usage. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-2 i 2 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-2 i 2 | |||
| CCI: | CCI-002128 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Authorize access to the system based on organization-defined attributes (as required). | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-2 i 3 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-2 i 3 | |||
| CCI: | CCI-003625 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Defines the attributes (as required) for authorizing access to the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-2 i 3 | ||
| CCI: | CCI-000012 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-14 |
| Definition: | Review accounts for compliance with account management requirements per organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-2 j | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-2 j | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-2 j | |||
| NIST: NIST SP 800-53A (v1): AC-2.1 (i) | |||
| CCI: | CCI-001547 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-11 |
| Definition: | Defines the frequency on which it will review information system accounts for compliance with account management requirements. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-2 j | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-2 j | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-2 j | |||
| NIST: NIST SP 800-53A (v1): AC-2.1 (i) | |||
| CCI: | CCI-002129 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Establish and implement a process for changing shared or group account authenticators (if deployed) when individuals are removed from the group. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-2 k | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-2 k | |||
| CCI: | CCI-003626 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Align account management processes with personnel termination and transfer processes. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-2 l | ||
| CCI: | CCI-000015 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-13 |
| Definition: | Support the management of system accounts using organization-defined automated mechanisms. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AC-2 (1) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-2 (1) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-2 (1) | |||
| NIST: NIST SP 800-53A (v1): AC-2 (1).1 | |||
| CCI: | CCI-000016 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-13 |
| Definition: | Automatically remove or disable temporary and emergency accounts after an organization-defined time-period for each type of account. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AC-2 (2) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-2 (2) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-2 (2) | |||
| NIST: NIST SP 800-53A (v1): AC-2 (2).1 (ii) | |||
| CCI: | CCI-001361 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-24 |
| Definition: | Defines a time period after which temporary accounts are automatically terminated. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-2 (2) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-2 (2) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-2 (2) | |||
| NIST: NIST SP 800-53A (v1): AC-2 (2).1 (i) | |||
| CCI: | CCI-001365 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-24 |
| Definition: | Defines a time period after which emergency accounts are automatically terminated. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-2 (2) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-2 (2) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-2 (2) | |||
| NIST: NIST SP 800-53A (v1): AC-2 (2).1 (i) | |||
| CCI: | CCI-001682 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2011-05-03 |
| Definition: | Automatically remove or disable emergency accounts after an organization-defined time period for each type of account. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AC-2 (2) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-2 (2) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-2 (2) | |||
| NIST: NIST SP 800-53A (v1): AC-2 (2).1 (ii) | |||
| CCI: | CCI-000217 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-24 |
| Definition: | Defines a time period after which inactive accounts are automatically disabled. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-2 (3) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-2 (3) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-2 (3) | |||
| NIST: NIST SP 800-53A (v1): AC-2 (3).1 (i) | |||
| CCI: | CCI-003627 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Disable accounts when the accounts have expired. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-2 (3) (a) | ||
| CCI: | CCI-003628 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Disable accounts when the accounts are no longer associated to a user. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-2 (3) (b) | ||
| CCI: | CCI-003629 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Disable accounts when the accounts are in violation of organizational policy. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-2 (3) (c) | ||
| CCI: | CCI-000017 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-13 |
| Definition: | Disable accounts when the accounts have been inactive for the organization-defined time-period. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AC-2 (3) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-2 (3) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-2 (3) (d) | |||
| NIST: NIST SP 800-53A (v1): AC-2 (3).1 (ii) | |||
| CCI: | CCI-000018 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-13 |
| Definition: | Automatically audit account creation actions. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AC-2 (4) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-2 (4) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-2 (4) | |||
| NIST: NIST SP 800-53A (v1): AC-2 (4).1 (i and ii) | |||
| CCI: | CCI-001403 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-24 |
| Definition: | Automatically audit account modification actions. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AC-2 (4) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-2 (4) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-2 (4) | |||
| NIST: NIST SP 800-53A (v1): AC-2 (4).1 (i and ii) | |||
| CCI: | CCI-001404 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-24 |
| Definition: | Automatically audit account disabling actions. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AC-2 (4) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-2 (4) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-2 (4) | |||
| NIST: NIST SP 800-53A (v1): AC-2 (4).1 (i and ii) | |||
| CCI: | CCI-001405 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-24 |
| Definition: | Automatically audit account removal actions. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AC-2 (4) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-2 (4) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-2 (4) | |||
| NIST: NIST SP 800-53A (v1): AC-2 (4).1 (i and ii) | |||
| CCI: | CCI-002130 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Automatically audit account enabling actions. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-2 (4) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-2 (4) | |||
| CCI: | CCI-000019 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-14 |
| Definition: | Require that users log out in accordance with the organization-defined time-period of expected inactivity or description of when to log out. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-2 (5) (a) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-2 (5) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-2 (5) | |||
| NIST: NIST SP 800-53A (v1): AC-2 (5).1 (ii) | |||
| CCI: | CCI-001406 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-24 |
| Definition: | Defines a time period of expected inactivity when users are required to log out. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-2 (5) (a) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-2 (5) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-2 (5) | |||
| NIST: NIST SP 800-53A (v1): AC-2 (5).1 (i) | |||
| CCI: | CCI-002133 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Defines other conditions when users are required to log out. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-2 (5) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-2 (5) | |||
| CCI: | CCI-002134 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Defines a list of dynamic privilege management capabilities to be implemented. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-2 (6) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-2 (6) | |||
| CCI: | CCI-002135 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Implement the organization-defined list of dynamic privilege management capabilities. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-2 (6) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-2 (6) | |||
| CCI: | CCI-001358 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | Establish privileged user accounts in accordance with a role-based access scheme; or an attribute-based access scheme. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-2 (7) (a) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-2 (7) (a) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-2 (7) (a) | |||
| NIST: NIST SP 800-53A (v1): AC-2 (7).1 (i) | |||
| CCI: | CCI-001407 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-24 |
| Definition: | Administer privileged user accounts in accordance with a role-based access scheme; or an attribute-based access scheme. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-2 (7) (a) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-2 (7) (a) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-2 (7) (a) | |||
| NIST: NIST SP 800-53A (v1): AC-2 (7).1 (i) | |||
| CCI: | CCI-001360 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | Monitor privileged role assignments. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-2 (7) (b) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-2 (7) (b) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-2 (7) (b) | |||
| NIST: NIST SP 800-53A (v1): AC-2 (7).1 (ii) | |||
| CCI: | CCI-003630 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Monitor changes to roles or attributes. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-2 (7) (c) | ||
| CCI: | CCI-002137 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Revoke access when privileged role or attribute assignments are no longer appropriate. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-2 (7) (c) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-2 (7) (d) | |||
| CCI: | CCI-002138 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Defines the system accounts that can be dynamically created. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-2 (8) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-2 (8) | |||
| CCI: | CCI-002139 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Create organization-defined system accounts dynamically. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-2 (8) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-2 (8) | |||
| CCI: | CCI-003631 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Defines the system accounts that can be dynamically activated. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-2 (8) | ||
| CCI: | CCI-003632 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Activate organization-defined system accounts dynamically. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-2 (8) | ||
| CCI: | CCI-003633 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Defines the system accounts that can be dynamically managed. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-2 (8) | ||
| CCI: | CCI-003634 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Manage organization-defined system accounts dynamically. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-2 (8) | ||
| CCI: | CCI-003635 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Defines the system accounts that can be dynamically deactivated. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-2 (8) | ||
| CCI: | CCI-003636 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Deactivate organization-defined system accounts dynamically. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-2 (8) | ||
| CCI: | CCI-002140 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Defines the conditions for establishing shared/group accounts. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-2 (9) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-2 (9) | |||
| CCI: | CCI-002141 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Only permit the use of shared and group accounts that meet organization-defined conditions for establishing shared and group accounts. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-2 (9) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-2 (9) | |||
| CCI: | CCI-002143 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Defines the circumstances and/or usage conditions that are to be enforced for organization-defined information system accounts. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-2 (11) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-2 (11) | |||
| CCI: | CCI-002144 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Defines the system accounts that are to be subject to the enforcement of organization-defined circumstances and/or usage conditions. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-2 (11) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-2 (11) | |||
| CCI: | CCI-002145 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Enforce organization-defined circumstances and/or usage conditions for organization-defined system accounts. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-2 (11) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-2 (11) | |||
| CCI: | CCI-002146 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Defines atypical usage for which the system accounts are to be monitored. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-2 (12) (a) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-2 (12) (a) | |||
| CCI: | CCI-002147 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Monitor system accounts for organization-defined atypical usage. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-2 (12) (a) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-2 (12) (a) | |||
| CCI: | CCI-002148 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Defines the personnel or roles to whom atypical usage of system accounts are to be reported. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-2 (12) (b) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-2 (12) (b) | |||
| CCI: | CCI-002149 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Report atypical usage of system accounts to organization-defined personnel or roles. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-2 (12) (b) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-2 (12) (b) | |||
| CCI: | CCI-002150 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Defines the time period within which the accounts of users posing a significant risk are to be disabled after discovery of the risk. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-2 (13) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-2 (13) | |||
| CCI: | CCI-002151 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Disable accounts of individuals within an organization-defined time-period of discovery of organization-defined significant risk. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-2 (13) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-2 (13) | |||
| CCI: | CCI-003637 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Defines the significant risks that may be discovered requiring disabled accounts of individuals. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-2 (13) | ||
| CCI: | CCI-000213 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-14 |
| Definition: | Enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AC-3 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-3 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-3 | |||
| NIST: NIST SP 800-53A (v1): AC-3.1 | |||
| CCI: | CCI-000021 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-13 |
| Definition: | Enforce dual authorization for organization-defined privileged commands and/or other organization-defined actions. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AC-3 (2) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-3 (2) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (2) | |||
| NIST: NIST SP 800-53A (v1): AC-3 (2).1 (ii) | |||
| CCI: | CCI-001408 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-24 |
| Definition: | Defines privileged commands for which dual authorization is to be enforced. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-3 (2) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-3 (2) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (2) | |||
| NIST: NIST SP 800-53A (v1): AC-3 | |||
| CCI: | CCI-002152 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Defines other actions necessary for which dual authorization is to be enforced. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-3 (2) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (2) | |||
| CCI: | CCI-002153 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Defines the mandatory access control policies that are to be enforced over all subjects and objects. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-3 (3) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (3) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (15) (a) | |||
| CCI: | CCI-003014 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-08-30 |
| Definition: | Enforce organization-defined mandatory access control policies over all subjects and objects. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-3 (3) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (3) | |||
| CCI: | CCI-002154 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Enforce organization-defined mandatory access control policy over the set of covered subjects and objects specified in the policy, and where the policy is uniformly enforced across the covered subjects and objects within the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-3 (3) (a) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (3) (a) | |||
| CCI: | CCI-002155 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Enforce organization-defined mandatory access control policy over the set of covered subjects and objects specified in the policy, and where the policy specifies that a subject that has been granted access to information is constrained from passing the information to unauthorized subjects or objects. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-3 (3) (b) (1) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (3) (b) (1) | |||
| CCI: | CCI-002156 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Enforce organization-defined mandatory access control policy over the set of covered subjects and objects specified in the policy, and where the policy specifies that a subject that has been granted access to information is constrained from granting its privileges to other subjects. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-3 (3) (b) (2) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (3) (b) (2) | |||
| CCI: | CCI-002157 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Enforce organization-defined mandatory access control policy over the set of covered subjects and objects specified in the policy, and where the policy specifies that a subject that has been granted access to information is constrained from changing one or more security attributes on subjects, objects, the system, or system components. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-3 (3) (b) (3) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (3) (b) (3) | |||
| CCI: | CCI-002158 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Enforce organization-defined mandatory access control policy over the set of covered subjects and objects specified in the policy, and where the policy specifies that a subject that has been granted access to information is constrained from choosing the security attributes to be associated with newly created or modified objects. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-3 (3) (b) (4) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (3) (b) (4) | |||
| CCI: | CCI-002159 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Enforce organization-defined mandatory access control policy over the set of covered subjects and objects specified in the policy, and where the policy specifies that a subject that has been granted access to information is constrained from choosing the attribute values to be associated with newly created or modified objects. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-3 (3) (b) (4) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (3) (b) (4) | |||
| CCI: | CCI-002160 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Enforce organization-defined mandatory access control policy over the set of covered subjects and objects specified in the policy, and where the policy specifies that a subject that has been granted access to information is constrained from changing the rules governing access control. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-3 (3) (b) (5) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (3) (b) (5) | |||
| CCI: | CCI-002161 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Defines subjects which may explicitly be granted organization-defined privileges such that they are not limited by any of the mandatory access control constraints. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-3 (3) (c) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (3) (c) | |||
| CCI: | CCI-002162 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Defines the privileges that may explicitly be granted to organization-defined subjects such that they are not limited by any of the mandatory access control constraints. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-3 (3) (c) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (3) (c) | |||
| CCI: | CCI-003015 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-08-30 |
| Definition: | Specifies that organization-defined subjects may explicitly be granted organization-defined privileges such that they are not limited by any defined subset (or all) of the above constraints. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-3 (3) (c) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (3) (c) | |||
| CCI: | CCI-002163 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Defines the discretionary access control policies the information system is to enforce over subjects and objects. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-3 (4) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (4) | |||
| CCI: | CCI-002164 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Enforce organization-defined discretionary access control policy that over the set of covered subjects and objects specified in the policy, and where the policy specifies that a subject that has been granted access to information can do one or more of the following: pass the information to any other subjects or objects; grant its privileges to other subjects; change security attributes on subjects, objects, the system, or the system's components; choose the security attributes to be associated with newly created or revised objects; and/or change the rules governing access control. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-3 (4) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (4) | |||
| CCI: | CCI-002165 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Enforce organization-defined discretionary access control policies over defined subjects and objects. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-3 (4) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (4) | |||
| CCI: | CCI-003638 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Enforce organization-defined discretionary access control policies over defined subjects and objects where the policy specifies that a subject that has been granted access to information can pass the information to any other subjects or objects. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (4) (a) | ||
| CCI: | CCI-003639 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Enforce organization-defined discretionary access control policies over defined subjects and objects where the policy specifies that a subject that has been granted access to information can grant its privileges to other subjects. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (4) (b) | ||
| CCI: | CCI-003640 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Enforce organization-defined discretionary access control policies over defined subjects and objects where the policy specifies that a subject that has been granted access to information can change security attributes on subjects, objects, the system, or the system's components. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (4) (c) | ||
| CCI: | CCI-003641 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Enforce organization-defined discretionary access control policies over defined subjects and objects where the policy specifies that a subject that has been granted access to information can choose the security attributes to be associated with newly created or revised objects. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (4) (d) | ||
| CCI: | CCI-003642 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Enforce organization-defined discretionary access control policies over defined subjects and objects where the policy specifies that a subject that has been granted access to information can change the rules governing access control. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (4) (e) | ||
| CCI: | CCI-000024 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-14 |
| Definition: | Prevent access to organization-defined security-relevant information except during secure, non-operable system states. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AC-3 (5) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-3 (5) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (5) | |||
| NIST: NIST SP 800-53A (v1): AC-3 (5).1 (ii) | |||
| CCI: | CCI-001411 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-24 |
| Definition: | Defines security-relevant information to which the system prevents access except during secure, non-operable system states. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-3 (5) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-3 (5) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (5) | |||
| NIST: NIST SP 800-53A (v1): AC-3 (5).1 (i) | |||
| CCI: | CCI-002166 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Defines the role-based access control policies to enforce over all subjects and objects. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-3 (7) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (7) | |||
| CCI: | CCI-002169 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Enforce a role-based access control policy over defined subjects and objects based upon organization-defined roles and users authorized to assume such roles. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-3 (7) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (7) | |||
| CCI: | CCI-002170 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Control access based upon organization-defined roles and users authorized to assume such roles. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-3 (7) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (7) | |||
| CCI: | CCI-002173 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Defines the roles authorized to control access based upon the role-based access control policy. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-3 (7) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (7) | |||
| CCI: | CCI-002174 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Defines the users authorized to control access based upon the role-based access control policy. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-3 (7) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (7) | |||
| CCI: | CCI-002177 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Defines the rules governing the timing of revocation of access authorizations. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-3 (8) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (8) | |||
| CCI: | CCI-002178 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Enforce the revocation of access authorizations resulting from changes to the security attributes of subjects based on organization-defined rules governing the timing of revocations of access authorizations. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-3 (8) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (8) | |||
| CCI: | CCI-002179 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Enforce the revocation of access authorizations resulting from changes to the security attributes of objects based on organization-defined rules governing the timing of revocations of access authorizations. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-3 (8) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (8) | |||
| CCI: | CCI-002180 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Defines the controls the organization-defined system or system component is to provide to protect information released outside the established system boundary. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-3 (9) (a) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (9) (a) | |||
| CCI: | CCI-002181 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Defines system or system components that are to provide organization-defined controls to protect information received outside the established system boundary. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-3 (9) (a) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (9) (a) | |||
| CCI: | CCI-002182 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Release information outside of the established system boundary only if organization-defined system or system components provides organization-defined controls. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-3 (9) (a) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (9) (a) | |||
| CCI: | CCI-002183 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Defines the controls to be used to validate the appropriateness of the information designated for release. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-3 (9) (b) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (9) (b) | |||
| CCI: | CCI-002184 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Release information outside of the established system boundary only if organization-defined controls are used to validate the appropriateness of the information designated for release. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-3 (9) (b) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (9) (b) | |||
| CCI: | CCI-002185 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Defines the conditions on which it will employ an audited override of automated access control mechanisms. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-3 (10) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (10) | |||
| CCI: | CCI-002186 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Employ an audited override of automated access control mechanisms under organization-defined conditions by organization-defined roles. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-3 (10) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (10) | |||
| CCI: | CCI-003643 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Defines the organization-defined roles for which it will employ an audited override of automated access control mechanisms. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (10) | ||
| CCI: | CCI-003644 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Restrict direct access to data repositories containing organization-defined information types. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (11) | ||
| CCI: | CCI-003645 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Defines the information types of which to restrict direct access to data repositories. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (11) | ||
| CCI: | CCI-003646 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Require applications to assert, as part of the installation process, the access needed to the organization-defined system applications and functions. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (12) (a) | ||
| CCI: | CCI-003647 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Defines the organization-defined system applications and functions as required of the applications as part of the installation process. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (12) (a) | ||
| CCI: | CCI-003648 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Require applications to provide an enforcement mechanism to prevent other-than-asserted access. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (12) (b) | ||
| CCI: | CCI-003649 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Approve access changed after initial installations of the application. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (12) (c) | ||
| CCI: | CCI-003650 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Enforce attribute-based access control policy over defined subjects and objects based upon organization-defined attributes to assume access permissions. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (13) | ||
| CCI: | CCI-003651 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Defines the attributes to assume access permissions for enforcing attribute-based access control policy. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (13) | ||
| CCI: | CCI-003652 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Enforce attribute-based control access over defined subjects and objects based upon organization-defined attributes to assume access permissions. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (13) | ||
| CCI: | CCI-003653 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Defines the attributes to assume access permissions for enforcing attribute-based control access. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (13) | ||
| CCI: | CCI-003654 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Provide organization-defined mechanisms to enable individuals to have access to the following elements of their personally identifiable information: organization-defined elements. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (14) | ||
| CCI: | CCI-003655 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Defines the mechanisms to be provided for access to elements of personally identifiable information. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (14) | ||
| CCI: | CCI-003656 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Defines the elements of personally identifiable information. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (14) | ||
| CCI: | CCI-003657 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Enforce organization-defined mandatory access control policy over the set of covered subjects and objects specified in the policy. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (15) (a) | ||
| CCI: | CCI-003658 | Status: | deprecated |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Defines the mandatory access control policies that are to be enforced over all subjects and objects. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (15) (a) | ||
| CCI: | CCI-003659 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Enforce organization-defined discretionary access control policy over the set of covered subjects and objects specified in the policy. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (15) (b) | ||
| CCI: | CCI-003660 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Defines the discretionary access control policies the system is to enforce over subjects and objects. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-3 (15) (b) | ||
| CCI: | CCI-001368 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | Enforce approved authorizations for controlling the flow of information within the system based on organization-defined information flow control policies. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AC-4 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-4 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-4 | |||
| NIST: NIST SP 800-53A (v1): AC-4.1 (iii) | |||
| CCI: | CCI-001414 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-24 |
| Definition: | Enforce approved authorizations for controlling the flow of information between connected systems based on organization-defined information flow control policies. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AC-4 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-4 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-4 | |||
| NIST: NIST SP 800-53A (v1): AC-4.1 (iii) | |||
| CCI: | CCI-001548 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-11 |
| Definition: | Defines the information flow control policies for controlling the flow of information within the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-4 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-4 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-4 | |||
| NIST: NIST SP 800-53A (v1): AC-4.1 (i) | |||
| CCI: | CCI-001549 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-11 |
| Definition: | Defines the information flow control policies for controlling the flow of information between interconnected systems. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-4 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-4 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-4 | |||
| NIST: NIST SP 800-53A (v1): AC-4.1 (i) | |||
| CCI: | CCI-002187 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Defines the security attributes to be used to enforce organization-defined information flow control policies. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-4 (1) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (1) | |||
| CCI: | CCI-002188 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Defines the information, source, and destination objects with which the organization-defined security attributes are to be associated. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-4 (1) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (1) | |||
| CCI: | CCI-002189 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Defines the information flow control policies to be enforced for flow control decisions. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-4 (1) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (1) | |||
| CCI: | CCI-002190 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Use organization-defined security attributes associated with organization-defined information, source, and destination objects to enforce organization-defined information flow control policies as a basis for flow control decisions. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-4 (1) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (1) | |||
| CCI: | CCI-003661 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Defines the privacy attributes to be used to enforce organization-defined information flow control policies. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (1) | ||
| CCI: | CCI-000026 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-13 |
| Definition: | Use protected processing domains to enforce organization-defined information flow control policies as a basis for flow control decisions. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AC-4 (2) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-4 (2) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (2) | |||
| NIST: NIST SP 800-53A (v1): AC-4 (2).1 | |||
| CCI: | CCI-002191 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Defines the information flow control policies to be enforced by the information system using protected processing domains. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-4 (2) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (2) | |||
| CCI: | CCI-000027 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-13 |
| Definition: | Enforce organization-defined information flow control policies. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AC-4 (3) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-4 (3) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (3) | |||
| NIST: NIST SP 800-53A (v1): AC-4 (3).1 (ii) | |||
| CCI: | CCI-002192 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Defines the policies to enforce dynamic information flow control. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-4 (3) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (3) | |||
| CCI: | CCI-000028 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-13 |
| Definition: | Prevent encrypted information from bypassing organization-defined flow control mechanisms by employing organization-defined procedures or methods. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-4 (4) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-4 (4) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (4) | |||
| NIST: NIST SP 800-53A (v1): AC-4 (4).1 | |||
| CCI: | CCI-002193 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Defines procedures or methods to be employed to prevent encrypted information from bypassing flow control mechanisms, such as decrypting the information, blocking the flow of the encrypted information, and/or terminating communications sessions attempting to pass encrypted information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-4 (4) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (4) | |||
| CCI: | CCI-003662 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Defines the information flow control mechanisms to prevent the bypassing of encrypted information. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (4) | ||
| CCI: | CCI-000029 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-13 |
| Definition: | Enforce organization-defined limitations on embedding data types within other data types. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AC-4 (5) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-4 (5) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (5) | |||
| NIST: NIST SP 800-53A (v1): AC-4 (5).1 (ii) | |||
| CCI: | CCI-001415 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-24 |
| Definition: | Defines limitations for the embedding of data types within other data types. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-4 (5) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-4 (5) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (5) | |||
| NIST: NIST SP 800-53A (v1): AC-4 (5).1 (i) | |||
| CCI: | CCI-000030 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-13 |
| Definition: | Enforce information flow control based on organization-defined metadata. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AC-4 (6) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-4 (6) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (6) | |||
| NIST: NIST SP 800-53A (v1): AC-4 (6).1 | |||
| CCI: | CCI-002194 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Defines the metadata the information system uses to enforce information flow control. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-4 (6) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (6) | |||
| CCI: | CCI-000031 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-13 |
| Definition: | Enforce one-way information flows using hardware-based flow control mechanisms. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AC-4 (7) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-4 (7) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (7) | |||
| NIST: NIST SP 800-53A (v1): AC-4 (7).1 (ii) | |||
| CCI: | CCI-000032 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-14 |
| Definition: | Enforce information flow control using organization-defined security policy filters as a basis for flow control decisions for organization-defined information flows. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AC-4 (8) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-4 (8) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (8) (a) | |||
| NIST: NIST SP 800-53A (v1): AC-4 (8).1 (ii) | |||
| CCI: | CCI-001417 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-24 |
| Definition: | Defines security policy filters to be enforced and used as a basis for flow control decisions. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-4 (8) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-4 (8) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (8) (a) | |||
| NIST: NIST SP 800-53A (v1): AC-4 (8).1 (i) | |||
| CCI: | CCI-002195 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Defines the information flows against which the organization-defined security or privacy policy filters are to be enforced. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-4 (8) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (8) (a) | |||
| CCI: | CCI-003663 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Enforce information flow control using organization-defined privacy policy filters as a basis for flow control decisions for organization-defined information flows. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (8) (a) | ||
| CCI: | CCI-003664 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Enforce information flow control using block; strip; modify and/or quarantine data after a filter processing failure in accordance with organization-defined security or privacy policy. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (8) (b) | ||
| CCI: | CCI-003665 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Defines the security or privacy policy to be enforced using block; strip; modify and/or quarantine data after a filter processing failure. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (8) (b) | ||
| CCI: | CCI-002196 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Defines the information flows for which will enforce the use of human reviews under organization-defined conditions. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-4 (9) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (9) | |||
| CCI: | CCI-002197 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Defines the conditions which will require the use of human reviews of organization-defined information flows. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-4 (9) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (9) | |||
| CCI: | CCI-002198 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Enforce the use of human reviews for organization-defined information flows under organization-defined conditions. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-4 (9) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (9) | |||
| CCI: | CCI-000034 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-13 |
| Definition: | Provide the capability for privileged administrators to enable and disable organization-defined security or privacy filters under organization-defined conditions. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AC-4 (10) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-4 (10) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (10) | |||
| NIST: NIST SP 800-53A (v1): AC-4 (1).1 (ii) | |||
| CCI: | CCI-001553 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-11 |
| Definition: | Defines security or privacy policy filters that privileged administrators have the capability to enable and disable. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-4 (10) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-4 (10) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (10) | |||
| NIST: NIST SP 800-53A (v1): AC-4 (10).1 (i) | |||
| CCI: | CCI-002199 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Defines the conditions that provides the capability for privileged administrators to enable and disable organization-defined security policy filters. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-4 (10) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (10) | |||
| CCI: | CCI-000035 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-14 |
| Definition: | Provide the capability for privileged administrators to configure the organization-defined security or privacy policy filters to support different security or privacy policies. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AC-4 (11) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-4 (11) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (11) | |||
| NIST: NIST SP 800-53A (v1): AC-4 (11).1 (ii) | |||
| CCI: | CCI-001554 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-11 |
| Definition: | Defines the security or privacy policy filters that privileged administrators have the capability to configure. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-4 (11) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-4 (11) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (11) | |||
| NIST: NIST SP 800-53A (v1): AC-4 (11).1 (i) | |||
| CCI: | CCI-002200 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Defines the data type identifiers to be used to validate data being transferred between different security domains. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-4 (12) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (12) | |||
| CCI: | CCI-002201 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | When transferring information between different security domains, use organization-defined data type identifiers to validate data essential for information flow decisions. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-4 (12) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (12) | |||
| CCI: | CCI-000219 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-14 |
| Definition: | When transferring information between different security domains, decompose information into organization-defined policy-relevant subcomponents for submission to policy enforcement mechanisms. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AC-4 (13) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-4 (13) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (13) | |||
| NIST: NIST SP 800-53A (v1): AC-4 (13).1 | |||
| CCI: | CCI-002202 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Defines the policy-relevant subcomponents into which information being transferred between different security domains is to be decomposed for submission to policy enforcement mechanisms. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-4 (13) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (13) | |||
| CCI: | CCI-001371 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | Defines security or privacy policy filters requiring fully enumerated formats which are to be implemented when transferring information between different security domains. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-4 (14) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-4 (14) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (14) | |||
| NIST: NIST SP 800-53A (v1): AC-4 (14).1 (i) | |||
| CCI: | CCI-001372 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | When transferring information between different security domains, implement organization-defined security or privacy policy filters requiring fully enumerated formats that restrict data structure and content. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AC-4 (14) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-4 (14) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (14) | |||
| NIST: NIST SP 800-53A (v1): AC-4 (14).1 (ii) | |||
| CCI: | CCI-001373 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | When transferring information between different security domains, examine the information for the presence of organization-defined unsanctioned information. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AC-4 (15) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-4 (15) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (15) | |||
| NIST: NIST SP 800-53A (v1): AC-4 (15).1 (i) | |||
| CCI: | CCI-001374 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | When transferring information between different security domains, prohibit the transfer of such information in accordance with the organization-defined security or privacy policy. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AC-4 (15) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-4 (15) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (15) | |||
| NIST: NIST SP 800-53A (v1): AC-4 (15).1 (ii) | |||
| CCI: | CCI-002203 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Defines the unsanctioned information when transferring information between different security domains. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-4 (15) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (15) | |||
| CCI: | CCI-002204 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Defines the security or privacy policy which prohibits the transfer of unsanctioned information between different security domains. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-4 (15) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (15) | |||
| CCI: | CCI-002205 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Uniquely identify and authenticate source by organization, system, application, service, and/or individual for information transfer. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-4 (17) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (17) | |||
| CCI: | CCI-002207 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Uniquely identify and authenticate destination points by organization, system, application, service, and/or individual for information transfer. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-4 (17) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (17) | |||
| CCI: | CCI-002211 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | When transferring information between different security domains, implement organization-defined security or privacy filters on metadata. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-4 (19) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (19) | |||
| CCI: | CCI-003666 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Defines the security or privacy policy filters implemented when transferring information between security domains. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (19) | ||
| CCI: | CCI-002212 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Defines the solutions in approved configurations to be employed to control the flow of organization-defined information across security domains. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-4 (20) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (20) | |||
| CCI: | CCI-002213 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Defines the information to be subjected to flow control across security domains. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-4 (20) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (20) | |||
| CCI: | CCI-002214 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Employ organization-defined solutions in approved configurations to control the flow of organization-defined information across security domains. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-4 (20) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (20) | |||
| CCI: | CCI-002215 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Defines the mechanisms and/or techniques to be used to logically or physically separate information flows. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-4 (21) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (21) | |||
| CCI: | CCI-002216 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Defines the types of information required to accomplish logical or physical separation of information flows. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-4 (21) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (21) | |||
| CCI: | CCI-002217 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Separate information flows logically or physically using organization-defined mechanisms and/or techniques to accomplish organization-defined required separations by types of information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-4 (21) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (21) | |||
| CCI: | CCI-002218 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Provide access from a single device to computing platforms, applications, or data residing on multiple different security domains, while preventing any information flow between the different security domains. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-4 (22) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (22) | |||
| CCI: | CCI-003667 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | When transferring information between security domains, modify non-releasable information by implementing organization-defined modification action. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (23) | ||
| CCI: | CCI-003668 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Defines the modification action when transferring information between different security domains. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (23) | ||
| CCI: | CCI-003669 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | When transferring information between different security domains, parse incoming data into an internal normalized format. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (24) | ||
| CCI: | CCI-003670 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | When transferring information between different security domains, regenerate the data to be consistent with its intended specification. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (24) | ||
| CCI: | CCI-003671 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | When transferring information between different security domains, sanitize data to minimize delivery of malicious content, command and control of malicious code, malicious code augmentation, and steganography encoded data; spillage of sensitive information in accordance with organization-defined policy. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (25) | ||
| CCI: | CCI-003672 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Defines the policy when transferring information between different security domains. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (25) | ||
| CCI: | CCI-003673 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | When transferring information between different security domains, record and audit content filtering actions and results for the information being filtered. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (26) | ||
| CCI: | CCI-003674 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | When transferring information between different security domains, implement content filtering solutions that provide redundant and independent filtering mechanisms for each data type. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (27) | ||
| CCI: | CCI-003675 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | When transferring information between different security domains, implement a linear content filter pipeline that is enforced with discretionary and mandatory access controls. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (28) | ||
| CCI: | CCI-003676 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | When transferring information between different security domains, employ content filter orchestration engines to ensure that content filtering mechanisms successfully complete execution without errors. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (29) (a) | ||
| CCI: | CCI-003677 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | When transferring information between different security domains, employ content filter orchestration engines to ensure that content filtering actions occur in the correct order and comply with organization-defined policy. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (29) (b) | ||
| CCI: | CCI-003678 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | When transferring information between different security domains, implement content filtering mechanisms using multiple processes. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (30) | ||
| CCI: | CCI-003679 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | When transferring information between different security domains, prevent the transfer of failed content to the receiving domain. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (31) | ||
| CCI: | CCI-003680 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | When transferring information between different security domains, the process that transfers information between filter pipelines does not filter message content. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (32) (a) | ||
| CCI: | CCI-003681 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | When transferring information between different security domains, the process that transfers information between filter pipelines validates filtering metadata. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (32) (b) | ||
| CCI: | CCI-003682 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | When transferring information between different security domains, the process that transfers information between filter pipelines ensures the content associated with the filtering metadata has successfully completed filtering. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (32) (c) | ||
| CCI: | CCI-003683 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | When transferring information between different security domains, the process that transfers information between filter pipelines transfers the content to the destination filter pipeline. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (32) (d) | ||
| CCI: | CCI-002219 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Defines the duties of individuals requiring separation. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-5 a | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-5 a | |||
| CCI: | CCI-003684 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Identify and document organization-defined duties of individuals requiring separation. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-5 a | ||
| CCI: | CCI-002220 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Define system access authorizations to support separation of duties. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-5 c | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-5 b | |||
| CCI: | CCI-000225 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-14 |
| Definition: | Employ the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) which are necessary to accomplish assigned organizational tasks. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-6 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-6 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-6 | |||
| NIST: NIST SP 800-53A (v1): AC-6.1 | |||
| CCI: | CCI-001558 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-11 |
| Definition: | Defines the security functions (deployed in hardware, software, and firmware) for which access must be authorized. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-6 (1) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-6 (1) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-6 (1) (a) | |||
| NIST: NIST SP 800-53A (v1): AC-6 (1).1 (i) | |||
| CCI: | CCI-002222 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Authorize access for organization-defined individuals or roles to organization-defined security functions (deployed in hardware, software, and firmware). | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-6 (1) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-6 (1) (a) | |||
| CCI: | CCI-003685 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Defines the individuals or roles who authorize access to organization-defined security functions. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-6 (1) (a) | ||
| CCI: | CCI-002221 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Defines the security-relevant information for which access must be explicitly authorized. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-6 (1) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-6 (1) (b) | |||
| CCI: | CCI-002223 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Authorize access for organization-defined individuals or roles to organization-defined security-relevant information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-6 (1) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-6 (1) (b) | |||
| CCI: | CCI-003686 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Defines the individuals or roles who authorize access to organization-defined security-relevant information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-6 (1) (b) | ||
| CCI: | CCI-000039 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-14 |
| Definition: | Require that users of system accounts, or roles, with access to organization-defined security functions or security-relevant information, use non-privileged accounts or roles, when accessing nonsecurity functions. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-6 (2) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-6 (2) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-6 (2) | |||
| NIST: NIST SP 800-53A (v1): AC-6 (2).1 (ii) | |||
| CCI: | CCI-001419 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-25 |
| Definition: | Defines the security functions or security-relevant information to which users of system accounts, or roles, have access. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-6 (2) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-6 (2) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-6 (2) | |||
| NIST: NIST SP 800-53A (v1): AC-6 (2).1 (i) | |||
| CCI: | CCI-000041 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-19 |
| Definition: | Authorize network access to organization-defined privileged commands only for organization-defined compelling operational needs. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-6 (3) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-6 (3) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-6 (3) | |||
| NIST: NIST SP 800-53A (v1): AC-6 (3).1 (ii) | |||
| CCI: | CCI-000042 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-19 |
| Definition: | Document the rationale for authorized network access to organization-defined privileged commands in the security plan for the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-6 (3) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-6 (3) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-6 (3) | |||
| NIST: NIST SP 800-53A (v1): AC-6 (3).1 (iii) | |||
| CCI: | CCI-001420 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-25 |
| Definition: | Defines the privileged commands to which network access is to be authorized only for organization-defined compelling operational needs. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-6 (3) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-6 (3) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-6 (3) | |||
| NIST: NIST SP 800-53A (v1): AC-6 (3).1 (i) | |||
| CCI: | CCI-002224 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Defines the compelling operational needs that must be met in order to be authorized network access to organization-defined privileged commands. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-6 (3) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-6 (3) | |||
| CCI: | CCI-002225 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Provide separate processing domains to enable finer-grained allocation of user privileges. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-6 (4) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-6 (4) | |||
| CCI: | CCI-002226 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Defines the personnel or roles to whom privileged accounts are to be restricted on the information system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-6 (5) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-6 (5) | |||
| CCI: | CCI-002227 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Restrict privileged accounts on the system to organization-defined personnel or roles. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-6 (5) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-6 (5) | |||
| CCI: | CCI-001422 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-25 |
| Definition: | Prohibit privileged access to the system by non-organizational users. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-6 (6) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-6 (6) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-6 (6) | |||
| NIST: NIST SP 800-53A (v1): AC-6 (6).1 | |||
| CCI: | CCI-002228 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Defines the frequency on which it conducts reviews of the privileges assigned to organization-defined roles or classes of users. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-6 (7) (a) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-6 (7) (a) | |||
| CCI: | CCI-002229 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Defines the roles or classes of users that are to have their privileges reviewed on an organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-6 (7) (a) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-6 (7) (a) | |||
| CCI: | CCI-002230 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Review, on an organization-defined frequency, the privileges assigned to organization-defined roles or classes of users to validate the need for such privileges. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-6 (7) (a) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-6 (7) (a) | |||
| CCI: | CCI-002231 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Reassign or remove privileges, if necessary, to correctly reflect organizational mission and business needs. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-6 (7) (b) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-6 (7) (b) | |||
| CCI: | CCI-002232 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Defines the software that is prevented from executing at a higher privilege than users executing the software. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-6 (8) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-6 (8) | |||
| CCI: | CCI-002233 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Prevent the organization-defined software from executing at higher privilege levels than users executing the software. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-6 (8) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-6 (8) | |||
| CCI: | CCI-002234 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Log the execution of privileged functions. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-6 (9) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-6 (9) | |||
| CCI: | CCI-002235 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Prevent non-privileged users from executing privileged functions. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-6 (10) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-6 (10) | |||
| CCI: | CCI-000043 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-19 |
| Definition: | Defines the maximum number of consecutive invalid logon attempts to the information system by a user during an organization-defined time period. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-7 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-7 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-7 a | |||
| NIST: NIST SP 800-53A (v1): AC-7.1 (i) | |||
| CCI: | CCI-000044 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-14 |
| Definition: | Enforce the organization-defined limit of consecutive invalid logon attempts by a user during the organization-defined time period. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AC-7 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-7 a | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-7 a | |||
| NIST: NIST SP 800-53A (v1): AC-7.1 (ii) | |||
| CCI: | CCI-001423 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-25 |
| Definition: | Defines the time period in which the organization-defined maximum number of consecutive invalid logon attempts occur. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-7 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-7 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-7 a | |||
| NIST: NIST SP 800-53A (v1): AC-7.1 (i) | |||
| CCI: | CCI-002236 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Defines the time period the information system will automatically lock the account or node when the maximum number of unsuccessful logon attempts is exceeded. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-7 b | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-7 b | |||
| CCI: | CCI-002237 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Defines the delay algorithm to delay the next logon prompt when the maximum number of unsuccessful logon attempts is exceeded. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-7 b | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-7 b | |||
| CCI: | CCI-002238 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Automatically lock the account or node for either an organization-defined time period, until the locked account or node is released by an administrator, or delays the next logon prompt according to the organization-defined delay algorithm when the maximum number of unsuccessful logon attempts is exceeded. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-7 b | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-7 b | |||
| CCI: | CCI-002239 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Defines the mobile devices that are to be purged or wiped after an organization-defined number of consecutive, unsuccessful device logon attempts. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-7 (2) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-7 (2) | |||
| CCI: | CCI-002240 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Defines the purging or wiping requirements and techniques to be used on organization-defined mobile devices after an organization-defined number of consecutive, unsuccessful device logon attempts. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-7 (2) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-7 (2) | |||
| CCI: | CCI-002241 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Defines the number of consecutive, unsuccessful device logon attempts after which the organization-defined mobile devices will be purged or wiped. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-7 (2) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-7 (2) | |||
| CCI: | CCI-002242 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Purge or wipe information from organization-defined mobile devices based on organization-defined purging or wiping requirements and techniques after an organization-defined number of consecutive, unsuccessful device logon attempts. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-7 (2) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-7 (2) | |||
| CCI: | CCI-003687 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Limit the number of unsuccessful biometric logon attempts to an organization-defined number. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-7 (3) | ||
| CCI: | CCI-003688 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Defines the number of allowed unsuccessful biometric logon attempts. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-7 (3) | ||
| CCI: | CCI-003689 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Allow the use of organization-defined authentication factors that are different from the primary authentication factors after the number of organization-defined consecutive invalid logon attempts have been exceeded. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-7 (4) (a) | ||
| CCI: | CCI-003690 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Defines the authentication factors after a number of organization-defined consecutive invalid logon attempts have been executed. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-7 (4) (a) | ||
| CCI: | CCI-003691 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Enforce a limit of organization-defined number consecutive invalid logon attempts through use of the alternative factors by a user during a organization-defined time period. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-7 (4) (b) | ||
| CCI: | CCI-003692 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Defines the number enforced for logon attempts. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-7 (4) (b) | ||
| CCI: | CCI-000048 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-19 |
| Definition: | Display an organization-defined system use notification message or banner to users before granting access to the system that provides privacy and security notices consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidelines. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AC-8 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-8 a | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-8 a | |||
| NIST: NIST SP 800-53A (v1): AC-8.1 (ii) | |||
| CCI: | CCI-002243 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Organization-defined system use notification message or banner is to state that users are accessing a U.S. Government system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-8 a 1 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-8 a 1 | |||
| CCI: | CCI-002244 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Organization-defined system use notification message or banner is to state that system usage may be monitored, recorded, and subject to audit. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-8 a 2 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-8 a 2 | |||
| CCI: | CCI-002245 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Organization-defined system use notification message or banner is to state that unauthorized use of the system is prohibited and subject to criminal and civil penalties. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-8 a 3 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-8 a 3 | |||
| CCI: | CCI-002246 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Organization-defined system use notification message or banner is to state that use of the system indicates consent to monitoring and recording. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-8 a 4 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-8 a 4 | |||
| CCI: | CCI-002247 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Defines the use notification message or banner the system displays to users before granting access to the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-8 a | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-8 a | |||
| CCI: | CCI-000050 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-14 |
| Definition: | Retain the notification message or banner on the screen until users acknowledge the usage conditions and take explicit actions to log on to or further access the system. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AC-8 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-8 b | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-8 b | |||
| NIST: NIST SP 800-53A (v1): AC-8.1 (iii) | |||
| CCI: | CCI-001384 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | For publicly accessible systems, display system use information with organization-defined conditions before granting further access to the publicly accessible system. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AC-8 c | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-8 c 1 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-8 c 1 | |||
| NIST: NIST SP 800-53A (v1): AC-8.2 (i) | |||
| CCI: | CCI-001385 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | For publicly accessible systems, displays references, if any, to monitoring that are consistent with privacy accommodations for such systems that generally prohibit those activities. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AC-8 c | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-8 c 2 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-8 c 2 | |||
| NIST: NIST SP 800-53A (v1): AC-8.2 (ii) | |||
| CCI: | CCI-001386 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | For publicly accessible systems, displays references, if any, to recording that are consistent with privacy accommodations for such systems that generally prohibit those activities. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AC-8 c | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-8 c 2 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-8 c 2 | |||
| NIST: NIST SP 800-53A (v1): AC-8.2 (ii) | |||
| CCI: | CCI-001387 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | For publicly accessible systems, displays references, if any, to auditing that are consistent with privacy accommodations for such systems that generally prohibit those activities. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AC-8 c | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-8 c 2 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-8 c 2 | |||
| NIST: NIST SP 800-53A (v1): AC-8.2 (ii) | |||
| CCI: | CCI-001388 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | For publicly accessible systems, includes a description of the authorized uses of the system. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AC-8 c | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-8 c 3 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-8 c 3 | |||
| NIST: NIST SP 800-53A (v1): AC-8.2 (iii) | |||
| CCI: | CCI-002248 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Defines the conditions of use which are to be displayed to users of the system before granting further access. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-8 c 1 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-8 c 1 | |||
| CCI: | CCI-000052 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-14 |
| Definition: | Notify the user, upon successful logon (access) to the system, of the date and time of the last logon (access). | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AC-9 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-9 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-9 | |||
| NIST: NIST SP 800-53A (v1): AC-9.1 | |||
| CCI: | CCI-000053 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-14 |
| Definition: | Notify the user, upon successful logon/access, of the number of unsuccessful logon/access attempts since the last successful logon/access. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AC-9 (1) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-9 (1) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-9 (1) | |||
| NIST: NIST SP 800-53A (v1): AC-9 (1).1 | |||
| CCI: | CCI-001389 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | Defines the time period that the system notifies the user of the number of successful logon/access attempts. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-9 (2) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-9 (2) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-9 (2) | |||
| NIST: NIST SP 800-53A (v1): AC-9 (2).1 (i) | |||
| CCI: | CCI-001390 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | Defines the time period that the system notifies the user of the number of unsuccessful logon/access attempts. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-9 (2) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-9 (2) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-9 (2) | |||
| NIST: NIST SP 800-53A (v1): AC-9 (2).1 (i) | |||
| CCI: | CCI-001391 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | Notify the user, upon successful logon, of the number of successful logons/accesses during the organization-defined time period. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AC-9 (2) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-9 (2) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-9 (2) | |||
| NIST: NIST SP 800-53A (v1): AC-9 (2).1 (ii) | |||
| CCI: | CCI-001392 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | Notify the user, upon successful logon, of the number of unsuccessful logon/access attempts during the organization-defined time period. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AC-9 (2) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-9 (2) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-9 (2) | |||
| NIST: NIST SP 800-53A (v1): AC-9 (2).1 (ii) | |||
| CCI: | CCI-001393 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | Defines the security-related characteristics/parameters of the user's account which, when changed, will result in a notification being provided to the user during the organization-defined time period. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-9 (3) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-9 (3) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-9 (3) | |||
| NIST: NIST SP 800-53A (v1): AC-9 (3).1 (ii) | |||
| CCI: | CCI-001394 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | Defines the time period during which organization-defined security-related changes to the user's account are to be tracked. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-9 (3) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-9 (3) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-9 (3) | |||
| NIST: NIST SP 800-53A (v1): AC-9 (3).1 (i) | |||
| CCI: | CCI-001395 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | Notify the user, upon successful logon, of changes to organization-defined security-related characteristics/parameters of the user's account during the organization-defined time-period. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AC-9 (3) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-9 (3) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-9 (3) | |||
| NIST: NIST SP 800-53A (v1): AC-9 (3).1 (ii) | |||
| CCI: | CCI-002249 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Defines the additional information to be included in the notification to the user upon successful logon. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-9 (4) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-9 (4) | |||
| CCI: | CCI-002250 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Notify the user, upon successful logon, of the following additional information: organization-defined additional information. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-9 (4) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-9 (4) | |||
| CCI: | CCI-000054 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-19 |
| Definition: | Limit the number of concurrent sessions for each organization-defined account and/or account type to an organization-defined number. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AC-10 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-10 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-10 | |||
| NIST: NIST SP 800-53A (v1): AC-10.1 (ii) | |||
| CCI: | CCI-000055 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-19 |
| Definition: | Defines the maximum number of concurrent sessions to be allowed for each organization-defined account and/or account type. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-10 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-10 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-10 | |||
| NIST: NIST SP 800-53A (v1): AC-10.1 (i) | |||
| CCI: | CCI-002252 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Defines the accounts and/or account types for which will limit the number of concurrent sessions. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-10 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-10 | |||
| CCI: | CCI-000057 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-19 |
| Definition: | Prevent further access to the system by initiating a device lock after organization-defined time period of inactivity; and/or requiring the user to initiate a device lock before leaving the system unattended. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AC-11 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-11 a | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-11 a | |||
| NIST: NIST SP 800-53A (v1): AC-11.1 (ii) | |||
| CCI: | CCI-000059 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-14 |
| Definition: | Defines the time-period of inactivity after which the system initiates a device lock. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-11 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-11 a | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-11 a | |||
| NIST: NIST SP 800-53A (v1): AC-11.1 (i) | |||
| CCI: | CCI-000056 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-14 |
| Definition: | Retain the device lock until the user reestablishes access using established identification and authentication procedures. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AC-11 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-11 b | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-11 b | |||
| NIST: NIST SP 800-53A (v1): AC-11.1 (iii) | |||
| CCI: | CCI-000060 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-19 |
| Definition: | Conceal, via the device lock, information previously visible on the display with a publicly viewable image. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AC-11 (1) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-11 (1) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-11 (1) | |||
| NIST: NIST SP 800-53A (v1): AC-11 (1).1 | |||
| CCI: | CCI-002360 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-26 |
| Definition: | Defines the conditions or trigger events requiring session disconnect when automatically terminating a user session. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-12 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-12 | |||
| CCI: | CCI-002361 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-26 |
| Definition: | Automatically terminate a user session after organization-defined conditions or trigger events requiring session disconnect. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-12 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-12 | |||
| CCI: | CCI-002362 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-26 |
| Definition: | Defines the information resources requiring authentication in order to gain access. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-12 (1) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-12 (1) | |||
| CCI: | CCI-002363 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-26 |
| Definition: | Provide a logout capability for user-initiated communications sessions whenever authentication is used to gain access to organization-defined information resources. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-12 (1) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-12 (1) | |||
| CCI: | CCI-002364 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-26 |
| Definition: | Display an explicit logout message to users indicating the reliable termination of authenticated communications sessions. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-12 (1) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-12 (2) | |||
| CCI: | CCI-003693 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Display an explicit message to users indicating that the session will end at an organization-defined time until end of session. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-12 (3) | ||
| CCI: | CCI-003694 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Defines the time until end of session, indicating the session will end. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-12 (3) | ||
| CCI: | CCI-000061 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-14 |
| Definition: | Identify organization-defined user actions that can be performed on the system without identification or authentication consistent with organizational missions/business functions. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-14 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-14 a | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-14 a | |||
| NIST: NIST SP 800-53A (v1): AC-14.1 (i) | |||
| CCI: | CCI-003695 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Defines the user actions that can be performed on the system without identification or authentication consistent with organizational missions/business functions. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-14 a | ||
| CCI: | CCI-000232 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-14 |
| Definition: | Document and provide supporting rationale in the security plan for the system, user actions not requiring identification and authentication. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-14 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-14 b | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-14 b | |||
| NIST: NIST SP 800-53A (v1): AC-14.1 (ii) | |||
| CCI: | CCI-002256 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Defines security attributes having organization-defined types of security attribute values which are associated with information in storage. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-16 a | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-16 a | |||
| CCI: | CCI-002257 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Defines security attributes having organization-defined types of security attribute values which are associated with information in process. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-16 a | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-16 a | |||
| CCI: | CCI-002258 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Defines security attributes, having organization-defined types of security attribute values, which are associated with information in transmission. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-16 a | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-16 a | |||
| CCI: | CCI-002259 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Defines security attribute values associated with organization-defined types of security attributes for information in storage. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-16 a | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-16 a | |||
| CCI: | CCI-002260 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Defines security attribute values associated with organization-defined types of security attributes for information in process. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-16 a | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-16 a | |||
| CCI: | CCI-002261 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Defines security attribute values associated with organization-defined types of security attributes for information in transmission. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-16 a | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-16 a | |||
| CCI: | CCI-002262 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Provide the means to associate organization-defined types of security attributes having organization-defined security attribute values with information in storage. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-16 a | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-16 a | |||
| CCI: | CCI-002263 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Provide the means to associate organization-defined types of security attributes having organization-defined security attribute values with information in process. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-16 a | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-16 a | |||
| CCI: | CCI-002264 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Provide the means to associate organization-defined types of security attributes having organization-defined security attribute values with information in transmission. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-16 a | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-16 a | |||
| CCI: | CCI-003696 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Defines privacy attributes having organization-defined types of privacy attribute values which are associated with information in storage. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-16 a | ||
| CCI: | CCI-003697 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Defines privacy attributes having organization-defined types of privacy attribute values which are associated with information in process. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-16 a | ||
| CCI: | CCI-003698 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Defines privacy attributes, having organization-defined types of privacy attribute values, which are associated with information in transmission. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-16 a | ||
| CCI: | CCI-003699 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Defines privacy attribute values associated with organization-defined types of privacy attributes for information in storage. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-16 a | ||
| CCI: | CCI-003700 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Defines privacy attribute values associated with organization-defined types of privacy attributes for information in process. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-16 a | ||
| CCI: | CCI-003701 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Defines privacy attribute values associated with organization-defined types of privacy attributes for information in transmission. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-16 a | ||
| CCI: | CCI-002265 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Ensure that the attribute associations are made and retained with the information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-16 b | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-16 b | |||
| CCI: | CCI-002266 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Ensure that the security attribute associations are retained with the information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-16 b | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-16 b | |||
| CCI: | CCI-003702 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Ensure that the privacy attribute associations are made with the information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-16 b | ||
| CCI: | CCI-003703 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Ensure that the privacy attribute associations are restrained with the information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-16 b | ||
| CCI: | CCI-002267 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Defines the security attributes that are permitted for organization-defined systems. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-16 c | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-16 c | |||
| CCI: | CCI-002268 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Defines the systems for which permitted organization-defined attributes are to be established. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-16 c | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-16 c | |||
| CCI: | CCI-002269 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Establish the following permitted organization-defined security attributes in AC-16a for organization-defined systems. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-16 c | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-16 c | |||
| CCI: | CCI-003704 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Establish the following permitted organization-defined privacy attributes defined in AC-16a for organization-defined systems. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-16 c | ||
| CCI: | CCI-003705 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Defines the privacy attributes that are permitted for organization-defined systems. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-16 c | ||
| CCI: | CCI-002270 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Defines the attribute values or ranges permitted for each of the established security attributes. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-16 d | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-16 d | |||
| CCI: | CCI-002271 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Determine organization-defined attribute values or ranges for each of the established attributes. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-16 d | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-16 d | |||
| CCI: | CCI-003706 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Defines the attribute values or ranges permitted for each of the established privacy attributes. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-16 d | ||
| CCI: | CCI-003707 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Audit changes to the attributes. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-16 e | ||
| CCI: | CCI-003708 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Review organization-defined security attributes for applicability on an organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-16 f | ||
| CCI: | CCI-003709 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Review organization-defined privacy attributes for applicability on an organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-16 f | ||
| CCI: | CCI-003710 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Defines the security and privacy attributes to be reviewed for applicability. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-16 f | ||
| CCI: | CCI-003711 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Defines the frequency of which the security and privacy attributes will be reviewed. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-16 f | ||
| CCI: | CCI-001424 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-25 |
| Definition: | Dynamically associate security attributes with organization-defined subjects in accordance with organization-defined security policies as information is created and combined. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AC-16 (1) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-16 (1) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (1) | |||
| NIST: NIST SP 800-53A (v1): AC-16 (1).1 | |||
| CCI: | CCI-002272 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Dynamically associate security attributes with organization-defined objects in accordance with organization-defined security policies as information is created and combined. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-16 (1) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (1) | |||
| CCI: | CCI-002273 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Defines the security policies to adhere to when dynamically associating security attributes with organization-defined subjects and objects. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-16 (1) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (1) | |||
| CCI: | CCI-002274 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Defines the subjects with which the system is to dynamically associate security attributes as information is created and combined. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-16 (1) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (1) | |||
| CCI: | CCI-002275 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Defines the objects with which the system is to dynamically associate security attributes as information is created and combined. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-16 (1) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (1) | |||
| CCI: | CCI-003712 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Dynamically associate privacy attributes with organization-defined subjects in accordance with organization-defined privacy policies as information is created and combined. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (1) | ||
| CCI: | CCI-003713 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Dynamically associate privacy attributes with organization-defined objects in accordance with organization-defined privacy policies as information is created and combined. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (1) | ||
| CCI: | CCI-003714 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Defines the privacy policies to adhere to when dynamically associating security attributes with organization-defined subjects and objects. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (1) | ||
| CCI: | CCI-001425 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-25 |
| Definition: | Provides authorized individuals (or processes acting on behalf of individuals) the capability to change the value of associated security attributes. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AC-16 (2) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-16 (2) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (2) | |||
| NIST: NIST SP 800-53A (v1): AC-16 (2).1 (ii) | |||
| CCI: | CCI-002277 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Provides authorized individuals (or processes acting on behalf of individuals) the capability to define the value of associated security attributes. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-16 (2) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (2) | |||
| CCI: | CCI-003715 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Provides authorized individuals (or processes acting on behalf of individuals) the capability to change the value of associated privacy attributes. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (2) | ||
| CCI: | CCI-003716 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Provides authorized individuals (or processes acting on behalf of individuals) the capability to define the value of associated privacy attributes. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (2) | ||
| CCI: | CCI-002278 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Defines the security attributes for which the association and integrity to organization-defined subjects and objects is maintained. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-16 (3) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (3) | |||
| CCI: | CCI-002279 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Defines the subjects for which the association and integrity of organization-defined security attributes is maintained. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-16 (3) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (3) | |||
| CCI: | CCI-002280 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Defines the objects for which the association and integrity of organization-defined security attributes is maintained. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-16 (3) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (3) | |||
| CCI: | CCI-002281 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Maintain the association of organization-defined security attributes to organization-defined subjects. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-16 (3) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (3) | |||
| CCI: | CCI-002282 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Maintain the association of organization-defined security attributes to organization-defined objects. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-16 (3) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (3) | |||
| CCI: | CCI-002283 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Maintain the integrity of organization-defined security attributes associated with organization-defined subjects. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-16 (3) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (3) | |||
| CCI: | CCI-002284 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Maintain the integrity of organization-defined security attributes associated with organization-defined objects. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-16 (3) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (3) | |||
| CCI: | CCI-003717 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Defines the privacy attributes for which the association and integrity to organization-defined subjects and objects is maintained. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (3) | ||
| CCI: | CCI-003718 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Maintain the association of organization-defined privacy attributes to organization-defined subjects. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (3) | ||
| CCI: | CCI-003719 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Maintain the association of organization-defined privacy attributes to organization-defined objects. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (3) | ||
| CCI: | CCI-003720 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Maintain the integrity of organization-defined privacy attributes associated with organization-defined subjects. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (3) | ||
| CCI: | CCI-003721 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Maintain the integrity of organization-defined privacy attributes associated with organization-defined objects. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (3) | ||
| CCI: | CCI-002286 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Defines the subjects with which organization-defined security attributes may be associated by authorized individuals (or processes acting on behalf of individuals). | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-16 (4) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (4) | |||
| CCI: | CCI-002287 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Defines the objects with which organization-defined security attributes may be associated by authorized individuals (or processes acting on behalf of individuals). | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-16 (4) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (4) | |||
| CCI: | CCI-002288 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Defines the security attributes authorized individuals (or processes acting on behalf of individuals) are permitted to associate with organization-defined subjects and objects. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-16 (4) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (4) | |||
| CCI: | CCI-002289 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Provide the capability to associate organization-defined security attributes with organization-defined subjects by authorized individuals (or processes acting on behalf of individuals). | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-16 (4) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (4) | |||
| CCI: | CCI-002290 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Provide the capability to associate organization-defined security attributes with organization-defined objects by authorized individuals (or processes acting on behalf of individuals). | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-16 (4) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (4) | |||
| CCI: | CCI-003722 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Defines the subjects with which organization-defined privacy attributes may be associated by authorized individuals (or processes acting on behalf of individuals). | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (4) | ||
| CCI: | CCI-003723 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Defines the objects with which organization-defined privacy attributes may be associated by authorized individuals (or processes acting on behalf of individuals). | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (4) | ||
| CCI: | CCI-003724 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Defines the privacy attributes authorized individuals (or processes acting on behalf of individuals) are permitted to associate with organization-defined subjects and objects. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (4) | ||
| CCI: | CCI-003725 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Provide the capability to associate organization-defined privacy attributes with organization-defined subjects by authorized individuals (or processes acting on behalf of individuals). | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (4) | ||
| CCI: | CCI-003726 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Provide the capability to associate organization-defined privacy attributes with organization-defined objects by authorized individuals (or processes acting on behalf of individuals). | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (4) | ||
| CCI: | CCI-001428 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-25 |
| Definition: | Display security attributes in human-readable form on each object that the system transmits to output devices to identify organization-identified special dissemination, handling, or distribution instructions using organization-identified human-readable, standard naming conventions. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AC-16 (5) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-16 (5) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (5) | |||
| NIST: NIST SP 800-53A (v1): AC-16 (5).1 (iii) | |||
| CCI: | CCI-001429 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-25 |
| Definition: | Identify special dissemination, handling, or distribution instructions for identifying security attributes on output. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-16 (5) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-16 (5) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (5) | |||
| NIST: NIST SP 800-53A (v1): AC-16 (5).1 (i) | |||
| CCI: | CCI-001430 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-25 |
| Definition: | Identify human-readable, standard naming conventions for identifying security attributes on output. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-16 (5) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-16 (5) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (5) | |||
| NIST: NIST SP 800-53A (v1): AC-16 (5).1 (ii) | |||
| CCI: | CCI-003727 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Displays privacy attributes in human-readable form on each object that the system transmits to output devices to identify organization-identified special dissemination, handling, or distribution instructions using organization-identified human-readable, standard naming conventions. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (5) | ||
| CCI: | CCI-003728 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Identifies special dissemination, handling, or distribution instructions for identifying privacy attributes on output. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (5) | ||
| CCI: | CCI-003729 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Identifies human-readable, standard naming conventions for identifying privacy attributes on output. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (5) | ||
| CCI: | CCI-002291 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Defines the security policies to be followed by personnel when associating organization-defined security attributes with organization-defined subjects and objects. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-16 (6) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (6) | |||
| CCI: | CCI-002292 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Defines the security attributes which are to be associated with organization-defined subjects and objects. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-16 (6) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (6) | |||
| CCI: | CCI-002293 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Defines the subjects to be associated, and that association maintained, with organization-defined security attributes in accordance with organization-defined security policies. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-16 (6) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (6) | |||
| CCI: | CCI-002294 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Defines the objects to be associated, and that association maintained, with organization-defined security attributes in accordance with organization-defined security policies. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-16 (6) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (6) | |||
| CCI: | CCI-002295 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Require personnel to associate organization-defined security attributes with organization-defined subjects in accordance with organization-defined security policies. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-16 (6) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (6) | |||
| CCI: | CCI-002296 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Require personnel to associate organization-defined security attributes with organization-defined objects in accordance with organization-defined security policies. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-16 (6) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (6) | |||
| CCI: | CCI-002297 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Require personnel to maintain the association of organization-defined security attributes with organization-defined subjects in accordance with organization-defined security policies. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-16 (6) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (6) | |||
| CCI: | CCI-002298 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Require personnel to maintain the association of organization-defined security attributes with organization-defined objects in accordance with organization-defined security policies. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-16 (6) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (6) | |||
| CCI: | CCI-003730 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Defines the privacy policies to be followed by personnel when associating organization-defined privacy attributes with organization-defined subjects and objects. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (6) | ||
| CCI: | CCI-003731 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Defines the privacy attributes which are to be associated with organization-defined subjects and objects. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (6) | ||
| CCI: | CCI-003732 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Defines the subjects to be associated, and that association maintained, with organization-defined privacy attributes in accordance with organization-defined privacy policies. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (6) | ||
| CCI: | CCI-003733 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Defines the objects to be associated, and that association maintained, with organization-defined privacy attributes in accordance with organization-defined privacy policies. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (6) | ||
| CCI: | CCI-003734 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Require personnel to associate organization-defined privacy attributes with organization-defined subjects in accordance with organization-defined privacy policies. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (6) | ||
| CCI: | CCI-003735 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Require personnel to associate organization-defined privacy attributes with organization-defined objects in accordance with organization-defined privacy policies. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (6) | ||
| CCI: | CCI-003736 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Require personnel to maintain the association of organization-defined privacy attributes with organization-defined subjects in accordance with organization-defined privacy policies. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (6) | ||
| CCI: | CCI-003737 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Require personnel to maintain the association of organization-defined privacy attributes with organization-defined objects in accordance with organization-defined privacy policies. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (6) | ||
| CCI: | CCI-002299 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Provide a consistent interpretation of security attributes transmitted between distributed system components. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-16 (7) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (7) | |||
| CCI: | CCI-003738 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Provide a consistent interpretation of privacy attributes transmitted between distributed system components. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (7) | ||
| CCI: | CCI-002300 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Defines the techniques and technologies to be implemented when associating security attributes with information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-16 (8) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (8) | |||
| CCI: | CCI-002301 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Defines the level of assurance to be provided when implementing organization-defined techniques and technologies in associating security attributes to information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-16 (8) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (8) | |||
| CCI: | CCI-002302 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Implement organization-defined techniques and technologies with an organization-defined level of assurance in associating security attributes to information. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-16 (8) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (8) | |||
| CCI: | CCI-003739 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Defines the techniques and technologies to be implemented when associating security attributes to information. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (8) | ||
| CCI: | CCI-003740 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Defines the level of assurance to be provided when implementing organization-defined techniques and technologies in associating privacy attributes to information. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (8) | ||
| CCI: | CCI-003741 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Implement organization-defined techniques and technologies with an organization-defined level of assurance in associating privacy attributes to information. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (8) | ||
| CCI: | CCI-002303 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Defines the techniques or procedures to be employed to validate re-grading mechanisms. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-16 (9) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (9) | |||
| CCI: | CCI-002304 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Change security attributes associated with information are reassigned only via re-grading mechanisms validated using organization-defined techniques or procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-16 (9) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (9) | |||
| CCI: | CCI-003742 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Change privacy attributes associated with information are reassigned only via re-grading mechanisms validated using organization-defined techniques or procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (9) | ||
| CCI: | CCI-002306 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Provide authorized individuals the capability to define or change the type of security attributes available for association with subjects. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-16 (10) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (10) | |||
| CCI: | CCI-002307 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Provide authorized individuals the capability to define or change the value of security attributes available for association with subjects. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-16 (10) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (10) | |||
| CCI: | CCI-002308 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Provide authorized individuals the capability to define or change the type of security attributes available for association with objects. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-16 (10) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (10) | |||
| CCI: | CCI-002309 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Provide authorized individuals the capability to define or change the value of security attributes available for association with objects. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-16 (10) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (10) | |||
| CCI: | CCI-003743 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Provide authorized individuals the capability to define or change the type of privacy attributes available for association with subjects. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (10) | ||
| CCI: | CCI-003744 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Provide authorized individuals the capability to define or change the value of privacy attributes available for association with subjects. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (10) | ||
| CCI: | CCI-003745 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Provide authorized individuals the capability to define or change the type of privacy attributes available for association with objects. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (10) | ||
| CCI: | CCI-003746 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Provide authorized individuals the capability to define or change the value of privacy attributes available for association with objects. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (10) | ||
| CCI: | CCI-002310 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Establish and document usage restrictions for each type of remote access allowed. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-17 a | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-17 a | |||
| CCI: | CCI-002311 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Establish and document configuration/connection requirements for each type of remote access allowed. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-17 a | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-17 a | |||
| CCI: | CCI-002312 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Establish and document implementation guidance for each type of remote access allowed. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-17 a | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-17 a | |||
| CCI: | CCI-000065 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-14 |
| Definition: | Authorize remote access to the system prior to allowing such connections. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-17 d | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-17 b | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-17 b | |||
| NIST: NIST SP 800-53A (v1): AC-17.1 (iv) | |||
| CCI: | CCI-000067 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-14 |
| Definition: | Employ automated mechanisms to monitor remote access methods. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AC-17 (1) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-17 (1) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-17 (1) | |||
| NIST: NIST SP 800-53A (v1): AC-17 (1).1 | |||
| CCI: | CCI-002314 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Employ automated mechanisms to control remote access methods. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-17 (1) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-17 (1) | |||
| CCI: | CCI-000068 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-14 |
| Definition: | Implement cryptographic mechanisms to protect the confidentiality of remote access sessions. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AC-17 (2) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-17 (2) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-17 (2) | |||
| NIST: NIST SP 800-53A (v1): AC-17 (2).1 | |||
| CCI: | CCI-001453 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-29 |
| Definition: | Implement cryptographic mechanisms to protect the integrity of remote access sessions. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AC-17 (2) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-17 (2) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-17 (2) | |||
| NIST: NIST SP 800-53A (v1): AC-17 (2).1 | |||
| CCI: | CCI-000069 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-19 |
| Definition: | Route all remote accesses through authorized and managed network access control points. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-17 (3) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-17 (3) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-17 (3) | |||
| NIST: NIST SP 800-53A (v1): AC-17 (3).1 (ii) | |||
| CCI: | CCI-000070 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-19 |
| Definition: | Authorize the execution of privileged commands via remote access only in a format that provides assessable evidence for organization-defined needs. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-17 (4) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-17 (4) (a) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-17 (4) (a) | |||
| NIST: NIST SP 800-53A (v1): AC-17 (4).1 (i) | |||
| CCI: | CCI-002316 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Authorize access to security-relevant information via remote access only in a format that provides assessable evidence for organization-defined needs. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-17 (4) (a) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-17 (4) (a) | |||
| CCI: | CCI-002317 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Defines the needs for when the execution of privileged commands via remote access is to be authorized. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-17 (4) (a) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-17 (4) (a) | |||
| CCI: | CCI-002318 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Defines the needs for when access to security-relevant information via remote access is to be authorized. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-17 (4) (a) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-17 (4) (a) | |||
| CCI: | CCI-002319 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Document the rationale for authorization of the execution of privilege commands via remote access. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-17 (4) (b) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-17 (4) (b) | |||
| CCI: | CCI-002320 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Document the rationale for authorization of access to security-relevant information via remote access. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-17 (4) (b) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-17 (4) (b) | |||
| CCI: | CCI-000072 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-25 |
| Definition: | Protect information about remote access mechanisms from unauthorized use and disclosure. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-17 (6) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-17 (6) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-17 (6) | |||
| NIST: NIST SP 800-53A (v1): AC-17 (6).1 | |||
| CCI: | CCI-002321 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Defines the time-period within which it disconnects or disables remote access to the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-17 (9) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-17 (9) | |||
| CCI: | CCI-002322 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Provide the capability to disconnect or disable remote access to the system within the organization-defined time period. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-17 (9) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-17 (9) | |||
| CCI: | CCI-003747 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Implement organization-defined mechanisms to authenticate organization-defined remote commands. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-17 (10) | ||
| CCI: | CCI-003748 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Defines the mechanisms used to authenticate organization-defined remote commands. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-17 (10) | ||
| CCI: | CCI-003749 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Defines the remote commands used for implementing organization-defined mechanisms. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-17 (10) | ||
| CCI: | CCI-001439 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-25 |
| Definition: | Establish implementation guidance for wireless access. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-18 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-18 a | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-18 a | |||
| NIST: NIST SP 800-53A (v1): AC-18.1 (i) | |||
| CCI: | CCI-002323 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Establish configuration requirements and connection requirements for wireless access. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-18 a | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-18 a | |||
| CCI: | CCI-001441 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-25 |
| Definition: | Authorize each type of wireless access to the system prior to allowing such connections. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-18 c | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-18 b | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-18 b | |||
| NIST: NIST SP 800-53A (v1): AC-18.1 (iii) | |||
| CCI: | CCI-001443 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-25 |
| Definition: | Protect wireless access to the system using authentication of users and/or devices. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AC-18 (1) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-18 (1) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-18 (1) | |||
| NIST: NIST SP 800-53A (v1): AC-18 (1).1 | |||
| CCI: | CCI-001444 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-25 |
| Definition: | Protect wireless access to the system using encryption. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AC-18 (1) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-18 (1) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-18 (1) | |||
| NIST: NIST SP 800-53A (v1): AC-18 (1).1 | |||
| CCI: | CCI-001449 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-25 |
| Definition: | Disable, when not intended for use, wireless networking capabilities internally embedded within system components prior to issuance and deployment. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-18 (3) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-18 (3) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-18 (3) | |||
| NIST: NIST SP 800-53A (v1): AC-18 (3).1 | |||
| CCI: | CCI-002324 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Identify and explicitly authorize users allowed to independently configure wireless networking capabilities. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-18 (4) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-18 (4) | |||
| CCI: | CCI-001451 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-25 |
| Definition: | Select radio antennas and calibrate transmission power levels to reduce the probability that signals from wireless access points can be received outside of organization-controlled boundaries. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-18 (5) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-18 (5) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-18 (5) | |||
| NIST: NIST SP 800-53A (v1): AC-18 (5).1 | |||
| CCI: | CCI-000083 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-19 |
| Definition: | Establish implementation guidance for organization-controlled mobile devices, to include when such devices are outside of controlled areas. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-19 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-19 a | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-19 a | |||
| NIST: NIST SP 800-53A (v1): AC-19.1 (i) | |||
| CCI: | CCI-002325 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Establish configuration requirements for organization-controlled mobile devices, to include when such devices are outside of controlled areas. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-19 a | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-19 a | |||
| CCI: | CCI-002326 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Establish connection requirements for organization-controlled mobile devices, to include when such devices are outside of controlled areas. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-19 a | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-19 a | |||
| CCI: | CCI-000084 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-14 |
| Definition: | Authorize connection of mobile devices to organizational systems. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-19 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-19 b | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-19 b | |||
| NIST: NIST SP 800-53A (v1): AC-19.1 (ii) | |||
| CCI: | CCI-001330 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | Prohibit the use of unclassified mobile devices in facilities containing systems processing, storing, or transmitting classified information unless specifically permitted by the authorizing official. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-19 (4) (a) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-19 (4) (a) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-19 (4) (a) | |||
| NIST: NIST SP 800-53A (v1): AC-19 (4).1 (i) | |||
| CCI: | CCI-001331 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | Prohibit the connection of unclassified mobile devices to classified systems. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-19 (4) (b) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-19 (4) (b) (1) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-19 (4) (b) (1) | |||
| NIST: NIST SP 800-53A (v1): AC-19 (4).1 (iii) | |||
| CCI: | CCI-001332 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | Connection of unclassified mobile devices to unclassified systems requires approval from the authorizing official. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-19 (4) (b) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-19 (4) (b) (2) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-19 (4) (b) (2) | |||
| NIST: NIST SP 800-53A (v1): AC-19 (4).1 (iii) | |||
| CCI: | CCI-001333 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | Use of internal or external modems or wireless interfaces within the unclassified mobile devices is prohibited. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-19 (4) (b) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-19 (4) (b) (3) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-19 (4) (b) (3) | |||
| NIST: NIST SP 800-53A (v1): AC-19 (4).1 (iii) | |||
| CCI: | CCI-001334 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | Require unclassified mobile devices used in facilities containing systems processing, storing, or transmitting classified information and the information stored on those devices be subject to random reviews and inspections by organization-defined security officials. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-19 (4) (b) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-19 (4) (b) (4) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-19 (4) (b) (4) | |||
| NIST: NIST SP 800-53A (v1): AC-19 (4).1 (iii) | |||
| CCI: | CCI-001335 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | Defines security officials to perform reviews and inspections of unclassified mobile devices in facilities containing systems processing, storing, or transmitting classified information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-19 (4) (b) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-19 (4) (b) (4) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-19 (4) (b) (4) | |||
| NIST: NIST SP 800-53A (v1): AC-19 (4).1 (ii) | |||
| CCI: | CCI-001458 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-29 |
| Definition: | If classified information is found on mobile devices, the incident handling policy is to be followed. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-19 (4) (b) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-19 (4) (b) (4) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-19 (4) (b) (4) | |||
| NIST: NIST SP 800-53A (v1): AC-19 (4).1 (iii) | |||
| CCI: | CCI-002327 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Defines the security policies which restrict the connection of classified mobile devices to classified systems. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-19 (4) (c) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-19 (4) (c) | |||
| CCI: | CCI-002328 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Restrict the connection of classified mobile devices to classified systems in accordance with organization-defined security policies. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-19 (4) (c) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-19 (4) (c) | |||
| CCI: | CCI-002329 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Defines the mobile devices that are to employ full-device or container encryption to protect the confidentiality and integrity of the information on the device. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-19 (5) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-19 (5) | |||
| CCI: | CCI-002330 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Employ full-device encryption or container encryption to protect the confidentiality of information on organization-defined mobile devices. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-19 (5) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-19 (5) | |||
| CCI: | CCI-002331 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Employ full-device encryption or container encryption to protect the integrity of information on organization-defined mobile devices. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-19 (5) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-19 (5) | |||
| CCI: | CCI-000093 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-14 |
| Definition: | Establish organization-defined terms and conditions, and/or identify organization-defined controls asserted to be implemented on external systems, consistent with the trust relationships established with other organizations owning, operating, and/or maintaining external systems, allowing authorized individuals to access the system from the external systems. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-20 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-20 a | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-20 a 1 | |||
| NIST: NIST SP 800-53A (v1): AC-20.1 | |||
| CCI: | CCI-002332 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Establish organization-defined terms and conditions, and/or identify organization-defined controls asserted to be implemented on external systems, consistent with the trust relationships established with other organizations owning, operating, and/or maintaining external systems, allowing authorized individuals to process, store, or transmit organization-controlled information using the external systems. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-20 b | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-20 a 2 | |||
| CCI: | CCI-003750 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Defines the terms and conditions for accessing the system from external systems. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-20 a 1 | ||
| CCI: | CCI-003751 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Defines the controls asserted to be implemented on external systems allowing individuals to access the system from external systems. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-20 a 1 | ||
| CCI: | CCI-003752 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Defines the terms and conditions for processing, storing, or transmitting organization-controlled information using external systems. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-20 a 2 | ||
| CCI: | CCI-003753 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Defines the controls asserted to be implemented on external systems allowing individuals to process, store, or transmit organization-controlled information using external systems. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-20 a 2 | ||
| CCI: | CCI-003754 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Prohibit the use of organizationally-defined types of external systems. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-20 b | ||
| CCI: | CCI-003755 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Defines the types of external systems that are prohibited. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-20 b | ||
| CCI: | CCI-003756 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Permit authorized individuals to use an external system to access the system or to process, store, or transmit organization-controlled information only after verification of the implementation of controls on the external system as specified in the organization's security policy and security plan. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-20 (1) (a) | ||
| CCI: | CCI-003757 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Permit authorized individuals to use an external system to access the system or to process, store, or transmit organization-controlled information only after verification of the implementation of controls on the external system as specified in the organization's privacy policy and privacy plan. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-20 (1) (a) | ||
| CCI: | CCI-002337 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Permit authorized individuals to use an external system to access the system or to process, store, or transmit organization-controlled information only after the system retains approved system connection or processing agreements with the organizational entity hosting the external system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-20 (1) (b) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-20 (1) (b) | |||
| CCI: | CCI-000097 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-14 |
| Definition: | Restrict the use of organization-controlled portable storage devices by authorized individuals on external systems using organization-defined restrictions. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-20 (2) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-20 (2) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-20 (2) | |||
| NIST: NIST SP 800-53A (v1): AC-20 (2).1 | |||
| CCI: | CCI-003758 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Defines the restrictions for the use of organization-controlled portable storage devices. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-20 (2) | ||
| CCI: | CCI-002338 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Restrict the use of non-organizationally owned systems or system components to process, store, or transmit organizational information using organization-defined restrictions. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-20 (3) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-20 (3) | |||
| CCI: | CCI-002339 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Defines the network accessible storage devices that are to be prohibited from being used in external systems. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-20 (4) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-20 (4) | |||
| CCI: | CCI-002340 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | Prohibit the use of organization-defined network accessible storage devices in external systems. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-20 (4) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-20 (4) | |||
| CCI: | CCI-003759 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Prohibit the use of organization-controlled portable storage devices by authorized individuals on external systems. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-20 (5) | ||
| CCI: | CCI-000098 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-19 |
| Definition: | Enable authorized users to determine whether access authorizations assigned to the sharing partner match the information's access and use restrictions for organization-defined information sharing circumstances where user discretion is required. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-21 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-21 a | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-21 a | |||
| NIST: NIST SP 800-53A (v1): AC-21.1 (ii) | |||
| CCI: | CCI-001470 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-29 |
| Definition: | Defines information sharing circumstances where user discretion is required. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-21 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-21 a | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-21 a | |||
| NIST: NIST SP 800-53A (v1): AC-21.1 (i) | |||
| CCI: | CCI-001471 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-29 |
| Definition: | Employ organization-defined automated mechanisms or manual processes required to assist users in making information sharing/collaboration decisions. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-21 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-21 b | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-21 b | |||
| NIST: NIST SP 800-53A (v1): AC-21.1 (iv) | |||
| CCI: | CCI-001472 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-29 |
| Definition: | Defines the automated mechanisms or manual processes required to assist users in making information sharing/collaboration decisions. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-21 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-21 b | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-21 b | |||
| NIST: NIST SP 800-53A (v1): AC-21.1 (iii) | |||
| CCI: | CCI-000099 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-19 |
| Definition: | Employ organization-defined automated mechanisms to enforce information-sharing decisions by authorized users based on access authorizations of sharing partners and access restrictions on information to be shared. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 (v3): AC-21 (1) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-21 (1) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-21 (1) | |||
| NIST: NIST SP 800-53A (v1): AC-21 (1).1 | |||
| CCI: | CCI-002341 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-25 |
| Definition: | Defines the information sharing restrictions to be enforced when implementing information search and retrieval services. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-21 (2) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-21 (2) | |||
| CCI: | CCI-002342 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-25 |
| Definition: | Implement information search and retrieval services that enforce organization-defined information sharing restrictions. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-21 (2) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-21 (2) | |||
| CCI: | CCI-001473 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-29 |
| Definition: | Designate individuals authorized to post information onto a publicly accessible system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-22 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-22 a | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-22 a | |||
| NIST: NIST SP 800-53A (v1): AC-22.1 (i) | |||
| CCI: | CCI-001474 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-29 |
| Definition: | Train authorized individuals to ensure that publicly accessible information does not contain nonpublic information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-22 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-22 b | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-22 b | |||
| NIST: NIST SP 800-53A (v1): AC-22.1 (ii) | |||
| CCI: | CCI-001475 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-29 |
| Definition: | Review the proposed content of information prior to posting onto the publicly accessible system to ensure that nonpublic information is not included. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-22 c | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-22 c | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-22 c | |||
| NIST: NIST SP 800-53A (v1): AC-22.1 (iii) | |||
| CCI: | CCI-001476 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-29 |
| Definition: | Review the content on the publicly accessible system for nonpublic information on an organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-22 d | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-22 d | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-22 d | |||
| NIST: NIST SP 800-53A (v1): AC-22.1 (iv) | |||
| CCI: | CCI-001477 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-29 |
| Definition: | Defines a frequency for reviewing the content on the publicly accessible system for nonpublic information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-22 d | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-22 d | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-22 d | |||
| NIST: NIST SP 800-53A (v1): AC-22.1 (ii) | |||
| CCI: | CCI-001478 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-29 |
| Definition: | Remove nonpublic information from the publicly accessible system, if discovered. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-22 e | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-22 d | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-22 d | |||
| NIST: NIST SP 800-53A (v1): AC-22.1 (v) | |||
| CCI: | CCI-002343 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-25 |
| Definition: | Defines the data mining prevention techniques to be employed to protect organization-defined data storage objects against data mining. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-23 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-23 | |||
| CCI: | CCI-002344 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-25 |
| Definition: | Defines the data mining detection techniques to be employed to detect data mining attempts against organization-defined data storage objects. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-23 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-23 | |||
| CCI: | CCI-002345 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-25 |
| Definition: | Defines the data storage objects that are to be protected against data mining attempts. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-23 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-23 | |||
| CCI: | CCI-002346 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-25 |
| Definition: | Employ organization-defined data mining prevention techniques for organization-defined data storage objects to protect against unauthorized data mining. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-23 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-23 | |||
| CCI: | CCI-002347 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-25 |
| Definition: | Employ organization-defined data mining detection techniques for organization-defined data storage objects to detect data mining attempts. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-23 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-23 | |||
| CCI: | CCI-002348 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-25 |
| Definition: | Defines the access control decisions that are to be applied to each access request prior to access enforcement. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-24 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-24 | |||
| CCI: | CCI-002349 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-25 |
| Definition: | Establish procedures or implement mechanisms to ensure organization-defined access control decisions are applied to each access request prior to access enforcement. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-24 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-24 | |||
| CCI: | CCI-002350 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-25 |
| Definition: | Defines the access authorization information that is to be transmitted using organization-defined security safeguards to organization-defined systems that enforce access control decisions. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-24 (1) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-24 (1) | |||
| CCI: | CCI-002351 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-25 |
| Definition: | Defines the controls to be employed when transmitting organization-defined access authorization information to organization-defined systems that enforce access control decisions. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-24 (1) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-24 (1) | |||
| CCI: | CCI-002352 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-25 |
| Definition: | Defines the systems that are to be recipients of organization-defined access authorization information using organization-defined security safeguards. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-24 (1) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-24 (1) | |||
| CCI: | CCI-002353 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-25 |
| Definition: | Transmit organization-defined access authorization information using organization-defined controls to organization-defined systems that enforce access control decisions. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-24 (1) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-24 (1) | |||
| CCI: | CCI-002354 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-25 |
| Definition: | Defines the security attributes, not to include the identity of the user or process acting on behalf of the user, to be used as the basis for enforcing access control decisions. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-24 (2) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-24 (2) | |||
| CCI: | CCI-002355 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-25 |
| Definition: | Enforce access control decisions based on organization-defined security or privacy attributes that do not include the identity of the user or process acting on behalf of the user. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-24 (2) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-24 (2) | |||
| CCI: | CCI-003760 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Defines the privacy attributes, not to include the identity of the user or process acting on behalf of the user, to be used as the basis for enforcing access control decisions. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AC-24 (2) | ||
| CCI: | CCI-002356 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-25 |
| Definition: | Defines the access control policies to be implemented by the reference monitor. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-25 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-25 | |||
| CCI: | CCI-002357 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-25 |
| Definition: | Implement a reference monitor for organization-defined access control policies that is tamperproof. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-25 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-25 | |||
| CCI: | CCI-002358 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-25 |
| Definition: | Implement a reference monitor for organization-defined access control policies that is always invoked. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-25 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-25 | |||
| CCI: | CCI-002359 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-25 |
| Definition: | Implement a reference monitor for organization-defined access control policies that is small enough to be subject to analysis and testing, the completeness of which can be assured. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-25 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AC-25 | |||
| CCI: | CCI-000100 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-20 |
| Definition: | Develop and document an organization level, mission/business process-level, or system-level awareness and training policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AT-1 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AT-1 a 1 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AT-1 a 1 (a) | |||
| NIST: NIST SP 800-53A (v1): AT-1.1 (i and ii) | |||
| CCI: | CCI-000101 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-20 |
| Definition: | Disseminate an organization level, mission/business process-level, or system-level awareness and training policy to organization-defined personnel or roles. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AT-1 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AT-1 a 1 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AT-1 a 1 (a) | |||
| NIST: NIST SP 800-53A (v1): AT-1.1 (iii) | |||
| CCI: | CCI-000103 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-20 |
| Definition: | Develop and document procedures to facilitate the implementation of the awareness and training policy and associated awareness and training controls. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AT-1 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AT-1 a 2 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AT-1 a 2 | |||
| NIST: NIST SP 800-53A (v1): AT-1.1 (iv and v) | |||
| CCI: | CCI-000104 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-20 |
| Definition: | Disseminate organization-level; mission/business process-level; or system-level awareness and training procedures to organization-defined personnel or roles. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AT-1 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AT-1 a 2 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AT-1 a 2 | |||
| NIST: NIST SP 800-53A (v1): AT-1.1 (vi) | |||
| CCI: | CCI-002048 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-05 |
| Definition: | Defines the personnel or roles to whom the awareness and training policy is disseminated. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AT-1 a 1 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AT-1 a 1 (a) | |||
| CCI: | CCI-002049 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-05 |
| Definition: | Defines the personnel or roles to whom the organization-level; mission/business process-level; system-level awareness and training procedures are disseminated. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AT-1 a 2 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AT-1 a 2 | |||
| CCI: | CCI-003761 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Develop and document an organization level, mission/business process-level, or system-level awareness and training policy that is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AT-1 a 1 (b) | ||
| CCI: | CCI-003762 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Designate an organization-defined official to manage the development and documentation of the awareness and training policy. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AT-1 b | ||
| CCI: | CCI-003763 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Designate an organization-defined official to manage the dissemination of the awareness and training policy. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AT-1 b | ||
| CCI: | CCI-003764 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Designate an organization-defined official to manage the development and documentation of the awareness and training procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AT-1 b | ||
| CCI: | CCI-003765 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Designate an organization-defined official to manage the dissemination of the awareness and training procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AT-1 b | ||
| CCI: | CCI-000102 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-20 |
| Definition: | Review and update the current security awareness and training policy in accordance with organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AT-1 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AT-1 b 1 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AT-1 c 1 | |||
| NIST: NIST SP 800-53A (v1): AT-1.2 (ii) | |||
| CCI: | CCI-000105 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-20 |
| Definition: | Review and update the current security awareness and training procedures in accordance with an organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AT-1 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AT-1 b 2 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AT-1 c 2 | |||
| NIST: NIST SP 800-53A (v1): AT-1.2 (iii) | |||
| CCI: | CCI-001564 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-11 |
| Definition: | Defines the frequency of security awareness and training policy reviews and updates. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AT-1 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AT-1 b 1 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AT-1 c 1 | |||
| NIST: NIST SP 800-53A (v1): AT-1.2 (i) | |||
| CCI: | CCI-001565 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-11 |
| Definition: | Defines the frequency of security awareness and training procedure reviews and updates. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AT-1 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AT-1 b 2 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AT-1 c 2 | |||
| NIST: NIST SP 800-53A (v1): AT-1.2 (iii) | |||
| CCI: | CCI-000106 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-14 |
| Definition: | Provide basic security literacy training to system users (including managers, senior executives, and contractors) as part of initial training for new users. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AT-2 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AT-2 a | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AT-2 a 1 | |||
| NIST: NIST SP 800-53A (v1): AT-2.1 (i) | |||
| CCI: | CCI-000112 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-20 |
| Definition: | Provide basic security awareness training to system users (including managers, senior executives, and contractors) when required by system changes or following organization-defined events. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AT-2 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AT-2 b | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AT-2 a 2 | |||
| NIST: NIST SP 800-53A (v1): AT-2.1 (i) | |||
| CCI: | CCI-003766 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Provide basic privacy awareness training to system users (including managers, senior executives, and contractors) when required by system changes or following organization-defined events. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AT-2 a 2 | ||
| CCI: | CCI-005147 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-08 |
| Definition: | Provide basic privacy literacy training to system users (including managers, senior executives, and contractors) as part of initial training for new users. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AT-2 a 1 | ||
| CCI: | CCI-003767 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Employ organization-defined awareness techniques to increase the security awareness of system users. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AT-2 b | ||
| CCI: | CCI-003768 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Employ organization-defined awareness techniques to increase the privacy awareness of system users. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AT-2 b | ||
| CCI: | CCI-003769 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Defines the awareness techniques for to increase security and privacy awareness of system uses. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AT-2 b | ||
| CCI: | CCI-003770 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Update literacy training and awareness content on an organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AT-2 c | ||
| CCI: | CCI-003771 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Update literacy training and awareness content following organization-defined event. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AT-2 c | ||
| CCI: | CCI-003772 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Defines the frequency for updating literacy training and awareness content. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AT-2 c | ||
| CCI: | CCI-003773 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Defines the events following updating literacy training and awareness content. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AT-2 c | ||
| CCI: | CCI-003774 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Incorporate lessons learned from internal or external security incidents or breaches into literacy training and awareness techniques. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AT-2 d | ||
| CCI: | CCI-000107 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-20 |
| Definition: | Provide practical exercises in literacy training that simulate events and incidents. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AT-2 (1) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AT-2 (1) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AT-2 (1) | |||
| NIST: NIST SP 800-53A (v1): AT-2 (1).1 | |||
| CCI: | CCI-002055 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-05 |
| Definition: | Provide literacy training on recognizing and reporting potential indicators of insider threat. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AT-2 (2) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AT-2 (2) | |||
| CCI: | CCI-003775 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Provide literacy training on recognizing and reporting potential and actual instances of social engineering. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AT-2 (3) | ||
| CCI: | CCI-003776 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Provide literacy training on recognizing and reporting potential and actual instances of social mining. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AT-2 (3) | ||
| CCI: | CCI-003777 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Provide literacy training on recognize suspicious communications and anomalous behavior in organizational systems using organization-defined indicators of malicious code. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AT-2 (4) | ||
| CCI: | CCI-003778 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Defines the indicators of malicious code used to recognize suspicious communications and anomalous behavior in organizational systems. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AT-2 (4) | ||
| CCI: | CCI-003779 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Provide literacy training on the advanced persistent threat. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AT-2 (5) | ||
| CCI: | CCI-003780 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Provide literacy training on the cyber threat environment. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AT-2 (6) (a) | ||
| CCI: | CCI-003781 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Reflect current cyber threat information in system operations. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AT-2 (6) (b) | ||
| CCI: | CCI-000108 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-20 |
| Definition: | Provide role-based security training to personnel with organization-defined roles and responsibilities before authorizing access to the system, information, or performing assigned duties. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AT-3 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AT-3 a | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AT-3 a 1 | |||
| NIST: NIST SP 800-53A (v1): AT-3.1 (i) | |||
| CCI: | CCI-000109 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-20 |
| Definition: | Provide role-based security training to personnel with organization-defined roles and responsibilities when required by system changes. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AT-3 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AT-3 b | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AT-3 a 2 | |||
| NIST: NIST SP 800-53A (v1): AT-3.1 (i) | |||
| CCI: | CCI-003782 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Defines the roles and responsibilities of the personnel providing role-based security and privacy training. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AT-3 a | ||
| CCI: | CCI-003783 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Provide role-based privacy training to personnel with organization-defined roles and responsibilities before authorizing access to the system, information, or performing assigned duties. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AT-3 a 1 | ||
| CCI: | CCI-003784 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Provide role-based privacy training to personnel with organization-defined roles and responsibilities when required by system changes. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AT-3 a 2 | ||
| CCI: | CCI-003785 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Update role-based training content on an organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AT-3 b | ||
| CCI: | CCI-003786 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Defines the frequency of which the role-based training content is updated. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AT-3 b | ||
| CCI: | CCI-003787 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Update role-based training content following organization-defined events. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AT-3 b | ||
| CCI: | CCI-003788 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Defines the events following updating role-based training content. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AT-3 b | ||
| CCI: | CCI-003789 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Incorporate lessons learned from internal or external security incidents or breaches into role-based training. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AT-3 c | ||
| CCI: | CCI-001481 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-29 |
| Definition: | Provide organization-defined personnel or roles with initial training in the employment and operation of environmental controls. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AT-3 (1) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AT-3 (1) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AT-3 (1) | |||
| NIST: NIST SP 800-53A (v1): AT-3 (1).1 (i) | |||
| CCI: | CCI-001482 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-29 |
| Definition: | Provide organization-defined personnel or roles with refresher training in the employment and operation of environmental controls in accordance with the organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AT-3 (1) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AT-3 (1) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AT-3 (1) | |||
| NIST: NIST SP 800-53A (v1): AT-3 (1).1 (iii) | |||
| CCI: | CCI-001483 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-29 |
| Definition: | Defines a frequency for providing employees with refresher training in the employment and operation of environmental controls. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AT-3 (1) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AT-3 (1) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AT-3 (1) | |||
| NIST: NIST SP 800-53A (v1): AT-3 (1).1 (ii) | |||
| CCI: | CCI-002050 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-05 |
| Definition: | Defines the personnel or roles to whom initial and refresher training in the employment and operation of environmental controls is to be provided. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AT-3 (1) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AT-3 (1) | |||
| CCI: | CCI-001566 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-11 |
| Definition: | Provide organization-defined personnel or roles with initial training in the employment and operation of physical security controls. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AT-3 (2) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AT-3 (2) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AT-3 (2) | |||
| NIST: NIST SP 800-53A (v1): AT-3 (2).1 (i) | |||
| CCI: | CCI-001567 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-11 |
| Definition: | Provide organization-defined personnel or roles with refresher training, thereafter, in the employment and operation of physical security controls in accordance with the organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AT-3 (2) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AT-3 (2) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AT-3 (2) | |||
| NIST: NIST SP 800-53A (v1): AT-3 (2).1 (iii) | |||
| CCI: | CCI-001568 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-11 |
| Definition: | Defines a frequency for providing employees with refresher training in the employment and operation of physical security controls. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AT-3 (2) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AT-3 (2) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AT-3 (2) | |||
| NIST: NIST SP 800-53A (v1): AT-3 (2).1 (ii) | |||
| CCI: | CCI-002051 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-05 |
| Definition: | Defines the personnel or roles to whom initial and refresher training in the employment and operation of physical security controls is to be provided. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AT-3 (2) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AT-3 (2) | |||
| CCI: | CCI-002052 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-05 |
| Definition: | Provide practical exercises in security training that reinforce training objectives. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AT-3 (3) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AT-3 (3) | |||
| CCI: | CCI-003790 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Provide practical exercises in privacy training that reinforce training objectives. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AT-3 (3) | ||
| CCI: | CCI-003791 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Defines the frequency for providing training in the employment and operation of personally identifiable information processing and transparency controls to personnel or roles. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AT-3 (5) | ||
| CCI: | CCI-003792 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Provide organization-defined personnel or roles with initial training in the employment and operation of personally identifiable information processing and transparency controls. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AT-3 (5) | ||
| CCI: | CCI-003793 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Defines the personnel or roles who are to be provided training in the employment and operation of personally identifiable information processing and transparency controls. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AT-3 (5) | ||
| CCI: | CCI-000113 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-14 |
| Definition: | Document individual security training activities, including security awareness training and specific system security training. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AT-4 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AT-4 a | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AT-4 a | |||
| NIST: NIST SP 800-53A (v1): AT-4.1 (i) | |||
| CCI: | CCI-000114 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-14 |
| Definition: | Monitor individual information security training activities, including security awareness training and specific security training. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AT-4 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AT-4 a | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AT-4 a | |||
| NIST: NIST SP 800-53A (v1): AT-4.1 (i) | |||
| CCI: | CCI-003794 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Document individual privacy training activities, including privacy awareness training and specific system privacy training. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AT-4 a | ||
| CCI: | CCI-003795 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Monitor individual information privacy training activities, including privacy awareness training and specific privacy training. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AT-4 a | ||
| CCI: | CCI-001336 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | Retain individual training records for an organization-defined time-period. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AT-4 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AT-4 b | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AT-4 b | |||
| NIST: NIST SP 800-53A (v1): AT-4.1 (iii) | |||
| CCI: | CCI-001337 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | Defines the time period for retaining individual training records. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AT-4 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AT-4 b | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AT-4 b | |||
| NIST: NIST SP 800-53A (v1): AT-4.1 (ii) | |||
| CCI: | CCI-003796 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Provide feedback on organizational training results to organization-defined personnel on an organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AT-6 | ||
| CCI: | CCI-003797 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Defines the frequency of which feedback is provided on organizational training results. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AT-6 | ||
| CCI: | CCI-003798 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Defines the organizational personnel or roles who provide feedback on organizational training results. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AT-6 | ||
| CCI: | CCI-000117 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-20 |
| Definition: | Develop and document an organization-level; mission/business process-level; and/or system-level audit and accountability policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AU-1 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AU-1 a 1 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-1 a 1 (a) | |||
| NIST: NIST SP 800-53A (v1): AU-1.1 (I and ii) | |||
| CCI: | CCI-000120 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-20 |
| Definition: | Develop and document procedures to facilitate the implementation of the audit and accountability policy and associated audit and accountability controls. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AU-1 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AU-1 a 2 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-1 a 2 | |||
| NIST: NIST SP 800-53A (v1): AU-1.1 (iv and v) | |||
| CCI: | CCI-001832 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-14 |
| Definition: | Disseminate the organization-level; mission/business process-level; and/or system-level audit and accountability policy to organization-defined personnel or roles. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AU-1 a 1 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-1 a 1 (a) | |||
| CCI: | CCI-001834 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-14 |
| Definition: | Disseminate to organization-defined personnel or roles procedures to facilitate the implementation of the audit and accountability policy and associated audit and accountability controls. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AU-1 a 2 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-1 a 2 | |||
| CCI: | CCI-001930 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-04-08 |
| Definition: | Defines the personnel or roles to whom the organization-level; mission/business process-level; and/or system-level audit and accountability policy is to be disseminated. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AU-1 a 1 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-1 a 1 | |||
| CCI: | CCI-001931 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-04-08 |
| Definition: | Defines the personnel or roles to whom the audit and accountability procedures are to be disseminated. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AU-1 a 2 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-1 a 2 | |||
| CCI: | CCI-003799 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Develop and document an organization-level; mission/business process-level; and/or system-level audit and accountability policy that is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AU-1 a 1 (b) | ||
| CCI: | CCI-003800 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Designate an organization-defined official to manage the development and documentation of the audit and accountability policy. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AU-1 b | ||
| CCI: | CCI-003801 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Designate an organization-defined official to manage the dissemination of the audit and accountability policy. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AU-1 b | ||
| CCI: | CCI-003802 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Designate an organization-defined official to manage the development and documentation of the audit and accountability procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AU-1 b | ||
| CCI: | CCI-003803 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Designate an organization-defined official to manage the dissemination of the audit and accountability procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AU-1 b | ||
| CCI: | CCI-003804 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Defines the official designated for managing the development, documentation, and dissemination of the audit and accountability policy. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AU-1 b | ||
| CCI: | CCI-003805 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-01 |
| Definition: | Defines the official designated for managing the development, documentation, and dissemination of the audit and accountability procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AU-1 b | ||
| CCI: | CCI-000119 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-20 |
| Definition: | Review and update the current audit and accountability policy on an organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AU-1 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AU-1 b 1 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-1 c 1 | |||
| NIST: NIST SP 800-53A (v1): AU-1.2 (ii) | |||
| CCI: | CCI-000122 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-20 |
| Definition: | Review and update the current audit and accountability procedures on an organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AU-1 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AU-1 b 2 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-1 c 2 | |||
| NIST: NIST SP 800-53A (v1): AU-1.2 (iv) | |||
| CCI: | CCI-001569 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-11 |
| Definition: | Defines the frequency on which the current audit and accountability policy will be reviewed and updated. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AU-1 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AU-1 b 1 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-1 c 1 | |||
| NIST: NIST SP 800-53A (v1): AU-1.2 (i) | |||
| CCI: | CCI-001570 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-11 |
| Definition: | Defines the frequency on which the current audit and accountability procedures will be reviewed and updated. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AU-1 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AU-1 b 2 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-1 c 2 | |||
| NIST: NIST SP 800-53A (v1): AU-1.2 (iii) | |||
| CCI: | CCI-003806 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Review and update the current audit and accountability policy following organization-defined events. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AU-1 c 1 | ||
| CCI: | CCI-003807 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Defines the events following reviewing and updating the current audit and accountability policy. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AU-1 c 1 | ||
| CCI: | CCI-003808 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Review and update the current audit and accountability procedures following organization-defined events. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AU-1 c 2 | ||
| CCI: | CCI-003809 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Defines the events following reviewing and updating the current audit and accountability procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AU-1 c 2 | ||
| CCI: | CCI-000123 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-15 |
| Definition: | Identify the organization-defined event types that the system is capable of logging in support of the audit function. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AU-2 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AU-2 a | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-2 a | |||
| NIST: NIST SP 800-53A (v1): AU-2.1 (ii) | |||
| CCI: | CCI-001571 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-11 |
| Definition: | Defines the event types that the system is capable of logging in support of the audit function. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AU-2 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AU-2 a | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-2 a | |||
| NIST: NIST SP 800-53A (v1): AU-2.1 (i) | |||
| CCI: | CCI-000124 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-15 |
| Definition: | Coordinate the event logging function with other organizational entities requiring audit-related information to guide and inform the selection criteria for events to be logged. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AU-2 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AU-2 b | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-2 b | |||
| NIST: NIST SP 800-53A (v1): AU-2.1 (iii) | |||
| CCI: | CCI-000126 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-15 |
| Definition: | Specify the organization-defined event types (subset of the event types defined in AU-2a) along with the frequency of (or situation requiring logging for each identified event type. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AU-2 d | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AU-2 d | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-2 c | |||
| NIST: NIST SP 800-53A (v1): AU-2.1 (v) | |||
| CCI: | CCI-001484 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-29 |
| Definition: | Defines the frequency of (or situation requiring) logging for each identified event. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AU-2 d | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AU-2 d | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-2 c | |||
| NIST: NIST SP 800-53A (v1): AU-2.1 (v) | |||
| CCI: | CCI-001485 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-29 |
| Definition: | Defines the event types for logging within the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AU-2 d | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AU-2 d | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-2 c | |||
| NIST: NIST SP 800-53A (v1): AU-2.1 (vi) | |||
| CCI: | CCI-000125 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-15 |
| Definition: | Provide a rationale for why the event types selected for logging are deemed to be adequate for support after-the-fact investigations of incidents. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AU-2 c | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AU-2 c | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-2 d | |||
| NIST: NIST SP 800-53A (v1): AU-2.1 (iv) | |||
| CCI: | CCI-003810 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Review and update the event types selected for logging on an organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AU-2 e | ||
| CCI: | CCI-003811 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Defines the frequency at which the event types selected for logging will be reviewed and updated. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AU-2 e | ||
| CCI: | CCI-000130 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-20 |
| Definition: | Ensure that audit records contain information that establishes what type of event occurred. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AU-3 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AU-3 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-3 a | |||
| NIST: NIST SP 800-53A (v1): AU-3.1 | |||
| CCI: | CCI-000131 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-20 |
| Definition: | Ensure that audit records containing information that establishes when the event occurred. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AU-3 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AU-3 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-3 b | |||
| NIST: NIST SP 800-53A (v1): AU-3.1 | |||
| CCI: | CCI-000132 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-20 |
| Definition: | Ensure that audit records containing information that establishes where the event occurred. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AU-3 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AU-3 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-3 c | |||
| NIST: NIST SP 800-53A (v1): AU-3.1 | |||
| CCI: | CCI-000133 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-20 |
| Definition: | Ensure that audit records containing information that establishes the source of the event. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AU-3 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AU-3 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-3 d | |||
| NIST: NIST SP 800-53A (v1): AU-3.1 | |||
| CCI: | CCI-000134 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-20 |
| Definition: | Ensure that audit records containing information that establishes the outcome of the event. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AU-3 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AU-3 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-3 e | |||
| NIST: NIST SP 800-53A (v1): AU-3.1 | |||
| CCI: | CCI-001487 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-29 |
| Definition: | Ensure that audit records containing information that establishes the identity of any individuals, subjects, or objects/entities associated with the event. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AU-3 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AU-3 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-3 f | |||
| NIST: NIST SP 800-53A (v1): AU-3.1 | |||
| CCI: | CCI-000135 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-20 |
| Definition: | Generate audit records containing the organization-defined additional information that is to be included in the audit records. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AU-3 (1) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AU-3 (1) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-3 (1) | |||
| NIST: NIST SP 800-53A (v1): AU-3 (1).1 (ii) | |||
| CCI: | CCI-001488 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-29 |
| Definition: | Defines the additional information to be included in the audit records. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AU-3 (1) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AU-3 (1) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-3 (1) | |||
| NIST: NIST SP 800-53A (v1): AU-3 (1).1 (i) | |||
| CCI: | CCI-003812 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Limit personally identifiable information contained in audit records to organization-defined elements identified in the privacy risk assessment. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AU-3 (3) | ||
| CCI: | CCI-003813 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Defines the elements identified in the privacy risk assessment for limiting personally identifiable information contained in audit records. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AU-3 (3) | ||
| CCI: | CCI-001848 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-14 |
| Definition: | Defines the audit log retention requirements for allocating audit log storage capacity. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AU-4 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-4 | |||
| CCI: | CCI-001849 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-14 |
| Definition: | Allocate audit log storage capacity to accommodate organization-defined audit log retention requirements. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AU-4 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-4 | |||
| CCI: | CCI-001850 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-14 |
| Definition: | Defines the frequency to off-load audit records onto a different system or media than the system being audited. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AU-4 (1) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-4 (1) | |||
| CCI: | CCI-001851 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-14 |
| Definition: | Transfer audit logs per organization-defined frequency to a different system, system component, or media than the system or system component conducting the logging. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AU-4 (1) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-4 (1) | |||
| CCI: | CCI-000139 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-15 |
| Definition: | Alert organization-defined personnel or roles within an organization-defined time period in the event of an audit logging process failure. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AU-5 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AU-5 a | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-5 a | |||
| NIST: NIST SP 800-53A (v1): AU-5.1 (ii) | |||
| CCI: | CCI-001572 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-11 |
| Definition: | Defines the personnel or roles to be alerted in the event of an audit logging process failure. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AU-5 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AU-5 a | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-5 a | |||
| NIST: NIST SP 800-53A (v1): AU-5.1 (i) | |||
| CCI: | CCI-003814 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Defines the time-period for the alert in the event of an audit process failure. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AU-5 a | ||
| CCI: | CCI-000140 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-20 |
| Definition: | Take organization-defined actions upon audit failure include, shutting down the system, overwriting oldest audit records, and stopping the generation of audit records. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AU-5 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AU-5 b | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-5 b | |||
| NIST: NIST SP 800-53A (v1): AU-5.1 (iv) | |||
| CCI: | CCI-001490 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-29 |
| Definition: | Defines the actions to be taken by the system upon audit failure, including shutting down the system, overwriting oldest audit records, and stopping the generation of audit records. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AU-5 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AU-5 b | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-5 b | |||
| NIST: NIST SP 800-53A (v1): AU-5.1 (iii) | |||
| CCI: | CCI-001852 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-14 |
| Definition: | Defines the personnel, roles and/or locations to receive a warning when allocated audit log storage volume reaches a defined percentage of maximum audit log storage capacity. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AU-5 (1) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-5 (1) | |||
| CCI: | CCI-001853 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-14 |
| Definition: | Defines the time period within which organization-defined personnel, roles, and/or locations are to receive warnings when allocated audit log storage volume reaches an organization-defined percentage of maximum audit log storage capacity. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AU-5 (1) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-5 (1) | |||
| CCI: | CCI-001854 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-14 |
| Definition: | Defines the percentage of maximum audit log storage capacity that is to be reached, at which time the system will provide a warning to organization-defined personnel, roles, and/or locations. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AU-5 (1) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-5 (1) | |||
| CCI: | CCI-001855 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-14 |
| Definition: | Provide a warning to organization-defined personnel, roles, and/or locations within an organization-defined time period when allocated audit log storage volume reaches an organization-defined percentage of repository maximum audit log storage capacity. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AU-5 (1) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-5 (1) | |||
| CCI: | CCI-000147 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-22 |
| Definition: | Defines the audit logging failure events requiring real-time alerts. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AU-5 (2) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AU-5 (2) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-5 (2) | |||
| NIST: NIST SP 800-53A (v1): AU-5 (2).1 (i) | |||
| CCI: | CCI-001856 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-14 |
| Definition: | Defines the real-time period in which to provide an alert when organization-defined audit failure events occur. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AU-5 (2) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-5 (2) | |||
| CCI: | CCI-001857 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-14 |
| Definition: | Defines the personnel, roles, and/or locations to receive alerts when organization-defined audit failure events occur. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AU-5 (2) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-5 (2) | |||
| CCI: | CCI-001858 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-14 |
| Definition: | Provide an alert in an organization-defined real-time-period to organization-defined personnel, roles, and/or locations when organization-defined audit failure events requiring real-time alerts occur. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AU-5 (2) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-5 (2) | |||
| CCI: | CCI-000145 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-20 |
| Definition: | Enforce configurable network communications traffic volume thresholds reflecting limits on audit log storage capacity by delaying or rejecting network traffic above those organization-defined thresholds. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AU-5 (3) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AU-5 (3) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-5 (3) | |||
| NIST: NIST SP 800-53A (v1): AU-5 (3).1 (i) | |||
| CCI: | CCI-001573 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-11 |
| Definition: | Defines whether to reject or delay network traffic that exceeds organization-defined thresholds. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AU-5 (3) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AU-5 (3) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-5 (3) | |||
| NIST: NIST SP 800-53A (v1): AU-5 (3).1 (ii) | |||
| CCI: | CCI-001859 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-14 |
| Definition: | Defines the network communication traffic volume thresholds reflecting limits on auditing capacity, specifying when the information system will reject or delay network traffic that exceed those thresholds. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AU-5 (3) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-5 (3) | |||
| CCI: | CCI-001860 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-14 |
| Definition: | Defines the audit logging failures which, should they occur, will invoke an organization-defined system mode. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AU-5 (4) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-5 (4) | |||
| CCI: | CCI-001861 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-14 |
| Definition: | Invoke a full system shutdown, partial system shutdown, or degraded operational mode with limited mission or business functionality available in the event of organization-defined audit logging failures, unless an alternate audit logging capability exists. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AU-5 (4) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-5 (4) | |||
| CCI: | CCI-002907 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-08-22 |
| Definition: | Defines the system mode to be invoked, such as a full system shutdown, a partial system shutdown, or a degraded operational mode with limited mission or business functionality available, in the event of organization-defined audit logging failures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AU-5 (4) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-5 (4) | |||
| CCI: | CCI-003815 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Provide an alternate audit logging capability in the event of a failure in primary audit logging capability that implements organization-defined alternate audit logging functionality. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AU-5 (5) | ||
| CCI: | CCI-003816 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Defines the alternate audit logging functionality in the event of a failure in primary audit logging capability. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AU-5 (5) | ||
| CCI: | CCI-000148 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-22 |
| Definition: | Review and analyze system audit records on an organization-defined frequency for indications of organization-defined inappropriate or unusual activity. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AU-6 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AU-6 a | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-6 a | |||
| NIST: NIST SP 800-53A (v1): AU-6.1 (ii) | |||
| CCI: | CCI-000151 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-15 |
| Definition: | Defines the frequency for the review and analysis of system audit records for organization-defined inappropriate or unusual activity. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AU-6 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AU-6 a | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-6 a | |||
| NIST: NIST SP 800-53A (v1): AU-6.1 (i) | |||
| CCI: | CCI-001862 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-15 |
| Definition: | Defines the types of inappropriate or unusual activity to be reviewed and analyzed in the audit records. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AU-6 a | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-6 a | |||
| CCI: | CCI-003817 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Review and analyze the potential impact of the organization-defined inappropriate or unusual activity. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AU-6 a | ||
| CCI: | CCI-000149 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-22 |
| Definition: | Report any findings to organization-defined personnel or roles for indications of organization-defined inappropriate or unusual activity. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AU-6 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AU-6 b | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-6 b | |||
| NIST: NIST SP 800-53A (v1): AU-6.1 (iii) | |||
| CCI: | CCI-001863 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-15 |
| Definition: | Defines the personnel or roles to receive the reports of organization-defined inappropriate or unusual activity. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AU-6 b | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-6 b | |||
| CCI: | CCI-003818 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Adjust the level of audit review and analysis within the system when there is a change in risk based on law enforcement information, intelligence information, or other credible sources of information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AU-6 c | ||
| CCI: | CCI-003819 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Adjust the level of audit reporting within the system when there is a change in risk based on law enforcement information, intelligence information, or other credible sources of information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AU-6 c | ||
| CCI: | CCI-001864 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-15 |
| Definition: | Integrate audit review and analysis using organization-defined automated mechanisms. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AU-6 (1) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-6 (1) | |||
| CCI: | CCI-001865 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-15 |
| Definition: | Integrate reporting processes using organization-defined automated mechanisms. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AU-6 (1) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-6 (1) | |||
| CCI: | CCI-003820 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Defines the automated mechanisms for integrating audit record review, analysis, and reporting processes. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AU-6 (1) | ||
| CCI: | CCI-000153 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-22 |
| Definition: | Analyze and correlate audit records across different repositories to gain organization-wide situational awareness. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AU-6 (3) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AU-6 (3) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-6 (3) | |||
| NIST: NIST SP 800-53A (v1): AU-6 (3).1 | |||
| CCI: | CCI-000154 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-22 |
| Definition: | Provide the capability to centrally review and analyze audit records from multiple components within the system. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AU-6 (4) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AU-6 (4) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-6 (4) | |||
| NIST: NIST SP 800-53A (v1): AU-6 (4).1 | |||
| CCI: | CCI-003821 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Implement the capability to centrally review and analyze audit records from multiple components within the system. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AU-6 (4) | ||
| CCI: | CCI-001866 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-15 |
| Definition: | Defines the data/information to be collected from other sources to enhance its ability to identify inappropriate or unusual activity. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AU-6 (5) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-6 (5) | |||
| CCI: | CCI-001867 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-15 |
| Definition: | Integrate analysis of audit records with analysis of vulnerability scanning information, performance data, system monitoring information, and/or organization-defined data/information collected from other sources to further enhance the ability to identify inappropriate or unusual activity. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AU-6 (5) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-6 (5) | |||
| CCI: | CCI-001491 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-29 |
| Definition: | Correlate information from audit records with information obtained from monitoring physical access to further enhance the ability to identify suspicious, inappropriate, unusual, or malevolent activity. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AU-6 (6) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AU-6 (6) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-6 (6) | |||
| NIST: NIST SP 800-53A (v1): AU-6 (6).1 | |||
| CCI: | CCI-001868 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-15 |
| Definition: | Specify the permitted actions for each information system process, role, and/or user associated with the review and analysis of audit information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AU-6 (7) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-6 (7) | |||
| CCI: | CCI-001869 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-15 |
| Definition: | Specify the permitted actions for each information system process, role, and/or user associated with the reporting of audit information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AU-6 (7) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-6 (7) | |||
| CCI: | CCI-001870 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-15 |
| Definition: | Perform a full-text analysis of logged privileged commands in a physically-distinct component or subsystem of the system, or other system that is dedicated to that analysis. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AU-6 (8) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-6 (8) | |||
| CCI: | CCI-001871 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-15 |
| Definition: | Correlate information from non-technical sources with audit record information to enhance organization-wide situational awareness. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AU-6 (9) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-6 (9) | |||
| CCI: | CCI-001875 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-15 |
| Definition: | Provide an audit reduction capability that supports on-demand audit review and analysis. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AU-7 a | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-7 a | |||
| CCI: | CCI-001876 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-15 |
| Definition: | Provide an audit reduction capability that supports on-demand reporting requirements. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AU-7 a | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-7 a | |||
| CCI: | CCI-001877 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-15 |
| Definition: | Provide an audit reduction capability that supports after-the-fact investigations of incidents. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AU-7 a | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-7 a | |||
| CCI: | CCI-001878 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-15 |
| Definition: | Provide a report generation capability that supports on-demand audit review and analysis. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AU-7 a | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-7 a | |||
| CCI: | CCI-001879 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-15 |
| Definition: | Provide a report generation capability that supports on-demand reporting requirements. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AU-7 a | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-7 a | |||
| CCI: | CCI-001880 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-15 |
| Definition: | Provide a report generation capability that supports after-the-fact investigations of security incidents. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AU-7 a | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-7 a | |||
| CCI: | CCI-003822 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Implement an audit reduction capability that supports on-demand audit review and analysis. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AU-7 a | ||
| CCI: | CCI-003823 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Implement an audit reduction capability that supports on-demand reporting requirements. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AU-7 a | ||
| CCI: | CCI-003824 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Implement an audit reduction capability that supports after-the-fact investigations of incidents. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AU-7 a | ||
| CCI: | CCI-003825 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Implement a report generation capability that supports on-demand audit review and analysis. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AU-7 a | ||
| CCI: | CCI-003826 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Implement a report generation capability that supports on-demand reporting requirements. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AU-7 a | ||
| CCI: | CCI-003827 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Implement a report generation capability that supports after-the-fact investigations of incidents. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AU-7 a | ||
| CCI: | CCI-001881 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-15 |
| Definition: | Provide an audit reduction capability that does not alter original content or time ordering of audit records. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AU-7 b | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-7 b | |||
| CCI: | CCI-001882 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-15 |
| Definition: | Provide a report generation capability that does not alter original content or time ordering of audit records. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AU-7 b | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-7 b | |||
| CCI: | CCI-003828 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Implement an audit reduction capability that does not alter original content or time ordering of audit records. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AU-7 b | ||
| CCI: | CCI-003829 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Implement a report generation capability that does not alter original content or time ordering of audit records. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AU-7 b | ||
| CCI: | CCI-000158 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-22 |
| Definition: | Provide the capability to process, sort, and search audit records for events of interest based on organization-defined audit fields within audit records. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AU-7 (1) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AU-7 (1) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-7 (1) | |||
| NIST: NIST SP 800-53A (v1): AU-7 (1).1 | |||
| CCI: | CCI-001883 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-15 |
| Definition: | Defines the audit fields within audit records to be processed, sorted, and searched for events of interest by the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AU-7 (1) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-7 (1) | |||
| CCI: | CCI-003830 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Implement the capability to process, sort, and search audit records for events of interest based on organization-defined audit fields within audit records. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AU-7 (1) | ||
| CCI: | CCI-000159 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-22 |
| Definition: | Use internal system clocks to generate time stamps for audit records. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AU-8 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AU-8 a | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-8 a | |||
| NIST: NIST SP 800-53A (v1): AU-8.1 | |||
| CCI: | CCI-001888 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-15 |
| Definition: | Defines the granularity of time measurement for time stamps generated for audit records. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AU-8 b | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-8 b | |||
| CCI: | CCI-001889 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-15 |
| Definition: | Record time stamps for audit records that meet organization-defined granularity of time measurement. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AU-8 b | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-8 b | |||
| CCI: | CCI-001890 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-15 |
| Definition: | Record time stamps for audit records that use Coordinated Universal Time, have a fixed local time offset from Coordinated Universal Time, or that include the local time offset as part of the time stamp. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AU-8 b | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-8 b | |||
| CCI: | CCI-000162 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-22 |
| Definition: | Protect audit information from unauthorized access. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AU-9 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AU-9 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-9 a | |||
| NIST: NIST SP 800-53A (v1): AU-9.1 | |||
| CCI: | CCI-000163 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-22 |
| Definition: | Protect audit information from unauthorized modification. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AU-9 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AU-9 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-9 a | |||
| NIST: NIST SP 800-53A (v1): AU-9.1 | |||
| CCI: | CCI-000164 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-22 |
| Definition: | Protect audit information from unauthorized deletion. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AU-9 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AU-9 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-9 a | |||
| NIST: NIST SP 800-53A (v1): AU-9.1 | |||
| CCI: | CCI-001493 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-29 |
| Definition: | Protect audit tools from unauthorized access. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AU-9 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AU-9 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-9 a | |||
| NIST: NIST SP 800-53A (v1): AU-9.1 | |||
| CCI: | CCI-001494 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-29 |
| Definition: | Protect audit tools from unauthorized modification. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AU-9 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AU-9 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-9 a | |||
| NIST: NIST SP 800-53A (v1): AU-9.1 | |||
| CCI: | CCI-001495 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-29 |
| Definition: | Protect audit tools from unauthorized deletion. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AU-9 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AU-9 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-9 a | |||
| NIST: NIST SP 800-53A (v1): AU-9.1 | |||
| CCI: | CCI-003831 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Alert organization-defined personnel or roles upon detection of unauthorized access, modification, or deletion of audit information. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AU-9 b | ||
| CCI: | CCI-003832 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Defines the personnel or roles to be alerted upon detection of unauthorized access, modification, or deletion of audit information. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AU-9 b | ||
| CCI: | CCI-000165 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-22 |
| Definition: | Write audit records to hardware-enforced, write-once media. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AU-9 (1) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AU-9 (1) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-9 (1) | |||
| NIST: NIST SP 800-53A (v1): AU-9 (1).1 | |||
| CCI: | CCI-001348 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | Store audit records on an organization-defined frequency in a repository that is part of a physically different system or system component than the system or component being audited. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AU-9 (2) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AU-9 (2) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-9 (2) | |||
| NIST: NIST SP 800-53A (v1): AU-9 (2).1 (iii) | |||
| CCI: | CCI-001349 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | Defines a frequency for storing audit records in a repository that is part of a physically different system or system component than the system or component being audited. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AU-9 (2) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AU-9 (2) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-9 (2) | |||
| NIST: NIST SP 800-53A (v1): AU-9 (2).1 (ii) | |||
| CCI: | CCI-001350 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | Implement cryptographic mechanisms to protect the integrity of audit information. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AU-9 (3) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AU-9 (3) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-9 (3) | |||
| NIST: NIST SP 800-53A (v1): AU-9 (3).1 | |||
| CCI: | CCI-001496 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-29 |
| Definition: | Implement cryptographic mechanisms to protect the integrity of audit tools. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AU-9 (3) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AU-9 (3) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-9 (3) | |||
| NIST: NIST SP 800-53A (v1): AU-9 (3).1 | |||
| CCI: | CCI-001351 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | Authorize access to management of audit logging functionality to only an organization-defined subset of privileged users or roles. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AU-9 (4) (a) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AU-9 (4) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-9 (4) | |||
| NIST: NIST SP 800-53A (v1): AU-9 (4).1 (i) | |||
| CCI: | CCI-001894 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-15 |
| Definition: | Defines the subset of privileged users who will be authorized access to the management of audit functionality. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AU-9 (4) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-9 (4) | |||
| CCI: | CCI-001895 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-15 |
| Definition: | Defines the audit information requiring dual authorization for movement or deletion actions. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AU-9 (5) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-9 (5) | |||
| CCI: | CCI-001896 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-15 |
| Definition: | Enforce dual authorization for movement and/or deletion of organization-defined audit information. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AU-9 (5) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-9 (5) | |||
| CCI: | CCI-001897 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-15 |
| Definition: | Defines the subset of privileged users or roles who will be authorized read-only access to audit information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AU-9 (6) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-9 (6) | |||
| CCI: | CCI-001898 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-15 |
| Definition: | Authorize read-only access to audit information to an organization-defined subset of privileged users or roles. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AU-9 (6) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-9 (6) | |||
| CCI: | CCI-003833 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Store audit information on a component running a different operating system than the system component being audited. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AU-9 (7) | ||
| CCI: | CCI-000166 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-22 |
| Definition: | Provide irrefutable evidence that an individual (or process acting on behalf of an individual) falsely denying having performed organization-defined actions to be covered by non-repudiation. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AU-10 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AU-10 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-10 | |||
| NIST: NIST SP 800-53A (v1): AU-10.1 | |||
| CCI: | CCI-001899 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-15 |
| Definition: | Defines the actions to be covered by non-repudiation. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AU-10 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-10 | |||
| CCI: | CCI-001900 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-15 |
| Definition: | Defines the strength of binding to be applied to the binding of the identity of the information producer with the information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AU-10 (1) (a) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-10 (1) (a) | |||
| CCI: | CCI-001901 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-15 |
| Definition: | Bind the identity of the information producer with the information to an organization-defined strength of binding. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AU-10 (1) (a) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-10 (1) (a) | |||
| CCI: | CCI-001902 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-15 |
| Definition: | Provide the means for authorized individuals to determine the identity of the producer of the information. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AU-10 (1) (b) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-10 (1) (b) | |||
| CCI: | CCI-001903 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-15 |
| Definition: | Defines the frequency on which the system is to validate the binding of the information producer identity to the information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AU-10 (2) (a) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-10 (2) (a) | |||
| CCI: | CCI-001904 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-15 |
| Definition: | Validate the binding of the information producer identity to the information at an organization-defined frequency. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AU-10 (2) (a) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-10 (2) (a) | |||
| CCI: | CCI-001905 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-15 |
| Definition: | Defines the actions to be performed in the event of an error when validating the binding of the information producer identity to the information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AU-10 (2) (b) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-10 (2) (b) | |||
| CCI: | CCI-001906 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-15 |
| Definition: | Perform organization-defined actions in the event of an error when validating the binding of the information producer identity to the information. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AU-10 (2) (b) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-10 (2) (b) | |||
| CCI: | CCI-001340 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | Maintain reviewer or releaser identity and credentials within the established chain of custody for all information reviewed or released. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AU-10 (3) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AU-10 (3) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-10 (3) | |||
| NIST: NIST SP 800-53A (v1): AU-10 (3).1 | |||
| CCI: | CCI-001341 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | Validate the binding of the information reviewer identity to the information at the transfer or release points prior to release or transfer between organization-defined security domains. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AU-10 (4) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AU-10 (4) (a) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-10 (4) (a) | |||
| NIST: NIST SP 800-53A (v1): AU-10 (4).1 | |||
| CCI: | CCI-001907 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-15 |
| Definition: | Defines the security domains which will require the system validate the binding of the information reviewer identity to the information at the transfer or release points prior to release/transfer. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AU-10 (4) (a) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-10 (4) (a) | |||
| CCI: | CCI-001908 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-15 |
| Definition: | Defines the action the system is to perform in the event of an information reviewer identity binding validation error. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AU-10 (4) (b) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-10 (4) (b) | |||
| CCI: | CCI-001909 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-15 |
| Definition: | Perform organization-defined actions in the event of an information reviewer identity binding validation error. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AU-10 (4) (b) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-10 (4) (b) | |||
| CCI: | CCI-000167 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-22 |
| Definition: | Retain audit records for an organization-defined time period to provide support for after-the-fact investigations of incidents and to meet regulatory and organizational information retention requirements. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AU-11 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AU-11 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-11 | |||
| NIST: NIST SP 800-53A (v1): AU-11.1 (iii) | |||
| CCI: | CCI-000168 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-15 |
| Definition: | Defines the time period for retention of audit records, which is consistent with its records retention policy, to provide support for after-the-fact investigations of incidents and meet regulatory and organizational information retention requirements. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AU-11 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AU-11 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-11 | |||
| NIST: NIST SP 800-53A (v1): AU-11.1 (i and ii) | |||
| CCI: | CCI-002044 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-05-29 |
| Definition: | Defines measures to be employed to ensure that long-term audit records generated by the system can be retrieved. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AU-11 (1) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-11 (1) | |||
| CCI: | CCI-002045 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-05-29 |
| Definition: | Employ organization-defined measures to ensure that long-term audit records generated by the information system can be retrieved. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AU-11 (1) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-11 (1) | |||
| CCI: | CCI-000169 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-22 |
| Definition: | Provide audit record generation capability for the event types the system is capable of auditing as defined in AU-2 a on organization-defined information system components. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AU-12 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AU-12 a | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-12 a | |||
| NIST: NIST SP 800-53A (v1): AU-12.1 (ii) | |||
| CCI: | CCI-001459 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-29 |
| Definition: | Defines system components that provide audit record generation capability. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AU-12 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AU-12 a | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-12 a | |||
| NIST: NIST SP 800-53A (v1): AU-12.1 (i) | |||
| CCI: | CCI-000171 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-15 |
| Definition: | Allow organization-defined personnel or roles to select the event types that are to be logged by specific components of the system. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AU-12 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AU-12 b | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-12 b | |||
| NIST: NIST SP 800-53A (v1): AU-12.1 (iii) | |||
| CCI: | CCI-001910 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-15 |
| Definition: | Defines the personnel or roles allowed to select which event types are to be logged by specific components of the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AU-12 b | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-12 b | |||
| CCI: | CCI-000172 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-15 |
| Definition: | Generate audit records for the event types defined in AU-2 c that include the audit record content defined in AU-3. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AU-12 c | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AU-12 c | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-12 c | |||
| NIST: NIST SP 800-53A (v1): AU-12.1 (iv) | |||
| CCI: | CCI-000173 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-15 |
| Definition: | Defines the level of tolerance for relationship between time stamps of individual records in the audit trail that will be used for correlation. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AU-12 (1) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AU-12 (1) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-12 (1) | |||
| NIST: NIST SP 800-53A (v1): AU-12 (1).1 (iv) | |||
| CCI: | CCI-000174 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-22 |
| Definition: | Compile audit records from organization-defined information system components into a system-wide (logical or physical) audit trail that is time-correlated to within an organization-defined level of tolerance for relationship between time stamps of individual records in the audit trail. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AU-12 (1) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AU-12 (1) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-12 (1) | |||
| NIST: NIST SP 800-53A (v1): AU-12 (1).1 (iii and v) | |||
| CCI: | CCI-001577 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-11 |
| Definition: | Defines the system components from which audit records are to be compiled into the system-wide audit trail. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AU-12 (1) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AU-12 (1) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-12 (1) | |||
| NIST: NIST SP 800-53A (v1): AU-12 (1).1 (ii) | |||
| CCI: | CCI-001353 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | Produce a system-wide (logical or physical) audit trail composed of audit records in a standardized format. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AU-12 (2) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AU-12 (2) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-12 (2) | |||
| NIST: NIST SP 800-53A (v1): AU-12 (2).1 | |||
| CCI: | CCI-001911 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-15 |
| Definition: | Defines the selectable event criteria to be used as the basis for changes to the auditing to be performed on organization-defined system components, by organization-defined individuals or roles, within organization-defined time thresholds. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AU-12 (3) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-12 (3) | |||
| CCI: | CCI-001912 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-15 |
| Definition: | Defines the time thresholds for organization-defined individuals or roles to change the auditing to be performed based on organization-defined selectable event criteria. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AU-12 (3) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-12 (3) | |||
| CCI: | CCI-001913 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-15 |
| Definition: | Defines the individuals or roles that are to be provided the capability to change the auditing to be performed based on organization-defined selectable event criteria, within organization-defined time thresholds. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AU-12 (3) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-12 (3) | |||
| CCI: | CCI-001914 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-15 |
| Definition: | Provide the capability for organization-defined individuals or roles to change the logging to be performed on organization-defined system components based on organization-defined selectable event criteria within organization-defined time thresholds. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AU-12 (3) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-12 (3) | |||
| CCI: | CCI-002047 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-05-29 |
| Definition: | Defines the system components on which the auditing that is to be performed can be changed by organization-defined individuals or roles. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AU-12 (3) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-12 (3) | |||
| CCI: | CCI-003834 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Implement the capability for organization-defined individuals or roles to change the auditing to be performed on organization-defined system components based on organization-defined selectable event criteria within organization-defined time thresholds. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AU-12 (3) | ||
| CCI: | CCI-003835 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Provide the capability for auditing the parameters of user query events for data sets containing personally identifiable information. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AU-12 (4) | ||
| CCI: | CCI-003836 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Implement the capability for auditing the parameters of user query events for data sets containing personally identifiable information. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AU-12 (4) | ||
| CCI: | CCI-001460 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-29 |
| Definition: | Monitor organization-defined open source information and/or information sites per organization-defined frequency for evidence of unauthorized disclosure of organizational information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AU-13 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AU-13 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-13 a | |||
| NIST: NIST SP 800-53A (v1): AU-13.1 (ii) | |||
| CCI: | CCI-001461 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-29 |
| Definition: | Defines a frequency for monitoring open source information and/or information sites for evidence of unauthorized exfiltration or disclosure of organizational information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AU-13 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AU-13 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-13 a | |||
| NIST: NIST SP 800-53A (v1): AU-13.1 (i) | |||
| CCI: | CCI-001915 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-15 |
| Definition: | Defines the open source information and/or information sites to be monitored for evidence of unauthorized exfiltration or disclosure of organizational information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AU-13 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-13 a | |||
| CCI: | CCI-003837 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | If an information disclosure is discovered, notify organization-defined personnel or roles. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AU-13 b 1 | ||
| CCI: | CCI-003838 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Defines the personnel or roles to be notified if an information disclosure is discovered. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AU-13 b 1 | ||
| CCI: | CCI-003839 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | If an information disclosure is discovered, take organization-defined additional actions. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AU-13 b 2 | ||
| CCI: | CCI-003840 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Defines the additional actions to be taken if an information disclosure is discovered. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AU-13 b 2 | ||
| CCI: | CCI-003841 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Monitor open-source information and information sites using organization-defined automated mechanisms. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AU-13 (1) | ||
| CCI: | CCI-003842 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Defines the automated mechanisms for monitoring open-source information. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AU-13 (1) | ||
| CCI: | CCI-001917 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-15 |
| Definition: | Defines the frequency for reviewing the open source information sites being monitored. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AU-13 (2) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-13 (2) | |||
| CCI: | CCI-001918 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-15 |
| Definition: | Review the open source information sites being monitored per organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AU-13 (2) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-13 (2) | |||
| CCI: | CCI-003843 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Employ discovery techniques, processes, and tools to determine if external entities are replicating organizational information in an unauthorized manner. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AU-13 (3) | ||
| CCI: | CCI-001919 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-15 |
| Definition: | Provide the capability for organization-defined users or roles to select a user session to record; view; hear; or log the content of a user session under organization-defined circumstances. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AU-14 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-14 a | |||
| CCI: | CCI-003844 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Implement the capability for organization-defined users or roles to select a user session to record; view; hear; and/or log the content of a user session under organization-defined circumstances. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AU-14 a | ||
| CCI: | CCI-003845 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Defines users or roles who will provide and implement the capability to record; view; hear; and/or log the content of a user session under organization-defined circumstances. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AU-14 a | ||
| CCI: | CCI-003846 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Defines the circumstances to record; view; hear; and/or log the content of a user session. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AU-14 a | ||
| CCI: | CCI-003847 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Develop, integrate, and use session auditing activities in consultation with legal counsel and in accordance with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AU-14 b | ||
| CCI: | CCI-001464 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-29 |
| Definition: | Initiates session audits automatically at system start-up. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AU-14 (1) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AU-14 (1) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-14 (1) | |||
| NIST: NIST SP 800-53A (v1): AU-14 (1).1 | |||
| CCI: | CCI-001920 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-15 |
| Definition: | Provide the capability for authorized users to remotely view and hear content related to an established user session in real time. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AU-14 (3) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-14 (3) | |||
| CCI: | CCI-003848 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Implement the capability for authorized users to remotely view and hear content related to an established user session in real time. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AU-14 (3) | ||
| CCI: | CCI-001923 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-15 |
| Definition: | Defines the audit information to be coordinated among external organizations when audit information is transmitted across organizational boundaries. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AU-16 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-16 | |||
| CCI: | CCI-001924 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-15 |
| Definition: | Defines the methods to be employed when coordinating audit information among external organizations when audit information is transmitted across organizational boundaries. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AU-16 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-16 | |||
| CCI: | CCI-001925 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-15 |
| Definition: | Employ organization-defined methods for coordinating organization-defined audit information among external organizations when audit information is transmitted across organizational boundaries. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AU-16 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-16 | |||
| CCI: | CCI-001926 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-15 |
| Definition: | Preserve the identity of individuals in cross-organizational audit trails. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AU-16 (1) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-16 (1) | |||
| CCI: | CCI-001927 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-15 |
| Definition: | Defines the organizations that will be provided cross-organizational audit information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AU-16 (2) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-16 (2) | |||
| CCI: | CCI-001928 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-15 |
| Definition: | Defines the cross-organizational sharing agreements to be established with organization-defined organizations authorized to be provided cross-organizational sharing of audit information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AU-16 (2) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-16 (2) | |||
| CCI: | CCI-001929 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-15 |
| Definition: | Provide cross-organizational audit information to organization-defined organizations based on organization-defined cross organizational sharing agreements. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AU-16 (2) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): AU-16 (2) | |||
| CCI: | CCI-005149 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2023-07-17 |
| Definition: | Implement organization-defined measures to disassociate individuals from audit information transmitted across organizational boundaries. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): AU-16 (3) | ||
| CCI: | CCI-000239 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-15 |
| Definition: | Develop and document an organization-level; mission/business process; system-level assessment, authorization, and monitoring policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CA-1 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CA-1 a 1 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CA-1 a 1 (a) | |||
| NIST: NIST SP 800-53A (v1): CA-1.1 (i and ii) | |||
| CCI: | CCI-000240 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-15 |
| Definition: | Disseminates to organization-defined personnel or roles an organization-level; mission/business process; system-level assessment, authorization, and monitoring policy. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CA-1 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CA-1 a 1 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CA-1 a 1 (a) | |||
| NIST: NIST SP 800-53A (v1): CA-1.1 (iii) | |||
| CCI: | CCI-000242 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-15 |
| Definition: | Develop and document procedures to facilitate the implementation of the assessment, authorization, and monitoring policy and associated assessment, authorization, and monitoring controls. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CA-1 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CA-1 a 2 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CA-1 a 2 | |||
| NIST: NIST SP 800-53A (v1): CA-1.1 (iv and v) | |||
| CCI: | CCI-000243 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-15 |
| Definition: | Disseminate to organization-defined personnel or roles procedures to facilitate the implementation of the assessment, authorization, and monitoring policy and associated assessment, authorization, and monitoring controls. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CA-1 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CA-1 a 2 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CA-1 a 2 | |||
| NIST: NIST SP 800-53A (v1): CA-1.1 (vi) | |||
| CCI: | CCI-002061 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-21 |
| Definition: | Defines the personnel or roles to whom the organization-level; mission/business process; system-level assessment, authorization, and monitoring policy is to be disseminated. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CA-1 a 1 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CA-1 a 1 (a) | |||
| CCI: | CCI-002062 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-21 |
| Definition: | Defines the personnel or roles to whom the assessment, authorization, monitoring procedures are to be disseminated. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CA-1 a 2 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CA-1 a 2 | |||
| CCI: | CCI-003849 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Disseminate an organization-level; mission/business process; system-level assessment, authorization, and monitoring policy that is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CA-1 a 1 (b) | ||
| CCI: | CCI-003850 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Defines the personnel or roles to whom the assessment, authorization, and monitoring policy is to be disseminated. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CA-1 a 2 | ||
| CCI: | CCI-003851 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Designate an organization-defined official to manage the development and documentation of the assessment, authorization, and monitoring policy. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CA-1 b | ||
| CCI: | CCI-003852 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Designate an organization-defined official to manage the development and documentation of the assessment, authorization, and monitoring procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CA-1 b | ||
| CCI: | CCI-003853 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Designate an organization-defined official to manage the dissemination of the assessment, authorization, and monitoring policy. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CA-1 b | ||
| CCI: | CCI-003854 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Designate an organization-defined official to manage the dissemination of the assessment, authorization, and monitoring procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CA-1 b | ||
| CCI: | CCI-000238 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-15 |
| Definition: | Defines the frequency to review and update the current assessment, authorization, and monitoring policy. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CA-1 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CA-1 b 1 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CA-1 c 1 | |||
| NIST: NIST SP 800-53A (v1): CA-1.2 (i) | |||
| CCI: | CCI-000241 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-15 |
| Definition: | Review and update the current assessment, authorization, and monitoring policy on an organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CA-1 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CA-1 b 1 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CA-1 c 1 | |||
| NIST: NIST SP 800-53A (v1): CA-1.2 (ii) | |||
| CCI: | CCI-000244 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-15 |
| Definition: | Review and update the current assessment, authorization, and monitoring procedures on an organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CA-1 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CA-1 b 2 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CA-1 c 2 | |||
| NIST: NIST SP 800-53A (v1): CA-1.2 (iv) | |||
| CCI: | CCI-001578 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-11 |
| Definition: | Defines the frequency to review and update the current assessment, authorization, and monitoring procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CA-1 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CA-1 b 2 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CA-1 c 2 | |||
| NIST: NIST SP 800-53A (v1): CA-1.2 (iii) | |||
| CCI: | CCI-003855 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Review and update the current assessment, authorization, and monitoring policy following organization-defined events. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CA-1 c 1 | ||
| CCI: | CCI-003856 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Defines the events following reviewing and updating the current assessment, authorization, and monitoring policy. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CA-1 c 1 | ||
| CCI: | CCI-003857 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Review and update the current assessment and authorization procedures following organization-defined events. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CA-1 c 2 | ||
| CCI: | CCI-003858 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Defines the events following reviewing and updating the current assessment, authorization, and monitoring procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CA-1 c 2 | ||
| CCI: | CCI-003859 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Select the appropriate assessor or assessment team for the type of assessment to be conducted. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CA-2 a | ||
| CCI: | CCI-000246 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-15 |
| Definition: | Develop a control assessment plan that describes the scope of the assessment including controls and control enhancements under assessment. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CA-2 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CA-2 a 1 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CA-2 b 1 | |||
| NIST: NIST SP 800-53A (v1): CA-2.1 (ii) | |||
| CCI: | CCI-000247 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-15 |
| Definition: | Develop a control assessment plan that describes the scope of the assessment including assessment procedures to be used to determine control effectiveness. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CA-2 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CA-2 a 2 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CA-2 b 2 | |||
| NIST: NIST SP 800-53A (v1): CA-2.1 (ii) | |||
| CCI: | CCI-000248 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-15 |
| Definition: | Develop a control assessment plan that describes the scope of the assessment including assessment environment. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CA-2 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CA-2 a 3 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CA-2 b 3 | |||
| NIST: NIST SP 800-53A (v1): CA-2.1 (ii) | |||
| CCI: | CCI-002070 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-21 |
| Definition: | Develop a control assessment plan that describes the scope of the assessment including assessment team, and assessment roles and responsibilities. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CA-2 a 3 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CA-2 b 3 | |||
| CCI: | CCI-003860 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Ensure the control assessment plan is reviewed and approved by the authorizing official or designated representative prior to conducting the assessment. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CA-2 c | ||
| CCI: | CCI-000251 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-15 |
| Definition: | Assess the controls in the systems and its environment of operation on an organization-defined frequency, to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting the security requirements. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CA-2 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CA-2 b | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CA-2 d | |||
| NIST: NIST SP 800-53A (v1): CA-2.2 (ii) | |||
| CCI: | CCI-000252 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-15 |
| Definition: | Defines the frequency on which the security controls in the system and its environment of operation are assessed. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CA-2 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CA-2 b | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CA-2 d | |||
| NIST: NIST SP 800-53A (v1): CA-2.2 (i) | |||
| CCI: | CCI-003861 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Assess the controls in the systems and its environment of operation on an organization-defined frequency, to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting the privacy requirements. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CA-2 d | ||
| CCI: | CCI-000253 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-15 |
| Definition: | Produce a control assessment report that document the results of the assessment. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CA-2 c | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CA-2 c | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CA-2 e | |||
| NIST: NIST SP 800-53A (v1): CA-2.2 (iii) | |||
| CCI: | CCI-000254 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-15 |
| Definition: | Provide the results of the control assessment to organization-defined individuals or roles. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CA-2 d | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CA-2 d | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CA-2 f | |||
| NIST: NIST SP 800-53A (v1): CA-2.2 (iv) | |||
| CCI: | CCI-002071 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-21 |
| Definition: | Defines the individuals or roles to whom the results of the control assessment are to be provided. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CA-2 d | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CA-2 f | |||
| CCI: | CCI-000255 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-15 |
| Definition: | Employ independent assessors or assessment teams to conduct control assessments. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CA-2 (1) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CA-2 (1) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CA-2 (1) | |||
| NIST: NIST SP 800-53A (v1): CA-2 (1).1 | |||
| CCI: | CCI-000256 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-15 |
| Definition: | Include as part of the control assessments, announced or unannounced, on an organization-defined frequency, in-depth monitoring; security instrumentation; automated security test cases; vulnerability scanning; malicious user testing; insider threat assessment; performance and load testing; data leakage or data loss assessment; and/or organization-defined other forms of assessment. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CA-2 (2) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CA-2 (2) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CA-2 (2) | |||
| NIST: NIST SP 800-53A (v1): CA-2 (2).1 (i) | |||
| CCI: | CCI-001582 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-11 |
| Definition: | Defines other forms of control assessments other than in-depth monitoring; security instrumentation; automated security test cases; vulnerability scanning; malicious user testing; insider threat assessment; performance and load testing; data leakage or data loss assessment that should be included as part of the control assessments. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CA-7 (2) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CA-2 (2) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CA-2 (2) | |||
| NIST: NIST SP 800-53A (v1): CA-7 (2).1 (i) | |||
| CCI: | CCI-002065 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-21 |
| Definition: | Defines the frequency at which to conduct control assessments. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CA-2 (2) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CA-2 (2) | |||
| CCI: | CCI-002066 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-21 |
| Definition: | Leverage the results of control assessments of the organization-defined system performed by an organization-defined external organization when the assessment meets organization-defined requirements. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CA-2 (3) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CA-2 (3) | |||
| CCI: | CCI-002067 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-21 |
| Definition: | Defines the system for which the results of control assessments will be leveraged. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CA-2 (3) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CA-2 (3) | |||
| CCI: | CCI-002068 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-21 |
| Definition: | Defines the external organizations from which control assessment results for organization-defined systems will be accepted. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CA-2 (3) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CA-2 (3) | |||
| CCI: | CCI-002069 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-21 |
| Definition: | Defines the requirements the control assessments for organization-defined systems from organization-defined external organizations must meet. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CA-2 (3) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CA-2 (3) | |||
| CCI: | CCI-003862 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Approve and manage the exchange of information between the system and other systems using interconnection security agreements; information exchange security agreements; memoranda of understanding or agreement; service level agreements; user agreement; and/or nondisclosure agreements with an organization-defined type of agreement. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CA-3 a | ||
| CCI: | CCI-000258 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-15 |
| Definition: | Document, as part of each exchange agreement, the interface characteristics. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CA-3 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CA-3 b | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CA-3 b | |||
| NIST: NIST SP 800-53A (v1): CA-3.1 (iii) | |||
| CCI: | CCI-000259 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-15 |
| Definition: | Document, as part of each exchange agreement, the security requirements, controls and responsibilities for each system, and the impact level of the information communicated. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CA-3 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CA-3 b | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CA-3 b | |||
| NIST: NIST SP 800-53A (v1): CA-3.1 (iii) | |||
| CCI: | CCI-003863 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Document, as part of each exchange agreement, the privacy requirements, controls and responsibilities for each system, and the impact level of the information communicated. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CA-3 b | ||
| CCI: | CCI-002083 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-21 |
| Definition: | Review and update the agreements on an organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CA-3 c | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CA-3 c | |||
| CCI: | CCI-002084 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-21 |
| Definition: | Defines the frequency at which reviews and updates to the agreements must be conducted. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CA-3 c | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CA-3 c | |||
| CCI: | CCI-003864 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Verify that individuals or systems transferring data between interconnecting systems have the requisite authorizations (i.e., write permissions or privileges) prior to accepting such data. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CA-3 (6) | ||
| CCI: | CCI-003865 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Identify transitive (downstream) information exchanges with other systems through the systems identified in CA-3a. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CA-3 (7) (a) | ||
| CCI: | CCI-003866 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Take measures to ensure that transitive (downstream) information exchanges cease when the controls on identified transitive (downstream) systems cannot be verified or validated. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CA-3 (7) (b) | ||
| CCI: | CCI-000264 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-15 |
| Definition: | Develop a plan of action and milestones for the system to document the planned remediation actions of the organization to correct weaknesses or deficiencies noted during the assessment of the controls and to reduce or eliminate known vulnerabilities in the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CA-5 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CA-5 a | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CA-5 a | |||
| NIST: NIST SP 800-53A (v1): CA-5-1 (i) and (ii) | |||
| CCI: | CCI-000265 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-15 |
| Definition: | Defines the frequency with which to update the existing plan of action and milestones for the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CA-5 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CA-5 b | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CA-5 b | |||
| NIST: NIST SP 800-53A (v1): CA-5-1 (iii) | |||
| CCI: | CCI-000266 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-15 |
| Definition: | Update, on an organization-defined frequency, the existing plan of action and milestones based on the findings from control assessments, independent audits or reviews, and continuous monitoring activities. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CA-5 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CA-5 b | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CA-5 b | |||
| NIST: NIST SP 800-53A (v1): CA-5-1 (iv) | |||
| CCI: | CCI-000267 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-15 |
| Definition: | Ensure the accuracy of the plan of action and milestones for the system using organization-defined automated mechanisms. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CA-5 (1) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CA-5 (1) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CA-5 (1) | |||
| NIST: NIST SP 800-53A (v1): CA-5 (1).1 | |||
| CCI: | CCI-000268 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-15 |
| Definition: | Ensure the currency of the plan of action and milestones for the system using organization-defined automated mechanisms. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CA-5 (1) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CA-5 (1) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CA-5 (1) | |||
| NIST: NIST SP 800-53A (v1): CA-5 (1).1 | |||
| CCI: | CCI-000269 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-15 |
| Definition: | Ensure the availability of the plan of action and milestones for the system using organization-defined automated mechanisms. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CA-5 (1) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CA-5 (1) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CA-5 (1) | |||
| NIST: NIST SP 800-53A (v1): CA-5 (1).1 | |||
| CCI: | CCI-003867 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Defines the automated mechanisms to ensure the accuracy, currency, and availability of the plan of actions and milestones. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CA-5 (1) | ||
| CCI: | CCI-000270 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-15 |
| Definition: | Assign a senior official as the authorizing official for the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CA-6 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CA-6 a | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CA-6 a | |||
| NIST: NIST SP 800-53A (v1): CA-6.1 (i) | |||
| CCI: | CCI-003868 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Assign a senior official as the authorizing official for common controls available for inheritance by organizational systems. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CA-6 b | ||
| CCI: | CCI-000271 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-15 |
| Definition: | Ensure the authorizing official for the system authorizes the system to operate before commencing operations. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CA-6 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CA-6 b | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CA-6 c 2 | |||
| NIST: NIST SP 800-53A (v1): CA-6.1 (ii) | |||
| CCI: | CCI-003869 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Ensure the authorizing official accepts the use of common controls inherited by the system, before commencing operations. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CA-6 c 1 | ||
| CCI: | CCI-003870 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Ensure that the authorizing official for common controls authorizes the use of those controls for inheritance by organizational systems. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CA-6 d | ||
| CCI: | CCI-000272 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-15 |
| Definition: | Update the authorization on an organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CA-6 c | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CA-6 c | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CA-6 e | |||
| NIST: NIST SP 800-53A (v1): CA-6.1 (iv) | |||
| CCI: | CCI-000273 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-15 |
| Definition: | Defines the frequency with which to update the authorizations. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CA-6 c | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CA-6 c | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CA-6 e | |||
| NIST: NIST SP 800-53A (v1): CA-6.1 (iii) | |||
| CCI: | CCI-003871 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Employ a joint authorization process for the system that includes multiple authorizing officials from the same organization conducting the authorization. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CA-6 (1) | ||
| CCI: | CCI-003872 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Employ a joint authorization process for the system that includes multiple authorizing officials with at least one authorizing official from an organization external to the organization conducting the authorization. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CA-6 (2) | ||
| CCI: | CCI-000274 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-15 |
| Definition: | Develop a continuous monitoring strategy. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CA-7 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CA-7 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CA-7 | |||
| NIST: NIST SP 800-53A (v1): CA-7.1 (i) | |||
| CCI: | CCI-003873 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Implement continuous monitoring in accordance with the organization-level continuous monitoring strategy. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CA-7 | ||
| CCI: | CCI-002087 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-21 |
| Definition: | Establish organization-defined system-level metrics to be monitored. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CA-7 a | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CA-7 a | |||
| CCI: | CCI-003874 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Defines the system-level metrics to be monitored. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CA-7 a | ||
| CCI: | CCI-002088 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-21 |
| Definition: | Establish organization-defined frequencies for monitoring. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CA-7 b | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CA-7 b | |||
| CCI: | CCI-003875 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Establish organization-defined frequencies for assessment of control effectiveness. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CA-7 b | ||
| CCI: | CCI-003876 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Defines the frequencies for monitoring of control effectiveness. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CA-7 b | ||
| CCI: | CCI-003877 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Defines the frequencies for assessment of control effectiveness. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CA-7 b | ||
| CCI: | CCI-000279 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-15 |
| Definition: | Implement ongoing control assessments in accordance with the continuous monitoring strategy. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CA-7 c | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CA-7 c | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CA-7 c | |||
| NIST: NIST SP 800-53A (v1): CA-7.1 (iv) | |||
| CCI: | CCI-003878 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Develop ongoing control assessments in accordance with the continuous monitoring strategy. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CA-7 c | ||
| CCI: | CCI-002090 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-21 |
| Definition: | Implement ongoing monitoring of system and organization-defined metrics in accordance with the continuous monitoring strategy. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CA-7 d | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CA-7 d | |||
| CCI: | CCI-002091 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-21 |
| Definition: | Implement a continuous monitoring program that includes correlation and analysis of information generated by assessments and monitoring. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CA-7 e | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CA-7 e | |||
| CCI: | CCI-002092 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-21 |
| Definition: | Implement a continuous monitoring program that includes response actions to address results of the analysis of control assessment and monitoring information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CA-7 f | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CA-7 f | |||
| CCI: | CCI-000280 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-15 |
| Definition: | Implement a continuous monitoring program that includes reporting the security status to organization-defined personnel or roles on an organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CA-7 d | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CA-7 g | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CA-7 g | |||
| NIST: NIST SP 800-53A (v1): CA-7.1 (iv) | |||
| CCI: | CCI-000281 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-15 |
| Definition: | Defines the frequency with which to report the security status to organization-defined personnel or roles. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CA-7 d | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CA-7 g | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CA-7 g | |||
| NIST: NIST SP 800-53A (v1): CA-7.1 (ii) | |||
| CCI: | CCI-003879 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Implement a continuous monitoring program that includes reporting the privacy status to organization-defined personnel or roles on an organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CA-7 g | ||
| CCI: | CCI-003880 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Defines the frequency with which to report the privacy status to organization-defined personnel or roles. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CA-7 g | ||
| CCI: | CCI-000282 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-15 |
| Definition: | Employ independent assessors or assessment teams to monitor the controls in the system on an ongoing basis. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CA-7 (1) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CA-7 (1) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CA-7 (1) | |||
| NIST: NIST SP 800-53A (v1): CA-7 (1).1 | |||
| CCI: | CCI-002086 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-21 |
| Definition: | Employ trend analyses to determine if control implementations, the frequency of continuous monitoring activities, and the types of activities used in the continuous monitoring process need to be modified based on empirical data. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CA-7 (3) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CA-7 (3) | |||
| CCI: | CCI-003881 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Ensure risk monitoring is an integral part of the continuous monitoring strategy that includes effectiveness monitoring. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CA-7 (4) (a) | ||
| CCI: | CCI-003882 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Ensure risk monitoring is an integral part of the continuous monitoring strategy that includes compliance monitoring. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CA-7 (4) (b) | ||
| CCI: | CCI-003883 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Ensure risk monitoring is an integral part of the continuous monitoring strategy that includes change monitoring. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CA-7 (4) (c) | ||
| CCI: | CCI-003884 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Employ organization-defined actions to validate that policies are established. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CA-7 (5) | ||
| CCI: | CCI-003885 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Employ organization-defined actions to validate that implemented controls are operating in a consistent manner. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CA-7 (5) | ||
| CCI: | CCI-003886 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Defines the actions used to validate policies. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CA-7 (5) | ||
| CCI: | CCI-003887 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Ensure the accuracy, currency, and availability of monitoring results for the system using organization-defined automated mechanisms. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CA-7 (6) | ||
| CCI: | CCI-003888 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Defines the automated mechanisms for ensuring accuracy, currency, and availability of monitoring results. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CA-7 (6) | ||
| CCI: | CCI-002093 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-21 |
| Definition: | Conduct penetration testing in accordance with organization-defined frequency on organization-defined systems or system components. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CA-8 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CA-8 | |||
| CCI: | CCI-002094 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-21 |
| Definition: | Defines the frequency for conducting penetration testing on organization-defined systems or system components. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CA-8 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CA-8 | |||
| CCI: | CCI-002095 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-21 |
| Definition: | Defines the systems or system components on which penetration testing will be conducted. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CA-8 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CA-8 | |||
| CCI: | CCI-002096 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-21 |
| Definition: | Employ an independent penetration agent or penetration team to perform penetration testing on the system or system components. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CA-8 (1) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CA-8 (1) | |||
| CCI: | CCI-002097 | Status: | draft |
| Contributor: | DISA FSP | Published Date: | 2013-06-21 |
| Definition: | Defines red team exercises to simulate attempts by adversaries to compromise organizational systems. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CA-8 (2) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CA-8 (2) | |||
| CCI: | CCI-002099 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-21 |
| Definition: | Employ organization-defined red team exercises to simulate attempts by adversaries to compromise organizational systems in accordance with applicable rules of engagement. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CA-8 (2) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CA-8 (2) | |||
| CCI: | CCI-003889 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Employ a penetration testing process, on an organization-defined frequency, that includes announced or unannounced attempts to bypass or circumvent controls associated with physical access points to the facility. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CA-8 (3) | ||
| CCI: | CCI-003890 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Defines the frequency the penetration testing process will be employed. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CA-8 (3) | ||
| CCI: | CCI-002101 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-21 |
| Definition: | Authorizes internal connections of organization-defined system components or classes of components to the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CA-9 (a) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CA-9 (a) | |||
| CCI: | CCI-002102 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-21 |
| Definition: | Defines the system components or classes of components that are authorized internal connections to the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CA-9 (a) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CA-9 (a) | |||
| CCI: | CCI-002103 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-21 |
| Definition: | Document, for each internal connection, the interface characteristics. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CA-9 (b) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CA-9 (b) | |||
| CCI: | CCI-002104 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-21 |
| Definition: | Document, for each internal connection, the security requirements. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CA-9 (b) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CA-9 (b) | |||
| CCI: | CCI-002105 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-21 |
| Definition: | Document, for each internal connection, the nature of the information communicated. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CA-9 (b) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CA-9 (b) | |||
| CCI: | CCI-003891 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Document, for each internal connection, the privacy requirements. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CA-9 (b) | ||
| CCI: | CCI-003892 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Terminate internal system connections after organization-defined conditions. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CA-9 (c) | ||
| CCI: | CCI-003893 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Defines the conditions for terminating internal system connections. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CA-9 (c) | ||
| CCI: | CCI-003894 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Review on an organization-defined frequency the continued need for each internal connection. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CA-9 (d) | ||
| CCI: | CCI-003895 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Defines the frequency for reviewing each internal connection. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CA-9 (d) | ||
| CCI: | CCI-002100 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-21 |
| Definition: | Perform security compliance checks on constituent components prior to the establishment of the internal connection. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CA-9 (1) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CA-9 (1) | |||
| CCI: | CCI-003896 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Perform privacy compliance checks on constituent components prior to the establishment of the internal connection. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CA-9 (1) | ||
| CCI: | CCI-000287 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-17 |
| Definition: | Develop and document an organization-level; mission/business process-level; and/or system-level configuration management policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-1 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CM-1 a 1 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-1 a 1 (a) | |||
| NIST: NIST SP 800-53A (v1): CM-1.1 (i) (ii) | |||
| CCI: | CCI-000290 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-17 |
| Definition: | Develop and document procedures to facilitate the implementation of the organization-level; mission/business process-level; and/or system-level configuration management policy and the associated configuration management controls. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-1 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CM-1 a 2 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-1 a 2 | |||
| NIST: NIST SP 800-53A (v1): CM-1.1 (iv) (v) | |||
| CCI: | CCI-000292 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-17 |
| Definition: | Review and update, on an organization-defined frequency, the procedures to facilitate the implementation of the organization-level; mission/business process-level; and/or system-level configuration management policy and associated configuration management controls. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-1 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CM-1 b 2 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-1 a 2 | |||
| NIST: NIST SP 800-53A (v1): CM-1.2 (iv) | |||
| CCI: | CCI-001821 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-01 |
| Definition: | Defines the organizational personnel or roles to whom the organization-level; mission/business process-level; and/or system-level configuration management policy is to be disseminated. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CM-1 a 1 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-1 a 1 (a) | |||
| CCI: | CCI-001822 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-01 |
| Definition: | Disseminate the organization-level; mission/business process-level; and/or system-level configuration management policy to organization-defined personnel or roles. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CM-1 a 1 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-1 a 1 (a) | |||
| CCI: | CCI-001824 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-01 |
| Definition: | Defines the organizational personnel or roles to whom the organization-level; mission/business process-level; and/or system-level configuration management procedures are to be disseminated. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CM-1 a 2 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-1 a 2 | |||
| CCI: | CCI-001825 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-01 |
| Definition: | Disseminate to organization-defined personnel or roles the procedures to facilitate the implementation of the organization-level; mission/business process-level; and/or system-level configuration management policy and associated configuration management controls. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CM-1 a 2 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-1 a 2 | |||
| CCI: | CCI-003897 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Develop and document an organization-level; mission/business process-level; and/or system-level configuration management policy that is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CM-1 a 1 (b) | ||
| CCI: | CCI-003898 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Defines the official to manage the development, documentation, and dissemination of the configuration management policy. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CM-1 b | ||
| CCI: | CCI-003899 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Designate an organization-defined official to manage the development and documentation of the configuration management policy. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CM-1 b | ||
| CCI: | CCI-003900 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Designate an organization-defined official to manage the dissemination of the configuration management policy. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CM-1 b | ||
| CCI: | CCI-003901 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Defines the official to manage the development, documentation, and dissemination of the configuration management procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CM-1 b | ||
| CCI: | CCI-003902 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Designate an organization-defined official to manage the development and documentation of the configuration management procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CM-1 b | ||
| CCI: | CCI-003903 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Designate an organization-defined official to manage the dissemination of the configuration management procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CM-1 b | ||
| CCI: | CCI-000286 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-17 |
| Definition: | Defines the frequency with which to review and update the configuration management policies. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-1 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CM-1 b 1 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-1 c 1 | |||
| NIST: NIST SP 800-53A (v1): CM-1.2 (i) | |||
| CCI: | CCI-000289 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-17 |
| Definition: | Review and update, on an organization-defined frequency, the configuration management policy. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-1 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CM-1 b 1 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-1 c 1 | |||
| NIST: NIST SP 800-53A (v1): CM-1.2 (ii) | |||
| CCI: | CCI-001584 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-11 |
| Definition: | Defines the frequency with which to review and update configuration management procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-1 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CM-1 b 2 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-1 c 2 | |||
| NIST: NIST SP 800-53A (v1): CM-1.2 (iii) | |||
| CCI: | CCI-003904 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Review and update the configuration management policy following organization-defined events. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CM-1 c 1 | ||
| CCI: | CCI-003905 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Defines the events for when the policy will be reviewed and updated. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CM-1 c 1 | ||
| CCI: | CCI-003906 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Review and update, on an organization-defined frequency, the current configuration management procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CM-1 c 2 | ||
| CCI: | CCI-003907 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Review and update the configuration management procedures following organization-defined events. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CM-1 c 2 | ||
| CCI: | CCI-003908 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Defines the events for when the procedures will be reviewed and updated. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CM-1 c 2 | ||
| CCI: | CCI-000295 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-17 |
| Definition: | Maintain, under configuration control, a current baseline configuration of the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-2 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CM-2 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-2 a | |||
| NIST: NIST SP 800-53A (v1): CM-2.1 (ii) | |||
| CCI: | CCI-003909 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Develop and document, under configuration control, a current baseline configuration of the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CM-2 a | ||
| CCI: | CCI-000296 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-17 |
| Definition: | Review and update the baseline configuration of the system on an organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-2 (1) (a) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CM-2 (1) (a) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-2 b 1 | |||
| NIST: NIST SP 800-53A (v1): CM-2 (1).1 (ii) | |||
| CCI: | CCI-000297 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-17 |
| Definition: | Review and update the baseline configuration of the system when required due to organization-defined circumstances. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-2 (1) (b) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CM-2 (1) (b) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-2 b 2 | |||
| NIST: NIST SP 800-53A (v1): CM-2 (1).1 (ii) | |||
| CCI: | CCI-001497 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-29 |
| Definition: | Defines a frequency for the review and update to the baseline configuration of the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-2 (1) (a) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CM-2 (1) (a) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-2 b 1 | |||
| NIST: NIST SP 800-53A (v1): CM-2 (1).1 (i) | |||
| CCI: | CCI-001585 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-12 |
| Definition: | Defines the circumstances that require reviews and updates to the baseline configuration of the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-2 (1) (b) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CM-2 (1) (b) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-2 b 2 | |||
| NIST: NIST SP 800-53A (v1): CM-2 (1).1 (i) | |||
| CCI: | CCI-003910 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Review and update the baseline configuration of the system when system components are installed or upgraded. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CM-2 b 3 | ||
| CCI: | CCI-000300 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-17 |
| Definition: | Maintain complete configuration of the system using organization-defined automated mechanisms. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-2 (2) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CM-2 (2) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-2 (2) | |||
| NIST: NIST SP 800-53A (v1): CM-2 (2).1 | |||
| CCI: | CCI-000301 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-17 |
| Definition: | Maintain current configuration of the system using organization-defined automated mechanisms. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-2 (2) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CM-2 (2) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-2 (2) | |||
| NIST: NIST SP 800-53A (v1): CM-2 (2).1 | |||
| CCI: | CCI-000302 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-17 |
| Definition: | Maintain accurate configuration of the system using organization-defined automated mechanisms. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-2 (2) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CM-2 (2) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-2 (2) | |||
| NIST: NIST SP 800-53A (v1): CM-2 (2).1 | |||
| CCI: | CCI-000303 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-17 |
| Definition: | Maintain available configuration of the system using organization-defined automated mechanisms. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-2 (2) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CM-2 (2) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-2 (2) | |||
| NIST: NIST SP 800-53A (v1): CM-2 (2).1 | |||
| CCI: | CCI-003911 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Defines the automated mechanisms for maintaining the currency, completeness, accuracy, and availability of the baseline configuration of the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CM-2 (2) | ||
| CCI: | CCI-000304 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-17 |
| Definition: | Retain organization-defined number of previous versions of baseline configurations of the system to support rollback. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-2 (3) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CM-2 (3) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-2 (3) | |||
| NIST: NIST SP 800-53A (v1): CM-2 (3).1 | |||
| CCI: | CCI-001736 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-02-28 |
| Definition: | Defines the number of previous versions of the baseline configuration of the system required to support rollback. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CM-2 (3) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-2 (3) | |||
| CCI: | CCI-000311 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-17 |
| Definition: | Maintain a baseline configuration for system development environments that is managed separately from the operational baseline configuration. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-2 (6) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CM-2 (6) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-2 (6) | |||
| NIST: NIST SP 800-53A (v1): CM-2 (6).1 | |||
| CCI: | CCI-000312 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-17 |
| Definition: | Maintain a baseline configuration for system test environments that is managed separately from the operational baseline configuration. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-2 (6) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CM-2 (6) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-2 (6) | |||
| NIST: NIST SP 800-53A (v1): CM-2 (6).1 | |||
| CCI: | CCI-001737 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-02-28 |
| Definition: | Defines the systems or system components that are to have organization-defined configurations applied when located in areas of significant risk. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CM-2 (7) (a) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-2 (7) (a) | |||
| CCI: | CCI-001738 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-02-28 |
| Definition: | Defines the configurations to be implemented on systems and system components when they are located in areas of significant risk. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CM-2 (7) (a) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-2 (7) (a) | |||
| CCI: | CCI-001739 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-02-28 |
| Definition: | Issue organization-defined systems or system components with organization-defined configurations to individuals traveling to locations the organization deems to be of significant risk. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CM-2 (7) (a) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-2 (7) (a) | |||
| CCI: | CCI-001815 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-01 |
| Definition: | Defines the controls to be applied to devices when individuals return from areas of significant risk. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CM-2 (7) (b) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-2 (7) (b) | |||
| CCI: | CCI-001816 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-01 |
| Definition: | Apply organization-defined controls to the systems or components when the individuals return from travel. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CM-2 (7) (b) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-2 (7) (b) | |||
| CCI: | CCI-000313 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-17 |
| Definition: | Determine and document the types of changes to the system that are configuration-controlled. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-3 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CM-3 a | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-3 a | |||
| NIST: NIST SP 800-53A (v1): CM-3.1 (i) | |||
| CCI: | CCI-000314 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-17 |
| Definition: | Approve or disapprove configuration-controlled changes to the system, with explicit consideration for security impact analyses. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-3 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CM-3 b | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-3 b | |||
| NIST: NIST SP 800-53A (v1): CM-3.1 (ii) | |||
| CCI: | CCI-001740 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-02-28 |
| Definition: | Review proposed configuration-controlled changes to the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CM-3 b | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-3 b | |||
| CCI: | CCI-003912 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Approve or disapprove configuration-controlled changes to the system, with explicit consideration for privacy impact analyses. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CM-3 b | ||
| CCI: | CCI-001741 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-02-28 |
| Definition: | Document configuration change decisions associated with the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CM-3 c | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-3 c | |||
| CCI: | CCI-001819 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-01 |
| Definition: | Implement approved configuration-controlled changes to the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CM-3 d | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-3 d | |||
| CCI: | CCI-002056 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-11 |
| Definition: | Defines the time period the records of configuration-controlled changes are to be retained. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CM-3 e | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-3 d | |||
| CCI: | CCI-000316 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-17 |
| Definition: | Retain records of configuration-controlled changes to the system for an organization-defined time period. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-3 d | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CM-3 e | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-3 e | |||
| NIST: NIST SP 800-53A (v1): CM-3.1 (iv) | |||
| CCI: | CCI-000318 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-17 |
| Definition: | Monitor and review activities associated with configuration-controlled changes to the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-3 e | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CM-3 f | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-3 f | |||
| NIST: NIST SP 800-53A (v1): CM-3.1 (v) | |||
| CCI: | CCI-000319 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-17 |
| Definition: | Coordinate and provides oversight for configuration change control activities through an organization-defined configuration change control element that convenes at the organization-defined frequency, and/or for any organization-defined configuration change conditions. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-3 f | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CM-3 g | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-3 g | |||
| NIST: NIST SP 800-53A (v1): CM-3.1 (vii) | |||
| CCI: | CCI-000320 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-17 |
| Definition: | Defines the frequency with which to convene the configuration change control element. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-3 f | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CM-3 g | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-3 g | |||
| NIST: NIST SP 800-53A (v1): CM-3.1 (vi) | |||
| CCI: | CCI-000321 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-17 |
| Definition: | Defines configuration change conditions that prompt the configuration change control element to convene. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-3 f | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CM-3 g | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-3 g | |||
| NIST: NIST SP 800-53A (v1): CM-3.1 (vi) | |||
| CCI: | CCI-001586 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-12 |
| Definition: | Defines the configuration change control element responsible for coordinating and providing oversight for configuration change control activities. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-3 f | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CM-3 g | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-3 g | |||
| NIST: NIST SP 800-53A (v1): CM-3.1 (vi) | |||
| CCI: | CCI-000322 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-17 |
| Definition: | Use organization-defined automated mechanisms to document proposed changes to the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-3 (1) (a) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CM-3 (1) (a) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-3 (1) (a) | |||
| NIST: NIST SP 800-53A (v1): CM-3 (1).1 (ii) | |||
| CCI: | CCI-003913 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Defines the automated mechanisms for documenting proposed changes to the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CM-3 (1) (a) | ||
| CCI: | CCI-000323 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-17 |
| Definition: | Use organization-defined automated mechanisms to notify organization-defined approval authorities of proposed changes to the system and request change approval. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-3 (1) (b) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CM-3 (1) (b) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-3 (1) (b) | |||
| NIST: NIST SP 800-53A (v1): CM-3 (1).1 (ii) | |||
| CCI: | CCI-001742 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-02-28 |
| Definition: | Defines the approval authorities to be notified when proposed changes to the system are received. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CM-3 (1) (b) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-3 (1) (b) | |||
| CCI: | CCI-003914 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Defines the automated mechanisms for notifying approval authorities of proposed changes to the system and request change proposal. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CM-3 (1) (b) | ||
| CCI: | CCI-000324 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-17 |
| Definition: | Use organization-defined automated mechanisms to highlight proposed changes to the system that have not been approved or disapproved by an organization-defined time period. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-3 (1) (c) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CM-3 (1) (c) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-3 (1) (c) | |||
| NIST: NIST SP 800-53A (v1): CM-3 (1).1 (ii) | |||
| CCI: | CCI-001498 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-29 |
| Definition: | Defines a time period after which proposed changes to the system that have not been approved or disapproved are highlighted. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-3 (1) (c) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CM-3 (1) (c) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-3 (1) (c) | |||
| NIST: NIST SP 800-53A (v1): CM-3 (1).1 (i) | |||
| CCI: | CCI-003915 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Defines the automated mechanisms for highlighting proposed changes to the system that have not been approved or disapproved within an organization-defined time period. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CM-3 (1) (c) | ||
| CCI: | CCI-000325 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-17 |
| Definition: | Use organization-defined automated mechanisms to prohibit changes to the system until designated approvals are received. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-3 (1) (d) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CM-3 (1) (d) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-3 (1) (d) | |||
| NIST: NIST SP 800-53A (v1): CM-3 (1).1 (ii) | |||
| CCI: | CCI-003916 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Defines the automated mechanisms for prohibiting changes to the system until designated approvals are received. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CM-3 (1) (d) | ||
| CCI: | CCI-000326 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-17 |
| Definition: | Use organization-defined automated mechanisms to document all changes to the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-3 (1) (e) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CM-3 (1) (e) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-3 (1) (e) | |||
| NIST: NIST SP 800-53A (v1): CM-3 (1).1 (ii) | |||
| CCI: | CCI-003917 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Defines the automated mechanisms for documenting all changes to the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CM-3 (1) (e) | ||
| CCI: | CCI-002057 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-11 |
| Definition: | Defines the personnel to be notified when approved changes to the system are completed. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CM-3 (1) (f) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-3 (1) (f) | |||
| CCI: | CCI-002058 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-11 |
| Definition: | Employ automated mechanisms to notify organization-defined personnel when approved changes to the system are completed. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CM-3 (1) (f) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-3 (1) (f) | |||
| CCI: | CCI-003918 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Defines the automated mechanisms for notifying organization-defined personnel when approved changes to the system are completed. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CM-3 (1) (f) | ||
| CCI: | CCI-000327 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-17 |
| Definition: | Tests changes to the system before finalizing the implementation of the changes. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-3 (2) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CM-3 (2) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-3 (2) | |||
| NIST: NIST SP 800-53A (v1): CM-3 (2).1 | |||
| CCI: | CCI-000328 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-17 |
| Definition: | Validate changes to the system before finalizing the implementation of the changes. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-3 (2) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CM-3 (2) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-3 (2) | |||
| NIST: NIST SP 800-53A (v1): CM-3 (2).1 | |||
| CCI: | CCI-000329 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-17 |
| Definition: | Document changes to the system before finalizing the implementation of the changes. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-3 (2) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CM-3 (2) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-3 (2) | |||
| NIST: NIST SP 800-53A (v1): CM-3 (2).1 | |||
| CCI: | CCI-000330 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-17 |
| Definition: | Implement changes to the current system baseline using organization-defined automated mechanisms. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-3 (3) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CM-3 (3) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-3 (3) | |||
| NIST: NIST SP 800-53A (v1): CM-3 (3).1 | |||
| CCI: | CCI-000331 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-17 |
| Definition: | Deploy the updated system baseline across the installed base using organization-defined automated mechanism. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-3 (3) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CM-3 (3) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-3 (3) | |||
| NIST: NIST SP 800-53A (v1): CM-3 (3).1 | |||
| CCI: | CCI-003919 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Defines the automated mechanisms to implement changes to the current system baseline. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CM-3 (3) | ||
| CCI: | CCI-003920 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Defines the automated mechanisms to deploy the updated baselines across the installed base. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CM-3 (3) | ||
| CCI: | CCI-000332 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-17 |
| Definition: | Require an organization-defined security representative to be a member of the organization-defined configuration change control element. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-3 (4) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CM-3 (4) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-3 (4) | |||
| NIST: NIST SP 800-53A (v1): CM-3 (3).1 | |||
| CCI: | CCI-003921 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Require an organization-defined privacy representative to be a member of the organization-defined configuration change control element. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CM-3 (4) | ||
| CCI: | CCI-003922 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Defines the security representatives required to be members of the configuration change control element. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CM-3 (4) | ||
| CCI: | CCI-003923 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Defines the privacy representatives required to be members of the configuration change control element. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CM-3 (4) | ||
| CCI: | CCI-003924 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Defines the configuration change control element required for security and privacy representatives. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CM-3 (4) | ||
| CCI: | CCI-001743 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-02-28 |
| Definition: | Defines the security responses to be automatically implemented if baseline configurations are changed in an unauthorized manner. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CM-3 (5) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-3 (5) | |||
| CCI: | CCI-001744 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-02-28 |
| Definition: | Implement organization-defined security responses automatically if baseline configurations are changed in an unauthorized manner. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CM-3 (5) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-3 (5) | |||
| CCI: | CCI-001745 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-02-28 |
| Definition: | Defines the controls that are to be provided by the cryptographic mechanisms are under configuration management. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CM-3 (6) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-3 (6) | |||
| CCI: | CCI-001746 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-02-28 |
| Definition: | Ensure that cryptographic mechanisms used to provide organization-defined control are under configuration management. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CM-3 (6) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-3 (6) | |||
| CCI: | CCI-003925 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Review changes to the system on an organization-defined frequency or when there are organization-defined circumstances to determine whether unauthorized changes have occurred. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CM-3 (7) | ||
| CCI: | CCI-003926 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Defines the frequency for reviewing changes to the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CM-3 (7) | ||
| CCI: | CCI-003927 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Defines the circumstances for determining whether unauthorized changes to the system have occurred. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CM-3 (7) | ||
| CCI: | CCI-003928 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Prevent or restrict changes to the configuration of the system under organization-defined circumstances. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CM-3 (8) | ||
| CCI: | CCI-003929 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Defines the circumstances for preventing or restricting changes to the configuration of the system. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CM-3 (8) | ||
| CCI: | CCI-000333 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Analyze changes to the system to determine potential security impacts prior to change implementation. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-4 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CM-4 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-4 | |||
| NIST: NIST SP 800-53A (v1): CM-4.1 | |||
| CCI: | CCI-003930 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Analyze changes to the system to determine potential privacy impacts prior to change implementation. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CM-4 | ||
| CCI: | CCI-001817 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-01 |
| Definition: | When analyzing changes to the system, looks for privacy impacts due to flaws, weaknesses, incompatibility, or intentional malice. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CM-4 (1) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-4 (1) | |||
| CCI: | CCI-001818 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-01 |
| Definition: | Analyze changes to the system in a separate test environment before installation in an operational environment. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CM-4 (1) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-4 (1) | |||
| CCI: | CCI-003931 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | When analyzing changes to the system, looks for security impacts due to flaws, weaknesses, incompatibility, or intentional malice. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CM-4 (1) | ||
| CCI: | CCI-000335 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | After system changes, verify that the impacted controls are implemented correctly, meeting the security requirements for the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-4 (2) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CM-4 (2) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-4 (2) | |||
| NIST: NIST SP 800-53A (v1): CM-4 (2).1 | |||
| CCI: | CCI-000336 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | After system changes, verify that the impacted controls are operating as intended, meeting the security requirements for the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-4 (2) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CM-4 (2) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-4 (2) | |||
| NIST: NIST SP 800-53A (v1): CM-4 (2).1 | |||
| CCI: | CCI-000337 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | After system changes, verify that the impacted controls are producing the desired outcome with regard to meeting the security requirements for the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-4 (2) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CM-4 (2) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-4 (2) | |||
| NIST: NIST SP 800-53A (v1): CM-4 (2).1 | |||
| CCI: | CCI-003932 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | After system changes, verify that the impacted controls are implemented correctly, meeting the privacy requirements for the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CM-4 (2) | ||
| CCI: | CCI-003933 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | After system changes, verify that the impacted controls are operating as intended, meeting the privacy requirements for the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CM-4 (2) | ||
| CCI: | CCI-003934 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | After system changes, verify that the impacted controls are producing the desired outcome with regard to meeting the privacy requirements for the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CM-4 (2) | ||
| CCI: | CCI-000340 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Approve physical access restrictions associated with changes to the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-5 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CM-5 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-5 | |||
| NIST: NIST SP 800-53A (v1): CM-5.1 | |||
| CCI: | CCI-000341 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Enforce physical access restrictions associated with changes to the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-5 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CM-5 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-5 | |||
| NIST: NIST SP 800-53A (v1): CM-5.1 | |||
| CCI: | CCI-000344 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Approve logical access restrictions associated with changes to the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-5 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CM-5 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-5 | |||
| NIST: NIST SP 800-53A (v1): CM-5.1 | |||
| CCI: | CCI-000345 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Enforce logical access restrictions associated with changes to the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-5 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CM-5 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-5 | |||
| NIST: NIST SP 800-53A (v1): CM-5.1 | |||
| CCI: | CCI-003935 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Define and document physical access restrictions associated with changes to the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CM-5 | ||
| CCI: | CCI-003936 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Define and document logical access restrictions associated with changes to the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CM-5 | ||
| CCI: | CCI-001813 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-01 |
| Definition: | Enforce access restrictions using organization-defined mechanisms. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CM-5 (1) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-5 (1) (a) | |||
| CCI: | CCI-003937 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Defines the automated mechanisms to enforce access restrictions. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CM-5 (1) (a) | ||
| CCI: | CCI-003938 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Automatically generate audit records of the enforcement actions. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CM-5 (1) (b) | ||
| CCI: | CCI-000353 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Defines system components requiring enforcement of a dual authorization for system changes. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-5 (4) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CM-5 (4) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-5 (4) | |||
| NIST: NIST SP 800-53A (v1): CM-5 (4).1 (i) | |||
| CCI: | CCI-000354 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Enforce dual authorization for implementing changes to organization-defined system components. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 (v3): CM-5 (4) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CM-5 (4) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-5 (4) | |||
| NIST: NIST SP 800-53A (v1): CM-5 (4).1 (ii) | |||
| CCI: | CCI-001751 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-02-28 |
| Definition: | Defines system-level information requiring enforcement of a dual authorization for system changes. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CM-5 (4) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-5 (4) | |||
| CCI: | CCI-001752 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-02-28 |
| Definition: | Enforce dual authorization for implementing changes to organization-defined system-level information. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CM-5 (4) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-5 (4) | |||
| CCI: | CCI-001753 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-02-28 |
| Definition: | Limit privileges to change system components within a production or operational environment. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CM-5 (5) (a) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-5 (5) (a) | |||
| CCI: | CCI-001754 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-02-28 |
| Definition: | Limit privileges to change system-related information within a production or operational environment. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CM-5 (5) (a) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-5 (5) (a) | |||
| CCI: | CCI-003939 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Defines the frequency with which to review and reevaluate system privileges. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CM-5 (5) (b) | ||
| CCI: | CCI-003940 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Review and reevaluate system privileges per an organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CM-5 (5) (b) | ||
| CCI: | CCI-001499 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-29 |
| Definition: | Limit privileges to change software resident within software libraries. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): CM-5 (6) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CM-5 (6) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-5 (6) | |||
| NIST: NIST SP 800-53A (v1): CM-5 (6).1 | |||
| CCI: | CCI-003941 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Establish and document configuration settings for components employed within the system that reflect the most restrictive mode consistent with operational requirements using organization-defined common secure configurations. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CM-6 a | ||
| CCI: | CCI-003942 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Defines the common secure configurations for establishing and documenting configuration settings within the system, that reflect the most restrictive mode consistent with operational requirements. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CM-6 a | ||
| CCI: | CCI-000366 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Implement the security configuration settings. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 (v3): CM-6 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CM-6 b | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-6 b | |||
| NIST: NIST SP 800-53A (v1): CM-6.1 (iv) | |||
| CCI: | CCI-000367 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Identify any deviations from the established configuration settings for organization-defined system components based on organization-defined operational requirements. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-6 c | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CM-6 c | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-6 c | |||
| NIST: NIST SP 800-53A (v1): CM-6.1 (v) | |||
| CCI: | CCI-000368 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Document any deviations from the established configuration settings for organization-defined system components based on organization-defined operational requirements. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-6 c | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CM-6 c | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-6 c | |||
| NIST: NIST SP 800-53A (v1): CM-6.1 (v) | |||
| CCI: | CCI-000369 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Approve any deviations from the established configuration settings for organization-defined system components based on organization-defined operational requirements. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-6 c | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CM-6 c | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-6 c | |||
| NIST: NIST SP 800-53A (v1): CM-6.1 (v) | |||
| CCI: | CCI-001755 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-02-28 |
| Definition: | Defines the system components for which any deviation from the established configuration settings are to be identified, documented, and approved. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CM-6 c | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-6 c | |||
| CCI: | CCI-001756 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-02-28 |
| Definition: | Defines the operational requirements on which the configuration settings for the organization-defined system components are to be based. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CM-6 c | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-6 c | |||
| CCI: | CCI-003943 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Monitor changes to the configuration settings in accordance with organizational policies. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CM-6 d | ||
| CCI: | CCI-003944 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Monitor changes to the configuration settings in accordance with organizational procedures. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CM-6 d | ||
| CCI: | CCI-003945 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Control changes to the configuration settings in accordance with organizational policies. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CM-6 d | ||
| CCI: | CCI-003946 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Control changes to the configuration settings in accordance with organizational procedures. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CM-6 d | ||
| CCI: | CCI-000370 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Manage configuration settings for organization-defined system components using organization-defined automated mechanisms. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-6 (1) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CM-6 (1) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-6 (1) | |||
| NIST: NIST SP 800-53A (v1): CM-6 (1).1 | |||
| CCI: | CCI-000371 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Apply configuration settings for organization-defined system components using organization-defined automated mechanisms. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-6 (1) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CM-6 (1) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-6 (1) | |||
| NIST: NIST SP 800-53A (v1): CM-6 (1).1 | |||
| CCI: | CCI-000372 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Verify configuration settings for organization-defined system components using organization-defined automated mechanisms. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-6 (1) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CM-6 (1) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-6 (1) | |||
| NIST: NIST SP 800-53A (v1): CM-6 (1).1 | |||
| CCI: | CCI-002059 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-11 |
| Definition: | Defines the system components for which the organization will employ automated mechanisms to centrally manage, apply, and verify configuration settings. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CM-6 (1) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-6 (1) | |||
| CCI: | CCI-003947 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Defines the automated mechanisms for managing, applying, and verifying configuration settings. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CM-6 (1) | ||
| CCI: | CCI-001757 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-02-28 |
| Definition: | Defines the actions to employ when responding to unauthorized changes to the organization-defined configuration settings. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CM-6 (2) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-6 (2) | |||
| CCI: | CCI-001758 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-02-28 |
| Definition: | Defines the configuration settings for which to employ organization-defined actions in response to unauthorized changes. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CM-6 (2) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-6 (2) | |||
| CCI: | CCI-001759 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-02-28 |
| Definition: | Take organization-defined actions in response to unauthorized changes to organization-defined configuration settings. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CM-6 (2) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-6 (2) | |||
| CCI: | CCI-000381 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Configure the system to provide only organization-defined mission essential capabilities. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): CM-7 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CM-7 a | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-7 a | |||
| NIST: NIST SP 800-53A (v1): CM-7.1 (ii) | |||
| CCI: | CCI-003948 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Defines the mission essential capabilities for configuring the system. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CM-7 a | ||
| CCI: | CCI-000380 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Defines prohibited or restricted functions, system ports, protocols, software and/or services for the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-7 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CM-7 b | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-7 b | |||
| NIST: NIST SP 800-53A (v1): CM-7.1 (i) | |||
| CCI: | CCI-000382 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Configure the system to prohibit or restrict the use of organization-defined prohibited or restricted functions, system ports, protocols, software, and/or services. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): CM-7 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CM-7 b | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-7 b | |||
| NIST: NIST SP 800-53A (v1): CM-7.1 (iii) | |||
| CCI: | CCI-000384 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Review the system per organization-defined frequency to identify unnecessary and nonsecure functions, ports, protocols, software, and services. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-7 (1) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CM-7 (1) (a) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-7 (1) (a) | |||
| NIST: NIST SP 800-53A (v1): CM-7 (1).1 (i) | |||
| CCI: | CCI-001760 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-02-28 |
| Definition: | Defines the frequency of system reviews to identify unnecessary and/or nonsecure functions, ports, protocols, software, and services. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CM-7 (1) (a) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-7 (1) (a) | |||
| CCI: | CCI-001761 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-02-28 |
| Definition: | Defines the functions, ports, protocols, software, and services within the information system that are to be disabled or removed when deemed unnecessary and/or nonsecure. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CM-7 (1) (b) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-7 (1) (b) | |||
| CCI: | CCI-001762 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-02-28 |
| Definition: | Disable or remove organization-defined functions, ports, protocols, software, and services within the system deemed to be unnecessary and/or nonsecure. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CM-7 (1) (b) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-7 (1) (b) | |||
| CCI: | CCI-001592 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-12 |
| Definition: | Defines the rules authorizing the terms and conditions of software program usage on the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-7 (2) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CM-7 (2) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-7 (2) | |||
| NIST: NIST SP 800-53A (v1): CM-7 (2).1 (i) | |||
| CCI: | CCI-001763 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-02-28 |
| Definition: | Defines the policies regarding software program usage and restrictions. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CM-7 (2) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-7 (2) | |||
| CCI: | CCI-001764 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-02-28 |
| Definition: | Prevent program execution in accordance with organization-defined policies, rules of behavior, and/or access agreements regarding software program usage and restrictions; rules authorizing the terms and conditions of software program usage. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CM-7 (2) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-7 (2) | |||
| CCI: | CCI-000387 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Defines registration requirements for functions, ports, protocols, and services. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-7 (3) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CM-7 (3) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-7 (3) | |||
| NIST: NIST SP 800-53A (v1): CM-7 (3).1 (i) | |||
| CCI: | CCI-000388 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Ensure compliance with organization-defined registration requirements for functions, ports, protocols, and services. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-7 (3) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CM-7 (3) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-7 (3) | |||
| NIST: NIST SP 800-53A (v1): CM-7 (3).1 (ii) | |||
| CCI: | CCI-001765 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-02-28 |
| Definition: | Defines the software programs not authorized to execute on the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CM-7 (4) (a) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-7 (4) (a) | |||
| CCI: | CCI-001766 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-02-28 |
| Definition: | Identify the organization-defined software programs not authorized to execute on the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CM-7 (4) (a) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-7 (4) (a) | |||
| CCI: | CCI-001767 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-02-28 |
| Definition: | Employ an allow-all, deny-by-exception policy to prohibit the execution of unauthorized software programs on the system. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CM-7 (4) (b) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-7 (4) (b) | |||
| CCI: | CCI-001768 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-02-28 |
| Definition: | Defines the frequency on which the list of unauthorized software programs will be reviewed and updated. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CM-7 (4) (c) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-7 (4) (c) | |||
| CCI: | CCI-001770 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-02-28 |
| Definition: | Review and update the list of unauthorized software programs per organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CM-7 (4) (c) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-7 (4) (c) | |||
| CCI: | CCI-001772 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-02-28 |
| Definition: | Defines the software programs authorized to execute on the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CM-7 (5) (a) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-7 (5) (a) | |||
| CCI: | CCI-001773 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-02-28 |
| Definition: | Identify the organization-defined software programs authorized to execute on the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CM-7 (5) (a) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-7 (5) (a) | |||
| CCI: | CCI-001774 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-02-28 |
| Definition: | Employ a deny-all, permit-by-exception policy to allow the execution of authorized software programs on the system. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CM-7 (5) (b) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-7 (5) (b) | |||
| CCI: | CCI-001775 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-02-28 |
| Definition: | Defines the frequency on which the list of authorized software programs will be reviewed and updated. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CM-7 (5) (c) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-7 (5) (c) | |||
| CCI: | CCI-001777 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-02-28 |
| Definition: | Review and update the list of authorized software programs per organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CM-7 (5) (c) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-7 (5) (c) | |||
| CCI: | CCI-003949 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Require that organization-defined user-installed software in a confined physical or virtual machine environment with limited privileges. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CM-7 (6) | ||
| CCI: | CCI-003950 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Defines the user-installed software required for executing in a confined physical or virtual machine environment with limited privileges. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CM-7 (6) | ||
| CCI: | CCI-003951 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Allow execution of binary or machine-executable code only in confined physical or virtual machine environments and with the explicit approval of organization-defined personnel or roles when such code is obtained from sources with limited or no warranty. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CM-7 (7) (a) | ||
| CCI: | CCI-003952 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Defines the personnel or roles who allow execution of binary or machine-executable code only in confined physical or virtual machine environments when such code is obtained from sources with limited or no warranty. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CM-7 (7) (a) | ||
| CCI: | CCI-003953 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Allow execution of binary or machine-executable code only in confined physical or virtual machine environments and with the explicit approval of organization-defined personnel or roles when such code is without the provision of source code. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CM-7 (7) (b) | ||
| CCI: | CCI-003954 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Defines the personnel or roles who allow execution of binary or machine-executable code only in confined physical or virtual machine environments when such code is without the provision of source code. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CM-7 (7) (b) | ||
| CCI: | CCI-003955 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Prohibit the use of binary or machine-executable code from sources with limited or no warranty or without the provision of source code. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CM-7 (8) (a) | ||
| CCI: | CCI-003956 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Allow exceptions only for compelling mission or operational requirements and with the approval of the authorizing official. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CM-7 (8) (b) | ||
| CCI: | CCI-003957 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Identify organization-defined hardware components authorized for system use. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CM-7 (9) (a) | ||
| CCI: | CCI-003958 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Defines the hardware components to be identified for authorized system use. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CM-7 (9) (a) | ||
| CCI: | CCI-003959 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Prohibit the use or connection of unauthorized hardware components. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CM-7 (9) (b) | ||
| CCI: | CCI-003960 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Review and update the list of authorized hardware components on an organization-defined frequency. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CM-7 (9) (c) | ||
| CCI: | CCI-003961 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Defines the frequency the hardware components are reviewed and updated. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CM-7 (9) (c) | ||
| CCI: | CCI-000398 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Defines information deemed necessary to achieve effective system component accountability. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-8 d | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CM-8 a 4 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-8 a 5 | |||
| NIST: NIST SP 800-53A (v1): CM-8.1 (i) | |||
| CCI: | CCI-003962 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Develop and document an inventory of system components that accurately reflects the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CM-8 a 1 | ||
| CCI: | CCI-003963 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Develop and document an inventory of system components that includes all components within the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CM-8 a 2 | ||
| CCI: | CCI-003964 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Develop and document an inventory of system components that does not include duplicate accounting of components or components assigned to any other system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CM-8 a 3 | ||
| CCI: | CCI-003965 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Develop and document an inventory of system components that is at the level of granularity deemed necessary for tracking. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CM-8 a 4 | ||
| CCI: | CCI-003966 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Develop and document an inventory of system components that is at the level of granularity deemed necessary for reporting. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CM-8 a 4 | ||
| CCI: | CCI-003967 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Develop and document an inventory of system components that includes organization-defined information deemed necessary to achieve effective system component accountability. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CM-8 a 5 | ||
| CCI: | CCI-001779 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-02-28 |
| Definition: | Defines the frequency on which the system component inventory is to be reviewed and updated. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CM-8 b | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-8 b | |||
| CCI: | CCI-001780 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-02-28 |
| Definition: | Review and update the system component inventory per organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CM-8 b | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-8 b | |||
| CCI: | CCI-000408 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Update the inventory of system components as part of component installations. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-8 (1) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CM-8 (1) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-8 (1) | |||
| NIST: NIST SP 800-53A (v1): CM-8 (1).1 | |||
| CCI: | CCI-000409 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Update the inventory of system components as part of component removals. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-8 (1) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CM-8 (1) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-8 (1) | |||
| NIST: NIST SP 800-53A (v1): CM-8 (1).1 | |||
| CCI: | CCI-000410 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Update the inventory of system components as part of system updates. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-8 (1) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CM-8 (1) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-8 (1) | |||
| NIST: NIST SP 800-53A (v1): CM-8 (1).1 | |||
| CCI: | CCI-000411 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Maintain the currency of the inventory of system components using organization-defined automated mechanisms. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-8 (2) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CM-8 (2) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-8 (2) | |||
| NIST: NIST SP 800-53A (v1): CM-8 (2).1 | |||
| CCI: | CCI-000412 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Maintain the completeness of the inventory of system components using organization-defined automated mechanisms. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-8 (2) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CM-8 (2) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-8 (2) | |||
| NIST: NIST SP 800-53A (v1): CM-8 (2).1 | |||
| CCI: | CCI-000413 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Maintain the accuracy of the inventory of system components using organization-defined automated mechanisms. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-8 (2) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CM-8 (2) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-8 (2) | |||
| NIST: NIST SP 800-53A (v1): CM-8 (2).1 | |||
| CCI: | CCI-000414 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Maintain the availability of the inventory of system components using organization-defined automated mechanisms. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-8 (2) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CM-8 (2) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-8 (2) | |||
| NIST: NIST SP 800-53A (v1): CM-8 (2).1 | |||
| CCI: | CCI-003968 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Defines the automated mechanisms for maintaining the currency, completeness, accuracy, and availability of the inventory of the system components. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CM-8 (2) | ||
| CCI: | CCI-000415 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Defines the frequency of employing automated mechanisms to detect the presence of unauthorized hardware, software, and firmware components within the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-8 (3) (a) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CM-8 (3) (a) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-8 (3) (a) | |||
| NIST: NIST SP 800-53A (v1): CM-8 (3).1 (i) | |||
| CCI: | CCI-000416 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Detect the presence of unauthorized hardware, software, and firmware components within the system using organization-defined automated mechanisms, on an organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-8 (3) (a) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CM-8 (3) (a) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-8 (3) (a) | |||
| NIST: NIST SP 800-53A (v1): CM-8 (3).1 (ii) | |||
| CCI: | CCI-003969 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Defines the automated mechanisms for detecting the presence of unauthorized hardware, software, and firmware components within the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CM-8 (3) (a) | ||
| CCI: | CCI-001783 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-01 |
| Definition: | Defines the personnel or roles to be notified when unauthorized hardware, software, and firmware components are detected within the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CM-8 (3) (b) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-8 (3) (b) | |||
| CCI: | CCI-001784 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-01 |
| Definition: | When unauthorized hardware, software, and firmware components are detected within the system, the organization takes action to disable network access by such components, isolates the components, and/or notifies organization-defined personnel or roles. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CM-8 (3) (b) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-8 (3) (b) | |||
| CCI: | CCI-000418 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Include in the system component inventory information, a means for identifying by name, position, and/or role, individuals responsible and accountable for administering those components. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-8 (4) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CM-8 (4) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-8 (4) | |||
| NIST: NIST SP 800-53A (v1): CM-8 (4).1 | |||
| CCI: | CCI-000420 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Include assessed component configurations and any approved deviations to current deployed configurations in the system component inventory. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-8 (6) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CM-8 (6) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-8 (6) | |||
| NIST: NIST SP 800-53A (v1): CM-8 (6).1 | |||
| CCI: | CCI-001785 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-01 |
| Definition: | Provide a centralized repository for the inventory of system components. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CM-8 (7) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-8 (7) | |||
| CCI: | CCI-001786 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-01 |
| Definition: | Support the tracking of system components by geographic location using organization-defined automated mechanisms. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CM-8 (8) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-8 (8) | |||
| CCI: | CCI-003970 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Defines the automated mechanisms for supporting the tracking of system components by geographic location. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CM-8 (8) | ||
| CCI: | CCI-001788 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-01 |
| Definition: | Assign system components to a system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CM-8 (9) (a) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-8 (9) (a) | |||
| CCI: | CCI-001789 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-01 |
| Definition: | Receive an acknowledgement from organization-defined personnel or roles of the acquired system components to a system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CM-8 (9) (b) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-8 (9) (b) | |||
| CCI: | CCI-000423 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Implement a configuration management plan for the system that addresses roles, responsibilities, and configuration management processes and procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-9 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CM-9 a | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-9 a | |||
| NIST: NIST SP 800-53A (v1): CM-9.1 (i) | |||
| CCI: | CCI-003971 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Develop and document a configuration management plan for the system that addresses roles, responsibilities, and configuration management processes. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CM-9 a | ||
| CCI: | CCI-003972 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Develop and document a configuration management plan for the system that addresses roles, responsibilities, and configuration management procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CM-9 a | ||
| CCI: | CCI-001792 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-01 |
| Definition: | Implement a configuration management plan for the system that establishes a process for identifying configuration items throughout the system development life cycle. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CM-9 b | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-9 b | |||
| CCI: | CCI-001795 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-01 |
| Definition: | Implement a configuration management plan for the system that establishes a process for managing the configuration of the configuration items. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CM-9 b | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-9 b | |||
| CCI: | CCI-003973 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Develop and document a configuration management plan for the system that establishes a process for identifying configuration items throughout the system development life cycle. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CM-9 b | ||
| CCI: | CCI-003974 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Develop and document a configuration management plan for the system that establishes a process for managing the configuration of the configuration items. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CM-9 b | ||
| CCI: | CCI-000426 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Implement a configuration management plan for the system that defines the configuration items for the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-9 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CM-9 c | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-9 c | |||
| NIST: NIST SP 800-53A (v1): CM-9.1 (i) | |||
| CCI: | CCI-001798 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-01 |
| Definition: | Implement a configuration management plan for the system that places the configuration items under configuration management. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CM-9 c | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-9 c | |||
| CCI: | CCI-003975 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Develop and document a configuration management plan for the system that defines the configuration items for the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CM-9 c | ||
| CCI: | CCI-003976 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Develop and document a configuration management plan for the system that places the configuration items under configuration management. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CM-9 c | ||
| CCI: | CCI-003977 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Develop and document a configuration management plan for the system that is reviewed and approved by organization-defined personnel or roles. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CM-9 d | ||
| CCI: | CCI-003978 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Defines the personnel or roles for those who review and approve the configuration management plan. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CM-9 d | ||
| CCI: | CCI-003979 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Implement a configuration management plan for the system that is reviewed and approved by organization-defined personnel or roles. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CM-9 d | ||
| CCI: | CCI-001799 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-01 |
| Definition: | Develop and document a configuration management plan for the system that protects the configuration management plan from unauthorized disclosure and modification. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CM-9 d | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-9 e | |||
| CCI: | CCI-001801 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-01 |
| Definition: | Implement a configuration management plan for the system that protects the configuration management plan from unauthorized disclosure and modification. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CM-9 d | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-9 e | |||
| CCI: | CCI-000436 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Assign responsibility for developing the configuration management process to organizational personnel that are not directly involved in system development. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-9 (1) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CM-9 (1) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-9 (1) | |||
| NIST: NIST SP 800-53A (v1): CM-9 (1).1 | |||
| CCI: | CCI-001726 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-02-28 |
| Definition: | Use software in accordance with contract agreements. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CM-10 a | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-10 a | |||
| CCI: | CCI-001727 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-02-28 |
| Definition: | Use software documentation in accordance with contract agreements. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CM-10 a | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-10 a | |||
| CCI: | CCI-001728 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-02-28 |
| Definition: | Use software in accordance with copyright laws. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CM-10 a | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-10 a | |||
| CCI: | CCI-001729 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-02-28 |
| Definition: | Use software documentation in accordance with copyright laws. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CM-10 a | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-10 a | |||
| CCI: | CCI-001730 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-02-28 |
| Definition: | Track the use of software protected by quantity licenses to control copying of the software. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CM-10 b | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-10 b | |||
| CCI: | CCI-001731 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-02-28 |
| Definition: | Track the use of software documentation protected by quantity licenses to control distribution of the software documentation. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CM-10 b | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-10 b | |||
| CCI: | CCI-001802 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-01 |
| Definition: | Track the use of software documentation protected by quantity licenses to control copying of the software documentation. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CM-10 b | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-10 b | |||
| CCI: | CCI-001803 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-01 |
| Definition: | Track the use of software protected by quantity licenses to control distribution of the software. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CM-10 b | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-10 b | |||
| CCI: | CCI-001732 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-02-28 |
| Definition: | Control the use of peer-to-peer file sharing technology to ensure that this capability is not used for the unauthorized distribution, display, performance, or reproduction of copyrighted work. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CM-10 c | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-10 c | |||
| CCI: | CCI-001733 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-02-28 |
| Definition: | Document the use of peer-to-peer file sharing technology to ensure that this capability is not used for the unauthorized distribution, display, performance, or reproduction of copyrighted work. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CM-10 c | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-10 c | |||
| CCI: | CCI-001734 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-02-28 |
| Definition: | Defines the restrictions to be followed on the use of open source software. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CM-10 (1) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-10 (1) | |||
| CCI: | CCI-001735 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-02-28 |
| Definition: | Establish organization-defined restrictions on the use of open source software. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CM-10 (1) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-10 (1) | |||
| CCI: | CCI-001804 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-01 |
| Definition: | Defines the policies for governing the installation of software by users. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CM-11 a | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-11 a | |||
| CCI: | CCI-001805 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-01 |
| Definition: | Establish organization-defined policies governing the installation of software by users. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CM-11 a | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-11 a | |||
| CCI: | CCI-001806 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-01 |
| Definition: | Defines methods to be employed to enforce the software installation policies. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CM-11 b | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-11 b | |||
| CCI: | CCI-001807 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-01 |
| Definition: | Enforce software installation policies through organization-defined methods. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CM-11 b | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-11 b | |||
| CCI: | CCI-001808 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-01 |
| Definition: | Defines the frequency on which it will monitor software installation policy compliance. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CM-11 c | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-11 c | |||
| CCI: | CCI-001809 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-01 |
| Definition: | Monitor software installation policy compliance per an organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CM-11 c | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CM-11 c | |||
| CCI: | CCI-003980 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Allow user installation of software only with explicit privileged status. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CM-11 (2) | ||
| CCI: | CCI-003981 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Enforce and monitor compliance with software installation policies using organization-defined automated mechanisms. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CM-11 (3) | ||
| CCI: | CCI-003982 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Identify and document the location of the organization-defined information on which the information is processed and stored. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CM-12 a | ||
| CCI: | CCI-003983 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Identify and document the specific system components on which the organization-defined information is processed and stored. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CM-12 a | ||
| CCI: | CCI-003984 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Defines the information on which the location and specific system components are processed and stored. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CM-12 a | ||
| CCI: | CCI-003985 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Identify and document the users who have access to the system where the information is processed and stored. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CM-12 b | ||
| CCI: | CCI-003986 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Identify and document the users who have access to the system components where the information is processed and stored. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CM-12 b | ||
| CCI: | CCI-003987 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Document changes to the location (i.e., system or system components) where the information is processed and stored. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CM-12 c | ||
| CCI: | CCI-003988 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Use automated tools to identify organization-defined information by information type on organization-defined components to ensure adequate controls are in place to protect organizational information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CM-12 (1) | ||
| CCI: | CCI-003989 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Defines the information by information type for identifying automated tools. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CM-12 (1) | ||
| CCI: | CCI-003990 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Defines the system components used to ensure controls are in place to protect organizational information and individual privacy. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CM-12 (1) | ||
| CCI: | CCI-003991 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Develop and document a map of system data actions. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CM-13 | ||
| CCI: | CCI-003992 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Prevent the installation of organization-defined software and firmware components without verification that the component has been digitally signed using a certificate that is recognized and approved by the organization. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CM-14 | ||
| CCI: | CCI-003993 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Defines the software and firmware for preventing installation without verification that the component has been digitally signed. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CM-14 | ||
| CCI: | CCI-000438 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Develop and document an organizational-level; mission/business process-level; and/or system-level contingency planning policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-1 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-1 a 1 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-1 a 1 (a) | |||
| NIST: NIST SP 800-53A (v1): CP-1.1 (i) (ii) | |||
| CCI: | CCI-000439 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Disseminate an organizational-level; mission/business process-level; and/or system-level contingency planning policy to organization-defined personnel or roles. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-1 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-1 a 1 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-1 a 1 (a) | |||
| NIST: NIST SP 800-53A (v1): CP-1.1 (iii) | |||
| CCI: | CCI-000441 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Develop and document procedures to facilitate the implementation of the contingency planning policy and associated contingency planning controls. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-1 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-1 a 2 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-1 a 2 | |||
| NIST: NIST SP 800-53A (v1): CP-1.1 (iv) (v) | |||
| CCI: | CCI-001597 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-12 |
| Definition: | Disseminate contingency planning procedures to organization-defined personnel or roles. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-1 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-1 a 2 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-1 a 2 | |||
| NIST: NIST SP 800-53A (v1): CP-1.1 (vi) | |||
| CCI: | CCI-002825 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-20 |
| Definition: | Defines the personnel or roles to whom the organizational-level; mission/business process-level; and/or system-level contingency planning policy is to be disseminated. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CP-1 a 1 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-1 a 1 (a) | |||
| CCI: | CCI-002826 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-20 |
| Definition: | Defines personnel or roles to whom the contingency planning procedures are disseminated. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CP-1 a 2 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-1 a 2 | |||
| CCI: | CCI-003994 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Develop and document an organizational-level; mission/business process-level; and/or system-level contingency planning policy that is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CP-1 a 1 (b) | ||
| CCI: | CCI-003995 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Disseminate an organizational-level; mission/business process-level; and/or system-level contingency planning policy to organization-defined personnel or roles that is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CP-1 a 1 (b) | ||
| CCI: | CCI-003996 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Designate an organization-defined official to manage development and documentation of the contingency planning policy. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CP-1 b | ||
| CCI: | CCI-003997 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Designate an organization-defined official to manage dissemination of the contingency planning policy. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CP-1 b | ||
| CCI: | CCI-003998 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Defines the official designated to manage the development, documentation, and dissemination of the contingency policy. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CP-1 b | ||
| CCI: | CCI-003999 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Designate an organization-defined official to manage the development and documentation of the contingency planning procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CP-1 b | ||
| CCI: | CCI-004000 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Designate an organization-defined official to manage the dissemination of the contingency procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CP-1 b | ||
| CCI: | CCI-004001 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Defines the official designated to manage the development, documentation, and dissemination of the contingency procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CP-1 b | ||
| CCI: | CCI-000437 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Defines the frequency with which to review and update the current contingency planning policy. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-1 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-1 b 1 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-1 c 1 | |||
| NIST: NIST SP 800-53A (v1): CP-1.2 (i) | |||
| CCI: | CCI-000440 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Review and update the current contingency planning policy in accordance with an organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-1 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-1 b 1 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-1 c 1 | |||
| NIST: NIST SP 800-53A (v1): CP-1.2 (ii) | |||
| CCI: | CCI-001596 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-12 |
| Definition: | Defines the frequency with which to review and update the current contingency planning procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-1 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-1 b 2 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-1 c 2 | |||
| NIST: NIST SP 800-53A (v1): CP-1.2 (iii) | |||
| CCI: | CCI-001598 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-12 |
| Definition: | Review and update the current contingency planning procedures in accordance with the organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-1 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-1 b 2 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-1 c 2 | |||
| NIST: NIST SP 800-53A (v1): CP-1.2 (iv) | |||
| CCI: | CCI-004002 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Review and update the current contingency planning policy following organization-defined events. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CP-1 c 1 | ||
| CCI: | CCI-004003 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Defines the events with which to review and update the current contingency planning policy. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CP-1 c 1 | ||
| CCI: | CCI-004004 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Review and update the current contingency planning procedures following organization-defined events. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CP-1 c 2 | ||
| CCI: | CCI-004005 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Defines the events with which to review and update the current contingency planning procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CP-1 c 2 | ||
| CCI: | CCI-000443 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Develop a contingency plan for the system that identifies essential missions. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-2 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-2 a 1 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-2 a 1 | |||
| NIST: NIST SP 800-53A (v1): CP-2.1 (i) | |||
| CCI: | CCI-000444 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Develop a contingency plan for the system that identifies essential business functions. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-2 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-2 a 1 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-2 a 1 | |||
| NIST: NIST SP 800-53A (v1): CP-2.1 (i) | |||
| CCI: | CCI-000445 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Develop a contingency plan for the system that identifies associated contingency requirements. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-2 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-2 a 1 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-2 a 1 | |||
| NIST: NIST SP 800-53A (v1): CP-2.1 (i) | |||
| CCI: | CCI-000446 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Develop a contingency plan for the system that provides recovery objectives. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-2 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-2 a 2 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-2 a 2 | |||
| NIST: NIST SP 800-53A (v1): CP-2.1 (i) | |||
| CCI: | CCI-000447 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Develop a contingency plan for the system that provides restoration priorities. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-2 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-2 a 2 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-2 a 2 | |||
| NIST: NIST SP 800-53A (v1): CP-2.1 (i) | |||
| CCI: | CCI-000448 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Develop a contingency plan for the system that provides metrics. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-2 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-2 a 2 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-2 a 2 | |||
| NIST: NIST SP 800-53A (v1): CP-2.1 (i) | |||
| CCI: | CCI-000449 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Develop a contingency plan for the system that addresses contingency roles, responsibilities, assigned individuals with contact information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-2 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-2 a 3 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-2 a 3 | |||
| NIST: NIST SP 800-53A (v1): CP-2.1 (i) | |||
| CCI: | CCI-000456 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Develop a contingency plan for the system that addresses eventual, full system restoration without deterioration of the controls originally planned and implemented. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-2 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-2 a 5 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-2 a 5 | |||
| NIST: NIST SP 800-53A (v1): CP-2.1 (i) | |||
| CCI: | CCI-000457 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Develop a contingency plan for the system that is reviewed and approved by organization-defined personnel or roles. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-2 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-2 a 6 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-2 a 7 | |||
| NIST: NIST SP 800-53A (v1): CP-2.1 (i) | |||
| CCI: | CCI-002830 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-20 |
| Definition: | Defines the personnel or roles who review and approve the contingency plan for the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CP-2 a 6 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-2 a 7 | |||
| CCI: | CCI-004006 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Develop a contingency plan for the system that addresses maintaining essential mission functions despite a system disruption, compromise, or failure. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CP-2 a 4 | ||
| CCI: | CCI-004007 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Develop a contingency plan for the system that addresses maintaining essential business functions despite a system disruption, compromise, or failure. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CP-2 a 4 | ||
| CCI: | CCI-004008 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Develop a contingency plan for the system that addresses the sharing of contingency information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CP-2 a 6 | ||
| CCI: | CCI-000458 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Defines the key contingency personnel (identified by name and/or by role) and organizational elements designated to receive copies of the contingency plan. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-2 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-2 b | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-2 b | |||
| NIST: NIST SP 800-53A (v1): CP-2.1 (ii) | |||
| CCI: | CCI-000459 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Distributes copies of the contingency plan to an organization-defined list of key contingency personnel (identified by name and/or by role) and organizational elements. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-2 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-2 b | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-2 b | |||
| NIST: NIST SP 800-53A (v1): CP-2.1 (iii) | |||
| CCI: | CCI-000460 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Coordinate contingency planning activities with incident handling activities. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-2 c | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-2 c | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-2 c | |||
| NIST: NIST SP 800-53A (v1): CP-2.2 (i) | |||
| CCI: | CCI-000461 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Defines the frequency with which to review the contingency plan for the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-2 c | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-2 d | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-2 d | |||
| NIST: NIST SP 800-53A (v1): CP-2.2 (ii) | |||
| CCI: | CCI-000462 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Reviews the contingency plan for the system in accordance with organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-2 c | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-2 d | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-2 d | |||
| NIST: NIST SP 800-53A (v1): CP-2.2 (iii) | |||
| CCI: | CCI-000463 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Updates the contingency plan to address changes to the organization. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-2 e | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-2 e | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-2 e | |||
| NIST: NIST SP 800-53A (v1): CP-2.2 (iv) | |||
| CCI: | CCI-000464 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Updates the contingency plan to address changes to the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-2 e | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-2 e | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-2 e | |||
| NIST: NIST SP 800-53A (v1): CP-2.2 (iv) | |||
| CCI: | CCI-000465 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Updates the contingency plan to address changes to the environment of operation. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-2 e | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-2 e | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-2 e | |||
| NIST: NIST SP 800-53A (v1): CP-2.2 (iv) | |||
| CCI: | CCI-000466 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Updates the contingency plan to address problems encountered during contingency plan implementation, execution, or testing. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-2 e | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-2 e | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-2 e | |||
| NIST: NIST SP 800-53A (v1): CP-2.2 (iv) | |||
| CCI: | CCI-000468 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Communicates contingency plan changes to an organization-defined list of key contingency personnel (identified by name and/or by role) and organizational elements. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-2 f | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-2 f | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-2 f | |||
| NIST: NIST SP 800-53A (v1): CP-2.2 (v) | |||
| CCI: | CCI-002831 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-20 |
| Definition: | Defines a list of key contingency personnel (identified by name and/or by role) and organizational elements to whom contingency plan changes are to be communicated. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CP-2 f | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-2 f | |||
| CCI: | CCI-004009 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Incorporate lessons learned from contingency plan testing, training, or actual contingency activities into contingency testing and training. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CP-2 g | ||
| CCI: | CCI-002832 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-20 |
| Definition: | Protects the contingency plan from unauthorized disclosure and modification. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CP-2 g | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-2 h | |||
| CCI: | CCI-000469 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Coordinate contingency plan development with organizational elements responsible for related plans. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-2 (1) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-2 (1) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-2 (1) | |||
| NIST: NIST SP 800-53A (v1): CP-2 (1).1 | |||
| CCI: | CCI-000470 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Conduct capacity planning so that necessary capacity for information processing exists during contingency operations. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-2 (2) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-2 (2) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-2 (2) | |||
| NIST: NIST SP 800-53A (v1): CP-2 (2).1 | |||
| CCI: | CCI-000471 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Conduct capacity planning so that necessary capacity for telecommunications exists during contingency operations. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-2 (2) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-2 (2) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-2 (2) | |||
| NIST: NIST SP 800-53A (v1): CP-2 (2).1 | |||
| CCI: | CCI-000472 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Conduct capacity planning so that necessary capacity for environmental support exists during contingency operations. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-2 (2) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-2 (2) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-2 (2) | |||
| NIST: NIST SP 800-53A (v1): CP-2 (2).1 | |||
| CCI: | CCI-000473 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Defines the time period for planning the resumption of essential missions as a result of contingency plan activation. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-2 (3) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-2 (3) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-2 (3) | |||
| NIST: NIST SP 800-53A (v1): CP-2 (3).1 (i) | |||
| CCI: | CCI-000474 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Defines the time period for planning the resumption of essential business functions as a result of contingency plan activation. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-2 (3) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-2 (3) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-2 (3) | |||
| NIST: NIST SP 800-53A (v1): CP-2 (3).1 (i) | |||
| CCI: | CCI-000475 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Plan for the resumption of all or essential mission functions within the organization-defined time period of contingency plan activation. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-2 (3) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-2 (3) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-2 (3) | |||
| NIST: NIST SP 800-53A (v1): CP-2 (3).1 (ii) | |||
| CCI: | CCI-000476 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Plan for the resumption of all or essential business functions within the organization-defined time period of contingency plan activation. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-2 (3) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-2 (3) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-2 (3) | |||
| NIST: NIST SP 800-53A (v1): CP-2 (3).1 (ii) | |||
| CCI: | CCI-000481 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Plan for the continuance of all or essential missions with little or no loss of operational continuity. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-2 (5) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-2 (5) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-2 (5) | |||
| NIST: NIST SP 800-53A (v1): CP-2 (5).1 (a) | |||
| CCI: | CCI-000482 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Plan for the continuance of all or essential business functions with little or no loss of operational continuity. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-2 (5) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-2 (5) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-2 (5) | |||
| NIST: NIST SP 800-53A (v1): CP-2 (5).1 (a) | |||
| CCI: | CCI-001599 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-12 |
| Definition: | Sustain operational continuity of essential missions until full system restoration at primary processing and/or storage sites. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-2 (5) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-2 (5) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-2 (5) | |||
| NIST: NIST SP 800-53A (v1): CP-2 (5).1 (b) | |||
| CCI: | CCI-001600 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-12 |
| Definition: | Sustains operational continuity of essential business functions until full system restoration at primary processing and/or storage sites. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-2 (5) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-2 (5) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-2 (5) | |||
| NIST: NIST SP 800-53A (v1): CP-2 (5).1 (b) | |||
| CCI: | CCI-000483 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Plan for the transfer of all or essential mission functions to alternate processing and/or storage sites with minimal or no loss of operational continuity. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-2 (6) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-2 (6) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-2 (6) | |||
| NIST: NIST SP 800-53A (v1): CP-2 (6).1 (i) | |||
| CCI: | CCI-000484 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Plan for the transfer of all or essential business functions to alternate processing and/or storage sites with minimal or no loss of operational continuity. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-2 (6) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-2 (6) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-2 (6) | |||
| NIST: NIST SP 800-53A (v1): CP-2 (6).1 (i) | |||
| CCI: | CCI-001601 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-12 |
| Definition: | Sustain operational continuity of essential mission functions at alternate processing and/or storage sites until system restoration to primary processing and/or storage sites. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-2 (6) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-2 (6) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-2 (6) | |||
| NIST: NIST SP 800-53A (v1): CP-2 (6).1 (ii) | |||
| CCI: | CCI-001602 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-12 |
| Definition: | Sustain operational continuity of essential business functions at alternate processing and/or storage sites until system restoration at primary processing and/or storage sites. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-2 (6) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-2 (6) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-2 (6) | |||
| NIST: NIST SP 800-53A (v1): CP-2 (6).1 (ii) | |||
| CCI: | CCI-002827 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-20 |
| Definition: | Coordinate the contingency plan with the contingency plans of external service providers to ensure that contingency requirements can be satisfied. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CP-2 (7) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-2 (7) | |||
| CCI: | CCI-002828 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-20 |
| Definition: | Identify critical system assets supporting all or essential mission functions. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CP-2 (8) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-2 (8) | |||
| CCI: | CCI-002829 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-20 |
| Definition: | Identify critical system assets supporting all or essential business functions. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CP-2 (8) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-2 (8) | |||
| CCI: | CCI-000485 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Defines the frequency of contingency training to system users. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-3 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-3 c | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-3 a 3 | |||
| NIST: NIST SP 800-53A (v1): CP-3.1 (ii) | |||
| CCI: | CCI-000486 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Provide contingency training to system users consistent with assigned roles and responsibilities within an organization-defined time period of assuming a contingency role or responsibility. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-3 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-3 a | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-3 a 1 | |||
| NIST: NIST SP 800-53A (v1): CP-3.1 (i) | |||
| CCI: | CCI-000487 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Provide contingency training to system users consistent with assigned roles and responsibilities in accordance with organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-3 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-3 c | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-3 a 3 | |||
| NIST: NIST SP 800-53A (v1): CP-3.1 (iii) | |||
| CCI: | CCI-002833 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-20 |
| Definition: | Defines the time period that contingency training is to be provided to system users consistent with assigned roles and responsibilities within assuming a contingency role or responsibility. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CP-3 a | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-3 a 1 | |||
| CCI: | CCI-002834 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-20 |
| Definition: | Provide contingency training to system users consistent with assigned roles and responsibilities when required by system changes. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CP-3 b | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-3 a 2 | |||
| CCI: | CCI-004010 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Review and update contingency training content on an organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CP-3 b | ||
| CCI: | CCI-004011 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Defines the frequency the contingency training content will be reviewed and updated. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CP-3 b | ||
| CCI: | CCI-004012 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Review and update contingency training content following organization-defined events. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CP-3 b | ||
| CCI: | CCI-004013 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Defines the events for which the contingency training content will be reviewed and updated. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CP-3 b | ||
| CCI: | CCI-000488 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Incorporate simulated events into contingency training to facilitate effective response by personnel in crisis situations. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-3 (1) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-3 (1) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-3 (1) | |||
| NIST: NIST SP 800-53A (v1): CP-3 (1).1 (i) (ii) | |||
| CCI: | CCI-000489 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Employ mechanisms used in operations to provide a more thorough and realistic contingency training environment. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-3 (2) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-3 (2) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-3 (2) | |||
| NIST: NIST SP 800-53A (v1): CP-3 (2).1 | |||
| CCI: | CCI-000490 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Defines the frequency with which to test the contingency plan for the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-4 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-4 a | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-4 a | |||
| NIST: NIST SP 800-53A (v1): CP-4.1 (ii) | |||
| CCI: | CCI-000492 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Defines the contingency plan tests to be conducted for the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-4 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-4 a | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-4 a | |||
| NIST: NIST SP 800-53A (v1): CP-4.1 (i) | |||
| CCI: | CCI-000494 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Test the contingency plan for the system in accordance with organization-defined frequency using organization-defined tests to determine the effectiveness of the plan and the organizational readiness to execute the plan. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-4 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-4 a | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-4 a | |||
| NIST: NIST SP 800-53A (v1): CP-4.1 (iii) | |||
| CCI: | CCI-000496 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Review the contingency plan test results. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-4 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-4 b | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-4 b | |||
| NIST: NIST SP 800-53A (v1): CP-4.1 (iv) | |||
| CCI: | CCI-000497 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Initiate corrective actions, if needed, after reviewing the contingency plan test results. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-4 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-4 c | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-4 c | |||
| NIST: NIST SP 800-53A (v1): CP-4.1 (iv) | |||
| CCI: | CCI-000498 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Coordinate contingency plan testing with organizational elements responsible for related plans. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-4 (1) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-4 (1) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-4 (1) | |||
| NIST: NIST SP 800-53A (v1): CP-4 (1).1 | |||
| CCI: | CCI-000500 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Test the contingency plan at the alternate processing site to familiarize contingency personnel with the facility and available resources. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-4 (2) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-4 (2) (a) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-4 (2) (a) | |||
| NIST: NIST SP 800-53A (v1): CP-4 (2).1 | |||
| CCI: | CCI-002835 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-20 |
| Definition: | Test the contingency plan at the alternate processing site to evaluate the capabilities of the alternate processing site to support contingency operations. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CP-4 (2) (b) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-4 (2) (b) | |||
| CCI: | CCI-000502 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Test the contingency plan using organization-defined automated mechanisms. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-4 (3) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-4 (3) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-4 (3) | |||
| NIST: NIST SP 800-53A (v1): CP-4 (3).1 | |||
| CCI: | CCI-004014 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Defines the automated mechanisms to test the contingency plan. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CP-4 (3) | ||
| CCI: | CCI-000504 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Include a full recovery and reconstitution of the system to a known state as part of contingency plan testing. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-4 (4) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-4 (4)4 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-4 (4) | |||
| NIST: NIST SP 800-53A (v1): CP-4 (4).1 | |||
| CCI: | CCI-004015 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Employ organization-defined mechanisms to organization-defined system or system component to disrupt and adversely affect the system or system component. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CP-4 (5) | ||
| CCI: | CCI-004016 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Defines the mechanisms employed to disrupt and adversely affect the system or system component. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CP-4 (5) | ||
| CCI: | CCI-004017 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Defines the system or system component used to employ organization-defined mechanisms. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CP-4 (5) | ||
| CCI: | CCI-000505 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Establish an alternate storage site, including necessary agreements to permit the storage of system backup information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-6 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-6 a | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-6 a | |||
| NIST: NIST SP 800-53A (v1): CP-6.1 (i) | |||
| CCI: | CCI-004018 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Establish an alternate storage site, including necessary agreements to permit the retrieval of system backup information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CP-6 a | ||
| CCI: | CCI-002836 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-20 |
| Definition: | Ensure that the alternate storage site provides security controls equivalent to that of the primary site. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CP-6 b | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-6 b | |||
| CCI: | CCI-000507 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Identify an alternate storage site that is sufficiently separated from the primary storage site to reduce susceptibility to the same threats. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-6 (1) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-6 (1) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-6 (1) | |||
| NIST: NIST SP 800-53A (v1): CP-6 (1).1 (ii) | |||
| CCI: | CCI-000508 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Configure the alternate storage site to facilitate recovery operations in accordance with recovery time and recovery point objectives. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-6 (2) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-6 (2) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-6 (2) | |||
| NIST: NIST SP 800-53A (v1): CP-6 (2).1 | |||
| CCI: | CCI-000509 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Identify potential accessibility problems to the alternate storage site in the event of an area-wide disruption or disaster. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-6 (3) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-6 (3) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-6 (3) | |||
| NIST: NIST SP 800-53A (v1): CP-6 (3).1 (i) | |||
| CCI: | CCI-001604 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-12 |
| Definition: | Outline explicit mitigation actions for potential accessibility problems to the alternate storage site in the event of an area-wide disruption or disaster. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-6 (3) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-6 (3) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-6 (3) | |||
| NIST: NIST SP 800-53A (v1): CP-6 (3).1 (ii) | |||
| CCI: | CCI-000510 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Defines the time-period consistent with recovery time and recovery point objectives for essential missions/business functions to permit the transfer and resumption of organization-defined system operations at an alternate processing site when the primary processing capabilities are unavailable. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-7 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-7 a | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-7 a | |||
| NIST: NIST SP 800-53A (v1): CP-7.1 (ii) | |||
| CCI: | CCI-000513 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Establish an alternate processing site including necessary agreements to permit the transfer and resumption of organization-defined system operations for essential mission functions within an organization-defined time period consistent with recovery time and recovery point objectives when the primary processing capabilities are unavailable. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-7 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-7 a | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-7 a | |||
| NIST: NIST SP 800-53A (v1): CP-7.1 (iii) | |||
| CCI: | CCI-000514 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Establish an alternate processing site including necessary agreements to permit the transfer and resumption of organization-defined system operations for essential business functions within an organization-defined time period consistent with recovery time and recovery point objectives when the primary processing capabilities are unavailable. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-7 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-7 a | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-7 a | |||
| NIST: NIST SP 800-53A (v1): CP-7.1 (iii) | |||
| CCI: | CCI-002839 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-20 |
| Definition: | Defines system operations that are permitted to transfer and resume at an alternate processing site for essential missions/business functions when the primary processing capabilities are unavailable. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CP-7 a | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-7 a | |||
| CCI: | CCI-000515 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Make available at the alternate processing site, the equipment and supplies required to transfer and resume operations or put contracts in place to support delivery to the site within the organization-defined time period for transfer and resumption. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-7 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-7 b | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-7 b | |||
| NIST: NIST SP 800-53A (v1): CP-7.1 (iv) | |||
| CCI: | CCI-000521 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Provide controls at the alternate processing site that are equivalent to those at the primary site. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-7 (5) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-7 c | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-7 c | |||
| NIST: NIST SP 800-53A (v1): CP-7 (5).1 | |||
| CCI: | CCI-000516 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Identify an alternate processing site that is sufficiently separated from the primary processing site to reduce susceptibility to the same threats. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-7 (1) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-7 (1) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-7 (1) | |||
| NIST: NIST SP 800-53A (v1): CP-7 (1).1 (ii) | |||
| CCI: | CCI-000517 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Identify potential accessibility problems to the alternate processing site in the event of an area-wide disruption or disaster. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-7 (2) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-7 (2) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-7 (2) | |||
| NIST: NIST SP 800-53A (v1): CP-7 (2).1 (i) | |||
| CCI: | CCI-001606 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-12 |
| Definition: | Identify potential accessibility problems to outline explicit mitigation actions. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-7 (2) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-7 (2) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-7 (2) | |||
| NIST: NIST SP 800-53A (v1): CP-7 (2).1 (ii) | |||
| CCI: | CCI-000518 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Develop alternate processing site agreements that contain priority-of-service provisions in accordance with availability requirements (including recovery time objectives). | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-7 (3) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-7 (3) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-7 (3) | |||
| NIST: NIST SP 800-53A (v1): CP-7 (3).1 | |||
| CCI: | CCI-000519 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Prepare the alternate processing site so that the site can serve as the operational site supporting essential missions. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-7 (4) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-7 (4) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-7 (4) | |||
| NIST: NIST SP 800-53A (v1): CP-7 (4).1 | |||
| CCI: | CCI-000520 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Prepare the alternate processing site so that the site can serve as the operational site supporting essential business functions. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-7 (4) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-7 (4) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-7 (4) | |||
| NIST: NIST SP 800-53A (v1): CP-7 (4).1 | |||
| CCI: | CCI-002837 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-20 |
| Definition: | Plan for circumstances that preclude returning to the primary processing site. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CP-7 (6) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-7 (6) | |||
| CCI: | CCI-002838 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-20 |
| Definition: | Prepare for circumstances that preclude returning to the primary processing site. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CP-7 (6) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-7 (6) | |||
| CCI: | CCI-000522 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Defines the time-period within which to permit the resumption of organization-defined system operations for essential mission functions when the primary telecommunications capabilities are unavailable at either the primary or alternate processing or storage sites. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-8 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-8 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-8 | |||
| NIST: NIST SP 800-53A (v1): CP-8.1 (ii) | |||
| CCI: | CCI-000523 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Defines the time-period within which to permit the resumption of organization-defined system operations for essential business functions when the primary telecommunications capabilities are unavailable at either the primary or alternate processing or storage sites. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-8 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-8 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-8 | |||
| NIST: NIST SP 800-53A (v1): CP-8.1 (ii) | |||
| CCI: | CCI-000524 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Establish alternate telecommunication services, including necessary agreements to permit the resumption of organization-defined system operations for essential mission functions within an organization-defined time period when the primary telecommunications capabilities are unavailable at either the primary or alternate processing or storage sites. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-8 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-8 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-8 | |||
| NIST: NIST SP 800-53A (v1): CP-8.1 (iii) | |||
| CCI: | CCI-000525 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Establish alternate telecommunication services, including necessary agreements to permit the resumption of organization-defined system operations for essential business functions within an organization-defined time period when the primary telecommunications capabilities are unavailable at either the primary or alternate processing or storage sites. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-8 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-8 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-8 | |||
| NIST: NIST SP 800-53A (v1): CP-8.1 (iii) | |||
| CCI: | CCI-002840 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-20 |
| Definition: | Defines the system operations to be resumed for essential mission functions within the organization-defined time period when the primary telecommunications capabilities are unavailable at either the primary or alternate processing or storage sites. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CP-8 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-8 | |||
| CCI: | CCI-002841 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-20 |
| Definition: | Defines the system operations to be resumed for essential business functions within the organization-defined time period when the primary telecommunications capabilities are unavailable at either the primary or alternate processing or storage sites. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CP-8 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-8 | |||
| CCI: | CCI-000526 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Develop primary telecommunications service agreements that contain priority-of-service provisions in accordance with availability requirements (including recovery time objectives). | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-8 (1) (a) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-8 (1) (a) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-8 (1) (a) | |||
| NIST: NIST SP 800-53A (v1): CP-8 (1).1 (i) | |||
| CCI: | CCI-000527 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Develop alternate telecommunications service agreements that contain priority-of-service provisions in accordance with availability requirements (including recovery time objectives). | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-8 (1) (a) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-8 (1) (a) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-8 (1) (a) | |||
| NIST: NIST SP 800-53A (v1): CP-8 (1).1 (i) | |||
| CCI: | CCI-004019 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Request Telecommunications Service Priority for all telecommunications services used for national security emergency preparedness in the event that the primary and/or alternate telecommunications services are provided by a common carrier. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CP-8 (1) (b) | ||
| CCI: | CCI-000530 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Obtain alternate telecommunications services to reduce the likelihood of sharing a single point of failure with primary telecommunications services. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-8 (2) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-8 (2) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-8 (2) | |||
| NIST: NIST SP 800-53A (v1): CP-8 (2).1 | |||
| CCI: | CCI-000531 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Obtain alternate telecommunications services from providers that are separated from primary service providers to reduce susceptibility to the same threats. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-8 (3) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-8 (3) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-8 (3) | |||
| NIST: NIST SP 800-53A (v1): CP-8 (3).1 (ii) | |||
| CCI: | CCI-000532 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Require primary telecommunications service providers to have contingency plans. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-8 (4) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-8 (4) (a) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-8 (4) (a) | |||
| NIST: NIST SP 800-53A (v1): CP-8 (4).1 | |||
| CCI: | CCI-000533 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Require alternate telecommunications service providers to have contingency plans. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-8 (4) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-8 (4) (a) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-8 (4) (a) | |||
| NIST: NIST SP 800-53A (v1): CP-8 (4).1 | |||
| CCI: | CCI-002842 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-20 |
| Definition: | Review provider contingency plans to ensure that the plans meet organizational contingency requirements. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CP-8 (4) (b) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-8 (4) (b) | |||
| CCI: | CCI-002843 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-20 |
| Definition: | Defines the frequency with which to obtain evidence of contingency testing by providers. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CP-8 (4) (c) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-8 (4) (c) | |||
| CCI: | CCI-002844 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-20 |
| Definition: | Defines the frequency with which to obtain evidence of contingency training by providers. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CP-8 (4) (c) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-8 (4) (c) | |||
| CCI: | CCI-002845 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-20 |
| Definition: | Obtain evidence of contingency testing by providers in accordance with organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CP-8 (4) (c) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-8 (4) (c) | |||
| CCI: | CCI-002846 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-20 |
| Definition: | Obtain evidence of contingency training by providers in accordance with organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CP-8 (4) (c) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-8 (4) (c) | |||
| CCI: | CCI-002847 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-20 |
| Definition: | Defines the frequency with which to test alternate telecommunication services. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CP-8 (5) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-8 (5) | |||
| CCI: | CCI-002848 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-20 |
| Definition: | Test alternate telecommunication services per organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CP-8 (5) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-8 (5) | |||
| CCI: | CCI-000534 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Defines the frequency of conducting user-level information backups to support recovery time objectives and recovery point objectives. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-9 (a) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-9 (a) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-9 (a) | |||
| NIST: NIST SP 800-53A (v1): CP-9 (6).1 (ii) | |||
| CCI: | CCI-000535 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Conduct backups of user-level information contained in organization-defined system components per organization-defined frequency that is consistent with recovery time and recovery point objectives. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-9 (a) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-9 (a) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-9 (a) | |||
| NIST: NIST SP 800-53A (v1): CP-9.1 (iv) | |||
| CCI: | CCI-000536 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Defines the frequency of conducting system-level information backups to support recovery time objectives and recovery point objectives. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-9 (b) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-9 (b) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-9 (b) | |||
| NIST: NIST SP 800-53A (v1): CP-9.1 (ii) | |||
| CCI: | CCI-000537 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Conduct backups of system-level information contained in the system per organization-defined frequency that is consistent with recovery time and recovery point objectives. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-9 (b) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-9 (b) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-9 (b) | |||
| NIST: NIST SP 800-53A (v1): CP-9.1 (v) | |||
| CCI: | CCI-000538 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Defines the frequency of conducting system documentation backups, including security-related documentation, to support recovery time objectives and recovery point objectives. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-9 (c) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-9 (c) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-9 (c) | |||
| NIST: NIST SP 800-53A (v1): CP-9.1 (iii) | |||
| CCI: | CCI-000539 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Conduct backups of system documentation, including security-related documentation, per an organization-defined frequency that is consistent with recovery time and recovery point objectives. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-9 (c) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-9 (c) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-9 (c) | |||
| NIST: NIST SP 800-53A (v1): CP-9.1 (vi) | |||
| CCI: | CCI-004020 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Defines the system components to conduct backups of user level information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CP-9 (a) | ||
| CCI: | CCI-004021 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Conduct backups of system documentation, including privacy-related documentation, per an organization-defined frequency that is consistent with recovery time and recovery point objectives. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CP-9 (c) | ||
| CCI: | CCI-004022 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Protect the confidentiality of backup information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CP-9 (d) | ||
| CCI: | CCI-004023 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Protect integrity of backup information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CP-9 (d) | ||
| CCI: | CCI-004024 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Protect the availability of backup information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CP-9 (d) | ||
| CCI: | CCI-000541 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Defines the frequency with which to test backup information to verify media reliability and information integrity. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-9 (1) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-9 (1) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-9 (1) | |||
| NIST: NIST SP 800-53A (v1): CP-9 (1).1 (i) | |||
| CCI: | CCI-000542 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Test backup information per an organization-defined frequency to verify media reliability and information integrity. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-9 (1) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-9 (1) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-9 (1) | |||
| NIST: NIST SP 800-53A (v1): CP-9 (1).1 (ii) | |||
| CCI: | CCI-000543 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Use a sample of backup information in the restoration of selected system functions as part of contingency plan testing. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-9 (2) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-9 (2) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-9 (2) | |||
| NIST: NIST SP 800-53A (v1): CP-9 (2).1 | |||
| CCI: | CCI-002849 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-20 |
| Definition: | Defines critical system software and other security-related information, of which backup copies must be stored in a separate facility or in a fire-rated container. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CP-9 (3) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-9 (3) | |||
| CCI: | CCI-002850 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-20 |
| Definition: | Store backup copies of organization-defined critical system software and other security-related information in a separate facility or in a fire-rated container that is not collocated with the operational system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CP-9 (3) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-9 (3) | |||
| CCI: | CCI-000547 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Defines the time-period and transfer rate of the system backup information to the alternate storage site consistent with the recovery time and recovery point objectives. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-9 (5) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-9 (5) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-9 (5) | |||
| NIST: NIST SP 800-53A (v1): CP-9 (5).1 (i) | |||
| CCI: | CCI-000548 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Transfer system backup information to the alternate storage site in accordance with the organization-defined time period and transfer rate consistent with the recovery time and recovery point objectives. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-9 (5) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-9 (5) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-9 (5) | |||
| NIST: NIST SP 800-53A (v1): CP-9 (5).1 (ii) | |||
| CCI: | CCI-000549 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Maintain a redundant secondary system that is not collocated with the primary system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-9 (6) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-9 (6) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-9 (6) | |||
| NIST: NIST SP 800-53A (v1): CP-9 (6).1 (i) | |||
| CCI: | CCI-001609 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-12 |
| Definition: | Activate the redundant secondary system that is not collocated with the primary system without loss of information or disruption to operations. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-9 (6) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-9 (6) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-9 (6) | |||
| NIST: NIST SP 800-53A (v1): CP-9 (6).1 (ii) | |||
| CCI: | CCI-002851 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-20 |
| Definition: | Defines the backup information that requires dual authorization for deletion or destruction. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CP-9 (7) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-9 (7) | |||
| CCI: | CCI-002852 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-20 |
| Definition: | Enforce dual authorization for the deletion or destruction of organization-defined backup information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CP-9 (7) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-9 (7) | |||
| CCI: | CCI-004025 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Implement cryptographic mechanisms to prevent unauthorized disclosure of organization-defined backup information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CP-9 (8) | ||
| CCI: | CCI-004026 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Implement cryptographic mechanisms to prevent unauthorized modification of organization-defined backup information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CP-9 (8) | ||
| CCI: | CCI-004027 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Defines the backup information which is protected by cryptographic mechanisms preventing unauthorized disclosure and modification. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CP-9 (8) | ||
| CCI: | CCI-004028 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Provide for the recovery and reconstitution of the system to a known state within an organization-defined time-period consistent with recovery time and recovery point objectives after a disruption, compromise, or failure. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CP-10 | ||
| CCI: | CCI-004029 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Defines the time-period consistent with recovery time and recovery point objectives for the recovery and reconstitution of the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CP-10 | ||
| CCI: | CCI-000553 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Implement transaction recovery for systems that are transaction-based. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-10 (2) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-10 (2) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-10 (2) | |||
| NIST: NIST SP 800-53A (v1): CP-10 (2).1 | |||
| CCI: | CCI-000556 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Defines restoration time periods within which to restore system components from configuration-controlled and integrity-protected information representing a known, operational state for the components. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-10 (4) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-10 (4) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-10 (4) | |||
| NIST: NIST SP 800-53A (v1): CP-10 (4).1 | |||
| CCI: | CCI-000557 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Provide the capability to restore information system components within organization-defined restoration time periods from configuration-controlled and integrity-protected information representing a known, operational state for the components. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-10 (4) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-10 (4) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-10 (4) | |||
| NIST: NIST SP 800-53A (v1): CP-10 (4).1 | |||
| CCI: | CCI-004030 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Protect system components used for recovery and reconstitution. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): CP-10 (6) | ||
| CCI: | CCI-002853 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-20 |
| Definition: | Provide the capability to employ organization-defined alternative communications protocols in support of maintaining continuity of operations. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CP-11 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-11 | |||
| CCI: | CCI-002854 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-20 |
| Definition: | Defines the alternative communications protocols the system must be capable of providing in support of maintaining continuity of operations. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CP-11 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-11 | |||
| CCI: | CCI-002855 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-20 |
| Definition: | When organization-defined conditions are detected, enters a safe mode of operation with organization-defined restrictions of safe mode of operation. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CP-12 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-12 | |||
| CCI: | CCI-002856 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-20 |
| Definition: | Defines the conditions that, when detected, the system enters a safe mode of operation with organization-defined restrictions of safe mode of operation. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CP-12 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-12 | |||
| CCI: | CCI-002857 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-20 |
| Definition: | Defines the restrictions of the safe mode of operation that the system will enter when organization-defined conditions are detected. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CP-12 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-12 | |||
| CCI: | CCI-002858 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-20 |
| Definition: | Employ organization-defined alternative or supplemental security mechanisms for satisfying organization-defined security functions when the primary means of implementing the security function is unavailable or compromised. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CP-13 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-13 | |||
| CCI: | CCI-002859 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-20 |
| Definition: | Defines the alternative or supplemental security mechanisms that will be employed for satisfying organization-defined security functions when the primary means of implementing the security function is unavailable or compromised. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CP-13 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-13 | |||
| CCI: | CCI-002860 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-20 |
| Definition: | Defines the security functions that must be satisfied when the primary means of implementing the security function is unavailable or compromised. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CP-13 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): CP-13 | |||
| CCI: | CCI-000757 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-17 |
| Definition: | Disseminate an organization-level; mission/business process-level; and/or system-level identification and authentication policy to organization-defined personnel. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): IA-1 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): IA-1 a 1 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): IA-1 a 1 (a) | |||
| NIST: NIST SP 800-53A (v1): IA-1.1 (iii) | |||
| CCI: | CCI-004031 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Defines the personnel or roles the organization-level; mission/business process-level; and/or system-level identification and authorization policy is disseminated to. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IA-1 a 1 | ||
| CCI: | CCI-004032 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Develop and document an organization-level; mission/business process-level; and/or system-level identification and authorization policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination, among organizational entities, and compliance. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IA-1 a 1 (a) | ||
| CCI: | CCI-004033 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Develop and document an organization-level; mission/business process-level; and/or system-level identification and authorization policy that is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IA-1 a 1 (b) | ||
| CCI: | CCI-004034 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Develop and document the procedures to facilitate the implementation of the identification and authorization policy and the associated identification and authentication controls. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IA-1 a 2 | ||
| CCI: | CCI-004035 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Designate an organization-defined official to manage development and documentation of the identification and authentication policy. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IA-1 b | ||
| CCI: | CCI-004036 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Designate an organization-defined official to manage dissemination of the identification and authentication policy. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IA-1 b | ||
| CCI: | CCI-004037 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Designate an organization-defined official to manage development and documentation of the identification and authentication procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IA-1 b | ||
| CCI: | CCI-004038 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Designate an organization-defined official to manage dissemination of the identification and authentication procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IA-1 b | ||
| CCI: | CCI-004039 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Defines the official designated to managing the development, documentation, and dissemination of the identification and authentication policy. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IA-1 b | ||
| CCI: | CCI-004040 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Defines the official designated to managing the development, documentation, and dissemination of the identification and authentication procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IA-1 b | ||
| CCI: | CCI-000758 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-17 |
| Definition: | Review and update the current identification and authentication policy in accordance with the organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): IA-1 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): IA-1 b 1 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): IA-1 c 1 | |||
| NIST: NIST SP 800-53A (v1): IA-1.2 (ii) | |||
| CCI: | CCI-000759 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-17 |
| Definition: | Defines a frequency for reviewing and updating the identification and authentication policy. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): IA-1 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): IA-1 b 1 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): IA-1 c 1 | |||
| NIST: NIST SP 800-53A (v1): IA-1.2 (i) | |||
| CCI: | CCI-000762 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-17 |
| Definition: | Review and update the current identification and authentication procedures in accordance with the organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): IA-1 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): IA-1 b 2 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): IA-1 c 2 | |||
| NIST: NIST SP 800-53A (v1): IA-1.2 (iv) | |||
| CCI: | CCI-000763 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-17 |
| Definition: | Defines a frequency for reviewing and updating the identification and authentication procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): IA-1 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): IA-1 b 2 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): IA-1 c 2 | |||
| NIST: NIST SP 800-53A (v1): IA-1.2 (iii) | |||
| CCI: | CCI-004041 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Review and update the current identification and authentication policy following organization-defined events. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IA-1 c 1 | ||
| CCI: | CCI-004042 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Defines the events following reviewing and updating the current identification and authentication policy. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IA-1 c 1 | ||
| CCI: | CCI-004043 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Review and update the current identification and authentication procedures following organization-defined events. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IA-1 c 2 | ||
| CCI: | CCI-004044 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Defines the events following reviewing and updating the current identification and authentication procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IA-1 c 2 | ||
| CCI: | CCI-000764 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-17 |
| Definition: | Uniquely identify and authenticate organizational users and associate that unique identification with processes acting on behalf of those users. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): IA-2 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): IA-2 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): IA-2 | |||
| NIST: NIST SP 800-53A (v1): IA-2.1 | |||
| CCI: | CCI-000765 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-17 |
| Definition: | Implement multifactor authentication for access to privileged accounts. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): IA-2 (1) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): IA-2 (1) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): IA-2 (1) | |||
| NIST: NIST SP 800-53A (v1): IA-2 (1).1 | |||
| CCI: | CCI-000766 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-17 |
| Definition: | Implement multifactor authentication for access to non-privileged accounts. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): IA-2 (2) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): IA-2 (2) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): IA-2 (2) | |||
| NIST: NIST SP 800-53A (v1): IA-2 (2).1 | |||
| CCI: | CCI-004045 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Require users to be individually authenticated before granting access to the shared accounts or resources. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IA-2 (5) | ||
| CCI: | CCI-004046 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Implement multi-factor authentication for local; network; and/or remote access to privileged accounts; and/or non-privileged accounts such that one of the factors is provided by a device separate from the system gaining access. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IA-2 (6) (a) | ||
| CCI: | CCI-004047 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Implement multi-factor authentication for local; network; and/or remote access to privileged accounts; and/or non-privileged accounts such that the device meets organization-defined strength of mechanism requirements. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IA-2 (6) (b) | ||
| CCI: | CCI-004048 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Defines the strength of mechanism requirements for implementing multi-factor authentication. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IA-2 (6) (b) | ||
| CCI: | CCI-001941 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-05-03 |
| Definition: | Implement replay-resistant authentication mechanisms for access to privileged accounts and/or non-privileged accounts. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IA-2 (8) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): IA-2 (8) | |||
| CCI: | CCI-001943 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-05-03 |
| Definition: | Defines the system accounts for which single sign-on capability will be provided. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IA-2 (10) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): IA-2 (10) | |||
| CCI: | CCI-001944 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-05-03 |
| Definition: | Defines the system services for which single sign-on capability will be provided. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IA-2 (10) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): IA-2 (10) | |||
| CCI: | CCI-001945 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-05-03 |
| Definition: | Provide a single sign-on capability for organization-defined system accounts. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IA-2 (10) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): IA-2 (10) | |||
| CCI: | CCI-001946 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-05-03 |
| Definition: | Provide a single sign-on capability for organization-defined system services. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IA-2 (10) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): IA-2 (10) | |||
| CCI: | CCI-001953 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-05-03 |
| Definition: | Accept Personal Identity Verification-compliant credentials. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IA-2 (12) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): IA-2 (12) | |||
| CCI: | CCI-001954 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-05-03 |
| Definition: | Electronically verify Personal Identity Verification-compliant credentials. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IA-2 (12) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): IA-2 (12) | |||
| CCI: | CCI-001955 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-05-03 |
| Definition: | Defines the out-of-band authentication to be implemented under organization-defined conditions. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IA-2 (13) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): IA-2 (13) | |||
| CCI: | CCI-001956 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-05-03 |
| Definition: | Defines the conditions for implementing organization-defined out-of-band authentication. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IA-2 (13) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): IA-2 (13) | |||
| CCI: | CCI-001957 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-05-03 |
| Definition: | Implement organization-defined out-of-band authentication mechanisms under organization-defined conditions. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IA-2 (13) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): IA-2 (13) | |||
| CCI: | CCI-000777 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-17 |
| Definition: | Defines devices and/or types of devices for which identification and authentication is required before establishing a connection. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): IA-3 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): IA-3 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): IA-3 | |||
| NIST: NIST SP 800-53A (v1): IA-3.1 (i) | |||
| CCI: | CCI-000778 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-17 |
| Definition: | Uniquely identify organization-defined devices and/or types of devices before establishing a local, remote, and/or network connection. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): IA-3 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): IA-3 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): IA-3 | |||
| NIST: NIST SP 800-53A (v1): IA-3.1 (ii) | |||
| CCI: | CCI-001958 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-05-03 |
| Definition: | Authenticate organization-defined devices and/or types of devices before establishing a local, remote, and/or network connection. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IA-3 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): IA-3 | |||
| CCI: | CCI-001959 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-05-03 |
| Definition: | Defines the devices and/or types of devices the system is to authenticate before establishing a connection. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IA-3 (1) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): IA-3 (1) | |||
| CCI: | CCI-001967 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-05-03 |
| Definition: | Authenticate organization-defined devices and/or types of devices before establishing a local, remote, and/or network connection using bidirectional authentication that is cryptographically based. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IA-3 (1) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): IA-3 (1) | |||
| CCI: | CCI-001960 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-05-03 |
| Definition: | Defines the lease information to be assigned to devices. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IA-3 (3) (a) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): IA-3 (3) (a) | |||
| CCI: | CCI-001961 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-05-03 |
| Definition: | Defines the lease duration to be assigned to devices. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IA-3 (3) (a) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): IA-3 (3) (a) | |||
| CCI: | CCI-001962 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-05-03 |
| Definition: | Where addresses are allocated dynamically, standardize dynamic address allocation lease information assigned to devices in accordance with organization-defined lease information. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IA-3 (3) (a) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): IA-3 (3) (a) | |||
| CCI: | CCI-001963 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-05-03 |
| Definition: | Where addresses are allocated dynamically, standardize dynamic address allocation lease duration assigned to devices in accordance with organization-defined lease duration. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IA-3 (3) (a) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): IA-3 (3) (a) | |||
| CCI: | CCI-000783 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-17 |
| Definition: | Audit lease information when assigned to a device. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): IA-3 (3) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): IA-3 (3) (b) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): IA-3 (3) (b) | |||
| NIST: NIST SP 800-53A (v1): IA-3 (3).1 (ii) | |||
| CCI: | CCI-001965 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-05-03 |
| Definition: | Defines the configuration management process that is to handle the device authentication procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IA-3 (4) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): IA-3 (4) | |||
| CCI: | CCI-001966 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-05-03 |
| Definition: | Handle device identification based on attestation is handled by the organization-defined configuration management process. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IA-3 (4) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): IA-3 (4) | |||
| CCI: | CCI-001968 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-05-03 |
| Definition: | Defines the configuration management process that is to handle the device identification procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IA-3 (4) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): IA-3 (4) | |||
| CCI: | CCI-001969 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-05-03 |
| Definition: | Handle device authentication based on attestation is handled by the organization-defined configuration management process. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IA-3 (4) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): IA-3 (4) | |||
| CCI: | CCI-001970 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-05-03 |
| Definition: | Defines the personnel or roles that authorize the assignment of individual, group, role, and device identifiers. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IA-4 a | ||
| NIST: NIST SP 800-53 Revision 5 (v5): IA-4 a | |||
| CCI: | CCI-001971 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-05-03 |
| Definition: | Manage system identifiers by receiving authorization from organization-defined personnel or roles to assign an individual, group, role, or device identifier. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IA-4 a | ||
| NIST: NIST SP 800-53 Revision 5 (v5): IA-4 a | |||
| CCI: | CCI-001972 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-05-03 |
| Definition: | Manage system identifiers by selecting an identifier that identifies an individual, group, role, or device. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IA-4 b | ||
| NIST: NIST SP 800-53 Revision 5 (v5): IA-4 b | |||
| CCI: | CCI-001973 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-05-03 |
| Definition: | Manage system identifiers by assigning the identifier to the intended individual, group, role, or device. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IA-4 c | ||
| NIST: NIST SP 800-53 Revision 5 (v5): IA-4 c | |||
| CCI: | CCI-001974 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-05-03 |
| Definition: | Defines the time period for which the reuse of identifiers is prohibited. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IA-4 d | ||
| NIST: NIST SP 800-53 Revision 5 (v5): IA-4 d | |||
| CCI: | CCI-001975 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-05-03 |
| Definition: | Manage system identifiers by preventing reuse of identifiers for an organization-defined time period. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IA-4 d | ||
| NIST: NIST SP 800-53 Revision 5 (v5): IA-4 d | |||
| CCI: | CCI-000796 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-17 |
| Definition: | Prohibit the use of system account identifiers that are the same as public identifiers for individual accounts. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): IA-4 (1) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): IA-4 (1) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): IA-4 (1) | |||
| NIST: NIST SP 800-53A (v1): IA-4 (1).1 | |||
| CCI: | CCI-000800 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-17 |
| Definition: | Defines characteristics for identifying individual status. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): IA-4 (4) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): IA-4 (4) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): IA-4 (4) | |||
| NIST: NIST SP 800-53A (v1): IA-4 (4).1 (i) | |||
| CCI: | CCI-000801 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-17 |
| Definition: | Manage individual identifiers by uniquely identifying each individual as organization-defined characteristics identifying individual status. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): IA-4 (4) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): IA-4 (4) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): IA-4 (4) | |||
| NIST: NIST SP 800-53A (v1): IA-4 (4).1 (ii) | |||
| CCI: | CCI-001976 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-05-03 |
| Definition: | Manage individual identifiers dynamically in accordance with organization-defined identifier policy. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IA-4 (5) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): IA-4 (5) | |||
| CCI: | CCI-004049 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Defines the dynamic identifier policy for managing individual identifiers dynamically. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IA-4 (5) | ||
| CCI: | CCI-001977 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-05-03 |
| Definition: | Defines the external organizations with which it will coordinate for cross-management of identifiers. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IA-4 (6) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): IA-4 (6) | |||
| CCI: | CCI-001978 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-05-03 |
| Definition: | Coordinate with organization-defined external organizations for cross-organization management of identifiers. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IA-4 (6) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): IA-4 (6) | |||
| CCI: | CCI-004050 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Generate pairwise pseudonymous identifiers. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IA-4 (8) | ||
| CCI: | CCI-004051 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Maintain the attributes for each uniquely identified individual, device, or service in organization-defined protected central storage. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IA-4 (9) | ||
| CCI: | CCI-004052 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Defines the protected central storage for maintaining the attributes for each uniquely individual, device or service. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IA-4 (9) | ||
| CCI: | CCI-001980 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-05-03 |
| Definition: | Manage system authenticators by verifying, as part of the initial authenticator distribution, the identity of the individual, group, role, service, or device receiving the authenticator. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IA-5 a | ||
| NIST: NIST SP 800-53 Revision 5 (v5): IA-5 a | |||
| CCI: | CCI-000176 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-22 |
| Definition: | Manage system authenticators by establishing initial authenticator content for authenticators issued by the organization. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): IA-5 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): IA-5 b | |||
| NIST: NIST SP 800-53 Revision 5 (v5): IA-5 b | |||
| NIST: NIST SP 800-53A (v1): IA-5.1 (ii) | |||
| CCI: | CCI-001544 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-11-30 |
| Definition: | Manage system authenticators by ensuring that authenticators have sufficient strength of mechanism for their intended use. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): IA-5 c | ||
| NIST: NIST SP 800-53 Revision 4 (v4): IA-5 c | |||
| NIST: NIST SP 800-53 Revision 5 (v5): IA-5 c | |||
| NIST: NIST SP 800-53A (v1): IA-5.1 (ii) | |||
| CCI: | CCI-001981 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-05-03 |
| Definition: | Manage system authenticators by establishing administrative procedures for initial authenticator distribution. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IA-5 d | ||
| NIST: NIST SP 800-53 Revision 5 (v5): IA-5 d | |||
| CCI: | CCI-001984 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-05-03 |
| Definition: | Manage system authenticators by establishing administrative procedures for revoking authenticators. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IA-5 d | ||
| NIST: NIST SP 800-53 Revision 5 (v5): IA-5 d | |||
| CCI: | CCI-001985 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-05-03 |
| Definition: | Manage system authenticators by implementing administrative procedures for initial authenticator distribution. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IA-5 d | ||
| NIST: NIST SP 800-53 Revision 5 (v5): IA-5 d | |||
| CCI: | CCI-001988 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-05-03 |
| Definition: | Manage system authenticators by implementing administrative procedures for revoking authenticators. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IA-5 d | ||
| NIST: NIST SP 800-53 Revision 5 (v5): IA-5 d | |||
| CCI: | CCI-004053 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Manage system authenticators by establishing administrative procedures for lost/compromised or damaged authenticators. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IA-5 d | ||
| CCI: | CCI-004054 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Manage system authenticators by implementing administrative procedures for lost/compromised or damaged authenticators. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IA-5 d | ||
| CCI: | CCI-004055 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Manage system authenticators by changing default authenticators prior to first use. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IA-5 e | ||
| CCI: | CCI-000182 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-22 |
| Definition: | Manage system authenticators by changing or refreshing authenticators in accordance with the organization-defined time period by authenticator type or when organization-defined events occur. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): IA-5 g | ||
| NIST: NIST SP 800-53 Revision 4 (v4): IA-5 g | |||
| NIST: NIST SP 800-53 Revision 5 (v5): IA-5 f | |||
| NIST: NIST SP 800-53A (v1): IA-5.1 (ii) | |||
| CCI: | CCI-001610 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-12 |
| Definition: | Defines the time-period (by authenticator type) for changing/refreshing authenticators. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): IA-5 g | ||
| NIST: NIST SP 800-53 Revision 4 (v4): IA-5 g | |||
| NIST: NIST SP 800-53 Revision 5 (v5): IA-5 f | |||
| NIST: NIST SP 800-53A (v1): IA-5.1 (i) | |||
| CCI: | CCI-004056 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Defines the events for when to change or refresh authenticators. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IA-5 f | ||
| CCI: | CCI-000183 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-22 |
| Definition: | Manage system authenticators by protecting authenticator content from unauthorized disclosure. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): IA-5 h | ||
| NIST: NIST SP 800-53 Revision 4 (v4): IA-5 h | |||
| NIST: NIST SP 800-53 Revision 5 (v5): IA-5 g | |||
| NIST: NIST SP 800-53A (v1): IA-5.1 (ii) | |||
| CCI: | CCI-002042 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-05-03 |
| Definition: | Manage system authenticators by protecting authenticator content from unauthorized modification. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IA-5 h | ||
| NIST: NIST SP 800-53 Revision 5 (v5): IA-5 g | |||
| CCI: | CCI-000184 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-22 |
| Definition: | Manage system authenticators by requiring individuals to take, and having devices implement, specific security controls to protect authenticators. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): IA-5 i | ||
| NIST: NIST SP 800-53 Revision 4 (v4): IA-5 i | |||
| NIST: NIST SP 800-53 Revision 5 (v5): IA-5 h | |||
| NIST: NIST SP 800-53A (v1): IA-5.1 (ii) | |||
| CCI: | CCI-001990 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-05-03 |
| Definition: | Manage system authenticators by changing authenticators for group or role accounts when membership to those accounts changes. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IA-5 j | ||
| NIST: NIST SP 800-53 Revision 5 (v5): IA-5 i | |||
| CCI: | CCI-004057 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Defines the frequency for updating commonly used, expected, or compromised passwords, when they are suspected of being compromised directly or indirectly. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IA-5 (1) (a) | ||
| CCI: | CCI-004058 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | For password-based authentication, maintain a list of commonly used, expected, or compromised passwords on an organization-defined frequency. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IA-5 (1) (a) | ||
| CCI: | CCI-004059 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | For password-based authentication, update the list of passwords on an organization-defined frequency. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IA-5 (1) (a) | ||
| CCI: | CCI-004060 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | For password-based authentication, update the list of passwords when organizational passwords are suspected to have been compromised directly or indirectly. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IA-5 (1) (a) | ||
| CCI: | CCI-004061 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | For password-based authentication, verify when users create or update passwords, that the passwords are not found on the list of commonly-used, expected, or compromised passwords in IA-5 (1) (a). | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IA-5 (1) (b) | ||
| CCI: | CCI-000197 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-15 |
| Definition: | For password-based authentication, transmit passwords only over cryptographically-protected channels. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): IA-5 (1) (c) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): IA-5 (1) (c) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): IA-5 (1) (c) | |||
| NIST: NIST SP 800-53A (v1): IA-5 (1).1 (v) | |||
| CCI: | CCI-004062 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | For password-based authentication, store passwords using an approved salted key derivation function, preferably using a keyed hash. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IA-5 (1) (d) | ||
| CCI: | CCI-004063 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | For password-based authentication, require immediate selection of a new password upon account recovery. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IA-5 (1) (e) | ||
| CCI: | CCI-004064 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | For password-based authentication, allow user selection of long passwords and passphrases, including spaces and all printable characters. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IA-5 (1) (f) | ||
| CCI: | CCI-004065 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | For password-based authentication, employ automated tools to assist the user in selecting strong password authenticators. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IA-5 (1) (g) | ||
| CCI: | CCI-004066 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | For password-based authentication, enforce organization-defined composition and complexity rules. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IA-5 (1) (h) | ||
| CCI: | CCI-004067 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Defines the composition and complexity rules to be enforced. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IA-5 (1) (h) | ||
| CCI: | CCI-000186 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-15 |
| Definition: | For public key-based authentication, enforce authorized access to the corresponding private key. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): IA-5 (2) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): IA-5 (2) (b) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): IA-5 (2) (a) (1) | |||
| NIST: NIST SP 800-53A (v1): IA-5 (2).1 | |||
| CCI: | CCI-000187 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-15 |
| Definition: | For public key-based authentication, map the authenticated identity to the account of the individual or group. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): IA-5 (2) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): IA-5 (2) (c) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): IA-5 (2) (a) (2) | |||
| NIST: NIST SP 800-53A (v1): IA-5 (2).1 | |||
| CCI: | CCI-000185 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-15 |
| Definition: | For public key-based authentication, validate certificates by constructing and verifying a certification path to an accepted trust anchor including checking certificate status information. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): IA-5 (2) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): IA-5 (2) (a) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): IA-5 (2) (b) (1) | |||
| NIST: NIST SP 800-53A (v1): IA-5 (2).1 | |||
| CCI: | CCI-004068 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | For public key-based authentication, implement a local cache of revocation data to support path discovery and validation. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IA-5 (2) (b) (2) | ||
| CCI: | CCI-001998 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-05-03 |
| Definition: | Require developers and installers of system components to provide unique authenticators or change default authenticators prior to delivery and installation. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IA-5 (5) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): IA-5 (5) | |||
| CCI: | CCI-000201 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-22 |
| Definition: | Protect authenticators commensurate with the security category of the information to which use of the authenticator permits access. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): IA-5 (6) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): IA-5 (6) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): IA-5 (6) | |||
| NIST: NIST SP 800-53A (v1): IA-5 (6).1 | |||
| CCI: | CCI-004069 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Ensure that the unencrypted static authenticators are not embedded in applications or other forms of static storage. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IA-5 (7) | ||
| CCI: | CCI-000204 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-22 |
| Definition: | Defines the security controls required to manage the risk of compromise due to individuals having accounts on multiple systems. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): IA-5 (8) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): IA-5 (8) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): IA-5 (8) | |||
| NIST: NIST SP 800-53A (v1): IA-5 (8).1 (i) | |||
| CCI: | CCI-001621 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-12 |
| Definition: | Implement organization-defined security controls to manage the risk of compromise due to individuals having accounts on multiple systems. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): IA-5 (8) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): IA-5 (8) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): IA-5 (8) | |||
| NIST: NIST SP 800-53A (v1): IA-5 (8).1 (ii) | |||
| CCI: | CCI-004070 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Use organization-defined external organizations to federate credentials. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IA-5 (9) | ||
| CCI: | CCI-004071 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Defines the external organizations used to federate credentials. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IA-5 (9) | ||
| CCI: | CCI-002001 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-05-03 |
| Definition: | Bind identities and authenticators dynamically using organization-defined binding rules. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IA-5 (10) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): IA-5 (10) | |||
| CCI: | CCI-004072 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Defines the binding rules for binding identities and authenticators. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IA-5 (10) | ||
| CCI: | CCI-002004 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-05-03 |
| Definition: | Defines the biometric quality requirements to be employed by the mechanisms for biometric-based authentication. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IA-5 (12) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): IA-5 (12) | |||
| CCI: | CCI-002005 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-05-03 |
| Definition: | For biometric-based authentication, employ mechanisms that satisfy organization-defined biometric quality requirements. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IA-5 (12) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): IA-5 (12) | |||
| CCI: | CCI-002006 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-05-03 |
| Definition: | Defines the time period after which the use of cached authenticators is prohibited. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IA-5 (13) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): IA-5 (13) | |||
| CCI: | CCI-002007 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-05-03 |
| Definition: | Prohibit the use of cached authenticators after an organization-defined time period. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IA-5 (13) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): IA-5 (13) | |||
| CCI: | CCI-002008 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-05-03 |
| Definition: | For PKI-based authentication, employs an organization-wide methodology for managing the content of PKI trust stores installed across all platforms including networks, operating systems, browsers, and applications. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IA-5 (14) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): IA-5 (14) | |||
| CCI: | CCI-004073 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Use only General Services Administration-approved and validated products and services for identity, credential, and access management. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IA-5 (15) | ||
| CCI: | CCI-004074 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Require that the issuance of organization-defined types of and/or specific authenticators be conducted in person or by a trusted external party before the organization-defined registration authority with authorization by organization-defined personnel or roles. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IA-5 (16) | ||
| CCI: | CCI-004075 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Defines types of and/or specific authenticators to be conducted in person or by a trusted external party before the organization-defined registration authority. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IA-5 (16) | ||
| CCI: | CCI-004076 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Defines the registration authority who conducts the issuance of organization-defined types of and/or specific authenticators. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IA-5 (16) | ||
| CCI: | CCI-004077 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Defines the personnel or roles who authorize the issuance of organization-defined types of and/or specific authenticators. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IA-5 (16) | ||
| CCI: | CCI-004078 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Employ presentation attack detection mechanisms for biometric-based authentication. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IA-5 (17) | ||
| CCI: | CCI-004079 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Employ organization-defined password managers to generate and manage passwords. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IA-5 (18) (a) | ||
| CCI: | CCI-004080 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Defines the password managers employed to generate and manage passwords. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IA-5 (18) (a) | ||
| CCI: | CCI-004081 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Protect the passwords using organization-defined controls. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IA-5 (18) (b) | ||
| CCI: | CCI-004082 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Defines the controls for protecting the passwords. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IA-5 (18) (b) | ||
| CCI: | CCI-000206 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-22 |
| Definition: | Obscure feedback of authentication information during the authentication process to protect the information from possible exploitation and use by unauthorized individuals. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): IA-6 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): IA-6 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): IA-6 | |||
| NIST: NIST SP 800-53A (v1): IA-6.1 | |||
| CCI: | CCI-000803 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-17 |
| Definition: | Implement mechanisms for authentication to a cryptographic module that meet the requirements of applicable laws, Executive Orders, directives, policies, regulations, standards, and guidance for such authentication. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): IA-7 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): IA-7 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): IA-7 | |||
| NIST: NIST SP 800-53A (v1): IA-7.1 | |||
| CCI: | CCI-000804 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-17 |
| Definition: | Uniquely identify and authenticate non-organizational users or processes acting on behalf of non-organizational users. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): IA-8 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): IA-8 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): IA-8 | |||
| NIST: NIST SP 800-53A (v1): IA-8.1 | |||
| CCI: | CCI-002009 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-05-03 |
| Definition: | Accept Personal Identity Verification-compliant credentials from other federal agencies. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IA-8 (1) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): IA-8 (1) | |||
| CCI: | CCI-002010 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-05-03 |
| Definition: | Electronically verify Personal Identity Verification-compliant credentials from other federal agencies. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IA-8 (1) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): IA-8 (1) | |||
| CCI: | CCI-004083 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Accept only external credentials that are NIST compliant. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IA-8 (2) (a) | ||
| CCI: | CCI-004084 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Document and maintain a list of accepted external authenticators. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IA-8 (2) (b) | ||
| CCI: | CCI-004085 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Conform to organization-defined identity management profiles for identity management. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IA-8 (4) | ||
| CCI: | CCI-004086 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Defines the identity management profiles for conforming to the profiles for identity management. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IA-8 (4) | ||
| CCI: | CCI-002015 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-05-03 |
| Definition: | Accept federated or PKI credentials that meet organization-defined policy. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IA-8 (5) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): IA-8 (5) | |||
| CCI: | CCI-002016 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-05-03 |
| Definition: | Verify federated PKI credentials that meet organization-defined policy. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IA-8 (5) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): IA-8 (5) | |||
| CCI: | CCI-004087 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Defines the policy for accepting and verifying federated or PKI credentials. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IA-8 (5) | ||
| CCI: | CCI-004088 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Implement organization-defined measures to disassociate user attributes or identifier assertion relationships among individuals. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IA-8 (6) | ||
| CCI: | CCI-004089 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Implement organization-defined measures to disassociate user attributes or identifier assertion relationships among credential service providers. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IA-8 (6) | ||
| CCI: | CCI-004090 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Implement organization-defined measures to disassociate user attributes or identifier assertion relationships among relying parties. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IA-8 (6) | ||
| CCI: | CCI-004091 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Defines the measures to be implemented to disassociate user attributes or identifier assertion relationships among individuals, credential service providers, and relying parties. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IA-8 (6) | ||
| CCI: | CCI-002018 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-05-03 |
| Definition: | Defines the system services and applications requiring authentication. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IA-9 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): IA-9 | |||
| CCI: | CCI-002021 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-05-03 |
| Definition: | Uniquely identify organization-defined system services and applications before establishing communications with devices, users, or other services or applications. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IA-9 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): IA-9 | |||
| CCI: | CCI-002022 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-05-03 |
| Definition: | Uniquely authenticate organization-defined system services and applications before establishing communications with devices, users, or other services or applications. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IA-9 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): IA-9 | |||
| CCI: | CCI-002033 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-05-03 |
| Definition: | Defines the specific circumstances or situations when individuals accessing the system employ organization-defined supplemental authentication techniques or mechanisms. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IA-10 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): IA-10 | |||
| CCI: | CCI-002034 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-05-03 |
| Definition: | Defines the supplemental authentication techniques or mechanisms to be employed in specific organization-defined circumstances or situations by individuals accessing the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IA-10 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): IA-10 | |||
| CCI: | CCI-002035 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-05-03 |
| Definition: | Require individuals accessing the system employ organization-defined supplemental authentication techniques or mechanisms under specific organization-defined circumstances or situations. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IA-10 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): IA-10 | |||
| CCI: | CCI-002036 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-05-03 |
| Definition: | Defines the circumstances or situations under which users will be required to reauthenticate. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IA-11 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): IA-11 | |||
| CCI: | CCI-004092 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Identity proof users that require accounts for logical access to systems based on appropriate identity assurance level requirements as specified in applicable standards. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IA-12 a | ||
| CCI: | CCI-004093 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Identity proof users that require accounts for logical access to systems based on appropriate identity assurance level requirements as specified in applicable guidelines. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IA-12 a | ||
| CCI: | CCI-004094 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Resolve user identities to a unique individual. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IA-12 b | ||
| CCI: | CCI-004095 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Collect identity evidence. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IA-12 c | ||
| CCI: | CCI-004096 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Validate identity evidence. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IA-12 c | ||
| CCI: | CCI-004097 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Verify identity evidence. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IA-12 c | ||
| CCI: | CCI-004098 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Require that the registration process to receive an account for logical access includes supervisor or sponsor authorization. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IA-12 (1) | ||
| CCI: | CCI-004099 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Require evidence of individual identification be presented to the registration authority. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IA-12 (2) | ||
| CCI: | CCI-004100 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Require that the presented identity evidence be validated through organizational defined methods of validation. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IA-12 (3) | ||
| CCI: | CCI-004101 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Require that the presented identity evidence be verified through organizational defined methods of verification. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IA-12 (3) | ||
| CCI: | CCI-004102 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Defines the methods of validation required for presenting identity evidence. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IA-12 (3) | ||
| CCI: | CCI-004103 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Defines the methods of verification required for presenting identity evidence. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IA-12 (3) | ||
| CCI: | CCI-004104 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Require that the validation of identity evidence be conducted in person before a designated registration authority. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IA-12 (4) | ||
| CCI: | CCI-004105 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Require that the verification of identity evidence be conducted in person before a designated registration authority. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IA-12 (4) | ||
| CCI: | CCI-004106 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-02 |
| Definition: | Require that a registration code or notice of proofing be delivered through an out-of-band channel to verify the users address (physical or digital) of record. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IA-12 (5) | ||
| CCI: | CCI-004107 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Accept externally-proofed identities at an organization-defined identity assurance level. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IA-12 (6) | ||
| CCI: | CCI-004108 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Defines the identity assurance level by accepting externally-proofed identities. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IA-12 (6) | ||
| CCI: | CCI-000805 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-17 |
| Definition: | Develop and document an organization-level; mission/business process-level; and/or system-level incident response policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): IR-1 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): IR-1 a 1 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): IR-1 a 1 (a) | |||
| NIST: NIST SP 800-53A (v1): IR-1.1 (i) (ii) | |||
| CCI: | CCI-000806 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-17 |
| Definition: | Disseminate an organization-level; mission/business process-level; and/or system-level incident response policy to organization-defined personnel or roles. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): IR-1 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): IR-1 a 1 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): IR-1 a 1 (a) | |||
| NIST: NIST SP 800-53A (v1): IR-1.1 (iii) | |||
| CCI: | CCI-000809 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-17 |
| Definition: | Develop and document procedures to facilitate the implementation of incident response policy and associated incident response controls. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): IR-1 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): IR-1 a 2 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): IR-1 a 2 | |||
| NIST: NIST SP 800-53A (v1): IR-1.1 (iv) (v) | |||
| CCI: | CCI-000810 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-17 |
| Definition: | Disseminate the incident response procedures to organization-defined personnel or roles. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): IR-1 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): IR-1 a 2 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): IR-1 a 2 | |||
| NIST: NIST SP 800-53A (v1): IR-1.1 (vi) | |||
| CCI: | CCI-002776 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-12 |
| Definition: | Defines the personnel or roles to whom the organization-level; mission/business process-level; and/or system-level incident response policy is disseminated. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IR-1 a 1 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): IR-1 a 1 (a) | |||
| CCI: | CCI-002777 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-12 |
| Definition: | Defines the personnel or roles to whom the incident response procedures are disseminated. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IR-1 a 2 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): IR-1 a 2 | |||
| CCI: | CCI-004109 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Develop and document an organization-level; mission/business process-level; and/or system-level incident response policy that is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IR-1 a 1 (b) | ||
| CCI: | CCI-004110 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Designate an organization-defined official to manage the incident response policy. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IR-1 b | ||
| CCI: | CCI-004111 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Designate an organization-defined official to manage the incident response procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IR-1 b | ||
| CCI: | CCI-004112 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Defines the official designated to manage the incident response policy and procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IR-1 b | ||
| CCI: | CCI-000807 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-17 |
| Definition: | Review and update the current incident response policy in accordance with organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): IR-1 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): IR-1 b 1 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): IR-1 c 1 | |||
| NIST: NIST SP 800-53A (v1): IR-1.2 (ii) | |||
| CCI: | CCI-000808 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-17 |
| Definition: | Defines the frequency with which to review and update the current incident response policy. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): IR-1 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): IR-1 b 1 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): IR-1 c 1 | |||
| NIST: NIST SP 800-53A (v1): IR-1.2 (i) | |||
| CCI: | CCI-000811 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-17 |
| Definition: | Review and update the current incident response procedures in accordance with organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): IR-1 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): IR-1 b 2 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): IR-1 c 2 | |||
| NIST: NIST SP 800-53A (v1): IR-1.2 (iv) | |||
| CCI: | CCI-000812 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-17 |
| Definition: | Defines the frequency with which to review and update the current incident response procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): IR-1 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): IR-1 b 2 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): IR-1 c 2 | |||
| NIST: NIST SP 800-53A (v1): IR-1.2 (iii) | |||
| CCI: | CCI-004113 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Review and update the current incident response policy following organization-defined events. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IR-1 c 1 | ||
| CCI: | CCI-004114 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Defines the events for reviewing and updating the current incident response policy. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IR-1 c 1 | ||
| CCI: | CCI-004115 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Review and update the current incident response procedures following organization-defined events. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IR-1 c 2 | ||
| CCI: | CCI-004116 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Defines the events for reviewing and updating the current incident response procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IR-1 c 2 | ||
| CCI: | CCI-000813 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-17 |
| Definition: | Provide incident response training to system users consistent with assigned roles and responsibilities within an organization-defined time period of assuming an incident response role or responsibility. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): IR-2 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): IR-2 a | |||
| NIST: NIST SP 800-53 Revision 5 (v5): IR-2 a 1 | |||
| NIST: NIST SP 800-53A (v1): IR-2.1 (ii) | |||
| CCI: | CCI-000814 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-17 |
| Definition: | Provide incident response training in accordance with organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): IR-2 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): IR-2 c | |||
| NIST: NIST SP 800-53 Revision 5 (v5): IR-2 a 3 | |||
| NIST: NIST SP 800-53A (v1): IR-2.1 (v) | |||
| CCI: | CCI-002778 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-12 |
| Definition: | Defines the time period in which system users who assume an incident response role or responsibility receive incident response training. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IR-2 a | ||
| NIST: NIST SP 800-53 Revision 5 (v5): IR-2 a 1 | |||
| CCI: | CCI-002779 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-12 |
| Definition: | Provide incident response training to system users consistent with assigned roles and responsibilities when required by system changes. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IR-2 b | ||
| NIST: NIST SP 800-53 Revision 5 (v5): IR-2 a 2 | |||
| CCI: | CCI-000815 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-17 |
| Definition: | Defines a frequency for incident response training. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): IR-2 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): IR-2 c | |||
| NIST: NIST SP 800-53 Revision 5 (v5): IR-2 c | |||
| NIST: NIST SP 800-53A (v1): IR-2.1 (iv) | |||
| CCI: | CCI-000816 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-17 |
| Definition: | Incorporate simulated events into incident response training to facilitate effective response by personnel in crisis situations. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): IR-2 (1) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): IR-2 (1) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): IR-2 (1) | |||
| NIST: NIST SP 800-53A (v1): IR-2 (1).1 | |||
| CCI: | CCI-000817 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-17 |
| Definition: | Provide an incident response training environment using organization-defined automated mechanisms. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): IR-2 (2) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): IR-2 (2) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): IR-2 (2) | |||
| NIST: NIST SP 800-53A (v1): IR-2 (2).1 | |||
| CCI: | CCI-004117 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Defines the automated mechanisms to provide an incident response training environment. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IR-2 (2) | ||
| CCI: | CCI-004118 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Provide incident response training on how to identify and respond to a breach, including the organization's process for reporting a breach. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IR-2 (3) | ||
| CCI: | CCI-000818 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-17 |
| Definition: | Test the effectiveness of the incident response capability for the system on an organization-defined frequency using organization-defined tests. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): IR-3 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): IR-3 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): IR-3 | |||
| NIST: NIST SP 800-53A (v1): IR-3.1 (iii) (v) | |||
| CCI: | CCI-000819 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-17 |
| Definition: | Defines a frequency for incident response tests. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): IR-3 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): IR-3 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): IR-3 | |||
| NIST: NIST SP 800-53A (v1): IR-3.1 (ii) | |||
| CCI: | CCI-000820 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-17 |
| Definition: | Defines tests for incident response. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): IR-3 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): IR-3 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): IR-3 | |||
| NIST: NIST SP 800-53A (v1): IR-3.1 (i) | |||
| CCI: | CCI-000821 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-17 |
| Definition: | Test the incident response capability using organization-defined automated mechanisms. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): IR-3 (1) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): IR-3 (1) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): IR-3 (1) | |||
| NIST: NIST SP 800-53A (v1): IR-3 (1).1 | |||
| CCI: | CCI-004119 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Defines the automated mechanisms to test the incident response capability. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IR-3 (1) | ||
| CCI: | CCI-002780 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-12 |
| Definition: | Coordinate incident response testing with organizational elements responsible for related plans. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IR-3 (2) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): IR-3 (2) | |||
| CCI: | CCI-004120 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Use qualitative data from testing to determine the effectiveness of incident response processes. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IR-3 (3) (a) | ||
| CCI: | CCI-004121 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Use quantitative data from testing to determine the effectiveness of incident response processes. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IR-3 (3) (a) | ||
| CCI: | CCI-004122 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Use qualitative data from testing to continuously improve incident response processes. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IR-3 (3) (b) | ||
| CCI: | CCI-004123 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Use quantitative data from testing to continuously improve incident response processes. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IR-3 (3) (b) | ||
| CCI: | CCI-004124 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Use qualitative data from testing to provide incident response measures and metrics that are accurate. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IR-3 (3) (c) | ||
| CCI: | CCI-004125 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Use quantitative data from testing to provide incident response measures and metrics that are accurate. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IR-3 (3) (c) | ||
| CCI: | CCI-004126 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Use qualitative data from testing to provide incident response measures and metrics that are consistent. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IR-3 (3) (c) | ||
| CCI: | CCI-004127 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Use quantitative data from testing to provide incident response measures and metrics that are consistent. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IR-3 (3) (c) | ||
| CCI: | CCI-004128 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Use qualitative data from testing to provide incident response measures and metrics that are in a reproducible format. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IR-3 (3) (c) | ||
| CCI: | CCI-004129 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Use quantitative data from testing to provide incident response measures and metrics that are in a reproducible format. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IR-3 (3) (c) | ||
| CCI: | CCI-000822 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Implement an incident handling capability for incidents that is consistent with the incident response plan and includes preparation, detection and analysis, containment, eradication, and recovery. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): IR-4 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): IR-4 a | |||
| NIST: NIST SP 800-53 Revision 5 (v5): IR-4 a | |||
| NIST: NIST SP 800-53A (v1): IR-4.1 (i) | |||
| CCI: | CCI-000823 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Coordinate incident handling activities with contingency planning activities. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): IR-4 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): IR-4 b | |||
| NIST: NIST SP 800-53 Revision 5 (v5): IR-4 b | |||
| NIST: NIST SP 800-53A (v1): IR-4.1 (ii) | |||
| CCI: | CCI-001625 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-12 |
| Definition: | Implement the resulting incident handling activity changes to incident response procedures, training, and testing accordingly. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): IR-4 c | ||
| NIST: NIST SP 800-53 Revision 4 (v4): IR-4 c | |||
| NIST: NIST SP 800-53 Revision 5 (v5): IR-4 c | |||
| NIST: NIST SP 800-53A (v1): IR-4.1 (iv) | |||
| CCI: | CCI-004130 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Incorporate lessons learned from ongoing incident handling activities into incident response procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IR-4 c | ||
| CCI: | CCI-004131 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Incorporate lessons learned from ongoing incident handling activities into incident response training. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IR-4 c | ||
| CCI: | CCI-004132 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Incorporate lessons learned from ongoing incident handling activities into incident response testing. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IR-4 c | ||
| CCI: | CCI-004133 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Ensure the rigor of incident handling activities are comparable and predictable across the organization. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IR-4 d | ||
| CCI: | CCI-004134 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Ensure the intensity of incident handling activities are comparable and predictable across the organization. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IR-4 d | ||
| CCI: | CCI-004135 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Ensure the scope of incident handling activities are comparable and predictable across the organization. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IR-4 d | ||
| CCI: | CCI-004136 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Ensure the results of incident handling activities are comparable and predictable across the organization. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IR-4 d | ||
| CCI: | CCI-000825 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Support the incident handling process using organization-defined automated mechanisms. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): IR-4 (1) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): IR-4 (1) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): IR-4 (1) | |||
| NIST: NIST SP 800-53A (v1): IR-4 (1).1 | |||
| CCI: | CCI-004137 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Defines the automated mechanisms for supporting the incident handling process. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IR-4 (1) | ||
| CCI: | CCI-000826 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Include organization-defined types of dynamic reconfiguration for organization-defined system components as part of the incident response capability. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): IR-4 (2) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): IR-4 (2) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): IR-4 (2) | |||
| NIST: NIST SP 800-53A (v1): IR-4 (2).1 | |||
| CCI: | CCI-002781 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-12 |
| Definition: | Defines the system components for dynamic reconfiguration as part of the incident response capability. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IR-4 (2) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): IR-4 (2) | |||
| CCI: | CCI-004138 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Defines the types of dynamic reconfiguration for system components. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IR-4 (2) | ||
| CCI: | CCI-000827 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Identify organization-defined classes of incidents for which organization-defined actions are to be taken to ensure continuation of organizational mission and business functions. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): IR-4 (3) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): IR-4 (3) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): IR-4 (3) | |||
| NIST: NIST SP 800-53A (v1): IR-4 (3).1 (i) | |||
| CCI: | CCI-000828 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Identify actions to take in response to organization-defined classes of incidents to ensure continuation of organizational missions and business functions. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): IR-4 (3) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): IR-4 (3) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): IR-4 (3) | |||
| NIST: NIST SP 800-53A (v1): IR-4 (3).1 (ii) | |||
| CCI: | CCI-004139 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Defines the classes of incidents to identify actions in response to those incidents. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IR-4 (3) | ||
| CCI: | CCI-004140 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Defines the actions to take in response to organization-defined classes of incidents to ensure continuation of organizational mission and business functions. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IR-4 (3) | ||
| CCI: | CCI-000829 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Correlate incident information and individual incident responses to achieve an organization-wide perspective on incident awareness and response. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): IR-4 (4) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): IR-4 (4) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): IR-4 (4) | |||
| NIST: NIST SP 800-53A (v1): IR-4 (4).1 | |||
| CCI: | CCI-000830 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Defines security violations that, if detected, initiate a configurable capability to automatically disable the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): IR-4 (5) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): IR-4 (5) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): IR-4 (5) | |||
| NIST: NIST SP 800-53A (v1): IR-4 (5).1 (i) | |||
| CCI: | CCI-000831 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Implement a configurable capability to automatically disable the system if organization-defined security violations are detected. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): IR-4 (5) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): IR-4 (5) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): IR-4 (5) | |||
| NIST: NIST SP 800-53A (v1): IR-4 (5).1 (ii) | |||
| CCI: | CCI-002782 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-12 |
| Definition: | Implement an incident handling capability for incidents involving insider threats. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IR-4 (6) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): IR-4 (6) | |||
| CCI: | CCI-004141 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Coordinate an incident handling capability for insider threats that includes organization-defined entities. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IR-4 (7) | ||
| CCI: | CCI-004142 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Defines the organizational entities for coordinating an incident handling capability for insider threats. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IR-4 (7) | ||
| CCI: | CCI-002785 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-12 |
| Definition: | Coordinate with organization-defined external organizations to correlate and share organization-defined incident information to achieve a cross-organization perspective on incident awareness and more effective incident responses. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IR-4 (8) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): IR-4 (8) | |||
| CCI: | CCI-002786 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-12 |
| Definition: | Defines external organizations with which to correlate and share organization-defined incident information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IR-4 (8) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): IR-4 (8) | |||
| CCI: | CCI-002787 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-12 |
| Definition: | Defines incident information to correlate and share with organization-defined external organizations. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IR-4 (8) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): IR-4 (8) | |||
| CCI: | CCI-002788 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-12 |
| Definition: | Employ organization-defined dynamic response capabilities to effectively respond to incidents. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IR-4 (9) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): IR-4 (9) | |||
| CCI: | CCI-002789 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-12 |
| Definition: | Defines dynamic response capabilities to effectively respond to incidents. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IR-4 (9) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): IR-4 (9) | |||
| CCI: | CCI-002790 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-12 |
| Definition: | Coordinate incident handling activities involving supply chain events with other organizations involved in the supply chain. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IR-4 (10) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): IR-4 (10) | |||
| CCI: | CCI-004143 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Establish and maintain an integrated incident response team that can be deployed to any location identified by the organization in an organization-defined time period. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IR-4 (11) | ||
| CCI: | CCI-004144 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Defines the time period for establishing and maintaining an integrated incident response team that can be deployed to any location identified by the organization. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IR-4 (11) | ||
| CCI: | CCI-004145 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Analyze malicious code and/or other residual artifacts remaining in the system after the incident. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IR-4 (12) | ||
| CCI: | CCI-004146 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Analyze anomalous or suspected adversarial behavior in or related to organization-defined environments or resources. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IR-4 (13) | ||
| CCI: | CCI-004147 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Defines the environments or resources for analyzing anomalous or suspected adversarial behavior. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IR-4 (13) | ||
| CCI: | CCI-004148 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Establish and maintain a security operations center. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IR-4 (14) | ||
| CCI: | CCI-004149 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Manage public relations associated with an incident. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IR-4 (15) (a) | ||
| CCI: | CCI-004150 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Employ measures to repair the reputation of the organization. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IR-4 (15) (b) | ||
| CCI: | CCI-000832 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Track and document incidents. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): IR-5 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): IR-5 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): IR-5 | |||
| NIST: NIST SP 800-53A (v1): IR-5.1 | |||
| CCI: | CCI-004151 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Track incidents using organization-defined automated mechanisms. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IR-5 (1) | ||
| CCI: | CCI-004152 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Collect incident information using organization-defined automated mechanisms. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IR-5 (1) | ||
| CCI: | CCI-004153 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Analyze incident information using organization-defined automated mechanisms. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IR-5 (1) | ||
| CCI: | CCI-004154 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Defines the automated mechanisms to track, collect, and analyze incident information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IR-5 (1) | ||
| CCI: | CCI-000834 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Defines a time period for personnel to report suspected incidents to the organizational incident response capability. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): IR-6 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): IR-6 a | |||
| NIST: NIST SP 800-53 Revision 5 (v5): IR-6 a | |||
| NIST: NIST SP 800-53A (v1): IR-6.1 (i) | |||
| CCI: | CCI-000835 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Require personnel to report suspected incidents to the organizational incident response capability within the organization-defined time period. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): IR-6 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): IR-6 a | |||
| NIST: NIST SP 800-53 Revision 5 (v5): IR-6 a | |||
| NIST: NIST SP 800-53A (v1): IR-6.1 (ii) | |||
| CCI: | CCI-000836 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Report incident information to organization-defined authorities. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): IR-6 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): IR-6 b | |||
| NIST: NIST SP 800-53 Revision 5 (v5): IR-6 b | |||
| NIST: NIST SP 800-53A (v1): IR-6.1 (iii) | |||
| CCI: | CCI-002791 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-12 |
| Definition: | Defines authorities to whom incident information is reported. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IR-6 b | ||
| NIST: NIST SP 800-53 Revision 5 (v5): IR-6 b | |||
| CCI: | CCI-000837 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Report incidents using organization-defined automated mechanisms. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): IR-6 (1) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): IR-6 (1) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): IR-6 (1) | |||
| NIST: NIST SP 800-53A (v1): IR-6 (1).1 | |||
| CCI: | CCI-004155 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Defines the automated mechanisms for reporting incidents. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IR-6 (1) | ||
| CCI: | CCI-000838 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Report system vulnerabilities associated with reported incidents to organization-defined personnel or roles. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): IR-6 (2) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): IR-6 (2) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): IR-6 (2) | |||
| NIST: NIST SP 800-53A (v1): IR-6 (2).1 | |||
| CCI: | CCI-002792 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-12 |
| Definition: | Defines personnel or roles to whom system vulnerabilities associated with reported incident information are reported. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IR-6 (2) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): IR-6 (2) | |||
| CCI: | CCI-002793 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-12 |
| Definition: | Provide incident information to other organizations involved in the supply chain or supply chain governance for systems or system components related to the incident. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IR-6 (3) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): IR-6 (3) | |||
| CCI: | CCI-004156 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Provide incident information to the provider of the product or service. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IR-6 (3) | ||
| CCI: | CCI-000839 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Provide an incident response support resource, integral to the organizational incident response capability, that offers advice and assistance to users of the system for the handling and reporting of incidents. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): IR-7 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): IR-7 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): IR-7 | |||
| NIST: NIST SP 800-53A (v1): IR-7.1 (i) (ii) | |||
| CCI: | CCI-000841 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Establish a direct, cooperative relationship between its incident response capability and external providers of system protection capability. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): IR-7 (2) (a) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): IR-7 (2) (a) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): IR-7 (2) (a) | |||
| NIST: NIST SP 800-53A (v1): IR-7 (2).1 (i) | |||
| CCI: | CCI-000842 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Identify organizational incident response team members to the external providers. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): IR-7 (2) (b) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): IR-7 (2) (b) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): IR-7 (2) (b) | |||
| NIST: NIST SP 800-53A (v1): IR-7 (2).1 (ii) | |||
| CCI: | CCI-000844 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Develop an incident response plan that is reviewed and approved by organization-defined personnel or roles on an organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): IR-8 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): IR-8 a 8 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): IR-8 a 9 | |||
| NIST: NIST SP 800-53A (v1): IR-8.1 | |||
| CCI: | CCI-002794 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-12 |
| Definition: | Develop an incident response plan. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IR-8 a | ||
| NIST: NIST SP 800-53 Revision 5 (v5): IR-8 a | |||
| CCI: | CCI-002795 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-12 |
| Definition: | Develop an incident response plan that provides the organization with a roadmap for implementing its incident response capability. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IR-8 a 1 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): IR-8 a 1 | |||
| CCI: | CCI-002796 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-12 |
| Definition: | Develop an incident response plan that describes the structure and organization of the incident response capability. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IR-8 a 2 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): IR-8 a 2 | |||
| CCI: | CCI-002797 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-12 |
| Definition: | Develop an incident response plan that provides a high-level approach for how the incident response capability fits into the overall organization. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IR-8 a 3 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): IR-8 a 3 | |||
| CCI: | CCI-002798 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-12 |
| Definition: | Develop an incident response plan that meets the unique requirements of the organization, which relate to mission, size, structure, and functions. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IR-8 a 4 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): IR-8 a 4 | |||
| CCI: | CCI-002799 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-12 |
| Definition: | Develop an incident response plan that defines reportable incidents. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IR-8 a 5 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): IR-8 a 5 | |||
| CCI: | CCI-002800 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-12 |
| Definition: | Develop an incident response plan that provides metrics for measuring the incident response capability within the organization. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IR-8 a 6 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): IR-8 a 6 | |||
| CCI: | CCI-002801 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-12 |
| Definition: | Develop an incident response plan that defines the resources and management support needed to effectively maintain and mature an incident response capability. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IR-8 a 7 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): IR-8 a 7 | |||
| CCI: | CCI-002802 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-12 |
| Definition: | Defines personnel or roles to review and approve the incident response plan. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IR-8 a 8 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): IR-8 a 9 | |||
| CCI: | CCI-004157 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Develop an incident response plan that addresses the sharing of incident information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IR-8 a 8 | ||
| CCI: | CCI-004158 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Defines the frequency organization-defined personnel or roles will review and approve the incident response plan. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IR-8 a 9 | ||
| CCI: | CCI-004159 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Develop an incident response plan that explicitly designates responsibility for incident response to organization-defined entities, personnel, or roles. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IR-8 a 10 | ||
| CCI: | CCI-000845 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Defines incident response personnel (identified by name and/or by role) and organizational elements to whom copies of the incident response plan are distributed. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): IR-8 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): IR-8 b | |||
| NIST: NIST SP 800-53 Revision 5 (v5): IR-8 b | |||
| NIST: NIST SP 800-53A (v1): IR-8.2 (i) | |||
| CCI: | CCI-000846 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Distributes copies of the incident response plan to organization-defined incident response personnel (identified by name and/or by role) and organizational elements. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): IR-8 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): IR-8 b | |||
| NIST: NIST SP 800-53 Revision 5 (v5): IR-8 b | |||
| NIST: NIST SP 800-53A (v1): IR-8.2 (ii) | |||
| CCI: | CCI-000849 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Update the incident response plan to address system and organizational changes or problems encountered during plan implementation, execution, or testing. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): IR-8 d | ||
| NIST: NIST SP 800-53 Revision 4 (v4): IR-8 d | |||
| NIST: NIST SP 800-53 Revision 5 (v5): IR-8 c | |||
| NIST: NIST SP 800-53A (v1): IR-8.2 (v) | |||
| CCI: | CCI-000850 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Communicate incident response plan changes to organization-defined incident response personnel (identified by name and/or by role) and organizational elements. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): IR-8 e | ||
| NIST: NIST SP 800-53 Revision 4 (v4): IR-8 e | |||
| NIST: NIST SP 800-53 Revision 5 (v5): IR-8 d | |||
| NIST: NIST SP 800-53A (v1): IR-8.2 (vi) | |||
| CCI: | CCI-002803 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-12 |
| Definition: | Defines incident response personnel (identified by name and/or by role) and organizational elements to whom incident response plan changes will be communicated. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IR-8 e | ||
| NIST: NIST SP 800-53 Revision 5 (v5): IR-8 d | |||
| CCI: | CCI-002804 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-12 |
| Definition: | Protect the incident response plan from unauthorized disclosure and modification. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IR-8 f | ||
| NIST: NIST SP 800-53 Revision 5 (v5): IR-8 e | |||
| CCI: | CCI-004160 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Include a process to determine if notice to individuals or other organizations, including oversight organizations, is needed, in the Incident Response Plan for breaches involving Personally Identifiable Information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IR-8 (1) (a) | ||
| CCI: | CCI-004161 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Include an assessment process to determine the extent of the harm, embarrassment, inconvenience, or unfairness to affected individuals and any mechanisms to mitigate such harms in the Incident Response Plan for breaches involving Personally Identifiable Information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IR-8 (1) (b) | ||
| CCI: | CCI-004162 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Include identification of applicable privacy requirements in the Incident Response Plan for breaches involving Personally Identifiable Information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IR-8 (1) (c) | ||
| CCI: | CCI-004163 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Respond to information spills by assigning organization-defined personnel or roles with responsibility for responding to information spills. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IR-9 a | ||
| CCI: | CCI-004164 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Defines the personnel or roles who will respond to information spills. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): IR-9 a | ||
| CCI: | CCI-002805 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-12 |
| Definition: | Respond to information spills by identifying the specific information involved in the system contamination. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IR-9 a | ||
| NIST: NIST SP 800-53 Revision 5 (v5): IR-9 b | |||
| CCI: | CCI-002806 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-12 |
| Definition: | Respond to information spills by alerting organization-defined personnel or roles of the information spill using a method of communication not associated with the spill. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IR-9 b | ||
| NIST: NIST SP 800-53 Revision 5 (v5): IR-9 c | |||
| CCI: | CCI-002807 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-12 |
| Definition: | Defines the personnel or roles to be alerted of information spills using a method of communication not associated with the spill. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IR-9 b | ||
| NIST: NIST SP 800-53 Revision 5 (v5): IR-9 c | |||
| CCI: | CCI-002808 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-12 |
| Definition: | Respond to information spills by isolating the contaminated system or system component. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IR-9 c | ||
| NIST: NIST SP 800-53 Revision 5 (v5): IR-9 d | |||
| CCI: | CCI-002809 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-12 |
| Definition: | Respond to information spills by eradicating the information from the contaminated system or component. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IR-9 d | ||
| NIST: NIST SP 800-53 Revision 5 (v5): IR-9 e | |||
| CCI: | CCI-002810 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-12 |
| Definition: | Respond to information spills by identifying other systems or system components that may have been subsequently contaminated. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IR-9 e | ||
| NIST: NIST SP 800-53 Revision 5 (v5): IR-9 f | |||
| CCI: | CCI-002811 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-12 |
| Definition: | Respond to information spills by performing additional organization-defined actions. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IR-9 f | ||
| NIST: NIST SP 800-53 Revision 5 (v5): IR-9 g | |||
| CCI: | CCI-002812 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-12 |
| Definition: | Defines additional actions required to respond to information spills. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IR-9 f | ||
| NIST: NIST SP 800-53 Revision 5 (v5): IR-9 g | |||
| CCI: | CCI-002816 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-12 |
| Definition: | Provide information spillage response training according to an organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IR-9 (2) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): IR-9 (2) | |||
| CCI: | CCI-002817 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-12 |
| Definition: | Defines the frequency with which to provide information spillage response training. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IR-9 (2) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): IR-9 (2) | |||
| CCI: | CCI-002818 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-12 |
| Definition: | Implement organization-defined procedures to ensure that organizational personnel impacted by information spills can continue to carry out assigned tasks while contaminated systems are undergoing corrective actions. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IR-9 (3) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): IR-9 (3) | |||
| CCI: | CCI-002819 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-12 |
| Definition: | Defines the procedures to be implemented to ensure that organizational personnel impacted by information spills can continue to carry out assigned tasks while contaminated systems are undergoing corrective actions. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IR-9 (3) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): IR-9 (3) | |||
| CCI: | CCI-002820 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-12 |
| Definition: | Employ organization-defined controls for personnel exposed to information not within assigned access authorizations. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IR-9 (4) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): IR-9 (4) | |||
| CCI: | CCI-002821 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-12 |
| Definition: | Defines the controls to be employed for personnel exposed to information not within assigned access authorizations. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IR-9 (4) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): IR-9 (4) | |||
| CCI: | CCI-000852 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Develop and document an organization-level; mission/business process-level; and/or system-level maintenance policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): MA-1 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): MA-1 a 1 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): MA-1 a 1 (a) | |||
| NIST: NIST SP 800-53A (v1): MA-1.1 (i and ii) | |||
| CCI: | CCI-000853 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Disseminate an organization-level; mission/business process-level; and/or system-level maintenance policy to organization-defined personnel or roles. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): MA-1 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): MA-1 a 1 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): MA-1 a 1 | |||
| NIST: NIST SP 800-53A (v1): MA-1.1 (iii) | |||
| CCI: | CCI-000855 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Develop and document procedures to facilitate the implementation of the system maintenance policy and associated system maintenance controls. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): MA-1 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): MA-1 a 2 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): MA-1 a 2 | |||
| NIST: NIST SP 800-53A (v1): MA-1.1 (iv and v) | |||
| CCI: | CCI-000856 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Disseminate procedures to facilitate the implementation of the system maintenance policy and associated system maintenance controls to organization-defined personnel or roles. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): MA-1 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): MA-1 a 2 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): MA-1 a 2 | |||
| NIST: NIST SP 800-53A (v1): MA-1.1 (vi) | |||
| CCI: | CCI-002861 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-22 |
| Definition: | Defines the personnel or roles to whom an organization-level; mission/business process-level; and/or system-level maintenance policy is disseminated. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): MA-1 a 1 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): MA-1 a 1 (a) | |||
| CCI: | CCI-002862 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-22 |
| Definition: | Defines the personnel or roles to whom system maintenance procedures are to be disseminated. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): MA-1 a 2 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): MA-1 a 2 | |||
| CCI: | CCI-004165 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Develop and document an organization-level; mission/business process-level; and/or system-level maintenance policy that is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): MA-1 a 1 (b) | ||
| CCI: | CCI-004166 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Designate an organization-defined official to manage the development, documentation, and dissemination of the maintenance policy. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): MA-1 b | ||
| CCI: | CCI-004167 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Designate an organization-defined official to manage the development, documentation, and dissemination of the maintenance procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): MA-1 b | ||
| CCI: | CCI-004168 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Defines the official who will manage the development, documentation, and dissemination of the maintenance policy. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): MA-1 b | ||
| CCI: | CCI-004169 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Defines the official who will manage the development, documentation, and dissemination of the maintenance procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): MA-1 b | ||
| CCI: | CCI-000851 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Defines the frequency with which to review and update the current system maintenance policy. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): MA-1 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): MA-1 b 1 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): MA-1 c 1 | |||
| NIST: NIST SP 800-53A (v1): MA-1.2 (i) | |||
| CCI: | CCI-000854 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Review and update the current maintenance policy in accordance with organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): MA-1 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): MA-1 b 1 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): MA-1 c 1 | |||
| NIST: NIST SP 800-53A (v1): MA-1.2 (ii) | |||
| CCI: | CCI-000857 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Review and update the current maintenance procedures in accordance with organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): MA-1 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): MA-1 b 2 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): MA-1 c 2 | |||
| NIST: NIST SP 800-53A (v1): MA-1.2 (iv) | |||
| CCI: | CCI-001628 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-12 |
| Definition: | Defines a frequency with which to review and update the current maintenance procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): MA-1 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): MA-1 b 2 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): MA-1 c 2 | |||
| NIST: NIST SP 800-53A (v1): MA-1.2 (iii) | |||
| CCI: | CCI-004170 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Review and update the current maintenance policy following organization-defined events. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): MA-1 c 1 | ||
| CCI: | CCI-004171 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Defines the events following reviewing and updating the current maintenance policy. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): MA-1 c 1 | ||
| CCI: | CCI-004172 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Review and update the current maintenance procedures following organization-defined events. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): MA-1 c 2 | ||
| CCI: | CCI-004173 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Defines the events following reviewing and updating the current maintenance procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): MA-1 c 2 | ||
| CCI: | CCI-002866 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-22 |
| Definition: | Schedule maintenance on system components in accordance with manufacturer or vendor specifications and/or organizational requirements. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): MA-2 a | ||
| NIST: NIST SP 800-53 Revision 5 (v5): MA-2 a | |||
| CCI: | CCI-002868 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-22 |
| Definition: | Document records of maintenance on system components in accordance with manufacturer or vendor specifications and/or organizational requirements. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): MA-2 a | ||
| NIST: NIST SP 800-53 Revision 5 (v5): MA-2 a | |||
| CCI: | CCI-002869 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-22 |
| Definition: | Review records of maintenance on system components in accordance with manufacturer or vendor specifications and/or organizational requirements. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): MA-2 a | ||
| NIST: NIST SP 800-53 Revision 5 (v5): MA-2 a | |||
| CCI: | CCI-002870 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-22 |
| Definition: | Schedule repair on system components in accordance with manufacturer or vendor specifications and/or organizational requirements. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): MA-2 a | ||
| NIST: NIST SP 800-53 Revision 5 (v5): MA-2 a | |||
| CCI: | CCI-002872 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-22 |
| Definition: | Document repair on system components in accordance with manufacturer or vendor specifications and/or organizational requirements. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): MA-2 a | ||
| NIST: NIST SP 800-53 Revision 5 (v5): MA-2 a | |||
| CCI: | CCI-002873 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-22 |
| Definition: | Review records of repairs on system components in accordance with manufacturer or vendor specifications and/or organizational requirements. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): MA-2 a | ||
| NIST: NIST SP 800-53 Revision 5 (v5): MA-2 a | |||
| CCI: | CCI-004174 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Schedule replacement on system components in accordance with manufacturer or vendor specifications and/or organizational requirements. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): MA-2 a | ||
| CCI: | CCI-004175 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Document replacement on system components in accordance with manufacturer or vendor specifications and/or organizational requirements. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): MA-2 a | ||
| CCI: | CCI-004176 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Review records of replacement on system components in accordance with manufacturer or vendor specifications and/or organizational requirements. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): MA-2 a | ||
| CCI: | CCI-004177 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Approve all maintenance activities, whether performed on site or remotely. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): MA-2 b | ||
| CCI: | CCI-004178 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Monitor all maintenance activities, whether performed on site or remotely. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): MA-2 b | ||
| CCI: | CCI-004179 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Approve all maintenance activities, whether the system or system components are serviced on site or removed to another location. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): MA-2 b | ||
| CCI: | CCI-004180 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Monitor all maintenance activities, whether the system or system components are serviced on site or removed to another location. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): MA-2 b | ||
| CCI: | CCI-000860 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Require that organization-defines personnel or roles explicitly approve the removal of the system or system components from organizational facilities for off-site maintenance, repair, or replacement. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): MA-2 c | ||
| NIST: NIST SP 800-53 Revision 4 (v4): MA-2 c | |||
| NIST: NIST SP 800-53 Revision 5 (v5): MA-2 c | |||
| NIST: NIST SP 800-53A (v1): MA-2.1 (iii) | |||
| CCI: | CCI-002874 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-22 |
| Definition: | Defines the personnel or roles who can explicitly approve the removal of the system or system components from organizational facilities for off-site maintenance, repairs or replacement. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): MA-2 c | ||
| NIST: NIST SP 800-53 Revision 5 (v5): MA-2 c | |||
| CCI: | CCI-000861 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Sanitize equipment to remove organization-defined information from associated media prior to removal from organizational facilities for off-site maintenance, repairs or replacement. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): MA-2 d | ||
| NIST: NIST SP 800-53 Revision 4 (v4): MA-2 d | |||
| NIST: NIST SP 800-53 Revision 5 (v5): MA-2 d | |||
| NIST: NIST SP 800-53A (v1): MA-2.1 (iv) | |||
| CCI: | CCI-004181 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Defines the information to be removed from associated media. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): MA-2 d | ||
| CCI: | CCI-000862 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Check all potentially impacted controls to verify that the controls are still functioning properly following maintenance, repair or replacement actions. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): MA-2 e | ||
| NIST: NIST SP 800-53 Revision 4 (v4): MA-2 e | |||
| NIST: NIST SP 800-53 Revision 5 (v5): MA-2 e | |||
| NIST: NIST SP 800-53A (v1): MA-2.1 (v) | |||
| CCI: | CCI-002875 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-22 |
| Definition: | Include organization-defined information in organizational maintenance records. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): MA-2 f | ||
| NIST: NIST SP 800-53 Revision 5 (v5): MA-2 f | |||
| CCI: | CCI-002876 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-22 |
| Definition: | Defines the information to include in organizational maintenance records. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): MA-2 f | ||
| NIST: NIST SP 800-53 Revision 5 (v5): MA-2 f | |||
| CCI: | CCI-004182 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Schedule maintenance, repair, and replacement actions for the system using organization-defined automated mechanisms. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): MA-2 (2) (a) | ||
| CCI: | CCI-004183 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Conduct maintenance, repair, and replacement actions for the system using organization-defined automated mechanisms. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): MA-2 (2) (a) | ||
| CCI: | CCI-004184 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Document maintenance, repair, and replacement actions for the system using organization-defined automated mechanisms. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): MA-2 (2) (a) | ||
| CCI: | CCI-002864 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-22 |
| Definition: | Produce up-to date, accurate, and complete records of all maintenance requested, scheduled, in process, and completed. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): MA-2 (2) (b) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): MA-2 (2) (b) | |||
| CCI: | CCI-002865 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-22 |
| Definition: | Produce up-to date, accurate, and complete records of all repair actions requested, scheduled, in process, and completed. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): MA-2 (2) (b) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): MA-2 (2) (b) | |||
| CCI: | CCI-004185 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Produce up-to date, accurate, and complete records of all replacement actions requested, scheduled, in process, and completed. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): MA-2 (2) (b) | ||
| CCI: | CCI-000865 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Approve the use of system maintenance tools. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): MA-3 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): MA-3 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): MA-3 a | |||
| NIST: NIST SP 800-53A (v1): MA-3.1 (i) | |||
| CCI: | CCI-000866 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Control the use of system maintenance tools. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): MA-3 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): MA-3 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): MA-3 a | |||
| NIST: NIST SP 800-53A (v1): MA-3.1 (i) | |||
| CCI: | CCI-000867 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Monitor the use of system maintenance tools. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): MA-3 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): MA-3 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): MA-3 a | |||
| NIST: NIST SP 800-53A (v1): MA-3.1 (i) | |||
| CCI: | CCI-004186 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Review previously approved system maintenance tools on an organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): MA-3 b | ||
| CCI: | CCI-004187 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Defines the frequency for reviewing previously approved system maintenance tools. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): MA-3 b | ||
| CCI: | CCI-000869 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Inspect the maintenance tools used by maintenance personnel for improper or unauthorized modifications. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): MA-3 (1) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): MA-3 (1) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): MA-3 (1) | |||
| NIST: NIST SP 800-53A (v1): MA-3 (1).1 | |||
| CCI: | CCI-000870 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Check media containing diagnostic and test programs for malicious code before the media are used in the system. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 (v3): MA-3 (2) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): MA-3 (2) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): MA-3 (2) | |||
| NIST: NIST SP 800-53A (v1): MA-3 (2).1 | |||
| CCI: | CCI-000871 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Prevent the unauthorized removal of maintenance equipment containing organizational information by: (a) verifying that there is no organizational information contained on the equipment; (b) sanitizing or destroying the equipment; (c) retaining the equipment within the facility; or (d) obtaining an exemption from organization-defined personnel or roles explicitly authorizing removal of the equipment from the facility. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): MA-3 (3) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): MA-3 (3) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): MA-3 (3) | |||
| NIST: NIST SP 800-53A (v1): MA-3 (3).1 | |||
| CCI: | CCI-002882 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-22 |
| Definition: | Defines the personnel or roles who can provide an exemption that explicitly authorizes removal of equipment from the facility. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): MA-3 (3) (d) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): MA-3 (3) (d) | |||
| CCI: | CCI-002883 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-22 |
| Definition: | Restrict the use of maintenance tools to authorized personnel only. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): MA-3 (4) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): MA-3 (4) | |||
| CCI: | CCI-004188 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Monitor the use of maintenance tools that execute with increased privilege. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): MA-3 (5) | ||
| CCI: | CCI-004189 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Inspect the maintenance tools to ensure the latest software updates and patches are installed. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): MA-3 (6) | ||
| CCI: | CCI-000873 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Approve nonlocal maintenance and diagnostic activities. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): MA-4 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): MA-4 a | |||
| NIST: NIST SP 800-53 Revision 5 (v5): MA-4 a | |||
| NIST: NIST SP 800-53A (v1): MA-4.1 (i) | |||
| CCI: | CCI-000874 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Monitor nonlocal maintenance and diagnostic activities. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): MA-4 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): MA-4 a | |||
| NIST: NIST SP 800-53 Revision 5 (v5): MA-4 a | |||
| NIST: NIST SP 800-53A (v1): MA-4.1 (i) | |||
| CCI: | CCI-000876 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Allow the use of nonlocal maintenance and diagnostic tools only as consistent with organizational policy and documented in the security plan for the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): MA-4 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): MA-4 b | |||
| NIST: NIST SP 800-53 Revision 5 (v5): MA-4 b | |||
| NIST: NIST SP 800-53A (v1): MA-4.1 (iii) | |||
| CCI: | CCI-000877 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Employ strong authentication in the establishment of nonlocal maintenance and diagnostic sessions. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): MA-4 c | ||
| NIST: NIST SP 800-53 Revision 4 (v4): MA-4 c | |||
| NIST: NIST SP 800-53 Revision 5 (v5): MA-4 c | |||
| NIST: NIST SP 800-53A (v1): MA-4.1 (iv) | |||
| CCI: | CCI-000878 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Maintain records for nonlocal maintenance and diagnostic activities. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): MA-4 d | ||
| NIST: NIST SP 800-53 Revision 4 (v4): MA-4 d | |||
| NIST: NIST SP 800-53 Revision 5 (v5): MA-4 d | |||
| NIST: NIST SP 800-53A (v1): MA-4.1 (v) | |||
| CCI: | CCI-004190 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Terminate session when nonlocal maintenance is completed. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): MA-4 e | ||
| CCI: | CCI-004191 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Terminate network connection when nonlocal maintenance is completed. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): MA-4 e | ||
| CCI: | CCI-002884 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-22 |
| Definition: | Log organization-defined audit events for nonlocal maintenance and diagnostic sessions. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): MA-4 (1) (a) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): MA-4 (1) (a) | |||
| CCI: | CCI-002885 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-22 |
| Definition: | Defines the audit events for logged for nonlocal maintenance and diagnostic sessions. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): MA-4 (1) (a) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): MA-4 (1) (a) | |||
| CCI: | CCI-002886 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-22 |
| Definition: | Review the audit records of the maintenance and diagnostic sessions to detect anomalous behavior. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): MA-4 (1) (b) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): MA-4 (1) (b) | |||
| CCI: | CCI-000882 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Require that nonlocal maintenance and diagnostic services be performed from a system that implements a security capability comparable to the capability implemented on the system being serviced. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): MA-4 (3) (a) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): MA-4 (3) (a) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): MA-4 (3) (a) | |||
| NIST: NIST SP 800-53A (v1): MA-4 (3).1 (i) | |||
| CCI: | CCI-000883 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Remove the component to be serviced from the system prior to nonlocal maintenance or diagnostic services; sanitize the component (for organizational information). | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): MA-4 (3) (b) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): MA-4 (3) (b) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): MA-4 (3) (b) | |||
| NIST: NIST SP 800-53A (v1): MA-4 (3).1 (i) | |||
| CCI: | CCI-001631 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-12 |
| Definition: | After the service is performed, inspect and sanitize the component (for potentially malicious software) before reconnecting the component to the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): MA-4 (3) (b) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): MA-4 (3) (b) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): MA-4 (3) (b) | |||
| NIST: NIST SP 800-53A (v1): MA-4 (3).1 (iii) | |||
| CCI: | CCI-000884 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Protect nonlocal maintenance sessions by employing organization-defined authenticators that are replay resistant. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): MA-4 (4) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): MA-4 (4) (a) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): MA-4 (4) (a) | |||
| NIST: NIST SP 800-53A (v1): MA-4 (4).1 (i) | |||
| CCI: | CCI-002887 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-22 |
| Definition: | Defines the authenticators that are replay resistant which will be employed to protect nonlocal maintenance sessions. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): MA-4 (4) (a) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): MA-4 (4) (a) | |||
| CCI: | CCI-001632 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-12 |
| Definition: | Protect nonlocal maintenance sessions by separating the maintenance session from other network sessions with the system by either physically separated communications paths or logically separated communications paths based upon encryption. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): MA-4 (4) (a) (b) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): MA-4 (4) (b) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): MA-4 (4) (b) (1) | |||
| NIST: NIST SP 800-53A (v1): MA-4 (4).1 (ii) | |||
| CCI: | CCI-004192 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Protect nonlocal maintenance sessions by separating the maintenance session from other network sessions with the system by logically separated communications paths. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): MA-4 (4) (b) (2) | ||
| CCI: | CCI-000887 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Require the approval of each nonlocal maintenance session by organization-defined personnel or roles. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): MA-4 (5) (b) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): MA-4 (5) (a) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): MA-4 (5) (a) | |||
| NIST: NIST SP 800-53A (v1): MA-4 (5).1 (iii) | |||
| CCI: | CCI-002888 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-22 |
| Definition: | Defines the personnel or roles authorized to approve each nonlocal maintenance session. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): MA-4 (5) (a) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): MA-4 (5) (a) | |||
| CCI: | CCI-000886 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Defines the personnel or roles to be notified of the date and time of planned nonlocal maintenance. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): MA-4 (5) (a) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): MA-4 (5) (b) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): MA-4 (5) (b) | |||
| NIST: NIST SP 800-53A (v1): MA-4 (5).1 (ii) | |||
| CCI: | CCI-002889 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-22 |
| Definition: | Notify organization-defined personnel or roles of the date and time of planned nonlocal maintenance. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): MA-4 (5) (b) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): MA-4 (5) (b) | |||
| CCI: | CCI-002890 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-22 |
| Definition: | Implement organization-defined cryptographic mechanisms to protect the integrity of nonlocal maintenance and diagnostic communications. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): MA-4 (6) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): MA-4 (6) | |||
| CCI: | CCI-003123 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-24 |
| Definition: | Implement organization-defined cryptographic mechanisms to protect the confidentiality of nonlocal maintenance and diagnostic communications. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): MA-4 (6) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): MA-4 (6) | |||
| CCI: | CCI-004193 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Defines the cryptographic mechanisms for protecting the integrity and confidentiality of nonlocal maintenance and diagnostic communications. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): MA-4 (6) | ||
| CCI: | CCI-002891 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-22 |
| Definition: | Verify session and network connection termination after the completion of nonlocal maintenance and diagnostic sessions. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): MA-4 (7) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): MA-4 (7) | |||
| CCI: | CCI-000890 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Establish a process for maintenance personnel authorization. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): MA-5 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): MA-5 a | |||
| NIST: NIST SP 800-53 Revision 5 (v5): MA-5 a | |||
| NIST: NIST SP 800-53A (v1): MA-5.1 (i) | |||
| CCI: | CCI-000891 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Maintain a list of authorized maintenance organizations or personnel. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): MA-5 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): MA-5 a | |||
| NIST: NIST SP 800-53 Revision 5 (v5): MA-5 a | |||
| NIST: NIST SP 800-53A (v1): MA-5.1 (ii) | |||
| CCI: | CCI-002894 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-22 |
| Definition: | Verify that non-escorted personnel performing maintenance on the system possess the required access authorizations. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): MA-5 b | ||
| NIST: NIST SP 800-53 Revision 5 (v5): MA-5 b | |||
| CCI: | CCI-002895 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-22 |
| Definition: | Designate organizational personnel with required access authorizations and technical competence to supervise the maintenance activities of personnel who do not possess the required access authorizations. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): MA-5 c | ||
| NIST: NIST SP 800-53 Revision 5 (v5): MA-5 c | |||
| CCI: | CCI-000893 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Implement procedures for the use of maintenance personnel that lack appropriate security clearances or are not U.S. citizens. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): MA-5 (1) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): MA-5 (1) (a) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): MA-5 (1) (a) | |||
| NIST: NIST SP 800-53A (v1): MA-5 (1).1 | |||
| CCI: | CCI-000894 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Requires maintenance personnel who do not have needed access authorizations, clearances, or formal access approvals to be escorted and supervised during the performance of maintenance and diagnostic activities on the system by approved organizational personnel who are fully cleared, have appropriate access authorizations, and are technically qualified. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): MA-5 (1) (a) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): MA-5 (1) (a) (1) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): MA-5 (1) (a) (1) | |||
| NIST: NIST SP 800-53A (v1): MA-5 (1).1 | |||
| CCI: | CCI-000895 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Require that, prior to initiating maintenance or diagnostic activities by personnel who do not have needed access authorizations, clearances or formal access approvals, all volatile information storage components within the system be sanitized and all nonvolatile storage media be removed or physically disconnected from the system and secured. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): MA-5 (1) (b) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): MA-5 (1) (a) (2) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): MA-5 (1) (a) (2) | |||
| NIST: NIST SP 800-53A (v1): MA-5 (1).1 | |||
| CCI: | CCI-004194 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Develop organization-defined alternate controls in the event a system component cannot be sanitized, removed, or disconnected from the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): MA-5 (1) (b) | ||
| CCI: | CCI-004195 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Implement organization-defined alternate controls in the event a system component cannot be sanitized, removed, or disconnected from the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): MA-5 (1) (b) | ||
| CCI: | CCI-004196 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Defines alternate controls in the event a system component cannot be sanitized, removed, or disconnected from the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): MA-5 (1) (b) | ||
| CCI: | CCI-000897 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Verify that personnel performing maintenance and diagnostic activities on a system processing, storing, or transmitting classified information possess security clearances and formal access approvals for at least the highest classification level and for all compartments of information on the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): MA-5 (2) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): MA-5 (2) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): MA-5 (2) | |||
| NIST: NIST SP 800-53A (v1): MA-5 (2).1 | |||
| CCI: | CCI-000898 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Verify that personnel performing maintenance and diagnostic activities on a system processing, storing, or transmitting classified information are U.S. citizens. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): MA-5 (3) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): MA-5 (3) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): MA-5 (3) | |||
| NIST: NIST SP 800-53A (v1): MA-5 (3).1 | |||
| CCI: | CCI-000899 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Ensure that cleared foreign nationals with appropriate security clearances are used to conduct maintenance and diagnostic activities on classified systems only when the systems are jointly owned and operated by the United States and foreign allied governments, or owned and operated solely by foreign allied governments. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): MA-5 (4) (a) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): MA-5 (4) (a) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): MA-5 (4) (a) | |||
| NIST: NIST SP 800-53A (v1): MA-5 (4).1 (i) | |||
| CCI: | CCI-000900 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Ensure that that approvals, consents, and detailed operational conditions regarding the use of foreign nationals to conduct maintenance and diagnostic activities on classified systems are fully documented within Memoranda of Agreements. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): MA-5 (4) (b) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): MA-5 (4) (b) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): MA-5 (4) (b) | |||
| NIST: NIST SP 800-53A (v1): MA-5 (4).1 (ii) | |||
| CCI: | CCI-002893 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-22 |
| Definition: | Ensure that non-escorted personnel performing maintenance activities not directly associated with the system but in the physical proximity of the system, have required access authorization. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): MA-5 (5) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): MA-5 (5) | |||
| CCI: | CCI-000903 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | Obtain maintenance support and/or spare parts for organization-defined system components within an organization-defined time period of failure. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): MA-6 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): MA-6 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): MA-6 | |||
| NIST: NIST SP 800-53A (v1): MA-6.1 (iii) | |||
| CCI: | CCI-002896 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-22 |
| Definition: | Defines the system components for which it obtains maintenance support and/or spare parts. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): MA-6 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): MA-6 | |||
| CCI: | CCI-002897 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-22 |
| Definition: | Defines a time period for obtaining maintenance support and/or spare parts for organization-defined system components after a failure. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): MA-6 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): MA-6 | |||
| CCI: | CCI-002898 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-22 |
| Definition: | Perform preventive maintenance on organization-defined information system components at organization-defined time intervals. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): MA-6 (1) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): MA-6 (1) | |||
| CCI: | CCI-002899 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-22 |
| Definition: | Defines system components on which to perform preventive maintenance. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): MA-6 (1) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): MA-6 (1) | |||
| CCI: | CCI-002900 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-22 |
| Definition: | Defines time intervals at which to perform preventive maintenance on organization-defined system components. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): MA-6 (1) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): MA-6 (1) | |||
| CCI: | CCI-002901 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-22 |
| Definition: | Perform predictive maintenance on organization-defined system components at organization-defined intervals. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): MA-6 (2) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): MA-6 (2) | |||
| CCI: | CCI-002902 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-22 |
| Definition: | Defines system components on which to perform predictive maintenance. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): MA-6 (2) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): MA-6 (2) | |||
| CCI: | CCI-002903 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-22 |
| Definition: | Defines time intervals at which to perform predictive maintenance on organization-defined system components. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): MA-6 (2) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): MA-6 (2) | |||
| CCI: | CCI-002904 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-22 |
| Definition: | Transfer predictive maintenance data to a maintenance management system using organization-defined automated mechanisms. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): MA-6 (3) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): MA-6 (3) | |||
| CCI: | CCI-004197 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Defines the automated mechanisms for transferring predictive maintenance data to a maintenance system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): MA-6 (3) | ||
| CCI: | CCI-004198 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Restrict or prohibit field maintenance on organization-defined systems or system components to organization-defined trusted maintenance facilities. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): MA-7 | ||
| CCI: | CCI-004199 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Defines the systems or system components which restrict or prohibit field maintenance. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): MA-7 | ||
| CCI: | CCI-004200 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Defines the trusted maintenance facilities which the systems or system components restrict or prohibit field maintenance. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): MA-7 | ||
| CCI: | CCI-000995 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Develop and document an organization-level; mission/business process-level; and/or system-level media protection policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): MP-1 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): MP-1 a 1 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): MP-1 a 1 (a) | |||
| NIST: NIST SP 800-53A (v1): MP-1.1 (i and ii) | |||
| CCI: | CCI-000996 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Disseminates a media protection policy to organization-defined personnel or roles. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): MP-1 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): MP-1 a 1 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): MP-1 a 1 | |||
| NIST: NIST SP 800-53A (v1): MP-1.1 (iii) | |||
| CCI: | CCI-000999 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Develop and document procedures to facilitate the implementation of the media protection policy and associated media protection controls. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): MP-1 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): MP-1 a 2 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): MP-1 a 2 | |||
| NIST: NIST SP 800-53A (v1): MP-1.1 (iv and v) | |||
| CCI: | CCI-001000 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Disseminate to organization-defined personnel or roles procedures to facilitate the implementation of the media protection policy and associated media protection controls. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): MP-1 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): MP-1 a 2 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): MP-1 a 2 | |||
| NIST: NIST SP 800-53A (v1): MP-1.1 (vi) | |||
| CCI: | CCI-002566 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-09 |
| Definition: | Defines personnel or roles to whom a media protection policy and procedures will be disseminated. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): MP-1 a 1 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): MP-1 a 1 | |||
| CCI: | CCI-004201 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Develop and document an organization-level; mission/business process-level; and/or system-level media protection policy that is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): MP-1 a 1 (b) | ||
| CCI: | CCI-004202 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Designate an organization-defined official to manage the development and documentation of the media protection policy. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): MP-1 b | ||
| CCI: | CCI-004203 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Designate an organization-defined official to manage the dissemination of the media protection policy. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): MP-1 b | ||
| CCI: | CCI-004204 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Designate an organization-defined official to manage development and documentation of the media protection procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): MP-1 b | ||
| CCI: | CCI-004205 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Designate an organization-defined official to manage dissemination of the media protection procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): MP-1 b | ||
| CCI: | CCI-004206 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Defines the official designated to manage the development, documentation, and dissemination of the media protection policy and procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): MP-1 b | ||
| CCI: | CCI-000997 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Review and update the current media protection policy in accordance with organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): MP-1 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): MP-1 b 1 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): MP-1 c 1 | |||
| NIST: NIST SP 800-53A (v1): MP-1.2 (ii) | |||
| CCI: | CCI-000998 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Defines a frequency for reviewing and updating the current media protection policy. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): MP-1 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): MP-1 b 1 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): MP-1 c 1 | |||
| NIST: NIST SP 800-53A (v1): MP-1.2 (i) | |||
| CCI: | CCI-001001 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Review and update the current media protection procedures in accordance with organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): MP-1 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): MP-1 b 2 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): MP-1 c 2 | |||
| NIST: NIST SP 800-53A (v1): MP-1.2 (iv) | |||
| CCI: | CCI-001002 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Defines a frequency for reviewing and updating the current media protection procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): MP-1 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): MP-1 b 2 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): MP-1 c 2 | |||
| NIST: NIST SP 800-53A (v1): MP-1.2 (iii) | |||
| CCI: | CCI-004207 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Review and update the current media protection policy following organization-defined events. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): MP-1 c 1 | ||
| CCI: | CCI-004208 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Defines the events following reviewing and updating the current media policy. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): MP-1 c 1 | ||
| CCI: | CCI-004209 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Review and update the current media protection procedures following organization-defined events. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): MP-1 c 2 | ||
| CCI: | CCI-004210 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Defines the events following reviewing and updating the current media procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): MP-1 c 2 | ||
| CCI: | CCI-001003 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Restrict access to organization-defined types of digital and/or non-digital media to organization-defined personnel or roles. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): MP-2 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): MP-2 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): MP-2 | |||
| NIST: NIST SP 800-53A (v1): MP-2.1 (ii) | |||
| CCI: | CCI-001004 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Defines types of digital and/or non-digital media for which the organization restricts access. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): MP-2 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): MP-2 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): MP-2 | |||
| NIST: NIST SP 800-53A (v1): MP-2.1 (i) | |||
| CCI: | CCI-001005 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Defines personnel or roles from which to restrict access to organization-defined types of digital and/or non-digital media. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): MP-2 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): MP-2 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): MP-2 | |||
| NIST: NIST SP 800-53A (v1): MP-2.1 (i) | |||
| CCI: | CCI-001010 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Mark system media indicating the distribution limitations, handling caveats, and applicable security markings (if any) of the information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): MP-3 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): MP-3 a | |||
| NIST: NIST SP 800-53 Revision 5 (v5): MP-3 a | |||
| NIST: NIST SP 800-53A (v1): MP-3.1 (ii) | |||
| CCI: | CCI-001011 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Exempt organization-defined types of system media from marking as long as the media remain within organization-defined controlled areas. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): MP-3 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): MP-3 b | |||
| NIST: NIST SP 800-53 Revision 5 (v5): MP-3 b | |||
| NIST: NIST SP 800-53A (v1): MP-3.1 (iv) | |||
| CCI: | CCI-001012 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Defines types of system media to exempt from marking as long as the media remain within organization-defined controlled areas. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): MP-3 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): MP-3 b | |||
| NIST: NIST SP 800-53 Revision 5 (v5): MP-3 b | |||
| NIST: NIST SP 800-53A (v1): MP-3.1 (iii) | |||
| CCI: | CCI-001013 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Defines controlled areas where organization-defined types of system media are exempt from being marked. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): MP-3 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): MP-3 b | |||
| NIST: NIST SP 800-53 Revision 5 (v5): MP-3 b | |||
| NIST: NIST SP 800-53A (v1): MP-3.1 (iii) | |||
| CCI: | CCI-001015 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Defines types of digital and/or non-digital media to physically control and securely store within organization-defined controlled areas. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): MP-4 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): MP-4 a | |||
| NIST: NIST SP 800-53 Revision 5 (v5): MP-4 a | |||
| NIST: NIST SP 800-53A (v1): MP-4.1 (i) | |||
| CCI: | CCI-001016 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Defines controlled areas where organization-defined types of digital and/or non-digital media are physically controlled and securely stored. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): MP-4 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): MP-4 a | |||
| NIST: NIST SP 800-53 Revision 5 (v5): MP-4 a | |||
| NIST: NIST SP 800-53A (v1): MP-4.1 (i) | |||
| CCI: | CCI-004211 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Physically control and securely store organization-defined types of digital and/or non-digital media within organization-defined controlled areas. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): MP-4 a | ||
| CCI: | CCI-004212 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Securely store organization-defined types of digital and/or non-digital media within organization-defined controlled areas. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): MP-4 a | ||
| CCI: | CCI-004213 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Protect system media types defined in MP-4a until the media are destroyed or sanitized using approved equipment. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): MP-4 b | ||
| CCI: | CCI-004214 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Protect system media types defined in MP-4a until the media are destroyed or sanitized using approved techniques. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): MP-4 b | ||
| CCI: | CCI-004215 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Protect system media types defined in MP-4a until the media are destroyed or sanitized using approved procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): MP-4 b | ||
| CCI: | CCI-001007 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Restrict access to media storage areas using organization-defined automated mechanisms. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): MP-2 (1) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): MP-4 (2) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): MP-4 (2) | |||
| NIST: NIST SP 800-53A (v1): MP-2 (1).1 (i) | |||
| CCI: | CCI-001008 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Log access attempts and access granted using organization-defined automated mechanisms. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): MP-2 (1) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): MP-4 (2) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): MP-4 (2) | |||
| NIST: NIST SP 800-53A (v1): MP-2 (1).1 (ii) | |||
| CCI: | CCI-004216 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Defines the automated mechanisms which restrict access to media storage areas and log access attempts and access granted. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): MP-4 (2) | ||
| CCI: | CCI-001021 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Defines types of system media protected and controlled during transport outside of controlled areas. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): MP-5 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): MP-5 a | |||
| NIST: NIST SP 800-53 Revision 5 (v5): MP-5 a | |||
| NIST: NIST SP 800-53A (v1): MP-5 | |||
| CCI: | CCI-001022 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Defines controls to be used to protect and control organization-defined types of system media during transport outside of controlled areas. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): MP-5 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): MP-5 a | |||
| NIST: NIST SP 800-53 Revision 5 (v5): MP-5 a | |||
| NIST: NIST SP 800-53A (v1): MP-5.1 (i) | |||
| CCI: | CCI-004217 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Protect organization-defined types of system media during transport outside of controlled areas using organization-defined controls. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): MP-5 a | ||
| CCI: | CCI-004218 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Control organization-defined types of system media during transport outside of controlled areas using organization-defined controls. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): MP-5 a | ||
| CCI: | CCI-001023 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Maintain accountability for system media during transport outside of controlled areas. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): MP-5 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): MP-5 b | |||
| NIST: NIST SP 800-53 Revision 5 (v5): MP-5 b | |||
| NIST: NIST SP 800-53A (v1): MP-5.1 (iii) | |||
| CCI: | CCI-001025 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Document activities associated with the transport of system media. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): MP-5 (2) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): MP-5 c | |||
| NIST: NIST SP 800-53 Revision 5 (v5): MP-5 c | |||
| NIST: NIST SP 800-53A (v1): MP-5 (2).1 | |||
| CCI: | CCI-001024 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Restrict the activities associated with the transport of system media to authorized personnel. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): MP-5 c | ||
| NIST: NIST SP 800-53 Revision 4 (v4): MP-5 d | |||
| NIST: NIST SP 800-53 Revision 5 (v5): MP-5 d | |||
| NIST: NIST SP 800-53A (v1): MP-5.1 (v) | |||
| CCI: | CCI-001026 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Employ an identified custodian during transport of system media outside of controlled areas. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): MP-5 (3) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): MP-5 (3) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): MP-5 (3) | |||
| NIST: NIST SP 800-53A (v1): MP-5 (3).1 | |||
| CCI: | CCI-001028 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Sanitize organization-defined system media prior to disposal, release out of organizational control, or release for reuse using organization-defined sanitization techniques and procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): MP-6 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): MP-6 a | |||
| NIST: NIST SP 800-53 Revision 5 (v5): MP-6 a | |||
| NIST: NIST SP 800-53A (v1): MP-6.1 (ii) | |||
| CCI: | CCI-002578 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-09 |
| Definition: | Defines system media to sanitize prior to disposal, release out of organizational control, or release for reuse using organization-defined sanitization techniques and procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): MP-6 a | ||
| NIST: NIST SP 800-53 Revision 5 (v5): MP-6 a | |||
| CCI: | CCI-002579 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-09 |
| Definition: | Defines the sanitization techniques and procedures to be used to sanitize organization-defined system media prior to disposal, release out of organizational control, or release for reuse. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): MP-6 a | ||
| NIST: NIST SP 800-53 Revision 5 (v5): MP-6 a | |||
| CCI: | CCI-002580 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-09 |
| Definition: | Employ sanitization mechanisms with the strength and integrity commensurate with the security category or classification of the information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): MP-6 b | ||
| NIST: NIST SP 800-53 Revision 5 (v5): MP-6 b | |||
| CCI: | CCI-002567 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-09 |
| Definition: | Review and approve media sanitization. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): MP-6 (1) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): MP-6 (1) | |||
| CCI: | CCI-002568 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-09 |
| Definition: | Track and document media sanitization. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): MP-6 (1) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): MP-6 (1) | |||
| CCI: | CCI-002569 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-09 |
| Definition: | Verify media sanitization. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): MP-6 (1) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): MP-6 (1) | |||
| CCI: | CCI-002570 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-09 |
| Definition: | Review and approve media disposal actions. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): MP-6 (1) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): MP-6 (1) | |||
| CCI: | CCI-002571 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-09 |
| Definition: | Track and document media disposal actions. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): MP-6 (1) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): MP-6 (1) | |||
| CCI: | CCI-002572 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-09 |
| Definition: | Verify media disposal actions. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): MP-6 (1) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): MP-6 (1) | |||
| CCI: | CCI-001031 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Defines a frequency for testing sanitization equipment and procedures to ensure that the intended sanitization is being achieved. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): MP-6 (2) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): MP-6 (2) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): MP-6 (2) | |||
| NIST: NIST SP 800-53A (v1): MP-6 (2).1 (i) | |||
| CCI: | CCI-004219 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Test sanitization equipment in accordance with the organization-defined frequency to ensure that the intended sanitization is being achieved. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): MP-6 (2) | ||
| CCI: | CCI-004220 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Test sanitization procedures in accordance with the organization-defined frequency to ensure that the intended sanitization is being achieved. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): MP-6 (2) | ||
| CCI: | CCI-001032 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Apply nondestructive sanitization techniques to portable storage devices prior to connecting such devices to the system in accordance with organization-defined circumstances requiring sanitization of portable storage devices. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): MP-6 (3) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): MP-6 (3) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): MP-6 (3) | |||
| NIST: NIST SP 800-53A (v1): MP-6 (3).1 (ii) | |||
| CCI: | CCI-001033 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Defines circumstances requiring sanitization of portable storage devices prior to connecting such devices to the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): MP-6 (3) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): MP-6 (3) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): MP-6 (3) | |||
| NIST: NIST SP 800-53A (v1): MP-6 (3).1 (i) | |||
| CCI: | CCI-002573 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-09 |
| Definition: | Enforce dual authorization for the sanitization of organization-defined system media. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): MP-6 (7) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): MP-6 (7) | |||
| CCI: | CCI-002574 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-09 |
| Definition: | Defines the system media that dual authorization is enforced for sanitization. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): MP-6 (7) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): MP-6 (7) | |||
| CCI: | CCI-002575 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-09 |
| Definition: | Defines systems or system components from which information is purged or wiped, either remotely or under the organization-defined conditions. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): MP-6 (8) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): MP-6 (8) | |||
| CCI: | CCI-002576 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-09 |
| Definition: | Defines conditions under which information from organization-defined systems or system components are to be purged or wiped. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): MP-6 (8) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): MP-6 (8) | |||
| CCI: | CCI-002577 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-09 |
| Definition: | Provide the capability to purge or wipe information from organization-defined systems, system components either remotely or under organization-defined conditions. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): MP-6 (8) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): MP-6 (8) | |||
| CCI: | CCI-002581 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-09 |
| Definition: | Defines the types of system media to restrict or prohibit on organization-defined systems or system components using organization-defined controls. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): MP-7 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): MP-7 (a) | |||
| CCI: | CCI-002582 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-09 |
| Definition: | Defines the systems or system components on which to restrict or prohibit the use of organization-defined types of system media using organization-defined controls. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): MP-7 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): MP-7 (a) | |||
| CCI: | CCI-002583 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-09 |
| Definition: | Defines the controls to use for restricting or prohibiting the use of organization-defined types of system media on organization-defined systems or system components. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): MP-7 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): MP-7 (a) | |||
| CCI: | CCI-002584 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-09 |
| Definition: | Restrict or prohibit the use of organization-defined types of system media on organization-defined systems or system components using organization-defined controls. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): MP-7 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): MP-7 (a) | |||
| CCI: | CCI-002585 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-09 |
| Definition: | Prohibit the use of portable storage devices in organizational systems when such devices have no identifiable owner. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): MP-7 (1) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): MP-7 (b) | |||
| CCI: | CCI-002586 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-09 |
| Definition: | Prohibit the use of sanitization-resistant media in organizational systems. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): MP-7 (2) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): MP-7 (2) | |||
| CCI: | CCI-004221 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Establish an organization-defined system media downgrading process that includes employing downgrading mechanisms with strength and integrity commensurate with the security category or classification of the information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): MP-8 a | ||
| CCI: | CCI-004222 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Defines the system media downgrading process that includes employing downgrading mechanisms with strength and integrity commensurate with the security category or classification of the information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): MP-8 a | ||
| CCI: | CCI-004223 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Verify that the system media downgrading process is commensurate with the security category and/or classification level of the information to be removed. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): MP-8 b | ||
| CCI: | CCI-004224 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Verify that the system media downgrading process is commensurate with the access authorizations of the potential recipients of the downgraded information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): MP-8 b | ||
| CCI: | CCI-004225 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Identify organization-defined system media requiring downgrading. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): MP-8 c | ||
| CCI: | CCI-004226 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Defines the system media requiring downgrading. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): MP-8 c | ||
| CCI: | CCI-002600 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-09 |
| Definition: | Downgrade the identified system media using the established process. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): MP-8 d | ||
| NIST: NIST SP 800-53 Revision 5 (v5): MP-8 d | |||
| CCI: | CCI-002587 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-09 |
| Definition: | Document system media downgrading actions. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): MP-8 (1) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): MP-8 (1) | |||
| CCI: | CCI-002591 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-09 |
| Definition: | Defines the frequency with which to test downgrading equipment and procedures to ensure correct performance. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): MP-8 (2) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): MP-8 (2) | |||
| CCI: | CCI-004227 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Test downgrading equipment on an organization-defined frequency to ensure that intended downgrading actions are being achieved. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): MP-8 (2) | ||
| CCI: | CCI-004228 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Test downgrading procedures on an organization-defined frequency to ensure that intended downgrading actions are being achieved. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): MP-8 (2) | ||
| CCI: | CCI-002593 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-09 |
| Definition: | Downgrade system media containing Controlled Unclassified Information (CUI) prior to public release. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): MP-8 (3) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): MP-8 (3) | |||
| CCI: | CCI-002594 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-09 |
| Definition: | Downgrade system media containing classified information prior to release to individuals without required access authorizations. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): MP-8 (4) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): MP-8 (4) | |||
| CCI: | CCI-000904 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Develop and document an organization-level; mission/business process-level; and/or system-level physical and environmental protection policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PE-1 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PE-1 a 1 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-1 a 1 (a) | |||
| NIST: NIST SP 800-53A (v1): PE-1.1 (i and ii) | |||
| CCI: | CCI-000905 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Disseminate a physical and environmental protection policy to organization-defined personnel or roles. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PE-1 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PE-1 a 1 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-1 a 1 | |||
| NIST: NIST SP 800-53A (v1): PE-1.1 (iii) | |||
| CCI: | CCI-000908 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Develop and document procedures to facilitate the implementation of the physical and environmental protection policy and associated physical and environmental protection controls. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PE-1 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PE-1 a 2 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-1 a 2 | |||
| NIST: NIST SP 800-53A (v1): PE-1.1 (iv and v) | |||
| CCI: | CCI-000909 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Disseminate physical and environmental protection procedures to organization-defined personnel or roles. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PE-1 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PE-1 a 2 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-1 a 2 | |||
| NIST: NIST SP 800-53A (v1): PE-1.1 (vi) | |||
| CCI: | CCI-002908 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-08-27 |
| Definition: | Defines the personnel or roles to whom an organization-level; mission/business process-level; and/or system-level physical and environmental protection policy is disseminated. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PE-1 a 1 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-1 a 1 | |||
| CCI: | CCI-002909 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-08-27 |
| Definition: | Defines the personnel or roles to whom the physical and environmental protection procedures are disseminated. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PE-1 a 2 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-1 a 2 | |||
| CCI: | CCI-004229 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Develop and document an organization-level; mission/business process-level; and/or system-level physical and environmental protection policy that is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PE-1 a 1 (b) | ||
| CCI: | CCI-004230 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Designate an organization-defined official to manage the development and documentation of the physical and environmental protection policy. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PE-1 b | ||
| CCI: | CCI-004231 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Designate an organization-defined official to manage the dissemination of the physical and environmental protection policy. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PE-1 b | ||
| CCI: | CCI-004232 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Designate an organization-defined official to manage development and documentation of the physical and environmental protection procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PE-1 b | ||
| CCI: | CCI-004233 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Designate an organization-defined official to manage dissemination of the physical and environmental protection procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PE-1 b | ||
| CCI: | CCI-004234 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Defines the official who will manage the physical and environmental policy. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PE-1 b | ||
| CCI: | CCI-004235 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Defines the official who will manage the physical and environmental procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PE-1 b | ||
| CCI: | CCI-000906 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Review and update the current physical and environmental protection policy in accordance with organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PE-1 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PE-1 b 1 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-1 c 1 | |||
| NIST: NIST SP 800-53A (v1): PE-1.2 (ii) | |||
| CCI: | CCI-000907 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Defines the frequency with which to review and update the physical and environmental protection policy. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PE-1 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PE-1 b 1 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-1 c 1 | |||
| NIST: NIST SP 800-53A (v1): PE-1.2 (i) | |||
| CCI: | CCI-000910 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Review and update the current physical and environmental protection procedures in accordance with organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PE-1 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PE-1 b 2 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-1 c 2 | |||
| NIST: NIST SP 800-53A (v1): PE-1.2 (iv) | |||
| CCI: | CCI-000911 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Defines the frequency with which to review and update the physical and environmental protection procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PE-1 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PE-1 b 2 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-1 c 2 | |||
| NIST: NIST SP 800-53A (v1): PE-1.2 (iii) | |||
| CCI: | CCI-004236 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Review and update the current physical and environmental protection policy following organization-defined events. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PE-1 c 1 | ||
| CCI: | CCI-004237 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Defines the events following reviewing and updating the current physical and environmental protection policy. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PE-1 c 1 | ||
| CCI: | CCI-004238 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Review and update the current physical and environmental protection procedures following organization-defined events. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PE-1 c 2 | ||
| CCI: | CCI-004239 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Defines the events following reviewing and updating the current physical and environmental protection procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PE-1 c 2 | ||
| CCI: | CCI-000912 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Develop a list of individuals with authorized access to the facility where the system resides. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PE-2 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PE-2 a | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-2 a | |||
| NIST: NIST SP 800-53A (v1): PE-2 (1).1 (i) | |||
| CCI: | CCI-002910 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-08-27 |
| Definition: | Approve a list of individuals with authorized access to the facility where the system resides. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PE-2 a | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-2 a | |||
| CCI: | CCI-002911 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-08-27 |
| Definition: | Maintain a list of individuals with authorized access to the facility where the system resides. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PE-2 a | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-2 a | |||
| CCI: | CCI-000913 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Issue authorization credentials for facility access. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PE-2 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PE-2 b | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-2 b | |||
| NIST: NIST SP 800-53A (v1): PE-2.1 (iii) | |||
| CCI: | CCI-000914 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Review the access list detailing authorized facility access by individuals in accordance with organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PE-2 c | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PE-2 c | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-2 c | |||
| NIST: NIST SP 800-53A (v1): PE-2.2 (ii) | |||
| CCI: | CCI-000915 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Defines the frequency with which to review the access list detailing authorized facility access by individuals. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PE-2 c | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PE-2 c | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-2 c | |||
| NIST: NIST SP 800-53A (v1): PE-2.2 (i) | |||
| CCI: | CCI-001635 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-12 |
| Definition: | Remove individuals from the facility access list when access is no longer required. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PE-2 c | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PE-2 d | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-2 d | |||
| NIST: NIST SP 800-53A (v1): PE-2.2 (iii) | |||
| CCI: | CCI-000916 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Authorize physical access to the facility where the system resides based on position or role. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PE-2 (1) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PE-2 (1) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-2 (1) | |||
| NIST: NIST SP 800-53A (v1): PE-2 (1).1 (ii) | |||
| CCI: | CCI-000917 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Require two forms of identification from an organization-defined list of acceptable forms of identification for visitor access to the facility where the system resides. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PE-2 (2) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PE-2 (2) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-2 (2) | |||
| NIST: NIST SP 800-53A (v1): PE-2 (2).1 | |||
| CCI: | CCI-002912 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-08-27 |
| Definition: | Defines a list of acceptable forms of identification for visitor access to the facility where the system resides. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PE-2 (2) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-2 (2) | |||
| CCI: | CCI-002913 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-08-27 |
| Definition: | Restrict unescorted access to the facility where the system resides to personnel with one or more of the following: security clearances for all information contained within the system; formal access authorizations for all information contained within the system; need for access to all information contained within the system; organization-defined physical access authorizations. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PE-2 (3) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-2 (3) | |||
| CCI: | CCI-002914 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-08-27 |
| Definition: | Defines the credentials required for personnel to have unescorted access to the facility where the system resides. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PE-2 (3) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-2 (3) | |||
| CCI: | CCI-000920 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Verify individual access authorizations before granting access to the facility. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PE-3 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PE-3 a 1 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-3 a 1 | |||
| NIST: NIST SP 800-53A (v1): PE-3.1 (ii) | |||
| CCI: | CCI-002915 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-08-27 |
| Definition: | Defines the entry and exit points to the facility where the system resides. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PE-3 a | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-3 a | |||
| CCI: | CCI-002916 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-08-27 |
| Definition: | Defines the physical access control systems or devices or guards that control ingress and egress to the facility where the system resides. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PE-3 a 2 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-3 a 2 | |||
| CCI: | CCI-004240 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Enforce physical access authorizations at organization-defined entry points to the facility where the system resides. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PE-3 a | ||
| CCI: | CCI-004241 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Enforce physical access authorizations at organization-defined exit points to the facility where the system resides. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PE-3 a | ||
| CCI: | CCI-004242 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Control ingress to the facility where the information system resides using one or more organization-defined physical access control systems or devices or guards. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PE-3 a 2 | ||
| CCI: | CCI-004243 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Control egress to the facility where the information system resides using one or more organization-defined physical access control systems or devices or guards. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PE-3 a 2 | ||
| CCI: | CCI-002917 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-08-27 |
| Definition: | Maintain physical access audit logs for organization-defined entry/exit points to the facility where the system resides. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PE-3 b | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-3 b | |||
| CCI: | CCI-002918 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-08-27 |
| Definition: | Defines entry and exit points to the facility where the system resides that require physical access audit logs be maintained. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PE-3 b | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-3 b | |||
| CCI: | CCI-002919 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-08-27 |
| Definition: | Control access to areas within the facility designated as publicly accessible by implementing organization-defined access controls. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PE-3 c | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-3 c | |||
| CCI: | CCI-002920 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-08-27 |
| Definition: | Defines physical access controls to control access to areas within the facility designated as publicly accessible. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PE-3 c | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-3 c | |||
| CCI: | CCI-002921 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-08-27 |
| Definition: | Escort visitors in the facility where the system resides during organization-defined circumstances requiring visitor escorts. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PE-3 d | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-3 d | |||
| CCI: | CCI-002922 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-08-27 |
| Definition: | Defines circumstances requiring visitor escorts in the facility where the system resides. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PE-3 d | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-3 d | |||
| CCI: | CCI-002923 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-08-27 |
| Definition: | Monitor visitor activity in the facility where the system resides during organization-defined circumstances requiring visitor monitoring. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PE-3 d | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-3 d | |||
| CCI: | CCI-002924 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-08-27 |
| Definition: | Define circumstances requiring visitor monitoring in the facility where the system resides. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PE-3 d | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-3 d | |||
| CCI: | CCI-000923 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Secure keys, combinations, and other physical access devices. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PE-3 e | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PE-3 e | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-3 e | |||
| NIST: NIST SP 800-53A (v1): PE-3.1 (v) | |||
| CCI: | CCI-000924 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Inventory organization-defined physical access devices on an organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PE-3 f | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PE-3 f | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-3 f | |||
| NIST: NIST SP 800-53A (v1): PE-3.2 (ii) | |||
| CCI: | CCI-000925 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Defines the frequency for conducting inventories of organization-defined physical access devices. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PE-3 f | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PE-3 f | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-3 f | |||
| NIST: NIST SP 800-53A (v1): PE-3.2 (i) | |||
| CCI: | CCI-002925 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-08-27 |
| Definition: | Defines the physical access devices to inventory. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PE-3 f | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-3 f | |||
| CCI: | CCI-000926 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Change combinations and keys in accordance with organization-defined frequency and/or when keys are lost, combinations are compromised, or when individuals possessing the keys or combinations are transferred or terminated. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PE-3 g | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PE-3 g | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-3 g | |||
| NIST: NIST SP 800-53A (v1): PE-3.2 (iv) | |||
| CCI: | CCI-000927 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Defines a frequency for changing combinations and keys. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PE-3 g | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PE-3 g | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-3 g | |||
| NIST: NIST SP 800-53A (v1): PE-3.2 (iii) | |||
| CCI: | CCI-000928 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Enforce physical access authorizations to the system in addition to the physical access controls for the facility where the system resides at organization-defined physical spaces containing one or more components of the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PE-3 (1) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PE-3 (1) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-3 (1) | |||
| NIST: NIST SP 800-53A (v1): PE-3 (1).1 | |||
| CCI: | CCI-002926 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-08-27 |
| Definition: | Defines the physical spaces containing one or more components of the system that require physical access authorizations and controls at the facility where the system resides. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PE-3 (1) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-3 (1) | |||
| CCI: | CCI-000929 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Perform security checks in accordance with organization-defined frequency at the physical boundary of the facility or system for unauthorized exfiltration of information or removal of system components. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PE-3 (2) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PE-3 (2) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-3 (2) | |||
| NIST: NIST SP 800-53A (v1): PE-3 (2).1 | |||
| CCI: | CCI-002927 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-08-27 |
| Definition: | Defines the frequency with which to perform security checks at the physical boundary of the facility or system for exfiltration of information or removal of system components. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PE-3 (2) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-3 (2) | |||
| CCI: | CCI-000930 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Employ guards to control every physical access point to the facility where the system resides 24 hours per day, 7 days per week. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PE-3 (3) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PE-3 (3) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-3 (3) | |||
| NIST: NIST SP 800-53A (v1): PE-3 (3).1 | |||
| CCI: | CCI-000931 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Use lockable physical casings to protect organization-defined system components from unauthorized physical access. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PE-3 (4) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PE-3 (4) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-3 (4) | |||
| NIST: NIST SP 800-53A (v1): PE-3 (4).1 (ii) | |||
| CCI: | CCI-000932 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Defines system components to be protected from unauthorized physical access using lockable physical casings. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PE-3 (4) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PE-3 (4) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-3 (4) | |||
| NIST: NIST SP 800-53A (v1): PE-3 (4).1 (i) | |||
| CCI: | CCI-000933 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Employ organization-defined anti-tamper technologies to deter and/or prevent physical tampering or alteration of organization-defined hardware components within the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PE-3 (5) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PE-3 (5) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-3 (5) | |||
| NIST: NIST SP 800-53A (v1): PE-3 (5).1 | |||
| CCI: | CCI-002928 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-08-27 |
| Definition: | Defines anti-tamper technologies to detect and prevent physical tampering or alteration of organization-defined hardware components within the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PE-3 (5) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-3 (5) | |||
| CCI: | CCI-002929 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-08-27 |
| Definition: | Defines hardware components within the system for which to employ organization-defined security safeguards to detect and prevent physical tampering or alteration. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PE-3 (5) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-3 (5) | |||
| CCI: | CCI-004244 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Limit access using physical barriers. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PE-3 (7) | ||
| CCI: | CCI-004245 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Employ access control vestibules at organization-defined locations within the facility. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PE-3 (8) | ||
| CCI: | CCI-004246 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Defines the locations within the facility where the access control vestibules are employed. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PE-3 (8) | ||
| CCI: | CCI-000936 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Control physical access to organization-defined system distribution and transmission lines within organizational facilities using organization-defined security controls. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PE-4 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PE-4 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-4 | |||
| NIST: NIST SP 800-53A (v1): PE-4.1 | |||
| CCI: | CCI-002930 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-08-27 |
| Definition: | Defines system distribution and transmission lines within organizational facilities to control physical access to using organization-defined security controls. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PE-4 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-4 | |||
| CCI: | CCI-002931 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-08-27 |
| Definition: | Defines security controls to control physical access to organization-defined system distribution and transmission lines within organizational facilities. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PE-4 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-4 | |||
| CCI: | CCI-000937 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Control physical access to output from organization-defined output devices to prevent unauthorized individuals from obtaining the output. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PE-5 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PE-5 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-5 | |||
| NIST: NIST SP 800-53A (v1): PE-5.1 | |||
| CCI: | CCI-004247 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Link individual identity to receipt of output from output devices. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PE-5 (2) | ||
| CCI: | CCI-002939 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-08-27 |
| Definition: | Monitor physical access to the facility where the system resides to detect and respond to physical security incidents. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PE-6 a | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-6 a | |||
| CCI: | CCI-000939 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Review physical access logs in accordance with organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PE-6 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PE-6 b | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-6 b | |||
| NIST: NIST SP 800-53A (v1): PE-6.1 (iii) | |||
| CCI: | CCI-000940 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Defines a frequency for reviewing physical access logs. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PE-6 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PE-6 b | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-6 b | |||
| NIST: NIST SP 800-53A (v1): PE-6.1 (ii) | |||
| CCI: | CCI-002940 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-08-27 |
| Definition: | Review physical access logs upon occurrence of organization-defined events or potential indications of events. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PE-6 b | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-6 b | |||
| CCI: | CCI-002941 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-08-27 |
| Definition: | Defines events or potential indications of events requiring review of physical access logs. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PE-6 b | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-6 b | |||
| CCI: | CCI-000941 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Coordinate results of reviews and investigations with the organization's incident response capability. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PE-6 c | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PE-6 c | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-6 c | |||
| NIST: NIST SP 800-53A (v1): PE-6.1 (iv) | |||
| CCI: | CCI-000942 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Monitor physical access to the facility where the system resides using physical intrusion alarms and surveillance equipment. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PE-6 (1) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PE-6 (1) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-6 (1) | |||
| NIST: NIST SP 800-53A (v1): PE-6 (1).1 | |||
| CCI: | CCI-002942 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-08-27 |
| Definition: | Recognize organization-defined classes or types of intrusions, using organization-defined automated mechanisms. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PE-6 (2) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-6 (2) | |||
| CCI: | CCI-002943 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-08-27 |
| Definition: | Defines the classes or types of intrusions to recognize using automated mechanisms. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PE-6 (2) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-6 (2) | |||
| CCI: | CCI-002944 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-08-27 |
| Definition: | Initiate organization-defined response actions to organization-defined classes or types of intrusions, using organization-defined automated mechanisms. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PE-6 (2) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-6 (2) | |||
| CCI: | CCI-002945 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-08-27 |
| Definition: | Defines the response actions to initiate when organization-defined classes or types of intrusions are recognized. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PE-6 (2) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-6 (2) | |||
| CCI: | CCI-004248 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Defines the automated mechanisms for recognizing organization-defined classes or types of intrusions and initiating organization-defined response actions. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PE-6 (2) | ||
| CCI: | CCI-002946 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-08-27 |
| Definition: | Employ video surveillance of organization-defined operational areas. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PE-6 (3) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-6 (3) (a) | |||
| CCI: | CCI-002947 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-08-27 |
| Definition: | Defines the operational areas in which to employ video surveillance. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PE-6 (3) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-6 (3) (a) | |||
| CCI: | CCI-004249 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Review video recordings on an organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PE-6 (3) (b) | ||
| CCI: | CCI-004250 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Defines the frequency with which to review video recordings. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PE-6 (3) (b) | ||
| CCI: | CCI-002948 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-08-27 |
| Definition: | Retain video surveillance recordings for an organization-defined time period. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PE-6 (3) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-6 (3) (c) | |||
| CCI: | CCI-002949 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-08-27 |
| Definition: | Defines the time period to retain video surveillance recordings. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PE-6 (3) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-6 (3) (c) | |||
| CCI: | CCI-002950 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-08-27 |
| Definition: | Monitor physical access to the system in addition to the physical access monitoring of the facility as organization-defined physical spaces containing one or more components of the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PE-6 (4) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-6 (4) | |||
| CCI: | CCI-002951 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-08-27 |
| Definition: | Defines physical spaces containing one or more components of the system in which physical access is monitored. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PE-6 (4) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-6 (4) | |||
| CCI: | CCI-000947 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Maintain visitor access records to the facility where the system resides for an organization-defined time period. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PE-8 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PE-8 a | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-8 a | |||
| NIST: NIST SP 800-53A (v1): PE-8.1 (i) | |||
| CCI: | CCI-002952 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-08-27 |
| Definition: | Defines the time period to maintain visitor access records to the facility where the system resides. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PE-8 a | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-8 a | |||
| CCI: | CCI-000948 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Review visitor access records in accordance with organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PE-8 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PE-8 b | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-8 b | |||
| NIST: NIST SP 800-53A (v1): PE-8.1 (ii) | |||
| CCI: | CCI-000949 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Defines the frequency with which to review the visitor access records for the facility where the system resides. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PE-8 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PE-8 b | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-8 b | |||
| NIST: NIST SP 800-53A (v1): PE-8.1 (ii) | |||
| CCI: | CCI-004251 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Report anomalies in visitor access records to organization-defined personnel. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PE-8 c | ||
| CCI: | CCI-004252 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Defines the personnel who are to report anomalies in visitor access records. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PE-8 c | ||
| CCI: | CCI-000950 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Maintain and review visitor access records using organization-defined automated mechanisms. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PE-8 (1) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PE-8 (1) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-8 (1) | |||
| NIST: NIST SP 800-53A (v1): PE-8 (1).1 | |||
| CCI: | CCI-004253 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Defines the automated mechanisms for maintaining and reviewing visitor access records. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PE-8 (1) | ||
| CCI: | CCI-004254 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Limit personally identifiable information contained in visitor access records to the organization-defined elements identified in the privacy risk assessment. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PE-8 (3) | ||
| CCI: | CCI-004255 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Defines the elements identified in the privacy risk assessment for limiting personally identifiable information contained in visitor access records. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PE-8 (3) | ||
| CCI: | CCI-000952 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Protect power equipment and power cabling for the system from damage and destruction. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PE-9 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PE-9 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-9 | |||
| NIST: NIST SP 800-53A (v1): PE-9.1 | |||
| CCI: | CCI-002953 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-08-27 |
| Definition: | Employ redundant power cabling paths that are physically separated by an organization-defined distance. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PE-9 (1) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-9 (1) | |||
| CCI: | CCI-002954 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-08-27 |
| Definition: | Defines the distance by which to physically separate redundant power cabling paths. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PE-9 (1) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-9 (1) | |||
| CCI: | CCI-000954 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Employ automatic voltage controls for organization-defined critical system components. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PE-9 (2) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PE-9 (2) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-9 (2) | |||
| NIST: NIST SP 800-53A (v1): PE-9 (2).1 (ii) | |||
| CCI: | CCI-000955 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Defines critical system components that require automatic voltage controls. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PE-9 (2) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PE-9 (2) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-9 (2) | |||
| NIST: NIST SP 800-53A (v1): PE-9 (2).1 (i) | |||
| CCI: | CCI-000956 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Provides the capability of shutting off power to the organization-defined system or individual system components in emergency situations. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PE-10 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PE-10 a | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-10 a | |||
| NIST: NIST SP 800-53A (v1): PE-10.1 (i) | |||
| CCI: | CCI-004256 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Defines the system or individual system components that provide the capability of shutting off power in emergency situations. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PE-10 a | ||
| CCI: | CCI-000957 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Place emergency shutoff switches or devices in an organization-defined location by system or system component to facilitate access for authorized personnel. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PE-10 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PE-10 b | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-10 b | |||
| NIST: NIST SP 800-53A (v1): PE-10.1 (iii) | |||
| CCI: | CCI-000958 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Defines a location for emergency shutoff switches or devices by system or system component. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PE-10 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PE-10 b | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-10 b | |||
| NIST: NIST SP 800-53A (v1): PE-10.1 (ii) | |||
| CCI: | CCI-000959 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Protect emergency power shutoff capability from unauthorized activation. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PE-10 c | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PE-10 c | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-10 c | |||
| NIST: NIST SP 800-53A (v1): PE-10.1 (iv) | |||
| CCI: | CCI-002955 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-08-29 |
| Definition: | Provide an uninterruptible power supply to facilitate an orderly shutdown of the system, and/or transition of the system to long-term alternate power in the event of a primary power source loss. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PE-11 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-11 | |||
| CCI: | CCI-000961 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Provide an alternate power supply for the system that is activated manually or automatically and that can maintain minimally required operational capability in the event of an extended loss of the primary power source. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PE-11 (1) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PE-11 (1) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-11 (1) | |||
| NIST: NIST SP 800-53A (v1): PE-11 (1).1 | |||
| CCI: | CCI-002956 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-08-29 |
| Definition: | Provide an alternate power supply for the system that is activated manually or automatically and that is self-contained. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PE-11 (2) (a) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-11 (2) (a) | |||
| CCI: | CCI-002957 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-08-29 |
| Definition: | Provide an alternate power supply for the system that is activated manually or automatically and that is not reliant on external power generation. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PE-11 (2) (b) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-11 (2) (b) | |||
| CCI: | CCI-002958 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-08-29 |
| Definition: | Provide an alternate power supply for the system that is activated manually or automatically and that is capable of maintaining minimally required operational capability or full operational capability in the event of an extended loss of the primary power source. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PE-11 (2) (c) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-11 (2) (c) | |||
| CCI: | CCI-000963 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Employ and maintains automatic emergency lighting for the information system that activates in the event of a power outage or disruption and that covers emergency exits and evacuation routes within the facility. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PE-12 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PE-12 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-12 | |||
| NIST: NIST SP 800-53A (v1): PE-12.1 (i) (ii)(iii) | |||
| CCI: | CCI-002959 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-08-29 |
| Definition: | Provide emergency lighting for all areas within the facility supporting essential mission functions. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PE-12 (1) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-12 (1) | |||
| CCI: | CCI-002960 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-08-29 |
| Definition: | Provide emergency lighting for all areas within the facility supporting essential business functions. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PE-12 (1) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-12 (1) | |||
| CCI: | CCI-000965 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Employ and maintain fire detection and suppression systems that are supported by an independent energy source. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PE-13 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PE-13 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-13 | |||
| NIST: NIST SP 800-53A (v1): PE-13.1 (i) (ii) | |||
| CCI: | CCI-002961 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-08-29 |
| Definition: | Employ fire detection systems for the system that activate automatically. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PE-13 (1) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-13 (1) | |||
| CCI: | CCI-002962 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-08-29 |
| Definition: | Employ fire detection systems for the system that automatically activate to notify organization-defined personnel or roles and organization-defined emergency responders in the event of a fire. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PE-13 (1) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-13 (1) | |||
| CCI: | CCI-002963 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-08-29 |
| Definition: | Defines the personnel or roles to be notified in the event of a fire. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PE-13 (1) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-13 (1) | |||
| CCI: | CCI-002964 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-08-29 |
| Definition: | Defines the emergency responders to be notified in the event of a fire. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PE-13 (1) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-13 (1) | |||
| CCI: | CCI-002965 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-08-29 |
| Definition: | Employ fire suppression systems that activate automatically and notify organization-defined personnel or roles and organization-defined emergency responders. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PE-13 (2) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-13 (2) (a) | |||
| CCI: | CCI-002966 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-08-29 |
| Definition: | Defines the personnel or roles to be automatically notified of any activation of fire suppression systems. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PE-13 (2) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-13 (2) (a) | |||
| CCI: | CCI-002967 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-08-29 |
| Definition: | Defines the emergency responders to be automatically notified of any activation of fire suppression systems. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PE-13 (2) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-13 (2) (a) | |||
| CCI: | CCI-000968 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Employ an automatic fire suppression capability for the system when the facility is not staffed on a continuous basis. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PE-13 (3) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PE-13 (3) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-13 (2) (b) | |||
| NIST: NIST SP 800-53A (v1): PE-13 (3).1 | |||
| CCI: | CCI-002968 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-08-29 |
| Definition: | Ensure that the facility undergoes, on an organization-defined frequency, fire protection inspections by authorized and qualified inspectors. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PE-13 (4) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-13 (4) | |||
| CCI: | CCI-002969 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-08-29 |
| Definition: | Defines a frequency with which the facility undergoes fire protection inspections. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PE-13 (4) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-13 (4) | |||
| CCI: | CCI-002970 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-08-29 |
| Definition: | Ensure the identified deficiencies are resolved within an organization-defined time period. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PE-13 (4) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-13 (4) | |||
| CCI: | CCI-002971 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-08-29 |
| Definition: | Defines the time period within which to resolve deficiencies identified during facility fire protection inspections. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PE-13 (4) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-13 (4) | |||
| CCI: | CCI-000971 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Maintain temperature; humidity; pressure; radiation; and/or organization-defined environmental control levels within the facility where the system resides at organization-defined acceptable levels. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PE-14 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PE-14 a | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-14 a | |||
| NIST: NIST SP 800-53A (v1): PE-14.1 (ii) | |||
| CCI: | CCI-000972 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Defines acceptable temperature, humidity, pressure, radiation, and/or organization-defined environmental control levels to be maintained within the facility where the system resides. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PE-14 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PE-14 a | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-14 a | |||
| NIST: NIST SP 800-53A (v1): PE-14.1 (i) | |||
| CCI: | CCI-000973 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Monitor environmental control levels in accordance with organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PE-14 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PE-14 b | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-14 b | |||
| NIST: NIST SP 800-53A (v1): PE-14.1 (iv) | |||
| CCI: | CCI-000974 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Defines a frequency for monitoring environmental control levels. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PE-14 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PE-14 b | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-14 b | |||
| NIST: NIST SP 800-53A (v1): PE-14.1 (iii) | |||
| CCI: | CCI-000975 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Employ organization-defined automatic environmental controls in the facility to prevent fluctuations potentially harmful to the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PE-14 (1) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PE-14 (1) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-14 (1) | |||
| NIST: NIST SP 800-53A (v1): PE-14 (1).1 | |||
| CCI: | CCI-004257 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Defines the automatic environmental controls for preventing potentially harmful fluctuations to the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PE-14 (1) | ||
| CCI: | CCI-000976 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Employ environmental control monitoring that provides an alarm or notification of changes potentially harmful to personnel or equipment to organization-defined personnel or roles. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PE-14 (2) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PE-14 (2) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-14 (2) | |||
| NIST: NIST SP 800-53A (v1): PE-14 (2).1 | |||
| CCI: | CCI-004258 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Defines the personnel or roles who employ environmental control monitoring that provides an alarm or notification of changes potentially harmful to personnel or equipment. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PE-14 (2) | ||
| CCI: | CCI-000977 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Protect the system from damage resulting from water leakage by providing master shutoff or isolation valves that are accessible. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PE-15 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PE-15 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-15 | |||
| NIST: NIST SP 800-53A (v1): PE-15.1 (i) | |||
| CCI: | CCI-000978 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Protect the system from damage resulting from water leakage by providing master shutoff or isolation valves that are working properly. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PE-15 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PE-15 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-15 | |||
| NIST: NIST SP 800-53A (v1): PE-15.1 (i) | |||
| CCI: | CCI-000979 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Key personnel have knowledge of the master water shutoff or isolation valves. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PE-15 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PE-15 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-15 | |||
| NIST: NIST SP 800-53A (v1): PE-15.1 (ii) | |||
| CCI: | CCI-002973 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-08-29 |
| Definition: | Defines the personnel or roles to be alerted when automated mechanisms detect the presence of water near the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PE-15 (1) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-15 (1) | |||
| CCI: | CCI-004259 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Detect the presence of water near the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PE-15 (1) | ||
| CCI: | CCI-004260 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Alert organization-defined personnel or roles of the presence of water near the system using organization-defined automated mechanisms. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PE-15 (1) | ||
| CCI: | CCI-004261 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Defines the automated mechanisms for detecting the presence of water and alerting organization-defined personnel or roles. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PE-15 (1) | ||
| CCI: | CCI-000981 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Authorize organization-defined types of system components entering and exiting the facility. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PE-16 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PE-16 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-16 a | |||
| NIST: NIST SP 800-53A (v1): PE-16.1 (ii) | |||
| CCI: | CCI-000983 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Control organization-defined types of system components entering and exiting the facility. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PE-16 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PE-16 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-16 a | |||
| NIST: NIST SP 800-53A (v1): PE-16.1 (ii) | |||
| CCI: | CCI-002974 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-08-29 |
| Definition: | Defines types of system components to authorize and control entering and exiting the facility and to maintain records. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PE-16 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-16 a | |||
| CCI: | CCI-000984 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Maintain records of system components. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PE-16 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PE-16 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-16 b | |||
| NIST: NIST SP 800-53A (v1): PE-16.1 (iii) | |||
| CCI: | CCI-004262 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Determine and document the organization-defined alternate work sites allowed for use by employees. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PE-17 a | ||
| CCI: | CCI-000985 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Employ organization-defined controls at alternate work sites. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PE-17 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PE-17 a | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-17 b | |||
| NIST: NIST SP 800-53A (v1): PE-17.1 (ii) | |||
| CCI: | CCI-002975 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-08-29 |
| Definition: | Defines controls to employ at alternate work sites. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PE-17 a | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-17 b | |||
| CCI: | CCI-000987 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Assess as feasible, the effectiveness of controls at alternate work sites. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PE-17 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PE-17 b | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-17 c | |||
| NIST: NIST SP 800-53A (v1): PE-17.1 (iii) | |||
| CCI: | CCI-000988 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Provide a means for employees to communicate with information security personnel in case of incidents. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PE-17 c | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PE-17 c | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-17 d | |||
| NIST: NIST SP 800-53A (v1): PE-17.1 (iv) | |||
| CCI: | CCI-004263 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Provide a means for employees to communicate with information privacy personnel in case of incidents. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PE-17 d | ||
| CCI: | CCI-000989 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Position system components within the facility to minimize potential damage from organization-defined physical and environmental hazards. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PE-18 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PE-18 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-18 | |||
| NIST: NIST SP 800-53A (v1): PE-18.1 (i) | |||
| CCI: | CCI-000991 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Position system components within the facility to minimize the opportunity for unauthorized access. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PE-18 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PE-18 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-18 | |||
| NIST: NIST SP 800-53A (v1): PE-18.1 (ii) | |||
| CCI: | CCI-002976 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-08-29 |
| Definition: | Defines physical and environmental hazards that could cause potential damage to system components within the facility. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PE-18 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-18 | |||
| CCI: | CCI-000993 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Protect the system from information leakage due to electromagnetic signals emanations. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PE-19 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PE-19 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-19 | |||
| NIST: NIST SP 800-53A (v1): PE-19.1 | |||
| CCI: | CCI-004264 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Protect system components, associated data communications, and networks in accordance with national Emissions Security policies based on the security category or classification of the information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PE-19 (1) | ||
| CCI: | CCI-004265 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Protect system components, associated data communications, and networks in accordance with national Emissions Security procedures based on the security category or classification of the information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PE-19 (1) | ||
| CCI: | CCI-002979 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-08-29 |
| Definition: | Employ organization-defined asset location technologies to track and monitor the location and movement of organization-defined assets within organization-defined controlled areas. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PE-20 a | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-20 | |||
| CCI: | CCI-002980 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-08-29 |
| Definition: | Defines asset location technologies to track and monitor the location and movement of organization-defined assets within organization-defined controlled areas. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PE-20 a | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-20 | |||
| CCI: | CCI-002981 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-08-29 |
| Definition: | Defines the assets within the organization-defined controlled areas which are to be tracked and monitored for their location and movement. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PE-20 a | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-20 | |||
| CCI: | CCI-002982 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-08-29 |
| Definition: | Defines controlled areas where the location and movement of organization-defined assets are tracked and monitored. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PE-20 a | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PE-20 | |||
| CCI: | CCI-004266 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Employ organization-defined protective measures against electromagnetic pulse damage for organization-defined systems and system components. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PE-21 | ||
| CCI: | CCI-004267 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Defines the protective measure employed against electromagnetic pulse damage for organization-defined systems and system components. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PE-21 | ||
| CCI: | CCI-004268 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Defines the systems and system components in which organization-defined protective measures are employed against electromagnetic pulse damage. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PE-21 | ||
| CCI: | CCI-004269 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Mark organization-defined system hardware components indicating the impact or classification level of the information permitted to be processed, stored, or transmitted by the hardware component. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PE-22 | ||
| CCI: | CCI-004270 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Defines the system hardware components which are marked, indicating the impact or classification level of the information permitted to be processed, stored, or transmitted by the hardware component. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PE-22 | ||
| CCI: | CCI-004271 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Plan the location or site of the facility where the system resides considering physical and environmental hazards. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PE-23 a | ||
| CCI: | CCI-004272 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | For existing facilities, consider the physical and environmental hazards in the organizational risk management strategy. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PE-23 b | ||
| CCI: | CCI-000563 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Develop and document an organization-level; mission/business process-level; and or system-level planning policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PL-1 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PL-1 a 1 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PL-1 a 1 (a) | |||
| NIST: NIST SP 800-53A (v1): PL-1.1 (i) (ii) | |||
| CCI: | CCI-000564 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Disseminate an organization-level; mission/business process-level; and or system-level planning policy to organization-defined personnel or roles. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PL-1 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PL-1 a 1 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PL-1 a 1 (a) | |||
| NIST: NIST SP 800-53A (v1): PL-1.1 (iii) | |||
| CCI: | CCI-000566 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Develop and document procedures to facilitate the implementation of the planning policy and associated planning controls. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PL-1 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PL-1 a 2 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PL-1 a 2 | |||
| NIST: NIST SP 800-53A (v1): PL-1.1 (iv) (v) | |||
| CCI: | CCI-000567 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Disseminates planning procedures to organization-defined personnel or roles. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PL-1 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PL-1 a 2 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PL-1 a 2 | |||
| NIST: NIST SP 800-53A (v1): PL-1.1 (vi) | |||
| CCI: | CCI-003047 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-23 |
| Definition: | Defines the personnel or roles to whom the planning policy is disseminated. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PL-1 a 1 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PL-1 a 1 (a) | |||
| CCI: | CCI-003048 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-23 |
| Definition: | Defines the personnel or roles to whom the planning procedures are disseminated. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PL-1 a 2 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PL-1 a 2 | |||
| CCI: | CCI-004273 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Develop and document an organization-level; mission/business process-level; and or system-level planning policy that is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PL-1 a 1 (b) | ||
| CCI: | CCI-004274 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Designate an organization-defined official to manage the development and documentation of the planning policy and procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PL-1 b | ||
| CCI: | CCI-004275 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Designate an organization-defined official to manage the dissemination of the planning policy and procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PL-1 b | ||
| CCI: | CCI-000568 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Review and update the current planning procedures in accordance with organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PL-1 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PL-1 b 2 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PL-1 c 2 | |||
| NIST: NIST SP 800-53A (v1): PL-1.2 (iv) | |||
| CCI: | CCI-001636 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-12 |
| Definition: | Defines the frequency with which to review and update the current planning policy. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PL-1 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PL-1 b 1 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PL-1 c 1 | |||
| NIST: NIST SP 800-53A (v1): PL-1.2 (i) | |||
| CCI: | CCI-001637 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-12 |
| Definition: | Review and update the current planning policy in accordance with organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PL-1 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PL-1 b 1 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PL-1 c 1 | |||
| NIST: NIST SP 800-53A (v1): PL-1.2 (ii) | |||
| CCI: | CCI-001638 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-12 |
| Definition: | Defines the frequency with which to review and update the current planning procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PL-1 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PL-1 b 2 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PL-1 c 2 | |||
| NIST: NIST SP 800-53A (v1): PL-1.2 (iii) | |||
| CCI: | CCI-004276 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Review and update the current planning policy following organization-defined events. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PL-1 c 1 | ||
| CCI: | CCI-004277 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Review and update the current planning procedures following organization-defined events. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PL-1 c 2 | ||
| CCI: | CCI-000571 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Develop security and privacy plans for the system that are reviewed and approved by the authorizing official or designated representative prior to plan implementation. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PL-2 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PL-2 a 9 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PL-2 a 15 | |||
| NIST: NIST SP 800-53A (v1): PL-2.1 (i) | |||
| CCI: | CCI-003049 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-23 |
| Definition: | Develop security and privacy plans for the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PL-2 a | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PL-2 a | |||
| CCI: | CCI-003050 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-23 |
| Definition: | Develop security and privacy plans for the system that are consistent with the organization's enterprise architecture. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PL-2 a 1 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PL-2 a 1 | |||
| CCI: | CCI-003051 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-23 |
| Definition: | Develop security and privacy plans for the system that explicitly defines the authorization boundary for the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PL-2 a 2 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PL-2 a 2 | |||
| CCI: | CCI-003052 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-23 |
| Definition: | Develop security and privacy plans for the system that describes the operational context of the system in terms of missions and business processes. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PL-2 a 3 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PL-2 a 3 | |||
| CCI: | CCI-003053 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-23 |
| Definition: | Develop security and privacy plans for the system that provide the security categorization of the system, including supporting rationale. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PL-2 a 4 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PL-2 a 6 | |||
| CCI: | CCI-003054 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-23 |
| Definition: | Develop security and privacy plans for the system that describe the operational environment for the system and any dependencies on or connections to, other systems or system components. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PL-2 a 5 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PL-2 a 9 | |||
| CCI: | CCI-003055 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-23 |
| Definition: | Develop security and privacy plans for the system that provide an overview of the security and privacy requirements for the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PL-2 a 6 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PL-2 a 10 | |||
| CCI: | CCI-003056 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-23 |
| Definition: | Develop security and privacy plans for the system that identify any relevant control baselines or overlays, if applicable. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PL-2 a 7 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PL-2 a 11 | |||
| CCI: | CCI-003057 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-23 |
| Definition: | Develop security and privacy plans for the system that describe the controls in place or planned for meeting the security and privacy requirements, including a rationale for any tailoring decisions. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PL-2 a 8 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PL-2 a 12 | |||
| CCI: | CCI-004278 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Develop security and privacy plans for the system that identify the individuals that fulfill system roles and responsibilities. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PL-2 a 4 | ||
| CCI: | CCI-004279 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Develop security and privacy plans for the system that identify the information types processed, stored, and transmitted by the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PL-2 a 5 | ||
| CCI: | CCI-004280 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Develop security and privacy plans for the system that describe any specific threats to the system that are of concern to the organization. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PL-2 a 7 | ||
| CCI: | CCI-004281 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Develop security and privacy plans for the system that provide the results of a privacy risk assessment for the systems processing personally identifiable information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PL-2 a 8 | ||
| CCI: | CCI-004282 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Develop security and privacy plans for the system that include risk determinations for security and privacy architecture and design decisions. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PL-2 a 13 | ||
| CCI: | CCI-004283 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Develop security and privacy plans for the system that include security- and privacy-related activities affecting the system that require planning and coordination with organization-defined individuals or groups. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PL-2 a 14 | ||
| CCI: | CCI-003059 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-23 |
| Definition: | Distribute copies of the plans to organization-defined personnel or roles. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PL-2 b | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PL-2 b | |||
| CCI: | CCI-003060 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-23 |
| Definition: | Defines the personnel or roles to whom copies of the plans are distributed. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PL-2 b | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PL-2 b | |||
| CCI: | CCI-003061 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-23 |
| Definition: | Communicate subsequent changes to the plans to organization-defined personnel or roles. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PL-2 b | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PL-2 b | |||
| CCI: | CCI-003062 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-23 |
| Definition: | Defines the personnel or roles to whom changes to the plans are communicated. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PL-2 b | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PL-2 b | |||
| CCI: | CCI-000572 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Defines the frequency for reviewing the plans for the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PL-2 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PL-2 c | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PL-2 c | |||
| NIST: NIST SP 800-53A (v1): PL-2.1 (ii) | |||
| CCI: | CCI-000573 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Review the plans in accordance with organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PL-2 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PL-2 c | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PL-2 c | |||
| NIST: NIST SP 800-53A (v1): PL-2.1 (iii) | |||
| CCI: | CCI-000574 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Update the plans to address changes to the system and environment of operation or problems identified during plan implementation or control assessments. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PL-2 c | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PL-2 d | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PL-2 d | |||
| NIST: NIST SP 800-53A (v1): PL-2.1 (iv) | |||
| CCI: | CCI-003063 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-23 |
| Definition: | Protect the plans from unauthorized disclosure. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PL-2 e | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PL-2 e | |||
| CCI: | CCI-003064 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-23 |
| Definition: | Protect the plans from unauthorized modification. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PL-2 e | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PL-2 e | |||
| CCI: | CCI-000592 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Establish the rules that describe their responsibilities and expected behavior, for information and system usage, for individuals requiring access to the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PL-4 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PL-4 a | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PL-4 a | |||
| NIST: NIST SP 800-53A (v1): PL-4.1 (i) | |||
| CCI: | CCI-004284 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Establish the rules describing the responsibilities and expected behavior, for security, for individuals requiring access to the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PL-4 a | ||
| CCI: | CCI-004285 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Establish the rules describing the responsibilities and expected behavior, for privacy, for individuals requiring access to the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PL-4 a | ||
| CCI: | CCI-004286 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Provide the rules describing the responsibilities and expected behavior, for information and system usage, for individuals requiring access to the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PL-4 a | ||
| CCI: | CCI-004287 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Provide the rules describing the responsibilities and expected behavior, for security, for individuals requiring access to the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PL-4 a | ||
| CCI: | CCI-004288 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Provide the rules describing the responsibilities and expected behavior, for privacy, for individuals requiring access to the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PL-4 a | ||
| CCI: | CCI-000593 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Receive a documented acknowledgement from such individuals, indicating that they have read, understand, and agree to abide by the rules of behavior, before authorizing access to information and the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PL-4 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PL-4 b | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PL-4 b | |||
| NIST: NIST SP 800-53A (v1): PL-4.1 (iii) | |||
| CCI: | CCI-003068 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-23 |
| Definition: | Review and update the rules of behavior in accordance with organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PL-4 c | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PL-4 c | |||
| CCI: | CCI-003069 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-23 |
| Definition: | Defines the frequency with which to review and update the rules of behavior. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PL-4 c | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PL-4 c | |||
| CCI: | CCI-003070 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-23 |
| Definition: | Require individuals who have acknowledged a previous version of the rules of behavior to read and re-acknowledge, on an organization-defined frequency, and/or when the rules of behavior are revised or updated. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PL-4 d | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PL-4 d | |||
| CCI: | CCI-004289 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Defines the frequency individuals are required to read and re-acknowledge the rules of behavior whenever the rules are revised or updated. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PL-4 d | ||
| CCI: | CCI-000594 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Include in the rules of behavior, restrictions on the use of social media, social networking sites, and external sites/applications. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PL-4 (1) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PL-4 (1) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PL-4 (1) (a) | |||
| NIST: NIST SP 800-53A (v1): PL-4 (1).1 | |||
| CCI: | CCI-000595 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Include in the rules of behavior, restrictions on posting organizational information on public websites. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PL-4 (1) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PL-4 (1) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PL-4 (1) (b) | |||
| NIST: NIST SP 800-53A (v1): PL-4 (1).1 | |||
| CCI: | CCI-004290 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Include in the rules of behavior, restrictions on use of organization-provided identifiers (e.g., email addresses) and authentication secrets (e.g., passwords) for creating accounts on external sites/applications. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PL-4 (1) (c) | ||
| CCI: | CCI-003071 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-23 |
| Definition: | Develop a security Concept of Operations (CONOPS) for the system describing how the organization intends to operate the system from the perspective of information security. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PL-7 a | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PL-7 a | |||
| CCI: | CCI-004291 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Develop a security Concept of Operations (CONOPS) for the system describing how the organization intends to operate the system from the perspective of information privacy. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PL-7 a | ||
| CCI: | CCI-000577 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Defines the frequency with which to review and update the CONOPS. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PL-2 (1) (b) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PL-7 b | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PL-7 b | |||
| NIST: NIST SP 800-53A (v1): PL-2 (1).1 (iii) | |||
| CCI: | CCI-000578 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Review and update the CONOPS in accordance with organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PL-2 (1) (b) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PL-7 b | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PL-7 b | |||
| NIST: NIST SP 800-53A (v1): PL-2 (1).1 (iv) | |||
| CCI: | CCI-003072 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-23 |
| Definition: | Develop security architectures for the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PL-8 a | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PL-8 a | |||
| CCI: | CCI-003073 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-23 |
| Definition: | Develop security architectures for the system that describes the requirements and approach to be taken for protecting the confidentiality, integrity, and availability of organizational information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PL-8 a 1 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PL-8 a 1 | |||
| CCI: | CCI-003074 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-23 |
| Definition: | Develop security architectures for the system that describe how the architectures are integrated into and support the enterprise architecture. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PL-8 a 2 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PL-8 a 3 | |||
| CCI: | CCI-003075 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-23 |
| Definition: | Develop security architectures for the system that describe any assumptions about, and dependencies on, external systems and services. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PL-8 a 3 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PL-8 a 4 | |||
| CCI: | CCI-004292 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Develop privacy architectures for the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PL-8 a | ||
| CCI: | CCI-004293 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Develop privacy architectures for the system that describes the requirements and approach to be taken for protecting the confidentiality, integrity, and availability of organizational information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PL-8 a 1 | ||
| CCI: | CCI-004294 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Develop security architectures for the system that describe the requirements and approach to be taken for processing personally identifiable information to minimize privacy risk to individuals. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PL-8 a 2 | ||
| CCI: | CCI-004295 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Develop privacy architectures for the system that describe the requirements and approach to be taken for processing personally identifiable information to minimize privacy risk to individuals. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PL-8 a 2 | ||
| CCI: | CCI-004296 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Develop privacy architectures for the system that describe how the architectures are integrated into and support the enterprise architecture. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PL-8 a 3 | ||
| CCI: | CCI-004297 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Develop privacy architectures for the system that describe any assumptions about, and dependencies on, external systems and services. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PL-8 a 4 | ||
| CCI: | CCI-003076 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-23 |
| Definition: | Review and update the architectures in accordance with organization-defined frequency to reflect updates in the enterprise architecture. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PL-8 b | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PL-8 b | |||
| CCI: | CCI-003077 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-23 |
| Definition: | Defines the frequency with which to review and update the system architecture. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PL-8 b | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PL-8 b | |||
| CCI: | CCI-003078 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-23 |
| Definition: | Reflect planned security architecture changes in the security plans. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PL-8 c | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PL-8 c | |||
| CCI: | CCI-003079 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-23 |
| Definition: | Reflect planned security architecture changes in the security Concept of Operations (CONOPS). | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PL-8 c | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PL-8 c | |||
| CCI: | CCI-003080 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-23 |
| Definition: | Reflect planned security architecture changes in the security organizational procurements and acquisitions. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PL-8 c | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PL-8 c | |||
| CCI: | CCI-004298 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Reflect planned privacy architecture changes in the privacy plans. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PL-8 c | ||
| CCI: | CCI-004299 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Reflect planned privacy architecture changes in the privacy Concept of Operations (CONOPS). | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PL-8 c | ||
| CCI: | CCI-004300 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Reflect planned privacy architecture changes in the privacy organizational procurements and acquisitions. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PL-8 c | ||
| CCI: | CCI-003081 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-23 |
| Definition: | Design the security architecture for the system using a defense-in-depth approach that allocates organization-defined controls to organization-defined locations. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PL-8 (1) (a) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PL-8 (1) (a) | |||
| CCI: | CCI-003082 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-23 |
| Definition: | Design the security architecture for the system using a defense-in-depth approach that allocates organization-defined controls to organization-defined architectural layers. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PL-8 (1) (a) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PL-8 (1) (a) | |||
| CCI: | CCI-003083 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-23 |
| Definition: | Defines the controls to be allocated to organization-defined locations for the security architecture. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PL-8 (1) (a) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PL-8 (1) (a) | |||
| CCI: | CCI-003084 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-23 |
| Definition: | Defines the controls to be allocated to organization-defined architectural layers. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PL-8 (1) (a) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PL-8 (1) (a) | |||
| CCI: | CCI-003085 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-23 |
| Definition: | Defines the locations to which the system allocates organization-defined controls in the security architecture. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PL-8 (1) (a) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PL-8 (1) (a) | |||
| CCI: | CCI-003086 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-23 |
| Definition: | Defines the architectural layers to which the system allocates organization-defined controls in the security architecture. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PL-8 (1) (a) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PL-8 (1) (a) | |||
| CCI: | CCI-004301 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Design the privacy architecture for the system using a defense-in-depth approach that allocates organization-defined controls to organization-defined locations. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PL-8 (1) (a) | ||
| CCI: | CCI-004302 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Design the privacy architecture for the system using a defense-in-depth approach that allocates organization-defined controls to organization-defined architectural layers. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PL-8 (1) (a) | ||
| CCI: | CCI-004303 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Defines the controls to be allocated to organization-defined locations for the privacy architecture. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PL-8 (1) (a) | ||
| CCI: | CCI-004304 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Defines the controls to be allocated to the organization-defined privacy architectural layers. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PL-8 (1) (a) | ||
| CCI: | CCI-004305 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Defines the locations to which the system allocates organization-defined controls in the privacy architecture. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PL-8 (1) (a) | ||
| CCI: | CCI-004306 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Defines the architectural layers to which the system allocates organization-defined controls in the privacy architecture. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PL-8 (1) (a) | ||
| CCI: | CCI-003087 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-23 |
| Definition: | Design the security architecture for the system using a defense-in-depth approach that ensures that the allocated controls operate in a coordinated and mutually reinforcing manner. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PL-8 (1) (b) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PL-8 (1) (b) | |||
| CCI: | CCI-004307 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Design the privacy architecture for the system using a defense-in-depth approach that ensures that the allocated controls operate in a coordinated and mutually reinforcing manner. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PL-8 (1) (b) | ||
| CCI: | CCI-003088 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-23 |
| Definition: | Require that organization-defined controls allocated to organization-defined locations and architectural layers be obtained from different suppliers. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PL-8 (2) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PL-8 (2) | |||
| CCI: | CCI-004308 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Defines the controls that are allocated to the organization-defined locations and architectural layers. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PL-8 (2) | ||
| CCI: | CCI-004309 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Defines the locations and architectural layers that are obtained from different suppliers. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PL-8 (2) | ||
| CCI: | CCI-003117 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-23 |
| Definition: | Centrally manage organization-defined controls and related processes. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PL-9 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PL-9 | |||
| CCI: | CCI-003118 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-23 |
| Definition: | Defines the controls and related processes to be centrally managed. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PL-9 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PL-9 | |||
| CCI: | CCI-004310 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Select a control baseline for the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PL-10 | ||
| CCI: | CCI-004311 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Tailor the selected control baseline by applying specified tailoring actions. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PL-11 | ||
| CCI: | CCI-000073 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-11-03 |
| Definition: | Develop an organization-wide information security program plan that provides an overview of the requirements for the security program and a description of the security program management controls and common controls in place or planned for meeting those requirements. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PM-1 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PM-1 a 1 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PM-1 a 1 | |||
| NIST: NIST SP 800-53A (v1): PM-1.1 (i) | |||
| CCI: | CCI-000074 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-11-03 |
| Definition: | Develop an organization-wide information security program plan that is approved by a senior official with responsibility and accountability for the risk being incurred to organizational operations (including mission, functions, image, and reputation), organizational assets, individuals, other organizations, and the Nation. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PM-1 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PM-1 a 4 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PM-1 a 4 | |||
| NIST: NIST SP 800-53A (v1): PM-1.1 (i) | |||
| CCI: | CCI-001680 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-06-09 |
| Definition: | Develop an organization-wide information security program plan that includes the identification and assignment of roles, responsibilities, management commitment, coordination among organizational entities, and compliance. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PM-1 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PM-1 a 2 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PM-1 a 2 | |||
| NIST: NIST SP 800-53A (v1): PM-1.1 (i) | |||
| CCI: | CCI-002984 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-08-29 |
| Definition: | Develop an organization-wide information security program plan that reflects the coordination among organizational entities responsible for information security. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PM-1 a 3 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PM-1 a 3 | |||
| CCI: | CCI-002985 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-08-29 |
| Definition: | Disseminate an organization-wide information security program plan that provides an overview of the requirements for the security program and a description of the security program management controls and common controls in place or planned for meeting those requirements. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PM-1 a 1 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PM-1 a 1 | |||
| CCI: | CCI-002986 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-08-29 |
| Definition: | Disseminate an organization-wide information security program plan that includes the identification and assignment of roles, responsibilities, management commitment, coordination among organizational entities, and compliance. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PM-1 a 2 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PM-1 a 2 | |||
| CCI: | CCI-002987 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-08-29 |
| Definition: | Disseminate an organization-wide information security plan that reflects the coordination among organizational entities responsible for information security. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PM-1 a 3 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PM-1 a 3 | |||
| CCI: | CCI-002988 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-08-29 |
| Definition: | Disseminate an organization-wide information security program plan that is approved by a senior official with responsibility and accountability for the risk being incurred to organizational operations (including mission, functions, image, and reputation), organizational assets, individuals, other organizations, and the Nation. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PM-1 a 4 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PM-1 a 4 | |||
| CCI: | CCI-000075 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-11-03 |
| Definition: | Review and update the organization-wide information security program plan on an organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PM-1 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PM-1 b | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PM-1 b | |||
| NIST: NIST SP 800-53A (v1): PM-1.1 (iii) | |||
| CCI: | CCI-000076 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-11-03 |
| Definition: | Defines the frequency with which to review and update the organization-wide information security program plan. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PM-1 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PM-1 b | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PM-1 b | |||
| NIST: NIST SP 800-53A (v1): PM-1.1 (ii) | |||
| CCI: | CCI-004312 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Review and update the organization-wide information security program plan following organization-defined events. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-1 b | ||
| CCI: | CCI-004313 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Defines the events for reviewing and updating the organization-wide information security program plan. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-1 b | ||
| CCI: | CCI-002989 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-08-29 |
| Definition: | Protect the information security program plan from unauthorized disclosure. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PM-1 d | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PM-1 c | |||
| CCI: | CCI-002990 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-08-29 |
| Definition: | Protect the information security program plan from unauthorized modification. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PM-1 d | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PM-1 c | |||
| CCI: | CCI-000078 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-11-03 |
| Definition: | Appoint a Senior Information Security Officer with the mission and resources to coordinate, develop, implement, and maintain an organization-wide information security program. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PM-2 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PM-2 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PM-2 | |||
| NIST: NIST SP 800-53A (v1): PM-2.1 (i and ii) | |||
| CCI: | CCI-000080 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-11-03 |
| Definition: | Include the resources needed to implement the information security programs in capital planning and investment requests and document all exceptions to this requirement. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PM-3 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PM-3 a | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PM-3 a | |||
| NIST: NIST SP 800-53A (v1): PM-3.1 (i and ii) | |||
| CCI: | CCI-004314 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Include the resources needed to implement the information security programs in capital planning and investment requests. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-3 a | ||
| CCI: | CCI-004315 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Include the resources needed to implement the information privacy programs in capital planning and investment requests. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-3 a | ||
| CCI: | CCI-004316 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Prepare documentation required for addressing information security programs in capital planning and investment requests in accordance with applicable laws, Executive Orders, directives, policies, regulations, and standards. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-3 b | ||
| CCI: | CCI-004317 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Prepare documentation required for addressing information privacy programs in capital planning and investment requests in accordance with applicable laws, Executive Orders, directives, policies, regulations, and standards. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-3 b | ||
| CCI: | CCI-000141 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-11-03 |
| Definition: | Make available for expenditure, the planned information security resources. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PM-3 c | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PM-3 c | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PM-3 c | |||
| NIST: NIST SP 800-53A (v1): PM-3.1 (iv) | |||
| CCI: | CCI-004318 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Make available for expenditure, the planned information privacy resources. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-3 c | ||
| CCI: | CCI-000142 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-11-03 |
| Definition: | Implement a process to ensure that plans of action and milestones for the information security program and the associated organizational systems are maintained. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PM-4 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PM-4 a 1 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PM-4 a 1 | |||
| NIST: NIST SP 800-53A (v1): PM-4.1 (i) | |||
| CCI: | CCI-000170 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-11-03 |
| Definition: | Implement a process to ensure that plans of action and milestones for the security program and associated organizational systems document the remedial information security actions to adequately respond to risk to organizational operations and assets, individuals, other organizations, and the Nation. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PM-4 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PM-4 a 2 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PM-4 a 2 | |||
| NIST: NIST SP 800-53A (v1): PM-4.1 (ii) | |||
| CCI: | CCI-002991 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-08-29 |
| Definition: | Implement a process to ensure that plans of action and milestones for the information security program and associated organizational systems are developed. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PM-4 a 1 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PM-4 a 1 | |||
| CCI: | CCI-004319 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Implement a process to ensure that plans of action and milestones for the privacy program and the associated organizational systems are maintained. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-4 a 1 | ||
| CCI: | CCI-004320 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Implement a process to ensure that plans of action and milestones for the privacy program and associated organizational systems are developed. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-4 a 1 | ||
| CCI: | CCI-004321 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Implement a process to ensure that plans of action and milestones for the supply chain risk management programs and the associated organizational systems are maintained. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-4 a 1 | ||
| CCI: | CCI-004322 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Implement a process to ensure that plans of action and milestones for the supply chain risk management programs and the associated organizational systems are developed. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-4 a 1 | ||
| CCI: | CCI-004323 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Implement a process to ensure that plans of action and milestones for the privacy program and associated organizational systems document the remedial information privacy actions to adequately respond to risk to organizational operations and assets, individuals, other organizations, and the Nation. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-4 a 2 | ||
| CCI: | CCI-004324 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Implement a process to ensure that plans of action and milestones for the supply chain risk management program and associated organizational systems document the remedial information supply chain risk management actions to adequately respond to risk to organizational operations and assets, individuals, other organizations, and the Nation. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-4 a 2 | ||
| CCI: | CCI-004325 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Implement a process to ensure that plans of action and milestones for the security program and associated organizational systems are reported in accordance with established reporting requirements. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-4 a 3 | ||
| CCI: | CCI-004326 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Implement a process to ensure that plans of action and milestones for the privacy program and associated organizational systems are reported in accordance with established reporting requirements. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-4 a 3 | ||
| CCI: | CCI-004327 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Implement a process to ensure that plans of action and milestones for the supply chain risk management program and associated organizational systems are reported in accordance with established reporting requirements. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-4 a 3 | ||
| CCI: | CCI-002993 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-08-29 |
| Definition: | Review plans of action and milestones for the security program and associated organization systems for consistency with the organizational risk management strategy and organization-wide priorities for risk response actions. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PM-4 b | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PM-4 b | |||
| CCI: | CCI-004328 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Develop an inventory of organizational systems. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-5 | ||
| CCI: | CCI-004329 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Update, on an organization-defined frequency, an inventory of organizational systems. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-5 | ||
| CCI: | CCI-004330 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Defines the frequency with which to update the inventory of organizational systems. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-5 | ||
| CCI: | CCI-004331 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Establish an inventory of all systems, applications, and projects that process personally identifiable information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-5 (1) | ||
| CCI: | CCI-004332 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Maintain an inventory of all systems, applications, and projects that process personally identifiable information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-5 (1) | ||
| CCI: | CCI-004333 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Update on an organization-defined frequency, an inventory of all systems, applications, and projects that process personally identifiable information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-5 (1) | ||
| CCI: | CCI-004334 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Defines the frequency of which an inventory of all systems, applications, and projects that process personally identifiable information will be updated. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-5 (1) | ||
| CCI: | CCI-000209 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-11-03 |
| Definition: | Develop the results of information security measures of performance. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PM-6 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PM-6 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PM-6 | |||
| NIST: NIST SP 800-53A (v1): PM-6.1 (i) | |||
| CCI: | CCI-000210 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-11-03 |
| Definition: | Monitor the results of information security measures of performance. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PM-6 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PM-6 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PM-6 | |||
| NIST: NIST SP 800-53A (v1): PM-6.1 (ii) | |||
| CCI: | CCI-000211 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-11-03 |
| Definition: | Report on the results of information security measures of performance. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PM-6 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PM-6 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PM-6 | |||
| NIST: NIST SP 800-53A (v1): PM-6.1 (iii) | |||
| CCI: | CCI-004335 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Develop the results of information privacy measures of performance. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-6 | ||
| CCI: | CCI-004336 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Monitor the results of information privacy measures of performance. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-6 | ||
| CCI: | CCI-004337 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Report on the results of information privacy measures of performance. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-6 | ||
| CCI: | CCI-000212 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-11-03 |
| Definition: | Develop an enterprise architecture with consideration for information security and the resulting risk to organizational operations, organizational assets, individuals, other organizations, and the Nation. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PM-7 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PM-7 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PM-7 | |||
| NIST: NIST SP 800-53A (v1): PM-7.1 | |||
| CCI: | CCI-004338 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Develop an enterprise architecture with consideration for information privacy and the resulting risk to organizational operations, organizational assets, individuals, other organizations, and the Nation. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-7 | ||
| CCI: | CCI-004339 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Maintain an enterprise architecture with consideration for information security and the resulting risk to organizational operations, organizational assets, individuals, other organizations, and the Nation. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-7 | ||
| CCI: | CCI-004340 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Maintain an enterprise architecture with consideration for information privacy and the resulting risk to organizational operations, organizational assets, individuals, other organizations, and the Nation. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-7 | ||
| CCI: | CCI-004341 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Offload organization-defined non-essential functions or services to other systems, system components, or an external provider. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-7 (1) | ||
| CCI: | CCI-004342 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Defines the non-essential functions or services to be offloaded to other systems, system components, or an external provider. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-7 (1) | ||
| CCI: | CCI-000216 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-11-03 |
| Definition: | Address information security issues in the development and documentation of a critical infrastructure and key resources protection plan. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PM-8 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PM-8 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PM-8 | |||
| NIST: NIST SP 800-53A (v1): PM-8.1 (I and iii) | |||
| CCI: | CCI-001640 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-12 |
| Definition: | Address information security issues in the updating of a critical infrastructure and key resources protection plan. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PM-8 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PM-8 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PM-8 | |||
| NIST: NIST SP 800-53A (v1): PM-8.1 (ii) | |||
| CCI: | CCI-004343 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Address information privacy issues in the development and documentation of a critical infrastructure and key resources protection plan. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-8 | ||
| CCI: | CCI-004344 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Address information privacy issues in the updating of a critical infrastructure and key resources protection plan. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-8 | ||
| CCI: | CCI-000227 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-11-03 |
| Definition: | Develop a comprehensive strategy to manage security risk to organizational operations and assets, individuals, other organizations, and the Nation associated with the operation and use of information systems. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PM-9 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PM-9 a | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PM-9 a 1 | |||
| NIST: NIST SP 800-53A (v1): PM-9.1 (i) | |||
| CCI: | CCI-004345 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Develop a comprehensive strategy to manage privacy risk to individuals resulting from the authorized processing of personally identifiable information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-9 a 2 | ||
| CCI: | CCI-000228 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-11-03 |
| Definition: | Implement the risk management strategy consistently across the organization. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PM-9 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PM-9 b | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PM-9 b | |||
| NIST: NIST SP 800-53A (v1): PM-9.1 (ii) | |||
| CCI: | CCI-002994 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-08-29 |
| Definition: | Review and update the risk management strategy in accordance with organization-defined frequency or as required, to address organizational changes. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PM-9 c | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PM-9 c | |||
| CCI: | CCI-002995 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-08-29 |
| Definition: | Defines the frequency with which to review and update the risk management strategy to address organizational changes. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PM-9 c | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PM-9 c | |||
| CCI: | CCI-004346 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Manage the security state of organizational systems and the environments in which those systems operate through authorization processes. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-10 a | ||
| CCI: | CCI-004347 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Manage the privacy state of organizational systems and the environments in which those systems operate through authorization processes. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-10 a | ||
| CCI: | CCI-000233 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-11-03 |
| Definition: | Designate individuals to fulfill specific roles and responsibilities within the organizational risk management process. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PM-10 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PM-10 b | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PM-10 b | |||
| NIST: NIST SP 800-53A (v1): PM-10.1 (ii) | |||
| CCI: | CCI-000234 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-11-03 |
| Definition: | Integrate the authorization processes into an organization-wide risk management program. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PM-10 c | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PM-10 c | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PM-10 c | |||
| NIST: NIST SP 800-53A (v1): PM-10.1 (iii) | |||
| CCI: | CCI-000235 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-11-04 |
| Definition: | Define organizational mission and business processes with consideration for information security and the resulting risk to organizational operations, organizational assets, individuals, other organizations, and the Nation. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PM-11 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PM-11 a | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PM-11 a | |||
| NIST: NIST SP 800-53A (v1): PM-11.1 (i) | |||
| CCI: | CCI-004348 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Define organizational mission and business processes with consideration for information privacy and the resulting risk to organizational operations, organizational assets, individuals, other organizations, and the Nation. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-11 a | ||
| CCI: | CCI-000236 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-11-04 |
| Definition: | Determine information protection needs arising from the defined mission and business processes. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PM-11 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PM-11 b | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PM-11 b | |||
| NIST: NIST SP 800-53A (v1): PM-11.1 (ii) | |||
| CCI: | CCI-004349 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Determine personally identifiable information processing needs arising from the defined mission and business processes. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-11 b | ||
| CCI: | CCI-004350 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Review and revise the mission and business processes on an organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-11 c | ||
| CCI: | CCI-004351 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Defines the frequency at which the mission and business processes are reviewed and revised. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-11 c | ||
| CCI: | CCI-002996 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-08-29 |
| Definition: | Implement an insider threat program that includes a cross-discipline insider threat incident handling team. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PM-12 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PM-12 | |||
| CCI: | CCI-002997 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-08-29 |
| Definition: | Establish a security workforce development and improvement program. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PM-13 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PM-13 | |||
| CCI: | CCI-004352 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Establish a privacy workforce development and improvement program. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-13 | ||
| CCI: | CCI-002998 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-08-29 |
| Definition: | Implement a process for ensuring that organizational plans for conducting security testing activities associated with organizational systems are developed. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PM-14 a 1 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PM-14 a 1 | |||
| CCI: | CCI-002999 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-08-29 |
| Definition: | Implement a process for ensuring that organizational plans for conducting security testing activities associated with organizational systems are maintained. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PM-14 a 1 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PM-14 a 1 | |||
| CCI: | CCI-003000 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-08-29 |
| Definition: | Implement a process for ensuring that organizational plans for conducting security training activities associated with organizational systems are developed. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PM-14 a 1 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PM-14 a 1 | |||
| CCI: | CCI-003001 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-08-29 |
| Definition: | Implement a process for ensuring that organizational plans for conducting security training activities associated with organizational systems are maintained. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PM-14 a 1 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PM-14 a 1 | |||
| CCI: | CCI-003002 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-08-29 |
| Definition: | Implement a process for ensuring that organizational plans for conducting security monitoring activities associated with organizational systems are developed. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PM-14 a 1 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PM-14 a 1 | |||
| CCI: | CCI-003003 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-08-29 |
| Definition: | Implement a process for ensuring that organizational plans for conducting security monitoring activities associated with organizational systems are maintained. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PM-14 a 1 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PM-14 a 1 | |||
| CCI: | CCI-003004 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-08-29 |
| Definition: | Implement a process for ensuring that organizational plans for conducting security testing associated with organizational systems continue to be executed. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PM-14 a 2 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PM-14 a 2 | |||
| CCI: | CCI-003005 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-08-29 |
| Definition: | Implement a process for ensuring that organizational plans for conducting security training associated with organizational systems continue to be executed. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PM-14 a 2 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PM-14 a 2 | |||
| CCI: | CCI-003006 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-08-29 |
| Definition: | Implement a process for ensuring that organizational plans for conducting security monitoring activities associated with organizational systems continue to be executed. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PM-14 a 2 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PM-14 a 2 | |||
| CCI: | CCI-004353 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Implement a process for ensuring that organizational plans for conducting privacy testing activities associated with organizational systems are developed. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-14 a 1 | ||
| CCI: | CCI-004354 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Implement a process for ensuring that organizational plans for conducting privacy testing activities associated with organizational systems are maintained. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-14 a 1 | ||
| CCI: | CCI-004355 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Implement a process for ensuring that organizational plans for conducting privacy training activities associated with organizational systems are developed. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-14 a 1 | ||
| CCI: | CCI-004356 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Implement a process for ensuring that organizational plans for conducting privacy training activities associated with organizational systems are maintained. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-14 a 1 | ||
| CCI: | CCI-004357 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Implement a process for ensuring that organizational plans for conducting privacy monitoring activities associated with organizational systems are developed. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-14 a 1 | ||
| CCI: | CCI-004358 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Implement a process for ensuring that organizational plans for conducting privacy monitoring activities associated with organizational information systems are maintained. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-14 a 1 | ||
| CCI: | CCI-004359 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Implement a process for ensuring that organizational plans for conducting privacy testing associated with organizational systems continue to be executed. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-14 a 2 | ||
| CCI: | CCI-004360 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Implement a process for ensuring that organizational plans for conducting privacy training associated with organizational systems continue to be executed. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-14 a 2 | ||
| CCI: | CCI-004361 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Implement a process for ensuring that organizational plans for conducting privacy monitoring activities associated with organizational systems continue to be executed. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-14 a 2 | ||
| CCI: | CCI-003007 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-08-29 |
| Definition: | Review testing plans for consistency with the organizational risk management strategy and organization-wide priorities for risk response actions. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PM-14 b | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PM-14 b | |||
| CCI: | CCI-003008 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-08-29 |
| Definition: | Review training plans for consistency with the organizational risk management strategy and organization-wide priorities for risk response actions. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PM-14 b | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PM-14 b | |||
| CCI: | CCI-003009 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-08-29 |
| Definition: | Review monitoring plans for consistency with the organizational risk management strategy and organization-wide priorities for risk response actions. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PM-14 b | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PM-14 b | |||
| CCI: | CCI-003010 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-08-29 |
| Definition: | Establish and institutionalize contact with selected groups and associations within the security community to facilitate ongoing security education and training for organizational personnel. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PM-15 a | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PM-15 a | |||
| CCI: | CCI-004362 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Establish and institutionalize contact with selected groups and associations within the privacy community to facilitate ongoing privacy education and training for organizational personnel. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-15 a | ||
| CCI: | CCI-003011 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-08-29 |
| Definition: | Establish and institutionalize contact with selected groups and associations within the security community to maintain currency with recommended security practices, techniques, and technologies. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PM-15 b | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PM-15 b | |||
| CCI: | CCI-004363 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Establish and institutionalize contact with selected groups and associations within the privacy community to maintain currency with recommended privacy practices, techniques, and technologies. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-15 b | ||
| CCI: | CCI-003012 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-08-29 |
| Definition: | Establish and institutionalize contact with selected groups and associations within the security community to share current security information including threats, vulnerabilities, and incidents. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PM-15 c | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PM-15 c | |||
| CCI: | CCI-004364 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Establish and institutionalize contact with selected groups and associations within the privacy community to share current privacy information including threats, vulnerabilities, and incidents. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-15 c | ||
| CCI: | CCI-003013 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-08-29 |
| Definition: | Implement a threat awareness program that includes a cross-organization information-sharing capability for threat intelligence. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PM-16 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PM-16 | |||
| CCI: | CCI-004365 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Employ automated means to maximize the effectiveness of sharing threat intelligence information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-16 (1) | ||
| CCI: | CCI-004366 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Establish policy to ensure that the requirements for the protection of Controlled Unclassified Information that is processed, stored or transmitted on external systems, are implemented in accordance with applicable laws, Executive Orders, directives, policies, regulations, and standards. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-17 a | ||
| CCI: | CCI-004367 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Establish procedures to ensure that the requirements for the protection of Controlled Unclassified Information that is processed, stored or transmitted on external systems, are implemented in accordance with applicable laws, Executive Orders, directives, policies, regulations, and standards. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-17 a | ||
| CCI: | CCI-004368 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Review and update the policy for Controlled Unclassified Information on an organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-17 b | ||
| CCI: | CCI-004369 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Defines the frequency in which the policy for Controlled Unclassified information is reviewed and updated. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-17 b | ||
| CCI: | CCI-004370 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Review and update the procedures for Controlled Unclassified Information on an organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-17 b | ||
| CCI: | CCI-004371 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Defines the frequency in which the procedures for Controlled Unclassified information is reviewed and updated. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-17 b | ||
| CCI: | CCI-004372 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Develop an organization-wide privacy program plan that provides an overview of the agency's privacy program. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-18 a | ||
| CCI: | CCI-004373 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Disseminate an organization-wide privacy program plan that provides an overview of the agency's privacy program. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-18 a | ||
| CCI: | CCI-004374 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Develop an organization-wide privacy program plan that provides an overview of the agency's privacy program and includes a description of the structure of the privacy program and the resources dictated to the privacy program. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-18 a 1 | ||
| CCI: | CCI-004375 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Disseminate an organization-wide privacy program plan that provides an overview of the agency's privacy program and includes a description of the structure of the privacy program and the resources dictated to the privacy program. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-18 a 1 | ||
| CCI: | CCI-004376 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Develop an organization-wide privacy program plan that provides an overview of the agency's privacy program and provides an overview of the requirements for the privacy program. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-18 a 2 | ||
| CCI: | CCI-004377 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Disseminate an organization-wide privacy program plan that provides an overview of the agency's privacy program and provides an overview of the requirements for the privacy program. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-18 a 2 | ||
| CCI: | CCI-004378 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Develop an organization-wide privacy program plan that provides an overview of the agency's privacy program and a description of the privacy program management controls and common controls in place or planned for meeting those requirements. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-18 a 2 | ||
| CCI: | CCI-004379 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Disseminate an organization-wide privacy program plan that provides an overview of the agency's privacy program and a description of the privacy program management controls and common controls in place or planned for meeting those requirements. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-18 a 2 | ||
| CCI: | CCI-004380 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Develop an organization-wide privacy program plan that provides an overview of the agency's privacy program and includes the role of the Senior Agency Official for Privacy and the identification and assignment of the roles of other privacy officials and staff and their responsibilities. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-18 a 3 | ||
| CCI: | CCI-004381 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Disseminate an organization-wide privacy program plan that provides an overview of the agency's privacy program and includes the role of the Senior Agency Official for Privacy and the identification and assignment of the roles of other privacy officials and staff and their responsibilities. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-18 a 3 | ||
| CCI: | CCI-004382 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Develop an organization-wide privacy program plan that provides an overview of the agency's privacy program and describes management commitment, compliance, and the strategic goals and objectives of the privacy program. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-18 a 4 | ||
| CCI: | CCI-004383 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Disseminate an organization-wide privacy program plan that provides an overview of the agency's privacy program and describes management commitment, compliance, and the strategic goals and objectives of the privacy program. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-18 a 4 | ||
| CCI: | CCI-004384 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Develop an organization-wide privacy program plan that provides an overview of the agency's privacy program and reflects coordination among organizational entities responsible for the different aspects of privacy. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-18 a 5 | ||
| CCI: | CCI-004385 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Disseminate an organization-wide privacy program plan that provides an overview of the agency's privacy program and reflects coordination among organizational entities responsible for the different aspects of privacy. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-18 a 5 | ||
| CCI: | CCI-004386 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Develop an organization-wide privacy program plan that provides an overview of the agency's privacy program and is approved by a senior official with responsibility and accountability for the privacy risk being incurred to organizational operations (including mission, functions, image, and reputation), organizational assets, individuals, other organizations, and the Nation. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-18 a 6 | ||
| CCI: | CCI-004387 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Disseminate an organization-wide privacy program plan that provides an overview of the agency's privacy program and is approved by a senior official with responsibility and accountability for the privacy risk being incurred to organizational operations (including mission, functions, image, and reputation), organizational assets, individuals, other organizations, and the Nation. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-18 a 6 | ||
| CCI: | CCI-004388 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Update the plan on an organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-18 a 6 | ||
| CCI: | CCI-004389 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Update the plan to address changes in federal privacy laws and policy and organizational changes and problems identified during plan implementation or privacy control assessments. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-18 b | ||
| CCI: | CCI-004390 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Appoint a Senior Agency Official for Privacy with the authority, mission, accountability, and resources to coordinate applicable privacy requirements. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-19 | ||
| CCI: | CCI-004391 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Appoint a Senior Agency Official for Privacy with the authority, mission, accountability, and resources to develop applicable privacy requirements. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-19 | ||
| CCI: | CCI-004392 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Appoint a Senior Agency Official for Privacy with the authority, mission, accountability, and resources to implement applicable privacy requirements. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-19 | ||
| CCI: | CCI-004393 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Appoint a Senior Agency Official for Privacy with the authority, mission, accountability, and resources to manage privacy risks through the organization-wide privacy program. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-19 | ||
| CCI: | CCI-004394 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Maintain a central resource webpage on the organization's principle public website that serves as a central source of information about the organization's privacy plan. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-20 | ||
| CCI: | CCI-004395 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Ensure that the public has access to information about organizational privacy activities. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-20 a | ||
| CCI: | CCI-004396 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Ensure that the public can communicate with its Senior Agency Official for Privacy. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-20 a | ||
| CCI: | CCI-004397 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Ensure that organizational privacy practices and reports are publicly available. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-20 b | ||
| CCI: | CCI-004398 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Employ publicly facing email addresses and/or phone lines to enable the public to provide feedback and/or direct questions to privacy offices regarding privacy practices. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-20 c | ||
| CCI: | CCI-004399 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Develop and post privacy policies on all external-facing websites, mobile applications, and other digital services that are written in plain language. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-20 (1) (a) | ||
| CCI: | CCI-004400 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Develop and post privacy policies on all external-facing websites, mobile applications, and other digital services that are organized in a way that is easy to understand and navigate. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-20 (1) (a) | ||
| CCI: | CCI-004401 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Develop and post privacy policies on all external-facing websites, mobile applications, and other digital services that provide information needed by the public to make an informed about whether and how to interact with the organization. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-20 (1) (b) | ||
| CCI: | CCI-004402 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Develop and post privacy policies on all external-facing websites, mobile applications, and other digital services that are updated whenever the organization makes a substantive change to the practices it describes. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-20 (1) (c) | ||
| CCI: | CCI-004403 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Develop and post privacy policies on all external-facing websites, mobile applications, and other digital services that includes a time/date stamp to inform the public of the date of the most recent changes. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-20 (1) (c) | ||
| CCI: | CCI-004404 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Develop an accurate accounting of disclosures of personally identifiable information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-21 a | ||
| CCI: | CCI-004405 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Maintain an accurate accounting of disclosures of personally identifiable information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-21 a | ||
| CCI: | CCI-004406 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Develop an accurate accounting of disclosures of personally identifiable information, including date, nature, and purpose of each disclosure of a record. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-21 a 1 | ||
| CCI: | CCI-004407 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Maintain an accurate accounting of disclosures of personally identifiable information, including date, nature, and purpose of each disclosure of a record. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-21 a 1 | ||
| CCI: | CCI-004408 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Develop an accurate accounting of disclosures of personally identifiable information, including name and address, or other contact information of the individual or organization to which the disclosure was made. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-21 a 2 | ||
| CCI: | CCI-004409 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Maintain an accurate accounting of disclosures of personally identifiable information, including name and address, or other contact information of the individual or organization to which the disclosure was made. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-21 a 2 | ||
| CCI: | CCI-004410 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Retain the accounting of disclosures for the length of the time the personally identifiable information is maintained or five years after the disclosure is made, whichever is longer. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-21 b | ||
| CCI: | CCI-004411 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Make the accounting of disclosures available to the individual to whom the personally identifiable information relates upon request. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-21 c | ||
| CCI: | CCI-004412 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Develop and document organization-wide policies for reviewing for the accuracy, relevance, timeliness, and completeness of personally identifiable information across the information life cycle. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-22 a | ||
| CCI: | CCI-004413 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Develop and document organization-wide procedures for reviewing for the accuracy, relevance, timeliness, and completeness of personally identifiable information across the information life cycle. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-22 a | ||
| CCI: | CCI-004414 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Develop and document organization-wide policies for correcting or deleting inaccurate or outdated personally identifiable information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-22 b | ||
| CCI: | CCI-004415 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Develop and document organization-wide procedures for correcting or deleting inaccurate or outdated personally identifiable information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-22 b | ||
| CCI: | CCI-004416 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Develop and document organization-wide policies for disseminating notice of corrected or deleted personally identifiable information to individuals or other appropriate entities. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-22 c | ||
| CCI: | CCI-004417 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Develop and document organization-wide procedures for disseminating notice of corrected or deleted personally identifiable information to individuals or other appropriate entities. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-22 c | ||
| CCI: | CCI-004418 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Develop and document organization-wide policies for appeals of adverse decisions on correction or deletion requests. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-22 d | ||
| CCI: | CCI-004419 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Develop and document organization-wide procedures for appeals of adverse decisions on correction or deletion requests. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-22 d | ||
| CCI: | CCI-004420 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Establish a Data Governance Body consisting of organization-defined roles with organization-defined responsibilities. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-23 | ||
| CCI: | CCI-004421 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Defines the roles that are established by the Data Governance Body. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-23 | ||
| CCI: | CCI-004422 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Defines the responsibilities the Data Governance Body establishes. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-23 | ||
| CCI: | CCI-004423 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Establish a Data Integrity Board to review proposals to conduct or participate in a matching program. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-24 a | ||
| CCI: | CCI-004424 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Establish a Data Integrity Board to conduct an annual review of all matching programs in which the agency has participated. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-24 b | ||
| CCI: | CCI-004425 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Develop and document policies that address the use of personally identifiable information for internal testing, training, and research. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-25 a | ||
| CCI: | CCI-004426 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Develop and document procedures that address the use of personally identifiable information for internal testing, training, and research. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-25 a | ||
| CCI: | CCI-004427 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Implement policies that address the use of personally identifiable information for internal testing, training, and research. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-25 a | ||
| CCI: | CCI-004428 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Implement procedures that address the use of personally identifiable information for internal testing, training, and research. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-25 a | ||
| CCI: | CCI-004429 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Limit or minimize the amount of personally identifiable information used for internal testing, training, and research purposes. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-25 b | ||
| CCI: | CCI-004430 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Authorize the use of personally identifiable information when such information is required for internal testing, training, and research. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-25 c | ||
| CCI: | CCI-004431 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Review and update policies on an organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-25 d | ||
| CCI: | CCI-004432 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-03 |
| Definition: | Defines the frequency of which the policies should be reviewed and updated. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-25 d | ||
| CCI: | CCI-004433 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Review and update procedures on an organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-25 d | ||
| CCI: | CCI-004434 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Defines the frequency of which the procedures should be reviewed and updated. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-25 d | ||
| CCI: | CCI-004435 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Implement a process for receiving and responding to complaints, concerns or questions from individuals about the organizational security practices. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-26 | ||
| CCI: | CCI-004436 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Implement a process for receiving and responding to complaints, concerns or questions from individuals about the organizational privacy practices. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-26 | ||
| CCI: | CCI-004437 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Implement mechanisms that are easy to use. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-26 a | ||
| CCI: | CCI-004438 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Implement mechanisms that are readily available by the public. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-26 a | ||
| CCI: | CCI-004439 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Implement all information necessary for successfully filing complaints. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-26 b | ||
| CCI: | CCI-004440 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Implement tracking mechanisms to ensure all complaints received are reviewed and appropriately addressed within an organization-defined time period. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-26 c | ||
| CCI: | CCI-004441 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Defines the time period of which the tracking mechanisms to ensure all complaints received are reviewed and addressed. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-26 c | ||
| CCI: | CCI-004442 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Implement acknowledgement of receipt of complaints, concerns, or questions from individuals within an organization-defined time period. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-26 d | ||
| CCI: | CCI-004443 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Defines the time period for acknowledging the receipt of complaints, concerns, or questions from individuals. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-26 d | ||
| CCI: | CCI-004444 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Implement response to complaints, concerns, or questions from individuals within an organization-defined time period. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-26 e | ||
| CCI: | CCI-004445 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Defines the time period for response to complaints, concerns, or questions from individuals. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-26 e | ||
| CCI: | CCI-004446 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Develop organization-defined privacy reports. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-27 | ||
| CCI: | CCI-004447 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Defines the privacy reports that are to be developed. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-27 | ||
| CCI: | CCI-004448 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Disseminate privacy reports to organization-defined oversight bodies to demonstrate accountability with statutory, regulatory, and policy privacy program mandates. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-27 a 1 | ||
| CCI: | CCI-004449 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Develop privacy reports for organization-defined officials and other personnel with responsibility for monitoring privacy program progress and compliance. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-27 a 2 | ||
| CCI: | CCI-004450 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Disseminate privacy reports for organization-defined officials and other personnel with responsibility for monitoring privacy program compliance. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-27 a 2 | ||
| CCI: | CCI-004451 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Defines the officials responsible for monitoring privacy program compliance. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-27 a 2 | ||
| CCI: | CCI-004452 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Review and update privacy reports on an organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-27 b | ||
| CCI: | CCI-004453 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Defines the frequency of which the privacy reports are reviewed and updated. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-27 b | ||
| CCI: | CCI-004454 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Identify and document assumptions affecting risk assessments, risk response, and risk monitoring. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-28 a 1 | ||
| CCI: | CCI-004455 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Identify and document constraints affecting risk assessments, risk response, and risk monitoring. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-28 a 2 | ||
| CCI: | CCI-004456 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Identify and document priorities and trade-offs considered by the organization for managing risk. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-28 a 3 | ||
| CCI: | CCI-004457 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Identify and document the organizational risk tolerance. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-28 a 4 | ||
| CCI: | CCI-004458 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Distribute the results of risk framing activities to organization-defined personnel. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-28 b | ||
| CCI: | CCI-004459 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Defines the personnel to distribute the results of risk framing activities. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-28 b | ||
| CCI: | CCI-004460 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Review and update risk framing considerations on an organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-28 c | ||
| CCI: | CCI-004461 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Defines the frequency for reviewing and updating risk framing considerations. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-28 c | ||
| CCI: | CCI-004462 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Appoint a Senior Accountable Official for Risk Management to align organizational information security management processes with strategic, operational, and budgetary planning processes. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-29 a | ||
| CCI: | CCI-004463 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Appoint a Senior Accountable Official for Risk Management to align organizational information privacy management processes with strategic, operational, and budgetary planning processes. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-29 a | ||
| CCI: | CCI-004464 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Establish a Risk Executive (function) to view and analyze risk from an organization-wide perspective. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-29 b | ||
| CCI: | CCI-004465 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Establish a Risk Executive (function) to ensure management of risk is consistent across the organization. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-29 b | ||
| CCI: | CCI-004466 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Develop an organization-wide strategy for managing supply chain risks associated with the development of systems, system components, and system services. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-30 a | ||
| CCI: | CCI-004467 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Develop an organization-wide strategy for managing supply chain risks associated with the acquisition of systems, system components, and system services. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-30 a | ||
| CCI: | CCI-004468 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Develop an organization-wide strategy for managing supply chain risks associated with the maintenance of systems, system components, and system services. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-30 a | ||
| CCI: | CCI-004469 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Develop an organization-wide strategy for managing supply chain risks associated with the disposal of systems, system components, and system services. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-30 a | ||
| CCI: | CCI-004470 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Implement the supply chain risk management strategy consistently across the organization. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-30 b | ||
| CCI: | CCI-004471 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Review and update the supply chain risk management strategy on an organization-defined frequency or as required, to address organizational changes. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-30 c | ||
| CCI: | CCI-004472 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Defines the frequency of which the supply chain risk management strategy will be reviewed and updated. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-30 c | ||
| CCI: | CCI-005150 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2023-07-17 |
| Definition: | Identify, prioritize, and assess suppliers of critical or mission-essential technologies, products, and services. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-30 (1) | ||
| CCI: | CCI-004473 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Develop an organization-wide continuous monitoring strategy establishing organization-defined metrics to be monitored. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-31 a | ||
| CCI: | CCI-004474 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Implement continuous monitoring programs that include establishing organization-wide metrics to be monitored. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-31 a | ||
| CCI: | CCI-004475 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Defines the metrics for developing and implementing continuous monitoring programs. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-31 a | ||
| CCI: | CCI-004476 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Develop an organization-wide continuous monitoring strategy establishing organization-defined frequencies for monitoring. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-31 b | ||
| CCI: | CCI-004477 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Develop an organization-wide continuous monitoring strategy establishing organization-defined frequencies for assessment of control effectiveness. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-31 b | ||
| CCI: | CCI-004478 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Defines the frequencies for developing and implementing continuous monitoring programs for monitoring. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-31 b | ||
| CCI: | CCI-004479 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Implement continuous monitoring programs that include establishing organization-wide frequencies for monitoring. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-31 b | ||
| CCI: | CCI-004480 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Implement continuous monitoring programs that include establishing organization-wide frequencies for assessment of control effectiveness. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-31 b | ||
| CCI: | CCI-004481 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Defines the frequencies for developing and implementing continuous monitoring programs for assessment of control effectiveness. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-31 b | ||
| CCI: | CCI-004482 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Develop an organization-wide continuous monitoring strategy for ongoing monitoring of organizationally-defined metrics in accordance with the continuous monitoring strategy. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-31 c | ||
| CCI: | CCI-004483 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Implement continuous monitoring programs that include ongoing monitoring of organizationally-defined metrics in accordance with the continuous monitoring strategy. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-31 c | ||
| CCI: | CCI-004484 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Develop an organization-wide continuous monitoring strategy for correlation and analysis of information generated by control assessments and monitoring. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-31 d | ||
| CCI: | CCI-004485 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Implement continuous monitoring programs that include correlation and analysis of information generated by control assessments and monitoring. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-31 d | ||
| CCI: | CCI-004486 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Develop an organization-wide continuous monitoring strategy for response actions to address results of the analysis of control assessment and monitoring information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-31 e | ||
| CCI: | CCI-004487 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Implement continuous monitoring programs that include response actions to address results of the analysis of control assessment and monitoring information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-31 e | ||
| CCI: | CCI-004488 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Develop an organization-wide continuous monitoring strategy for reporting the security status of organizational systems to organization-defined personnel or roles on an organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-31 f | ||
| CCI: | CCI-004489 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Develop an organization-wide continuous monitoring strategy for reporting the privacy status of organizational systems to organization-defined personnel or roles on an organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-31 f | ||
| CCI: | CCI-004490 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Implement continuous monitoring programs that include reporting the security status of organizational systems to organization-defined personnel or roles on an organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-31 f | ||
| CCI: | CCI-004491 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Implement continuous monitoring programs that include reporting the privacy status of organizational systems to organization-defined personnel or roles on an organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-31 f | ||
| CCI: | CCI-004492 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Defines the personnel or roles for whom to report the security status of organizational systems. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-31 f | ||
| CCI: | CCI-004493 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Defines the personnel or roles for whom to report the privacy status of organizational systems. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-31 f | ||
| CCI: | CCI-004494 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Defines the frequency of reporting the security status of organizational systems to organization-defined personnel or roles. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-31 f | ||
| CCI: | CCI-004495 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Defines the frequency of reporting the privacy status of organizational systems to organization-defined personnel or roles. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-31 f | ||
| CCI: | CCI-004496 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Analyze organization-defined systems or system components supporting mission essential services or functions to ensure that the information resources are being used consistent with their intended purpose. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-32 | ||
| CCI: | CCI-004497 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Defines the systems or system components that are used to analyze mission essential services or functions. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PM-32 | ||
| CCI: | CCI-001504 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-11-02 |
| Definition: | Develop and document an organization-level; mission/business process-level; and/or system-level personnel security policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PS-1 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PS-1 a 1 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PS-1 a 1 (a) | |||
| NIST: NIST SP 800-53A (v1): PS-1.1 (i) (ii) | |||
| CCI: | CCI-001505 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-11-02 |
| Definition: | Disseminate an organization-level; mission/business process-level; and/or system-level personnel security policy to organization-defined personnel or roles. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PS-1 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PS-1 a 1 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PS-1 a 1 | |||
| NIST: NIST SP 800-53A (v1): PS-1.1 (iii) | |||
| CCI: | CCI-001509 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-11-02 |
| Definition: | Develop and document procedures to facilitate the implementation of the personnel security policy and associated personnel security controls. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PS-1 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PS-1 a 2 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PS-1 a 2 | |||
| NIST: NIST SP 800-53A (v1): PS-1.1 (iv) (v) | |||
| CCI: | CCI-001510 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-11-02 |
| Definition: | Disseminate personnel security procedures to organization-defined personnel or roles. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PS-1 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PS-1 a 2 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PS-1 a 2 | |||
| NIST: NIST SP 800-53A (v1): PS-1.1 (vi) | |||
| CCI: | CCI-003017 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-12 |
| Definition: | Defines the personnel or roles to whom an organization-level; mission/business process-level; and/or system-level personnel security policy is disseminated. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PS-1 a 1 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PS-1 a 1 | |||
| CCI: | CCI-003018 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-12 |
| Definition: | Defines the personnel or roles to whom the personnel security procedures are disseminated. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PS-1 a 2 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PS-1 a 2 | |||
| CCI: | CCI-004498 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Develop and document an organization-level; mission/business process-level; and/or system-level personnel security policy that is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PS-1 a 1 (b) | ||
| CCI: | CCI-004499 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Designate an organization-defined official to manage the development and documentation of the personnel security policy. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PS-1 b | ||
| CCI: | CCI-004500 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Designate an organization-defined official to manage the dissemination of the personnel security policy. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PS-1 b | ||
| CCI: | CCI-004501 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Defines the official who will manage the personnel security policy. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PS-1 b | ||
| CCI: | CCI-004502 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Designate an organization-defined official to manage development and documentation of the personnel security procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PS-1 b | ||
| CCI: | CCI-004503 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Designate an organization-defined official to manage the dissemination of the personnel security procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PS-1 b | ||
| CCI: | CCI-004504 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Defines the official who will manage the personnel security procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PS-1 b | ||
| CCI: | CCI-001506 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-11-02 |
| Definition: | Review and update the current personnel security policy in accordance with organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PS-1 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PS-1 b 2 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PS-1 c 1 | |||
| NIST: NIST SP 800-53A (v1): PS-1.2 (ii) | |||
| CCI: | CCI-001507 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-11-02 |
| Definition: | Defines the frequency with which to review and update the current personnel security policy. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PS-1 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PS-1 b 1 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PS-1 c 1 | |||
| NIST: NIST SP 800-53A (v1): PS-1.2 (i) | |||
| CCI: | CCI-001508 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-11-02 |
| Definition: | Defines the frequency with which to review and update the current personnel security procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PS-1 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PS-1 b 2 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PS-1 c 2 | |||
| NIST: NIST SP 800-53A (v1): PS-1.2 (iii) | |||
| CCI: | CCI-001511 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-11-02 |
| Definition: | Review and update the current personnel security procedures in accordance with organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PS-1 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PS-1 b 2 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PS-1 c 2 | |||
| NIST: NIST SP 800-53A (v1): PS-1.2 (iv) | |||
| CCI: | CCI-004505 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Review and update the current personnel security policy following organization-defined events. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PS-1 c 1 | ||
| CCI: | CCI-004506 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Defines the events following reviewing and updating the current personnel security policy. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PS-1 c 1 | ||
| CCI: | CCI-004507 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Review and update the current personnel security procedures following organization-defined events. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PS-1 c 2 | ||
| CCI: | CCI-004508 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Defines the events following reviewing and updating the current personnel security procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PS-1 c 2 | ||
| CCI: | CCI-001512 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-11-02 |
| Definition: | Assign a risk designation to all organizational positions. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PS-2 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PS-2 a | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PS-2 a | |||
| NIST: NIST SP 800-53A (v1): PS-2.1 (i) | |||
| CCI: | CCI-001513 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-11-02 |
| Definition: | Establish screening criteria for individuals filling organizational positions. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PS-2 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PS-2 b | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PS-2 b | |||
| NIST: NIST SP 800-53A (v1): PS-2.1 (ii) | |||
| CCI: | CCI-001514 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-11-02 |
| Definition: | Review and update position risk designations in accordance with organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PS-2 c | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PS-2 c | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PS-2 c | |||
| NIST: NIST SP 800-53A (v1): PS-2.1 (iv) | |||
| CCI: | CCI-001515 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-11-02 |
| Definition: | Defines the frequency with which to review and update position risk designations. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PS-2 c | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PS-2 c | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PS-2 c | |||
| NIST: NIST SP 800-53A (v1): PS-2.1 (iii) | |||
| CCI: | CCI-001516 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-11-02 |
| Definition: | Screen individuals prior to authorizing access to the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PS-3 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PS-3 a | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PS-3 a | |||
| NIST: NIST SP 800-53A (v1): PS-3.1 (i) | |||
| CCI: | CCI-001517 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-11-02 |
| Definition: | Rescreen individuals with authorized access to the system in accordance with organization-defined conditions requiring rescreening, and where rescreening is so indicated, on the organization-defined frequency of rescreening. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PS-3 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PS-3 b | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PS-3 b | |||
| NIST: NIST SP 800-53A (v1): PS-3.1 (iii) | |||
| CCI: | CCI-001518 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-11-02 |
| Definition: | Defines the conditions requiring rescreening of individuals with authorized access to the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PS-3 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PS-3 b | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PS-3 b | |||
| NIST: NIST SP 800-53A (v1): PS-3.1 (ii) | |||
| CCI: | CCI-001519 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-11-02 |
| Definition: | Defines the frequency for rescreening individuals with authorized access to the information system when organization-defined conditions requiring rescreening are met. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PS-3 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PS-3 b | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PS-3 b | |||
| NIST: NIST SP 800-53A (v1): PS-3.1 (ii) | |||
| CCI: | CCI-001520 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-11-02 |
| Definition: | Verify that individuals accessing a system processing, storing, or transmitting classified information are cleared and indoctrinated to the highest classification level of the information to which they have access on the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PS-3 (1) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PS-3 (1) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PS-3 (1) | |||
| NIST: NIST SP 800-53A (v1): PS-3 (1).1 (i) (ii) | |||
| CCI: | CCI-001521 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-11-02 |
| Definition: | Verify that individuals accessing a system processing, storing, or transmitting types of classified information which require formal indoctrination, are formally indoctrinated for all of the relevant types of information to which they have access on the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PS-3 (2) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PS-3 (2) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PS-3 (2) | |||
| NIST: NIST SP 800-53A (v1): PS-3 (2).1 | |||
| CCI: | CCI-003019 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-12 |
| Definition: | Verify that individuals accessing a system processing, storing, or transmitting information requiring special protection have valid access authorizations that are demonstrated by assigned official government duties. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PS-3 (3) (a) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PS-3 (3) (a) | |||
| CCI: | CCI-003020 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-12 |
| Definition: | Verify that individuals accessing a system processing, storing, or transmitting information requiring special protection satisfy organization-defined additional personnel screening criteria. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PS-3 (3) (b) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PS-3 (3) (b) | |||
| CCI: | CCI-003021 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-12 |
| Definition: | Defines additional personnel screening criteria that individuals accessing a system processing, storing, or transmitting information requiring protection must satisfy. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PS-3 (3) (b) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PS-3 (3) (b) | |||
| CCI: | CCI-004509 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Verify that individuals accessing a system processing, storing, or transmitting organization-defined information types meet organization-defined citizenship requirements. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PS-3 (4) | ||
| CCI: | CCI-004510 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Defines the information types that meet the organization-defined citizenship requirement. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PS-3 (4) | ||
| CCI: | CCI-004511 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Defines the citizenship requirements for individuals accessing a system, storing, or transmitting organization-defined information types. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PS-3 (4) | ||
| CCI: | CCI-001522 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-11-02 |
| Definition: | Upon termination of individual employment, disable system access within an organization-defined time period. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PS-4 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PS-4 a | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PS-4 a | |||
| NIST: NIST SP 800-53A (v1): PS-4.1 (i) | |||
| CCI: | CCI-003022 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-12 |
| Definition: | Defines the time period within which to disable system access upon termination of individual employment. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PS-4 a | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PS-4 a | |||
| CCI: | CCI-003023 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-12 |
| Definition: | Upon termination of individual employment, terminate or revoke any authenticators and credentials associated with the individual. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PS-4 b | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PS-4 b | |||
| CCI: | CCI-001523 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-11-02 |
| Definition: | Upon termination of individual employment, conduct exit interviews that include a discussion of organization-defined information security topics. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PS-4 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PS-4 c | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PS-4 c | |||
| NIST: NIST SP 800-53A (v1): PS-4.1 (ii) | |||
| CCI: | CCI-003024 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-12 |
| Definition: | Defines information security topics to be discussed while conducting exit interviews. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PS-4 c | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PS-4 c | |||
| CCI: | CCI-001524 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-11-02 |
| Definition: | Upon termination of individual employment, retrieve all security-related organizational system-related property. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PS-4 c | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PS-4 d | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PS-4 d | |||
| NIST: NIST SP 800-53A (v1): PS-4.1 (iii) | |||
| CCI: | CCI-001525 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-11-02 |
| Definition: | Upon termination of individual employment, retain access to organizational information formerly controlled by the terminated individual. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PS-4 d | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PS-4 e | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PS-4 e | |||
| NIST: NIST SP 800-53A (v1): PS-4.1 (iv) | |||
| CCI: | CCI-001526 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-11-02 |
| Definition: | Upon termination of individual employment, retain access to organizational systems formerly controlled by the terminated individual. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PS-4 d | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PS-4 e | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PS-4 e | |||
| NIST: NIST SP 800-53A (v1): PS-4.1 (iv) | |||
| CCI: | CCI-003027 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-12 |
| Definition: | Notify terminated individuals of applicable, legally binding post-employment requirements for the protection of organizational information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PS-4 (1) (a) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PS-4 (1) (a) | |||
| CCI: | CCI-003028 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-12 |
| Definition: | Require terminated individuals to sign an acknowledgment of post-employment requirements as part of the organizational termination process. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PS-4 (1) (b) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PS-4 (1) (b) | |||
| CCI: | CCI-003029 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-12 |
| Definition: | Use organization-defined automated mechanisms to notify organization-defined personnel or roles of individual termination actions; and/or disable access to system resources. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PS-4 (2) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PS-4 (2) | |||
| CCI: | CCI-003030 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-12 |
| Definition: | Defines the personnel or roles to be notified by automated mechanism of individual termination actions, and/or disable access to system resources. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PS-4 (2) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PS-4 (2) | |||
| CCI: | CCI-004512 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Defines the automated mechanisms for notifying organization-defined personnel or roles of individual termination actions; and/or disable access to system resources. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PS-4 (2) | ||
| CCI: | CCI-001527 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-11-03 |
| Definition: | Review and confirm the ongoing operational need for current logical and physical access authorizations to systems and facilities when individuals are reassigned or transferred to other positions within the organization. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PS-5 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PS-5 a | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PS-5 a | |||
| NIST: NIST SP 800-53A (v1): PS-5.1 (i) | |||
| CCI: | CCI-001528 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-11-03 |
| Definition: | Initiate organization-defined transfer or reassignment actions within an organization-defined time period following the formal personnel transfer action. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PS-5 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PS-5 b | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PS-5 b | |||
| NIST: NIST SP 800-53A (v1): PS-5.1 (iii) | |||
| CCI: | CCI-001529 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-11-03 |
| Definition: | Defines transfer or reassignment actions to initiate within an organization-defined time period following the formal personnel transfer action. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PS-5 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PS-5 b | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PS-5 b | |||
| NIST: NIST SP 800-53A (v1): PS-5.1 (ii) | |||
| CCI: | CCI-001530 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-11-03 |
| Definition: | Defines the time period within which the organization initiates organization-defined transfer or reassignment actions following the formal personnel transfer action. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PS-5 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PS-5 b | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PS-5 b | |||
| NIST: NIST SP 800-53A (v1): PS-5.1 (ii) | |||
| CCI: | CCI-003031 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-12 |
| Definition: | Modify access authorization as needed to correspond with any changes in operational need due to reassignment or transfer. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PS-5 c | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PS-5 c | |||
| CCI: | CCI-003032 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-12 |
| Definition: | Notify organization-defined personnel or roles within an organization-defined time period when individuals are transferred or reassigned to other positions within the organization. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PS-5 d | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PS-5 d | |||
| CCI: | CCI-003033 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-12 |
| Definition: | Defines personnel or roles to be notified when individuals are transferred or reassigned to other positions within the organization. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PS-5 d | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PS-5 d | |||
| CCI: | CCI-003034 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-12 |
| Definition: | Defines the time period within which organization-defined personnel or roles are to be notified when individuals are transferred or reassigned to other positions within the organization. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PS-5 d | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PS-5 d | |||
| CCI: | CCI-003035 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-12 |
| Definition: | Develop and document access agreements for organizational systems. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PS-6 a | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PS-6 a | |||
| CCI: | CCI-001532 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-11-03 |
| Definition: | Review and update the access agreements for organizational systems in accordance with organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PS-6 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PS-6 b | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PS-6 b | |||
| NIST: NIST SP 800-53A (v1): PS-6.1 (iv) | |||
| CCI: | CCI-001533 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-11-03 |
| Definition: | Defines the frequency with which to review and update access agreements for organizational systems. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PS-6 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PS-6 b | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PS-6 b | |||
| NIST: NIST SP 800-53A (v1): PS-6.1 (iii) | |||
| CCI: | CCI-004513 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Verify that individuals requiring access to organizational information sign appropriate access agreements prior to being granted access. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PS-6 c 1 | ||
| CCI: | CCI-004514 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Verify that individuals requiring access to organizational systems sign appropriate access agreements prior to being granted access. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PS-6 c 1 | ||
| CCI: | CCI-004515 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Verify that individuals requiring access to organizational information re-sign access agreements to maintain access to organizational information systems when access agreements have been updated or in accordance with organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PS-6 c 2 | ||
| CCI: | CCI-004516 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Verify that individuals requiring access to organizational systems re-sign access agreements to maintain access to organizational information systems when access agreements have been updated or in accordance with organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PS-6 c 2 | ||
| CCI: | CCI-004517 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Defines the frequency for individuals requiring access to organizational information to re-sign access agreements. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PS-6 c 2 | ||
| CCI: | CCI-004518 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Defines the frequency for individuals requiring access to organizational systems to re-sign access agreements. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PS-6 c 2 | ||
| CCI: | CCI-001536 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-11-03 |
| Definition: | Verify that access to classified information requiring special protection is granted only to individuals who have a valid access authorization that is demonstrated by assigned official government duties. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PS-6 (2) (a) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PS-6 (2) (a) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PS-6 (2) (a) | |||
| NIST: NIST SP 800-53A (v1): PS-6 (2).1 | |||
| CCI: | CCI-001537 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-11-03 |
| Definition: | Verify that access to classified information requiring special protection is granted only to individuals who satisfy associated personnel security criteria. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PS-6 (2) (b) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PS-6 (2) (b) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PS-6 (2) (b) | |||
| NIST: NIST SP 800-53A (v1): PS-6 (2).1 | |||
| CCI: | CCI-001538 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-11-03 |
| Definition: | Verify that access to classified information requiring special protection is granted only to individuals who have read, understood, and signed a nondisclosure agreement. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PS-6 (2) (c) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PS-6 (2) (c) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PS-6 (2) (c) | |||
| NIST: NIST SP 800-53A (v1): PS-6 (2).1 | |||
| CCI: | CCI-003038 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-12 |
| Definition: | Notify individuals of applicable, legally binding post-employment requirements for protection of organizational information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PS-6 (3) (a) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PS-6 (3) (a) | |||
| CCI: | CCI-003039 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-12 |
| Definition: | Require individuals to sign an acknowledgement of legally binding post-employment requirements for protection of organizational information, if applicable, as part of granting initial access to covered information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PS-6 (3) (b) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PS-6 (3) (b) | |||
| CCI: | CCI-001539 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-11-03 |
| Definition: | Establish personnel security requirements including security roles and responsibilities for external providers. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PS-7 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PS-7 a | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PS-7 a | |||
| NIST: NIST SP 800-53A (v1): PS-7.1 (i) | |||
| CCI: | CCI-004519 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Require external providers to comply with personnel security policies established by the organization. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PS-7 b | ||
| CCI: | CCI-004520 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Require external providers to comply with personnel security procedures established by the organization. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PS-7 b | ||
| CCI: | CCI-001540 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-11-03 |
| Definition: | Document personnel security requirements. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PS-7 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PS-7 c | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PS-7 c | |||
| NIST: NIST SP 800-53A (v1): PS-7.1 (ii) | |||
| CCI: | CCI-003041 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-12 |
| Definition: | Require external providers to notify organization-defined personnel or roles of any personnel transfers or terminations of external personnel who possess organizational credentials and/or badges, or who have system privileges within an organization-defined time period. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PS-7 d | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PS-7 d | |||
| CCI: | CCI-003042 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-12 |
| Definition: | Defines personnel or roles whom external providers are to notify when external personnel who possess organizational credentials and /or badges or who have system privileges are transferred or terminated. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PS-7 d | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PS-7 d | |||
| CCI: | CCI-003043 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-12 |
| Definition: | Defines the time period for external providers to notify organization-defined personnel or roles when external personnel who possess organizational credentials and/or badges, or who have system privileges are transferred or terminated. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PS-7 d | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PS-7 d | |||
| CCI: | CCI-001541 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-11-03 |
| Definition: | Monitor provider compliance with personnel security requirements. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PS-7 c | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PS-7 e | |||
| NIST: NIST SP 800-53 Revision 5 (v5): PS-7 e | |||
| NIST: NIST SP 800-53A (v1): PS-7.1 (iii) | |||
| CCI: | CCI-004521 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Employ a formal sanctions process for individuals failing to comply with established information security policies. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PS-8 a | ||
| CCI: | CCI-004522 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Employ a formal sanctions process for individuals failing to comply with established information security procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PS-8 a | ||
| CCI: | CCI-003044 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-12 |
| Definition: | Notify organization-defined personnel or roles within an organization-defined time period when a formal employee sanctions process is initiated, identifying the individual sanctioned and the reason for the sanction. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PS-8 b | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PS-8 b | |||
| CCI: | CCI-003045 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-12 |
| Definition: | Defines personnel or roles who are to be notified when a formal employee sanctions process is initiated. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PS-8 b | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PS-8 b | |||
| CCI: | CCI-003046 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-12 |
| Definition: | Defines the time period within which to notify organization-defined personnel or roles when a formal employee sanctions process is initiated. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PS-8 b | ||
| NIST: NIST SP 800-53 Revision 5 (v5): PS-8 b | |||
| CCI: | CCI-004523 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Incorporate security roles and responsibilities into organizational position descriptions. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PS-9 | ||
| CCI: | CCI-004524 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Incorporate privacy roles and responsibilities into organizational position descriptions. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PS-9 | ||
| CCI: | CCI-004525 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Develop and document organization-level; mission/business process-level; and/or system level personally identifiable information processing and transparency policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PT-1 a 1 (a) | ||
| CCI: | CCI-004526 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Disseminate organization-level; mission/business process-level; and/or system level personally identifiable information processing and transparency policy to organization-defined personnel or roles. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PT-1 a | ||
| CCI: | CCI-004527 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Defines the personnel or roles to whom the organization-level; mission/business process-level; and/or system level personally identifiable information processing and transparency policy is to be disseminated. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PT-1 a | ||
| CCI: | CCI-004528 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Develop and document organization-level; mission/business process-level; and/or system level personally identifiable information processing and transparency policy that is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PT-1 a 1 (b) | ||
| CCI: | CCI-004529 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Develop and document procedures to facilitate the implementation of the personally identifiable information processing and transparency policy and the associated personally identifiable information processing and transparency controls. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PT-1 a 2 | ||
| CCI: | CCI-004530 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Designate an organization-defined official to manage the development and documentation of the personally identifiable information processing and transparency policy. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PT-1 b | ||
| CCI: | CCI-004531 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Designate an organization-defined official to manage the development and documentation of the personally identifiable information processing and transparency procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PT-1 b | ||
| CCI: | CCI-004532 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Defines the official designated to manage the development, documentation, and dissemination of the personally identifiable information processing and transparency policy and procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PT-1 b | ||
| CCI: | CCI-004533 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Review and update the current personally identifiable information processing and transparency policy on an organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PT-1 c 1 | ||
| CCI: | CCI-004534 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Review and update the current personally identifiable information processing and transparency policy following organization-defined events. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PT-1 c 1 | ||
| CCI: | CCI-004535 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Defines the events following reviewing and updating the current personally identifiable processing and transparency policy. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PT-1 c 1 | ||
| CCI: | CCI-004536 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Review and update the current personally identifiable information processing and transparency procedures on an organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PT-1 c 2 | ||
| CCI: | CCI-004537 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Review and update the current personally identifiable information processing and transparency procedures following organization-defined events. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PT-1 c 2 | ||
| CCI: | CCI-004538 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Defines the events following reviewing and updating the current personally identifiable processing and transparency procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PT-1 c 2 | ||
| CCI: | CCI-004539 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Determine and document the organization-defined authority that permits the organization-defined processing of personally identifiable information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PT-2 a | ||
| CCI: | CCI-004540 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Defines the authority who will permit the organization-defined processing of personally identifiable information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PT-2 a | ||
| CCI: | CCI-004541 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Defines the processing of the personally identifiable information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PT-2 a | ||
| CCI: | CCI-004542 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Restrict the organization-defined processing of personally identifiable information to only that which is authorized. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PT-2 b | ||
| CCI: | CCI-004543 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Defines the processing of the personally identifiable information to only that which is authorized. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PT-2 b | ||
| CCI: | CCI-004544 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Attach data tags containing organization-defined authorized processing to organization-defined elements of personally identifiable information. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PT-2 (1) | ||
| CCI: | CCI-004545 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Defines the authorized processing which will attach data tags to organization-defined elements of personally identifiable information. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PT-2 (1) | ||
| CCI: | CCI-004546 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Defines the elements of personally identifiable information containing organization-defined authorized processing. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PT-2 (1) | ||
| CCI: | CCI-004547 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Manage enforcement of the authorized processing of personally identifiable information using organization-defined automated mechanisms. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PT-2 (2) | ||
| CCI: | CCI-004548 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Defines the automated mechanisms for managing enforcement of the authorized processing of personally identifiable information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PT-2 (2) | ||
| CCI: | CCI-004549 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Identify and document the organization-defined purpose(s) for processing personally identifiable information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PT-3 a | ||
| CCI: | CCI-004550 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Defines the purpose(s) of identifying and documenting personally identifiable information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PT-3 a | ||
| CCI: | CCI-004551 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Describe the purpose(s) in the public privacy notices and policies of the organization. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PT-3 b | ||
| CCI: | CCI-004552 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Restrict the organization-defined processing of personally identifiable information to only that which is compatible with the identified purpose(s). | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PT-3 c | ||
| CCI: | CCI-004553 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Defines the processing of personally identifiable information to only that which is compatible with the identified purpose(s). | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PT-3 c | ||
| CCI: | CCI-004554 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Monitor changes in processing personally identifiable information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PT-3 d | ||
| CCI: | CCI-004555 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Implement organization-defined mechanisms to ensure that any changes are made in accordance with organization-defined requirements. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PT-3 d | ||
| CCI: | CCI-004556 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Defines the mechanisms for ensuring any changes are made in accordance with organization-defined requirements. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PT-3 d | ||
| CCI: | CCI-004557 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Defines the requirements for implementing organization-defined mechanisms. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PT-3 d | ||
| CCI: | CCI-004558 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Attach data tags containing organization-defined processing purposes to organization-defined elements of personally identifiable information. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PT-3 (1) | ||
| CCI: | CCI-004559 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Defines the elements of personally identifiable information containing organization-defined processing purposes. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PT-3 (1) | ||
| CCI: | CCI-004560 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Track processing purposes of personally identifiable information using organization-defined automated mechanisms. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PT-3 (2) | ||
| CCI: | CCI-004561 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Implement organization-defined tools or mechanisms for individuals to consent to the processing of their personally identifiable information prior to its collection that facilitate individuals' informed decision-making. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PT-4 | ||
| CCI: | CCI-004562 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Defines the tools or mechanisms for individuals to consent to the processing of their personally identifiable information prior to its collection that facilitate individuals' informed decision-making. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PT-4 | ||
| CCI: | CCI-004563 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Provide organization-defined mechanisms to allow individuals to tailor processing permissions to selected elements of personally identifiable information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PT-4 (1) | ||
| CCI: | CCI-004564 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Defines the mechanisms for allowing individuals to tailor processing permissions to selected elements of personally identifiable information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PT-4 (1) | ||
| CCI: | CCI-004565 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Present organization-defined consent mechanisms to individuals at an organization-defined frequency and in conjunction with organization-defined personally identifiable information processing. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PT-4 (2) | ||
| CCI: | CCI-004566 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Defines the frequency for presenting organization-defined consent mechanisms to individuals. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PT-4 (2) | ||
| CCI: | CCI-004567 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Defines the consent mechanisms needed by individuals on an organization-defined frequency, with organization-defined personally identifiable information processing. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PT-4 (2) | ||
| CCI: | CCI-004568 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Defines the personally identifiable information processing needed for presenting organization-defined consent mechanisms to individuals. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PT-4 (2) | ||
| CCI: | CCI-004569 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Implement organization-defined tools or mechanisms for individuals to revoke consent to the processing of their personally identifiable information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PT-4 (3) | ||
| CCI: | CCI-004570 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Defines the tools or mechanisms for individuals to revoke consent to the processing of their personally identifiable information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PT-4 (3) | ||
| CCI: | CCI-004571 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Provide notice to individuals about the processing of personally identifiable information that is available to individuals upon first interacting with an organization, and subsequently at an organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PT-5 a | ||
| CCI: | CCI-004572 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Defines the frequency for providing notice to individuals about the processing of personally identifiable information that is available to individuals upon first interacting with an organization. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PT-5 a | ||
| CCI: | CCI-004573 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Provide notice to individuals about the processing of personally identifiable information is clear and easy-to-understand, expressing information about personally identifiable information processing in plain language. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PT-5 b | ||
| CCI: | CCI-004574 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Provide notice to individuals about the processing of personally identifiable information that identifies the authority that authorizes the processing of personally identifiable information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PT-5 c | ||
| CCI: | CCI-004575 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Provide notice to individuals about the processing of personally identifiable information that identifies the purposes for which personally identifiable information is to be processes. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PT-5 d | ||
| CCI: | CCI-004576 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Provide notice to individuals about the processing of personally identifiable information that includes organization-defined information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PT-5 e | ||
| CCI: | CCI-004577 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Defines the information that includes providing notice to individuals about the processing of personally identifiable information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PT-5 e | ||
| CCI: | CCI-004578 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Present notice of personally identifiable information processing to individuals at a time and location where the individual provides personally identifiable information or in conjunction with a data action or organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PT-5 (1) | ||
| CCI: | CCI-004579 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Defines the frequency for presenting notice of personally identifiable information processing to individuals at a time and location where the individual provides personally identifiable information or in conjunction with a data action. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PT-5 (1) | ||
| CCI: | CCI-004580 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Include Privacy Act statements on forms that collect information that will be maintained in a Privacy Act system of records, or provide Privacy Act statements on separate forms that can be retained by individuals. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PT-5 (2) | ||
| CCI: | CCI-004581 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | For systems that process information that will be maintained in a Privacy Act system of records: draft system of records notices in accordance with OMB guidance. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PT-6 a | ||
| CCI: | CCI-004582 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | For systems that process information that will be maintained in a Privacy Act system of records: submit new and significantly modified system of records notices to the OMB and appropriate committees for advance review. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PT-6 a | ||
| CCI: | CCI-004583 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | For systems that process information that will be maintained in a Privacy Act system of records: publish system of records notices in the Federal Register. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PT-6 b | ||
| CCI: | CCI-004584 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | For systems that process information that will be maintained in a Privacy Act system of records: keep system of records notices accurate, up-to-date, and scoped in accordance with policy. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PT-6 c | ||
| CCI: | CCI-004585 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Review all routine uses published in the system of records notice at an organization-defined frequency to ensure continued accuracy. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PT-6 (1) | ||
| CCI: | CCI-004586 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Defines the frequency for reviewing all routine uses in published in the system of records notice. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PT-6 (1) | ||
| CCI: | CCI-004587 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Review all routine uses published in the system of records notice at an organization-defined frequency to ensure that routine uses continue to be compatible with the purpose for which the information was collected. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PT-6 (1) | ||
| CCI: | CCI-004588 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Review all Privacy Act exemptions claimed for the system of records at organization-defined frequency to ensure they remain appropriate and necessary with law. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PT-6 (2) | ||
| CCI: | CCI-004589 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Review all Privacy Act exemptions claimed for the system of records at organization-defined frequency to ensure they have been promulgated as regulations. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PT-6 (2) | ||
| CCI: | CCI-004590 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Review all Privacy Act exemptions claimed for the system of records at organization-defined frequency to ensure that they are accurately described in the system of records notice. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PT-6 (2) | ||
| CCI: | CCI-004591 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Defines the frequency for reviewing all Privacy Act exemptions claimed for the system of records. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PT-6 (2) | ||
| CCI: | CCI-004592 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Apply organization-defined processing conditions for specific categories of personally identifiable information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PT-7 | ||
| CCI: | CCI-004593 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Defines the processing conditions for applying specific categories of personally identifiable information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PT-7 | ||
| CCI: | CCI-004594 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | When a system processes Social Security numbers: eliminate unnecessary collection, maintenance, and use of Social Security numbers, and explore alternatives to their use as a personal identifier. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PT-7 (1) (a) | ||
| CCI: | CCI-004595 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | When a system processes Social Security numbers: do not deny any individuals any right, benefit, or privilege provided by law because of such individuals' refusal to disclose his or her Social Security number. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PT-7 (1) (b) | ||
| CCI: | CCI-004596 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | When a system processes Social Security numbers: inform any individual who is asked to disclose his or Social Security number whether that disclosure is mandatory or voluntary, by what statutory or other authority such number is solicited, and what uses will be made of it. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PT-7 (1) (c) | ||
| CCI: | CCI-004597 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Prohibit the processing of information describing how any individual exercises rights guaranteed by the First Amendment unless expressly authorized by statue or by the individual or unless pertinent to and within the scope of an authorized law enforcement activity. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PT-7 (2) | ||
| CCI: | CCI-004598 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | When a system or organization processes information for the purpose of conducting a matching program: obtain approval from the Data Integrity Board to conduct the matching program. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PT-8 a | ||
| CCI: | CCI-004599 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | When a system or organization processes information for the purpose of conducting a matching program: develop and enter into a computer matching agreement. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PT-8 b | ||
| CCI: | CCI-004600 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | When a system or organization processes information for the purpose of conducting a matching program: publish a matching notice in the Federal Register. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PT-8 c | ||
| CCI: | CCI-004601 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | When a system or organization processes information for the purpose of conducting a matching program: independently verify the information produced by the matching program before taking adverse action against an individual, if required. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PT-8 d | ||
| CCI: | CCI-004602 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | When a system or organization processes information for the purpose of conducting a matching program: provide individuals with notice and an opportunity to contest the findings before taking adverse action against an individual. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): PT-8 e | ||
| CCI: | CCI-001037 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Develop and document an organization-level; mission/business process-level; system-level risk assessment policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): RA-1 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): RA-1 a 1 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): RA-1 a 1 (a) | |||
| NIST: NIST SP 800-53A (v1): RA-1.1 (i) (ii) | |||
| CCI: | CCI-001038 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Disseminate an organization-level; mission/business process-level; system-level risk assessment policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance to organization-defined personnel or roles. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): RA-1 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): RA-1 a 1 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): RA-1 a 1 (a) | |||
| NIST: NIST SP 800-53A (v1): RA-1.1 (iii) | |||
| CCI: | CCI-001041 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Develop and document procedures to facilitate the implementation of the risk assessment policy and associated risk assessment controls. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): RA-1 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): RA-1 a 2 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): RA-1 a 2 | |||
| NIST: NIST SP 800-53A (v1): RA-1.1 (iv) (v) | |||
| CCI: | CCI-001042 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Disseminate risk assessment procedures to facilitate the implementation of the risk assessment policy and associated risk assessment controls to organization-defined personnel or roles. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): RA-1 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): RA-1 a 2 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): RA-1 a 2 | |||
| NIST: NIST SP 800-53A (v1): RA-1.1 (vi) | |||
| CCI: | CCI-002368 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-01 |
| Definition: | Defines the personnel or roles to whom the organization-level; mission/business process-level; system-level risk assessment policy is disseminated. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): RA-1 a 1 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): RA-1 a 1 (a) | |||
| CCI: | CCI-002369 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-01 |
| Definition: | Defines the personnel or roles to whom the risk assessment procedures are disseminated. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): RA-1 a 2 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): RA-1 a 2 | |||
| CCI: | CCI-004603 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Develop and document an organization-level; mission/business process-level; system-level risk assessment policy that is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): RA-1 a 1 (b) | ||
| CCI: | CCI-004604 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Disseminate an organization-level; mission/business process-level; system-level risk assessment policy that is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines, to organization-defined personnel or roles. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): RA-1 a 1 (b) | ||
| CCI: | CCI-004605 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Designate an organization-defined official to manage the development and documentation of the risk assessment policy. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): RA-1 b | ||
| CCI: | CCI-004606 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Designate an organization-defined official to manage the dissemination of the risk assessment policy. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): RA-1 b | ||
| CCI: | CCI-004607 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Designate an organization-defined official to manage development and documentation of the risk assessment procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): RA-1 b | ||
| CCI: | CCI-004608 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Designate an organization-defined official to manage dissemination of the risk assessment procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): RA-1 b | ||
| CCI: | CCI-004609 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Defines the official designated to manage the development, documentation, and dissemination of the risk assessment policy and procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): RA-1 b | ||
| CCI: | CCI-001039 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Review and update the current risk assessment policy in accordance with organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): RA-1 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): RA-1 b 1 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): RA-1 c 1 | |||
| NIST: NIST SP 800-53A (v1): RA-1.2 (ii) | |||
| CCI: | CCI-001040 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Defines the frequency with which to review and update the current risk assessment policy. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): RA-1 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): RA-1 b 1 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): RA-1 c 1 | |||
| NIST: NIST SP 800-53A (v1): RA-1.2 (i) | |||
| CCI: | CCI-001043 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Review and update the current risk assessment procedures in accordance with organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): RA-1 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): RA-1 b 2 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): RA-1 c 2 | |||
| NIST: NIST SP 800-53A (v1): RA-1.2 (iv) | |||
| CCI: | CCI-001044 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Defines the frequency with which to review and update the current risk assessment procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): RA-1 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): RA-1 b 2 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): RA-1 c 2 | |||
| NIST: NIST SP 800-53A (v1): RA-1.2 (iii) | |||
| CCI: | CCI-004610 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Review and update the current risk assessment policy following organization-defined events. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): RA-1 c 1 | ||
| CCI: | CCI-004611 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Defines the events following reviewing and updating the current risk assessment policy. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): RA-1 c 1 | ||
| CCI: | CCI-004612 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Review and update the current risk assessment procedures following organization-defined events. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): RA-1 c 2 | ||
| CCI: | CCI-004613 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Defines the events following reviewing and updating the current risk assessment procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): RA-1 c 2 | ||
| CCI: | CCI-004614 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Categorize the system and information it processes. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): RA-2 a | ||
| CCI: | CCI-004615 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Categorize the system and information it stores. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): RA-2 a | ||
| CCI: | CCI-004616 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Categorize the system and information it transmits. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): RA-2 a | ||
| CCI: | CCI-001046 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Document the security categorization results including supporting rationale in the security plan for the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): RA-2 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): RA-2 b | |||
| NIST: NIST SP 800-53 Revision 5 (v5): RA-2 b | |||
| NIST: NIST SP 800-53A (v1): RA-2.1 (ii) | |||
| CCI: | CCI-001047 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Verify the security categorization decision is reviewed and approved by the authorizing official or authorizing official designated representative. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): RA-2 c | ||
| NIST: NIST SP 800-53 Revision 4 (v4): RA-2 c | |||
| NIST: NIST SP 800-53 Revision 5 (v5): RA-2 c | |||
| NIST: NIST SP 800-53A (v1): RA-2.1 (iii) | |||
| CCI: | CCI-004617 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Conduct a impact-level categorization of organizational systems to obtain additional granularity on system impact levels. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): RA-2 (1) | ||
| CCI: | CCI-001048 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Conduct a risk assessment, including determining the likelihood and magnitude of harm, from the unauthorized access, use, disclosure, disruption, modification, or destruction of the system, the information it processes, stores, or transmits, and any related information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): RA-3 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): RA-3 a | |||
| NIST: NIST SP 800-53 Revision 5 (v5): RA-3 a 2 | |||
| NIST: NIST SP 800-53A (v1): RA-3.1 (i) | |||
| CCI: | CCI-004618 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Conduct a risk assessment, including identifying threats to the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): RA-3 a 1 | ||
| CCI: | CCI-004619 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Conduct a risk assessment, including identifying vulnerabilities in the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): RA-3 a 1 | ||
| CCI: | CCI-004620 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Conduct a risk assessment, including determining the likelihood and impact of adverse effects on individuals arising from the processing of personally-identifiable information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): RA-3 a 3 | ||
| CCI: | CCI-004621 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Integrate risk assessment results from the organization. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): RA-3 b | ||
| CCI: | CCI-004622 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Integrate risk management decisions from the organization. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): RA-3 b | ||
| CCI: | CCI-004623 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Integrate mission or business process perspectives with system-level risk assessments. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): RA-3 b | ||
| CCI: | CCI-001049 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Document risk assessment results in the organization-defined document. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): RA-3 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): RA-3 b | |||
| NIST: NIST SP 800-53 Revision 5 (v5): RA-3 c | |||
| NIST: NIST SP 800-53A (v1): RA-3.1 (iii) | |||
| CCI: | CCI-001642 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-12 |
| Definition: | Defines the organizational document in which risk assessment results are documented (e.g., security plan, privacy plan; risk assessment report). | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): RA-3 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): RA-3 b | |||
| NIST: NIST SP 800-53 Revision 5 (v5): RA-3 c | |||
| NIST: NIST SP 800-53A (v1): RA-3.1 (ii) | |||
| CCI: | CCI-001050 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Review risk assessment results on an organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): RA-3 c | ||
| NIST: NIST SP 800-53 Revision 4 (v4): RA-3 c | |||
| NIST: NIST SP 800-53 Revision 5 (v5): RA-3 d | |||
| NIST: NIST SP 800-53A (v1): RA-3.1 (v) | |||
| CCI: | CCI-001051 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Defines a frequency for reviewing risk assessment results. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): RA-3 c | ||
| NIST: NIST SP 800-53 Revision 4 (v4): RA-3 c | |||
| NIST: NIST SP 800-53 Revision 5 (v5): RA-3 d | |||
| NIST: NIST SP 800-53A (v1): RA-3.1 (iv) | |||
| CCI: | CCI-002370 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-01 |
| Definition: | Disseminate risk assessment results to organization-defined personnel or roles. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): RA-3 d | ||
| NIST: NIST SP 800-53 Revision 5 (v5): RA-3 e | |||
| CCI: | CCI-002371 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-01 |
| Definition: | Defines the personnel or roles to whom the risk assessment results will be disseminated. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): RA-3 d | ||
| NIST: NIST SP 800-53 Revision 5 (v5): RA-3 e | |||
| CCI: | CCI-001052 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Update the risk assessment on an organization-defined frequency or when there are significant changes to the system, its environment of operation, or other conditions that may impact the security or privacy state of the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): RA-3 d | ||
| NIST: NIST SP 800-53 Revision 4 (v4): RA-3 e | |||
| NIST: NIST SP 800-53 Revision 5 (v5): RA-3 f | |||
| NIST: NIST SP 800-53A (v1): RA-3 | |||
| CCI: | CCI-001053 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Defines a frequency for updating the risk assessment. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): RA-3 d | ||
| NIST: NIST SP 800-53 Revision 4 (v4): RA-3 e | |||
| NIST: NIST SP 800-53 Revision 5 (v5): RA-3 f | |||
| NIST: NIST SP 800-53A (v1): RA-3 | |||
| CCI: | CCI-004624 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Assess supply chain risks associated with organization-defined systems, system components, and system services. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): RA-3 (1) (a) | ||
| CCI: | CCI-004625 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Defines the systems, system-components, and system services for assessing supply chain risks. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): RA-3 (1) (a) | ||
| CCI: | CCI-004626 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Update the supply chain risk assessment on an organization-defined frequency when there are significant changes to the relevant supply chain, or when changes to the system, environments of operation, or other conditions may necessitate a change in the supply chain. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): RA-3 (1) (b) | ||
| CCI: | CCI-004627 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Defines the frequency for updating the supply chain assessment. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): RA-3 (1) (b) | ||
| CCI: | CCI-004628 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Use all-source intelligence to assist in the analysis of risk. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): RA-3 (2) | ||
| CCI: | CCI-004629 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Determine the current cyber threat environment on an ongoing basis using organization-defined means. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): RA-3 (3) | ||
| CCI: | CCI-004630 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Defines the means for determining the current threat environment. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): RA-3 (3) | ||
| CCI: | CCI-004631 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Employ organization-defined advanced automation and analytics capabilities to predict and identify risks to organization-defined systems or system components. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): RA-3 (4) | ||
| CCI: | CCI-004632 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Defines the advanced automation and analytics capabilities for predicting and identifying risks to organization-defined systems or system components. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): RA-3 (4) | ||
| CCI: | CCI-004633 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Defines the systems or system components for employing advanced automation and analytics capabilities. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): RA-3 (4) | ||
| CCI: | CCI-001054 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Monitor and scan for vulnerabilities in the system and hosted applications on an organization-defined frequency and/or randomly in accordance with organization-defined process. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): RA-5 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): RA-5 a | |||
| NIST: NIST SP 800-53 Revision 5 (v5): RA-5 a | |||
| NIST: NIST SP 800-53A (v1): RA-5.1 (ii) | |||
| CCI: | CCI-001055 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Defines a frequency for scanning for vulnerabilities in the system and hosted applications, and/or randomly in accordance with organization-defined process. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): RA-5 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): RA-5 a | |||
| NIST: NIST SP 800-53 Revision 5 (v5): RA-5 a | |||
| NIST: NIST SP 800-53A (v1): RA-5.1 (i) | |||
| CCI: | CCI-001056 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Monitor and scan for vulnerabilities in the system and hosted applications when new vulnerabilities potentially affecting the system/applications are identified and reported. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): RA-5 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): RA-5 a | |||
| NIST: NIST SP 800-53 Revision 5 (v5): RA-5 a | |||
| NIST: NIST SP 800-53A (v1): RA-5.1 (iii) | |||
| CCI: | CCI-001641 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-12 |
| Definition: | Defines the process for conducting random vulnerability scans on the system and hosted applications. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): RA-5 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): RA-5 a | |||
| NIST: NIST SP 800-53 Revision 5 (v5): RA-5 a | |||
| NIST: NIST SP 800-53A (v1): RA-5.1 (i) | |||
| CCI: | CCI-001643 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-12 |
| Definition: | Monitor and scan for vulnerabilities in the system and hosted applications in accordance with the organization-defined process for random scans. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): RA-5 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): RA-5 a | |||
| NIST: NIST SP 800-53 Revision 5 (v5): RA-5 a | |||
| NIST: NIST SP 800-53A (v1): RA-5.1 (ii) | |||
| CCI: | CCI-001057 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Employ vulnerability monitoring tools and techniques that facilitate interoperability among tools and automate parts of the vulnerability management process by using standards for: enumerating platforms, software flaws, and improper configurations. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): RA-5 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): RA-5 b | |||
| NIST: NIST SP 800-53 Revision 5 (v5): RA-5 b 1 | |||
| NIST: NIST SP 800-53A (v1): RA-5.1 (iv) | |||
| CCI: | CCI-004634 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Employ vulnerability monitoring tools and techniques that facilitate interoperability among tools and automate parts of the vulnerability management process by using standards for: formatting checklists and test procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): RA-5 b 2 | ||
| CCI: | CCI-004635 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Employ vulnerability monitoring tools and techniques that facilitate interoperability among tools and automate parts of the vulnerability management process by using standards for: measuring vulnerability impact. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): RA-5 b 3 | ||
| CCI: | CCI-001058 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Analyze vulnerability scan reports and results from vulnerability monitoring. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): RA-5 c | ||
| NIST: NIST SP 800-53 Revision 4 (v4): RA-5 c | |||
| NIST: NIST SP 800-53 Revision 5 (v5): RA-5 c | |||
| NIST: NIST SP 800-53A (v1): RA-5.1 (v) | |||
| CCI: | CCI-001059 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Remediate legitimate vulnerabilities in organization-defined response times in accordance with an organizational assessment risk. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): RA-5 d | ||
| NIST: NIST SP 800-53 Revision 4 (v4): RA-5 d | |||
| NIST: NIST SP 800-53 Revision 5 (v5): RA-5 d | |||
| NIST: NIST SP 800-53A (v1): RA-5.2 (ii) | |||
| CCI: | CCI-001060 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Defines response times for remediating legitimate vulnerabilities in accordance with an organization assessment of risk. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): RA-5 d | ||
| NIST: NIST SP 800-53 Revision 4 (v4): RA-5 d | |||
| NIST: NIST SP 800-53 Revision 5 (v5): RA-5 d | |||
| NIST: NIST SP 800-53A (v1): RA-5.2 (i) | |||
| CCI: | CCI-001061 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Share information obtained from the vulnerability monitoring process and control assessments with organization-defined personnel or roles to help eliminate similar vulnerabilities in other systems. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): RA-5 e | ||
| NIST: NIST SP 800-53 Revision 4 (v4): RA-5 e | |||
| NIST: NIST SP 800-53 Revision 5 (v5): RA-5 e | |||
| NIST: NIST SP 800-53A (v1): RA-5.2 (iii) | |||
| CCI: | CCI-002376 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Defines the personnel or roles with whom the information obtained from the vulnerability monitoring process and control assessments will be shared. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): RA-5 e | ||
| NIST: NIST SP 800-53 Revision 5 (v5): RA-5 e | |||
| CCI: | CCI-004636 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Employ vulnerability monitoring tools that include the capability to readily update the vulnerabilities to be scanned. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): RA-5 f | ||
| CCI: | CCI-001063 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Update the system vulnerabilities scanned on an organization-defined frequency, prior to a new scan, and/or when new vulnerabilities are identified and reported. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): RA-5 (2) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): RA-5 (2) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): RA-5 (2) | |||
| NIST: NIST SP 800-53A (v1): RA-5 (2).1 (ii) | |||
| CCI: | CCI-001064 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Defines a frequency for updating the system vulnerabilities scanned. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): RA-5 (2) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): RA-5 (2) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): RA-5 (2) | |||
| NIST: NIST SP 800-53A (v1): RA-5 (2).1 (i) | |||
| CCI: | CCI-002373 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-01 |
| Definition: | Define the breadth and depth of vulnerability scanning coverage (i.e., information system components scanned and vulnerabilities checked). | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): RA-5 (3) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): RA-5 (3) | |||
| CCI: | CCI-001066 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Determine information about the system that is discoverable. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): RA-5 (4) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): RA-5 (4) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): RA-5 (4) | |||
| NIST: NIST SP 800-53A (v1): RA-5 (4).1 | |||
| CCI: | CCI-002374 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-01 |
| Definition: | Defines the corrective actions if unintended information about the system is discovered. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): RA-5 (4) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): RA-5 (4) | |||
| CCI: | CCI-002375 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Take organization-defined corrective actions if information about the system is discovered. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): RA-5 (4) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): RA-5 (4) | |||
| CCI: | CCI-001067 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Implement privileged access authorization to organization-identified system components for organization-defined vulnerability scanning activities. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): RA-5 (5) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): RA-5 (5) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): RA-5 (5) | |||
| NIST: NIST SP 800-53A (v1): RA-5 (5).1 (ii) | |||
| CCI: | CCI-001645 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-12 |
| Definition: | The organization identifies the information system components to which privileged access is authorized for selected organization-defined vulnerability scanning activities. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): RA-5 (5) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): RA-5 (5) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): RA-5 (5) | |||
| NIST: NIST SP 800-53A (v1): RA-5 (5).1 (i) | |||
| CCI: | CCI-002906 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-08-13 |
| Definition: | Defines the vulnerability scanning activities in which the system implements privileged access authorization to organization-identified system components. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): RA-5 (5) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): RA-5 (5) | |||
| CCI: | CCI-001068 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Compare the results of multiple vulnerability scans using organization-defined automated mechanisms. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): RA-5 (6) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): RA-5 (6) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): RA-5 (6) | |||
| NIST: NIST SP 800-53A (v1): RA-5 (6).1 | |||
| CCI: | CCI-004637 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Defines the automated mechanisms for comparing the results of multiple vulnerability scans. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): RA-5 (6) | ||
| CCI: | CCI-001071 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Review historic audit logs to determine if a vulnerability identified in the organization-defined system has been previously exploited within an organization-defined time period. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): RA-5 (8) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): RA-5 (8) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): RA-5 (8) | |||
| NIST: NIST SP 800-53A (v1): RA-5 (8).1 | |||
| CCI: | CCI-004638 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Defines the system in which will be identified for determining if a vulnerability has been exploited. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): RA-5 (8) | ||
| CCI: | CCI-004639 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Defines the time period for reviewing historic audit logs to determine if a vulnerability identified has been exploited. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): RA-5 (8) | ||
| CCI: | CCI-002372 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-01 |
| Definition: | Correlate the output from vulnerability scanning tools to determine the presence of multi-vulnerability and multi-hop attack vectors. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): RA-5 (10) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): RA-5 (10) | |||
| CCI: | CCI-004640 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Establish a public reporting channel for receiving reports of vulnerabilities in organizational systems and system components. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): RA-5 (11) | ||
| CCI: | CCI-003119 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-23 |
| Definition: | Employ a technical surveillance countermeasures survey at organization-defined locations on an organization-defined frequency or when organization-defined events or indicators occur. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): RA-6 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): RA-6 | |||
| CCI: | CCI-003120 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-23 |
| Definition: | Defines the locations where technical surveillance countermeasures surveys are to be employed. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): RA-6 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): RA-6 | |||
| CCI: | CCI-003121 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-23 |
| Definition: | Defines the frequency on which to employ technical surveillance countermeasures surveys. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): RA-6 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): RA-6 | |||
| CCI: | CCI-003122 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-23 |
| Definition: | Defines the events or indicators upon which technical surveillance countermeasures surveys are to be employed. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): RA-6 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): RA-6 | |||
| CCI: | CCI-004641 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Respond to findings from security assessments. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): RA-7 | ||
| CCI: | CCI-004642 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Respond to findings from privacy assessments. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): RA-7 | ||
| CCI: | CCI-004643 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Respond to findings from monitoring. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): RA-7 | ||
| CCI: | CCI-004644 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Respond to findings from audits in accordance with organizational risk tolerance. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): RA-7 | ||
| CCI: | CCI-004645 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Conduct privacy impact assessments for systems, programs, or other activities before developing or procuring information technology that processes personally identifiable information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): RA-8 a | ||
| CCI: | CCI-004646 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Conduct privacy impact assessments for systems, programs, or other activities before initiating a new collection of personally identifiable information that will be processes using information technology. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): RA-8 b 1 | ||
| CCI: | CCI-004647 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Conduct privacy impact assessments for systems, programs, or other activities before initiating a new collection of personally identifiable information that includes personally identifiable information permitting the physical or virtual (online) contacting of a specific individual, if identical questions have been posed to, or identical reporting requirements imposed on, ten or more persons, other than agencies, instrumentalities, or employees of the Federal Government. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): RA-8 b 2 | ||
| CCI: | CCI-004648 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Identify critical system components and functions by performing a criticality analysis for organization-defined systems, system components, or system services at organization-defined decision points in the system development life cycle. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): RA-9 | ||
| CCI: | CCI-004649 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Defines the system, system components, or system services to perform a criticality analysis for identifying critical system components and functions. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): RA-9 | ||
| CCI: | CCI-004650 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Defines the decision points in the system development life cycle at which organization-defined system, system components, or system services to perform a criticality analysis for identifying critical system components and functions. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): RA-9 | ||
| CCI: | CCI-004651 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Establish and maintain a cyber threat hunting capability to search for indicators of compromise in organizational systems. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): RA-10 a 1 | ||
| CCI: | CCI-004652 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Establish and maintain a cyber threat hunting capability to detect, track, and disrupt threats that evade existing controls. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): RA-10 a 2 | ||
| CCI: | CCI-004653 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Employ the threat hunting capability on an organization-defined frequency. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): RA-10 b | ||
| CCI: | CCI-004654 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Defines the frequency for employing the threat hunting capability. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): RA-10 b | ||
| CCI: | CCI-000602 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Develop and document an organization-level; mission/business process-level; and/or system-level system and services acquisition policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-1 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SA-1 a 1 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-1 a 1 (a) | |||
| NIST: NIST SP 800-53A (v1): SA-1.1 (i) (ii) | |||
| CCI: | CCI-000603 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Disseminate to organization-defined personnel or roles an organization-level; mission/business process-level; and/or system-level system and services acquisition policy. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-1 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SA-1 a 1 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-1 a 1 | |||
| NIST: NIST SP 800-53A (v1): SA-1.1 (iii) | |||
| CCI: | CCI-000605 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Develop and document procedures to facilitate the implementation of the system and services acquisition policy and associated system and services acquisition controls. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-1 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SA-1 a 2 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-1 a 2 | |||
| NIST: NIST SP 800-53A (v1): SA-1.1 (iv) (v) | |||
| CCI: | CCI-000606 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Disseminate to organization-defined personnel or roles procedures to facilitate the implementation of the system and services acquisition policy and associated system and services acquisition controls. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-1 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SA-1 a 2 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-1 a 2 | |||
| NIST: NIST SP 800-53A (v1): SA-1.1 (vi) | |||
| CCI: | CCI-003089 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-23 |
| Definition: | Defines the personnel or roles to whom the organization-level; mission/business process-level; and/or system-level system and services acquisition policy is disseminated. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-1 a 1 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-1 a 1 (a) | |||
| CCI: | CCI-003090 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-23 |
| Definition: | Defines the personnel or roles to whom procedures to facilitate the implementation of the system and services acquisition policy and associated system and services acquisition controls are disseminated. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-1 a 2 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-1 a 2 | |||
| CCI: | CCI-004655 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Develop and document an organization-level; mission/business process-level; and/or system-level system and services acquisition policy that is consistent with applicable laws, Executive Orders, directives, regulations, polices, standards, and guidelines. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-1 a 1 (b) | ||
| CCI: | CCI-004656 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Designate an organization-defined official to manage development and documentation of the system and services acquisition policy. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-1 b | ||
| CCI: | CCI-004657 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Designate an organization-defined official to manage dissemination of the system and services acquisition policy. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-1 b | ||
| CCI: | CCI-004658 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Defines the official designated to manage development and documentation of the system and services acquisition policy. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-1 b | ||
| CCI: | CCI-004659 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Designate an organization-defined official to manage the development and documentation of the system and services acquisition procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-1 b | ||
| CCI: | CCI-004660 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Designate an organization-defined official to manage the dissemination of the system and services acquisition procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-1 b | ||
| CCI: | CCI-004661 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Defines the official designated to manage the system and services acquisition procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-1 b | ||
| CCI: | CCI-000601 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Defines the frequency with which to review and update the current system and services acquisition policy. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-1 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SA-1 b 1 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-1 c 1 | |||
| NIST: NIST SP 800-53A (v1): SA-1.2 (i) | |||
| CCI: | CCI-000604 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Review and update the current system and services acquisition policy in accordance with organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-1 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SA-1 b 1 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-1 c 1 | |||
| NIST: NIST SP 800-53A (v1): SA-1.2 (ii) | |||
| CCI: | CCI-000607 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Review and update the current system and services acquisition procedures in accordance with organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-1 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SA-1 b 2 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-1 c 2 | |||
| NIST: NIST SP 800-53A (v1): SA-1.2 (iv) | |||
| CCI: | CCI-001646 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-12 |
| Definition: | Defines the frequency with which to review and update the current system and services acquisition procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-1 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SA-1 b 2 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-1 c 2 | |||
| NIST: NIST SP 800-53A (v1): SA-1.2 (iii) | |||
| CCI: | CCI-004662 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Review and update the current system and services acquisition policy following organization-defined events. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-1 c 1 | ||
| CCI: | CCI-004663 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Defines the events following reviewing and updating the current system and services acquisition policy. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-1 c 1 | ||
| CCI: | CCI-004664 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Review and update the current system and services acquisition procedures following organization-defined events. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-1 c 2 | ||
| CCI: | CCI-004665 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Defines the events following reviewing and updating the current system and services acquisition procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-1 c 2 | ||
| CCI: | CCI-003091 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-23 |
| Definition: | Determine the high-level information security requirements for the system or system service in mission and business process planning. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-2 a | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-2 a | |||
| CCI: | CCI-004666 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Determine the high-level information privacy requirements for the system or system service in mission and business process planning. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-2 a | ||
| CCI: | CCI-000610 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Determine the resources required to protect the system or system service as part of the organizational capital planning and investment control process. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-2 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SA-2 b | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-2 b | |||
| NIST: NIST SP 800-53A (v1): SA-2.1 (ii) | |||
| CCI: | CCI-000611 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Document the resources required to protect the system or system service as part of the organizational capital planning and investment control process. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-2 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SA-2 b | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-2 b | |||
| NIST: NIST SP 800-53A (v1): SA-2.1 (ii) | |||
| CCI: | CCI-000612 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Allocate the resources required to protect the system or system service as part of the organizational capital planning and investment control process. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-2 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SA-2 b | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-2 b | |||
| NIST: NIST SP 800-53A (v1): SA-2.1 (ii) | |||
| CCI: | CCI-000613 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Establish a discrete line item for information security in organizational programming documentation. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-2 c | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SA-2 c | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-2 c | |||
| NIST: NIST SP 800-53A (v1): SA-2.1 (iii) | |||
| CCI: | CCI-000614 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Establish a discrete line item for information security in organizational budgeting documentation. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-2 c | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SA-2 c | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-2 c | |||
| NIST: NIST SP 800-53A (v1): SA-2.1 (iii) | |||
| CCI: | CCI-004667 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Establish a discrete line item for information privacy in organizational programming documentation. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-2 c | ||
| CCI: | CCI-004668 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Establish a discrete line item for information privacy in organizational budgeting documentation. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-2 c | ||
| CCI: | CCI-000615 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Manage the system using an organization-defined system development life cycle that incorporates information security considerations. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-3 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SA-3 a | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-3 a | |||
| NIST: NIST SP 800-53A (v1): SA-3.1 (i) | |||
| CCI: | CCI-003092 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-23 |
| Definition: | Defines a system development life cycle that is used to manage the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-3 a | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-3 a | |||
| CCI: | CCI-004669 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Acquire the system using an organization-defined system development life cycle that incorporates information security considerations. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-3 a | ||
| CCI: | CCI-004670 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Acquire the system using an organization-defined system development life cycle that incorporates information privacy considerations. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-3 a | ||
| CCI: | CCI-004671 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Develop the system using an organization-defined system development life cycle that incorporates information security considerations. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-3 a | ||
| CCI: | CCI-004672 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Develop the system using an organization-defined system development life cycle that incorporates information privacy considerations. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-3 a | ||
| CCI: | CCI-004673 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Manage the system using an organization-defined system development life cycle that incorporates information privacy considerations. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-3 a | ||
| CCI: | CCI-004674 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Defines a system development life cycle that is used to develop the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-3 a | ||
| CCI: | CCI-004675 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Defines a system development life cycle that is used to acquire the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-3 a | ||
| CCI: | CCI-000616 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Define and document information system security roles and responsibilities throughout the system development life cycle. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-3 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SA-3 b | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-3 b | |||
| NIST: NIST SP 800-53A (v1): SA-3.1 (ii) | |||
| CCI: | CCI-004676 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Define and document information system privacy roles and responsibilities throughout the system development life cycle. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-3 b | ||
| CCI: | CCI-000618 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Identify individuals having information system security roles and responsibilities. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-3 c | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SA-3 c | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-3 c | |||
| NIST: NIST SP 800-53A (v1): SA-3.1 (iii) | |||
| CCI: | CCI-004677 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Identify individuals having information system privacy roles and responsibilities. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-3 c | ||
| CCI: | CCI-003093 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-23 |
| Definition: | Integrate the organizational information security risk management process into system development life cycle activities. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-3 d | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-3 d | |||
| CCI: | CCI-004678 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Integrate the organizational information privacy risk management process into system development life cycle activities. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-3 d | ||
| CCI: | CCI-004679 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Protect system preproduction environments commensurate with risk throughout the system development life cycle for the system, system component, or system service. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-3 (1) | ||
| CCI: | CCI-004680 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Approve the use of live data in preproduction environments for the system, system component, or system service. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-3 (2) (a) | ||
| CCI: | CCI-004681 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Document the use of live data in preproduction environments for the system, system component, or system service. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-3 (2) (a) | ||
| CCI: | CCI-004682 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Control the use of live data in preproduction environments for the system, system component, or system service. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-3 (2) (a) | ||
| CCI: | CCI-004683 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Protect preproduction environments for the system, system component, or system service at the same impact or classification level as any live data in use within the preproduction environments. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-3 (2) (b) | ||
| CCI: | CCI-004684 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Plan for a technology refresh schedule to support the system throughout the system development life cycle. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-3 (3) | ||
| CCI: | CCI-004685 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Implement technology refresh schedule to support the system throughout the system development life cycle. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-3 (3) | ||
| CCI: | CCI-004686 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Defines the organization-defined contract language for including the requirements, descriptions, and criteria in the acquisition contract for the system, system component, or system service. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-4 | ||
| CCI: | CCI-003094 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-23 |
| Definition: | Include the security functional requirements, explicitly or by reference, using standardized contract language; and/or organization-defined contract language in the acquisition contract for the system, system component, or system service. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-4 a | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-4 a | |||
| CCI: | CCI-004687 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Include the privacy functional requirements, explicitly or by reference, using standardized contract language; and/or organization-defined contract language in the acquisition contract for the information system, system component, or information system service. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-4 a | ||
| CCI: | CCI-003095 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-23 |
| Definition: | Include the strength of mechanism requirements, explicitly or by reference, using standardized contract language; and/or organization-defined contract language in the acquisition contract for the information system, system component, or information system service. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-4 b | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-4 b | |||
| CCI: | CCI-003096 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-23 |
| Definition: | Include the security assurance requirements, explicitly or by reference, using standardized contract language; and/or organization-defined contract language in the acquisition contract for the information system, system component, or information system service. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-4 c | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-4 c | |||
| CCI: | CCI-004688 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Include the privacy assurance requirements, explicitly or by reference, using standardized contract language; and/or organization-defined contract language in the acquisition contract for the information system, system component, or information system service. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-4 c | ||
| CCI: | CCI-004689 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Include the controls needed to satisfy security requirements, explicitly or by reference, using standardized contract language; and/or organization-defined contract language in the acquisition contract for the information system, system component, or information system service. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-4 d | ||
| CCI: | CCI-004690 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Include the controls needed to satisfy privacy requirements, explicitly or by reference, using standardized contract language; and/or organization-defined contract language in the acquisition contract for the information system, system component, or information system service. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-4 d | ||
| CCI: | CCI-003097 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-23 |
| Definition: | Include the security documentation requirements, explicitly or by reference, using standardized contract language; and/or organization-defined contract language in the acquisition contract for the information system, system component, or information system service. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-4 d | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-4 e | |||
| CCI: | CCI-004691 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Include the privacy documentation requirements, explicitly or by reference, using standardized contract language; and/or organization-defined contract language in the acquisition contract for the information system, system component, or information system service. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-4 e | ||
| CCI: | CCI-003098 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-23 |
| Definition: | Include the requirements for protecting security documentation, explicitly or by reference, using standardized contract language; and/or organization-defined contract language in the acquisition contract for the information system, system component, or information system service. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-4 e | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-4 f | |||
| CCI: | CCI-004692 | Status: | deprecated |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Include the requirements for protecting security documentation, explicitly or by reference, using standardized contract language; and/or organization-defined contract language in the acquisition contract for the information system, system component, or information system service. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-4 f | ||
| CCI: | CCI-004693 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Include the requirements for protecting privacy documentation, explicitly or by reference, using standardized contract language; and/or organization-defined contract language in the acquisition contract for the information system, system component, or information system service. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-4 f | ||
| CCI: | CCI-003099 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-23 |
| Definition: | Include the description of the system development environment and environment in which the system is intended to operate, explicitly or by reference, using standardized contract language; and/or organization-defined contract language in the acquisition contract for the information system, system component, or information system service. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-4 f | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-4 g | |||
| CCI: | CCI-004694 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Include the allocation of responsibility or identification of parties responsible for information security, explicitly or by reference, using standardized contract language; and/or organization-defined contract language in the acquisition contract for the information system, system component, or information system service. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-4 h | ||
| CCI: | CCI-004695 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Include the allocation of responsibility or identification of parties responsible for information privacy, explicitly or by reference, using standardized contract language; and/or organization-defined contract language in the acquisition contract for the information system, system component, or information system service. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-4 h | ||
| CCI: | CCI-004696 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Include the allocation of responsibility or identification of parties responsible for supply chain risk management, explicitly or by reference, using standardized contract language; and/or organization-defined contract language in the acquisition contract for the information system, system component, or information system service. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-4 h | ||
| CCI: | CCI-003100 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-23 |
| Definition: | Include the acceptance criteria, explicitly or by reference, using standardized contract language; and/or organization-defined contract language in the acquisition contract for the information system, system component, or information system service. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-4 g | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-4 i | |||
| CCI: | CCI-000623 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Require the developer of the system, system component, or system service to provide a description of the functional properties of the controls to be implemented. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-4 (1) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SA-4 (1) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-4 (1) | |||
| NIST: NIST SP 800-53A (v1): SA-4 (1).1 | |||
| CCI: | CCI-003101 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-23 |
| Definition: | Require the developer of the system, system component, or system service to provide design information for the controls that includes security-relevant external system interfaces, high-level design, low-level design, source code, hardware schematics, and/or organization-defined design information at an organization-defined level of detail. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-4 (2) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-4 (2) | |||
| CCI: | CCI-003102 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-23 |
| Definition: | Require the developer of the system, system component, or system service to provide implementation information for the controls that includes security-relevant external system interfaces, high-level design, low-level design, source code, hardware schematics, and/or organization-defined implementation information at an organization-defined level of detail. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-4 (2) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-4 (2) | |||
| CCI: | CCI-003103 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-23 |
| Definition: | Defines the design information that the developer of the system, system component, or system service is required to provide for the controls to be designed. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-4 (2) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-4 (2) | |||
| CCI: | CCI-003104 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-23 |
| Definition: | Defines the implementation information that the developer of the system, system component, or system service is required to provide for the security controls to be implemented. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-4 (2) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-4 (2) | |||
| CCI: | CCI-003105 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-23 |
| Definition: | Defines the level of detail for the design information of the controls that is required to be provided by the developer of the information system, system component, or information system services. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-4 (2) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-4 (2) | |||
| CCI: | CCI-003106 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-23 |
| Definition: | Defines the level of detail for the implementation information of the security controls that is required to be provided by the developer of the information system, system component, or information system services. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-4 (2) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-4 (2) | |||
| CCI: | CCI-004697 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Require the developer of the system, system component, or system service to demonstrate the use of a system development life cycle process that includes organization-defined systems engineering methods. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-4 (3) (a) | ||
| CCI: | CCI-004698 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Defines the systems engineering methods for demonstrating the use of a system development life cycle process. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-4 (3) (a) | ||
| CCI: | CCI-004699 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Require the developer of the system, system component, or system service to demonstrate the use of a system development life cycle process that includes organization-defined system security engineering methods and/or privacy engineering methods. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-4 (3) (b) | ||
| CCI: | CCI-004700 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Defines the system security engineering methods and/or privacy engineering methods for demonstrating the use of a system development life cycle process. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-4 (3) (b) | ||
| CCI: | CCI-004701 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Require the developer of the system, system component, or system service to demonstrate the use of a system development life cycle process that includes organization-defined software development methods; testing; evaluation, assessment, verification, and validation methods, and quality control processes. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-4 (3) (c) | ||
| CCI: | CCI-004702 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Defines the software development methods; testing; evaluation, assessment, verification, and validation methods, and quality control processes for demonstrating the use of a system development life cycle process. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-4 (3) (c) | ||
| CCI: | CCI-003109 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-23 |
| Definition: | Require the developer of the system, system component, or system service to deliver the system, component, or service with organization-defined security configurations implemented. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-4 (5) (a) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-4 (5) (a) | |||
| CCI: | CCI-003110 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-23 |
| Definition: | Defines the security configurations required to be implemented when the developer delivers the system, system component, or system service. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-4 (5) (a) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-4 (5) (a) | |||
| CCI: | CCI-003111 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-23 |
| Definition: | Requires the developer of the system, system component, or system service to use the configurations as the default for any subsequent system, component, or service reinstallation or upgrade. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-4 (5) (b) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-4 (5) (b) | |||
| CCI: | CCI-000631 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Employ only government off-the-shelf or commercial off-the-shelf information assurance and information assurance-enabled information technology products that compose an NSA-approved solution to protect classified information when the networks used to transmit the information are at a lower classification level than the information being transmitted. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-4 (6) (a) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SA-4 (6) (a) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-4 (6) (a) | |||
| NIST: NIST SP 800-53A (v1): SA-4 (6).1 (i) | |||
| CCI: | CCI-000633 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Ensure that government off-the-shelf or commercial-off-the-shelf information assurance and information assurance-enabled information technology products have been evaluated and/or validated by NSA or in accordance with NSA-approved procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-4 (6) (b) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SA-4 (6) (b) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-4 (6) (b) | |||
| NIST: NIST SP 800-53A (v1): SA-4 (6).1 (ii) | |||
| CCI: | CCI-000634 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Limit the use of commercially provided information assurance and information assurance-enabled information technology products to those products that have been successfully evaluated against a National Information Assurance partnership (NIAP)-approved Protection Profile for a specific technology type, if such a profile exists. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-4 (7) (a) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SA-4 (7) (a) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-4 (7) (a) | |||
| NIST: NIST SP 800-53A (v1): SA-4 (7).1 (i) | |||
| CCI: | CCI-000635 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Require, if no NIAP-approved Protection Profile exists for a specific technology type but a commercially provided information technology product relies on cryptographic functionality to enforce its security policy, that the cryptographic module is FIPS-validated or NSA-approved. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-4 (7) (b) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SA-4 (7) (b) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-4 (7) (b) | |||
| NIST: NIST SP 800-53A (v1): SA-4 (7).1 (ii) | |||
| CCI: | CCI-003112 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-23 |
| Definition: | Require the developer of the system, system component, or system service to produce a plan for the continuous monitoring of control effectiveness that is consistent with the continuous monitoring program of the organization. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-4 (8) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-4 (8) | |||
| CCI: | CCI-003114 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-23 |
| Definition: | Require the developer of the system, system component, or system service to identify the functions, ports, protocols, and services intended for organizational use. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-4 (9) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-4 (9) | |||
| CCI: | CCI-003116 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-23 |
| Definition: | Employ only information technology products on the FIPS 201-approved products list for Personal Identity Verification (PIV) capability implemented within organizational systems. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-4 (10) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-4 (10) | |||
| CCI: | CCI-004703 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Include organization-defined Privacy Act requirements in the acquisition contract for the operation of a system of records on behalf of an organization to accomplish an organizational mission or function. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-4 (11) | ||
| CCI: | CCI-004704 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Defines the Privacy Act requirements to include in the acquisition contract. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-4 (11) | ||
| CCI: | CCI-004705 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Include organizational data ownership requirements in the acquisition contract. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-4 (12) (a) | ||
| CCI: | CCI-004706 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Require all data to be removed from the contractor's system and returned to the organization within an organization-defined time frame. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-4 (12) (b) | ||
| CCI: | CCI-004707 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Defines the time frame for returning the data removed from the contractor's system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-4 (12) (b) | ||
| CCI: | CCI-003124 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | Obtain or develop administrator documentation for the system, system component, or system service that describes secure configuration of the system, component, or service. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-5 a 1 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-5 a 1 | |||
| CCI: | CCI-003125 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | Obtain or develop administrator documentation for the system, system component, or system service that describes secure installation of the system, component, or service. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-5 a 1 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-5 a 1 | |||
| CCI: | CCI-003126 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | Obtain or develop administrator documentation for the system, system component, or system service that describes secure operation of the system, component, or service. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-5 a 1 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-5 a 1 | |||
| CCI: | CCI-003127 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | Obtain or develop administrator documentation for the system, system component, or system services that describes effective use and maintenance of security functions and mechanisms. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-5 a 2 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-5 a 2 | |||
| CCI: | CCI-003128 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | Obtain or develop administrator documentation for the system, system component, or system service that describes known vulnerabilities regarding configuration and use of administrative or privileged functions. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-5 a 3 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-5 a 3 | |||
| CCI: | CCI-004708 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Obtain or develop administrator documentation for the system, system component, or system services that describes effective use and maintenance of privacy functions and mechanisms. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-5 a 2 | ||
| CCI: | CCI-003129 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | Obtain or develop user documentation for the system, system component, or system service that describes user-accessible security functions and mechanisms and how to effectively use those functions and mechanisms. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-5 b 1 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-5 b 1 | |||
| CCI: | CCI-003130 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | Obtain or develop user documentation for the system, system component, or system service that describes methods for user interaction which enables individuals to use the system, component, or service in a more secure manner. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-5 b 2 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-5 b 2 | |||
| CCI: | CCI-003131 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | Obtain or develop user documentation for the system, system component, or system service that describes user responsibilities in maintaining the security of the system, component, or service. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-5 b 3 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-5 b 3 | |||
| CCI: | CCI-004709 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Obtain or develop user documentation for the system, system component, or system service that describes user-accessible privacy functions and mechanisms and how to effectively use those functions and mechanisms. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-5 b 1 | ||
| CCI: | CCI-004710 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Obtain or develop user documentation for the system, system component, or system service that describes methods for user interaction which enables individuals to protect individual privacy. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-5 b 2 | ||
| CCI: | CCI-004711 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Obtain or develop user documentation for the system, system component, or system service that describes user responsibilities in maintaining the privacy of individuals. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-5 b 3 | ||
| CCI: | CCI-000642 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Document attempts to obtain system, system component, or system service documentation when such documentation is either unavailable or nonexistent. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-5 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SA-5 c | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-5 c | |||
| NIST: NIST SP 800-53A (v1): SA-5.1 (iii) | |||
| CCI: | CCI-003132 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | Take organization-defined actions in response to attempts to obtain either unavailable or nonexistent documentation for the system, system component, or system service. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-5 c | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-5 c | |||
| CCI: | CCI-003133 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | Defines actions to be taken in response to attempts to obtain either unavailable or nonexistent documentation for the system, system component, or system service. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-5 c | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-5 c | |||
| CCI: | CCI-003135 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | Distribute system, system component, or system service documentation to organization-defined personnel or roles. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-5 e | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-5 d | |||
| CCI: | CCI-003136 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | Defines the personnel or roles to whom system, system component, or system service documentation is to be distributed. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-5 e | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-5 d | |||
| CCI: | CCI-000664 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Apply organization-defined systems security and privacy engineering principles in the specification of the system and system components. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-8 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SA-8 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-8 | |||
| NIST: NIST SP 800-53A (v1): SA-8.1 (i) | |||
| CCI: | CCI-000665 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Apply organization-defined systems security and privacy engineering principles in the design of the system and system components. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-8 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SA-8 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-8 | |||
| NIST: NIST SP 800-53A (v1): SA-8.1 (ii) | |||
| CCI: | CCI-000666 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Apply organization-defined systems security and privacy engineering principles in the development of the system and system components. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-8 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SA-8 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-8 | |||
| NIST: NIST SP 800-53A (v1): SA-8.1 (iii) | |||
| CCI: | CCI-000667 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Apply organization-defined systems security and privacy engineering principles in the implementation of the system and system components. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-8 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SA-8 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-8 | |||
| NIST: NIST SP 800-53A (v1): SA-8.1 (iv) | |||
| CCI: | CCI-000668 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Apply organization-defined systems security and privacy engineering principles in the modification of the system and system components. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-8 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SA-8 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-8 | |||
| NIST: NIST SP 800-53A (v1): SA-8.1 (v) | |||
| CCI: | CCI-004712 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Defines the systems security and privacy engineering principles applied to the specification of the system and system components. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-8 | ||
| CCI: | CCI-004713 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Defines the systems security engineering principles applied to the design of the system and system components. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-8 | ||
| CCI: | CCI-004714 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Defines the systems security engineering principles applied to the development of the system and system components. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-8 | ||
| CCI: | CCI-004715 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Defines the systems security engineering principles applied to the implementation of the system and system components. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-8 | ||
| CCI: | CCI-004716 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Defines the systems security engineering principles applied to the modification of the system and system components. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-8 | ||
| CCI: | CCI-004717 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Implement the security design principle of clear abstractions. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (1) | ||
| CCI: | CCI-004718 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Implement the security design principle of least common mechanism in organization-defined systems or system components. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (2) | ||
| CCI: | CCI-004719 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Defines the systems or system components which will implement the security design principle of least common mechanism. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (2) | ||
| CCI: | CCI-004720 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Implement the security design principles of modularity and layering in organization-defined systems or system components. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (3) | ||
| CCI: | CCI-004721 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Defines the systems or system components which will implement the security design principles of modularity and layering. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (3) | ||
| CCI: | CCI-004722 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Implement the security design principle of partially ordered dependencies in organization-defined systems or system components. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (4) | ||
| CCI: | CCI-004723 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Defines the systems or system components which will implement the security design principle of partially ordered dependencies. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (4) | ||
| CCI: | CCI-004724 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Implement the security design principle of efficiently mediated access in organization-defined systems or system components. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (5) | ||
| CCI: | CCI-004725 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Defines the systems or system components which will implement the security design principle of efficiently mediated access. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (5) | ||
| CCI: | CCI-004726 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Implement the security design principle of minimized sharing in organization-defined systems or system components. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (6) | ||
| CCI: | CCI-004727 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Defines the systems or system components which will implement the security design principle of minimized sharing. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (6) | ||
| CCI: | CCI-004728 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Implement the security design principle of reduced complexity in organization-defined systems or system components. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (7) | ||
| CCI: | CCI-004729 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Defines the systems or system components which will implement the security design principle of reduced complexity. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (7) | ||
| CCI: | CCI-004730 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-04 |
| Definition: | Implement the security design principle of secure evolvability in organization-defined systems or system components. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (8) | ||
| CCI: | CCI-004731 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the systems or system components which will implement the security design principle of secure evolvability. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (8) | ||
| CCI: | CCI-004732 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Implement the security design principle of trusted components in organization-defined systems or system components. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (9) | ||
| CCI: | CCI-004733 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the systems or system components which will implement the security design principle of trusted components. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (9) | ||
| CCI: | CCI-004734 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Implement the security design principle of hierarchical trust in organization-defined systems or system components. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (10) | ||
| CCI: | CCI-004735 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the systems or system components which will implement the security design principle of hierarchical trust. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (10) | ||
| CCI: | CCI-004736 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Implement the security design principle of inverse modification threshold in organization-defined systems or system components. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (11) | ||
| CCI: | CCI-004737 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the systems or system components which will implement the security design principle of inverse modification threshold. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (11) | ||
| CCI: | CCI-004738 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Implement the security design principle of hierarchical protection in organization-defined systems or system components. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (12) | ||
| CCI: | CCI-004739 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the systems or system components which will implement the security design principle of hierarchical protection. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (12) | ||
| CCI: | CCI-004740 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Implement the security design principle of minimized security elements in organization-defined systems or system components. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (13) | ||
| CCI: | CCI-004741 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the systems or system components which will implement the security design principle of minimized security elements. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (13) | ||
| CCI: | CCI-004742 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Implement the security design principle of least privilege in organization-defined systems or system components. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (14) | ||
| CCI: | CCI-004743 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the systems or system components which will implement the security design principle of least privilege. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (14) | ||
| CCI: | CCI-004744 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Implement the security design principle of predicate permission in organization-defined systems or system components. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (15) | ||
| CCI: | CCI-004745 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the systems or system components which will implement the security design principle of predicate permission. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (15) | ||
| CCI: | CCI-004746 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Implement the security design principle of self-reliant trustworthiness in organization-defined systems or system components. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (16) | ||
| CCI: | CCI-004747 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the systems or system components which will implement the security design principle of self-reliant trustworthiness. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (16) | ||
| CCI: | CCI-004748 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Implement the security design principle of secure distributed composition in organization-defined systems or system components. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (17) | ||
| CCI: | CCI-004749 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the systems or system components which will implement the security design principle of secure distributed composition. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (17) | ||
| CCI: | CCI-004750 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Implement the security design principle of trusted communication channels in organization-defined systems or system components. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (18) | ||
| CCI: | CCI-004751 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the systems or system components which will implement the security design principle of trusted communication channels. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (18) | ||
| CCI: | CCI-004752 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Implement the security design principle of continuous protection in organization-defined systems or system components. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (19) | ||
| CCI: | CCI-004753 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the systems or system components which will implement the security design principle of continuous protection. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (19) | ||
| CCI: | CCI-004754 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Implement the security design principle of secure metadata management in organization-defined systems or system components. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (20) | ||
| CCI: | CCI-004755 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the systems or system components which will implement the security design principle of secure metadata management. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (20) | ||
| CCI: | CCI-004756 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Implement the security design principle of self-analysis in organization-defined systems or system components. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (21) | ||
| CCI: | CCI-004757 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the systems or system components which will implement the security design principle of self-analysis. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (21) | ||
| CCI: | CCI-004758 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Implement the security design principle of accountability and traceability in organization-defined systems or system components. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (22) | ||
| CCI: | CCI-004759 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the systems or system components which will implement the security design principle of accountability and traceability. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (22) | ||
| CCI: | CCI-004760 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Implement the security design principle of secure defaults in organization-defined systems or system components. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (23) | ||
| CCI: | CCI-004761 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the systems or system components which will implement the security design principle of secure defaults. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (23) | ||
| CCI: | CCI-004762 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Implement the security design principle of secure failure and recovery in organization-defined systems or system components. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (24) | ||
| CCI: | CCI-004763 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the systems or system components which will implement the security design principle of secure failure and recovery. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (24) | ||
| CCI: | CCI-004764 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Implement the security design principle of economic security in organization-defined systems or system components. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (25) | ||
| CCI: | CCI-004765 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the systems or system components which will implement the security design principle of economic security. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (25) | ||
| CCI: | CCI-004766 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Implement the security design principle of performance security in organization-defined systems or system components. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (26) | ||
| CCI: | CCI-004767 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the systems or system components which will implement the security design principle of performance security. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (26) | ||
| CCI: | CCI-004768 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Implement the security design principle of human factored security in organization-defined systems or system components. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (27) | ||
| CCI: | CCI-004769 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the systems or system components which will implement the security design principle of human factored security. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (27) | ||
| CCI: | CCI-004770 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Implement the security design principle of acceptable security in organization-defined systems or system components. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (28) | ||
| CCI: | CCI-004771 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the systems or system components which will implement the security design principle of acceptable security. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (28) | ||
| CCI: | CCI-004772 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Implement the security design principle of repeatable and documented procedures in organization-defined systems or system components. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (29) | ||
| CCI: | CCI-004773 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the systems or system components which will implement the security design principle of repeatable and documented procedures. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (29) | ||
| CCI: | CCI-004774 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Implement the security design principle of procedural rigor in organization-defined systems or system components. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (30) | ||
| CCI: | CCI-004775 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the systems or system components which will implement the security design principle of procedural rigor. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (30) | ||
| CCI: | CCI-004776 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Implement the security design principle of secure system modification in organization-defined systems or system components. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (31) | ||
| CCI: | CCI-004777 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the systems or system components which will implement the security design principle of secure system modification. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (31) | ||
| CCI: | CCI-004778 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Implement the security design principle of sufficient documentation in organization-defined systems or system components. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (32) | ||
| CCI: | CCI-004779 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the systems or system components which will implement the security design principle of sufficient documentation. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (32) | ||
| CCI: | CCI-004780 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Implement the privacy principle of minimization using organization-defined processes. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (33) | ||
| CCI: | CCI-004781 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the processes for implementing the privacy principle of minimization. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-8 (33) | ||
| CCI: | CCI-000669 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Require that providers of external system services comply with organizational security requirements. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-9 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SA-9 a | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-9 | |||
| NIST: NIST SP 800-53A (v1): SA-9.1 (i) | |||
| CCI: | CCI-004782 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Require that providers of external system services comply with organizational privacy requirements. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-9 a | ||
| CCI: | CCI-004783 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Require that providers of external system services employ organization-defined controls. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-9 a | ||
| CCI: | CCI-004784 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the controls for complying with organizational security and privacy requirements. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-9 a | ||
| CCI: | CCI-004785 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Define and document organizational oversight with regard to external system services. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-9 b | ||
| CCI: | CCI-004786 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Define and document user roles and responsibilities with regard to external system services. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-9 b | ||
| CCI: | CCI-003138 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | Employ organization-defined processes, methods, and techniques to monitor control compliance by external service providers on an ongoing basis. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-9 c | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-9 c | |||
| CCI: | CCI-003139 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | Defines processes, methods, and techniques to employ to monitor control compliance by external service providers on an ongoing basis. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-9 c | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-9 c | |||
| CCI: | CCI-003140 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | Conduct an organizational assessment of risk prior to the acquisition or outsourcing of information security services. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-9 (1) (a) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-9 (1) (a) | |||
| CCI: | CCI-003141 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | Verify that the acquisition or outsourcing of dedicated information security services is approved by organization-defined personnel or roles. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-9 (1) (b) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-9 (1) (b) | |||
| CCI: | CCI-003142 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | Defines the personnel or roles authorized to approve the acquisition or outsourcing of dedicated information security services. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-9 (1) (b) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-9 (1) (b) | |||
| CCI: | CCI-003143 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | Require providers of organization-defined external system services to identify the functions, ports, protocols, and other services required for the use of such services. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-9 (2) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-9 (2) | |||
| CCI: | CCI-003144 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | Defines the external system services for which the providers are required to identify the functions, ports, protocols, and other services required for the use of such services. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-9 (2) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-9 (2) | |||
| CCI: | CCI-003145 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | Establish trust relationships with external service providers based on organization-defined security requirements, properties, factors, or conditions defining acceptable trust relationships. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-9 (3) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-9 (3) | |||
| CCI: | CCI-003146 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | Document trust relationships with external service providers based on organization-defined security requirements, properties, factors, or conditions defining acceptable trust relationships. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-9 (3) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-9 (3) | |||
| CCI: | CCI-003147 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | Maintain trust relationships with external service providers based on organization-defined security requirements, properties, factors, or conditions defining acceptable trust relationships. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-9 (3) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-9 (3) | |||
| CCI: | CCI-003148 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | Defines security requirements, properties, factors, or conditions defining acceptable trust relationships with external service providers. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-9 (3) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-9 (3) | |||
| CCI: | CCI-004787 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Establish trust relationships with external service providers based on organization-defined privacy requirements, properties, factors, or conditions defining acceptable trust relationships. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-9 (3) | ||
| CCI: | CCI-004788 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Document trust relationships with external service providers based on organization-defined privacy requirements, properties, factors, or conditions defining acceptable trust relationships. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-9 (3) | ||
| CCI: | CCI-004789 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Maintain trust relationships with external service providers based on organization-defined privacy requirements, properties, factors, or conditions defining acceptable trust relationships. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-9 (3) | ||
| CCI: | CCI-004790 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines privacy requirements, properties, factors, or conditions defining acceptable trust relationships with external service providers. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-9 (3) | ||
| CCI: | CCI-003149 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | Take organization-defined actions to verify that the interests of organization-defined external service providers are consistent with and reflect organizational interests. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-9 (4) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-9 (4) | |||
| CCI: | CCI-003150 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | Defines the actions taken to verify that the interests of organization-defined external service providers are consistent with and reflect organizational interests. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-9 (4) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-9 (4) | |||
| CCI: | CCI-003151 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | Defines external service providers whose interests are consistent with and reflect organizational interests. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-9 (4) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-9 (4) | |||
| CCI: | CCI-003152 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | Restrict the location of information processing, information or data, and/or system services to organization-defined locations based on organization-defined requirements or conditions. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-9 (5) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-9 (5) | |||
| CCI: | CCI-003153 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | Defines the locations for which to restrict information processing, information or data, and/or system services based on organization-defined requirements or conditions. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-9 (5) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-9 (5) | |||
| CCI: | CCI-003154 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | Defines the requirements or conditions on which to base restricting the location of information processing, information or data, and/or system services to organization-defined locations. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-9 (5) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-9 (5) | |||
| CCI: | CCI-004791 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Maintain exclusive control of cryptographic keys for encrypted material stored or transmitted through an external system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-9 (6) | ||
| CCI: | CCI-004792 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Provide the capability to check the integrity of organizational information while it resides in the external system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-9 (7) | ||
| CCI: | CCI-004793 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Restrict the geographic location of information processing and data storage to facilities located within the legal jurisdictional boundary of the United States. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-9 (8) | ||
| CCI: | CCI-003155 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | Require the developer of the system, system component, or system service to perform configuration management during system, component, or service design, development, implementation, operation and/or disposal. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-10 a | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-10 a | |||
| CCI: | CCI-003156 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | Require the developer of the system, system component, or system service to document the integrity of changes to organization-defined configuration items under configuration management. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-10 b | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-10 b | |||
| CCI: | CCI-003157 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | Require the developer of the system, system component, or system service to manage the integrity of changes to organization-defined configuration items under configuration management. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-10 b | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-10 b | |||
| CCI: | CCI-003158 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | Require the developer of the system, system component, or system service to control the integrity of changes to organization-defined configuration items under configuration management. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-10 b | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-10 b | |||
| CCI: | CCI-003159 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | Defines the configuration items under configuration management that require the integrity of changes to be documented, managed and controlled. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-10 b | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-10 b | |||
| CCI: | CCI-000692 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | Require the developer of the system, system component, or system service to implement only organization-approved changes to the system, component, or service. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-10 (c) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SA-10 c | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-10 c | |||
| NIST: NIST SP 800-53A (v1): SA-10.1 (iii) | |||
| CCI: | CCI-000694 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | Require the developer of the system, system component, or system service to document approved changes to the system, component, or service. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-10 (d) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SA-10 d | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-10 d | |||
| NIST: NIST SP 800-53A (v1): SA-10.1 (iv) | |||
| CCI: | CCI-003160 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | Require the developer of the system, system component, or system service to document the potential security impacts of approved changes to the system, component, or service. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-10 d | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-10 d | |||
| CCI: | CCI-004794 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Require the developer of the system, system component, or system service to document the potential privacy impacts of approved changes to the system, component, or service. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-10 d | ||
| CCI: | CCI-003161 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | Require the developer of the system, system component, or system service to track security flaws within the system, component, or service. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-10 e | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-10 e | |||
| CCI: | CCI-003162 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | Require the developer of the system, system component, or system service to track flaw resolution within the system, component, or service. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-10 e | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-10 e | |||
| CCI: | CCI-003163 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | Require the developer of the system, system component, or system service to report findings of security flaws and flaw resolution within the system, component, or service to organization-defined personnel. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-10 e | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-10 e | |||
| CCI: | CCI-003164 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | Defines the personnel to whom security flaw findings and flaw resolution within the system, component, or service are reported. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-10 e | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-10 e | |||
| CCI: | CCI-000698 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | Require the developer of the system, system component, or system service to enable integrity verification of software and firmware components. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-10 (1) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SA-10 (1) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-10 (1) | |||
| NIST: NIST SP 800-53A (v1): SA-10 (1).1 | |||
| CCI: | CCI-000700 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | Provide an alternate configuration management process using organizational personnel in the absence of a dedicated developer configuration management team. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-10 (2) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SA-10 (2) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-10 (2) | |||
| NIST: NIST SP 800-53A (v1): SA-10 (2).1 | |||
| CCI: | CCI-003165 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | Require the developer of the system, system component, or system service to enable integrity verification of hardware components. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-10 (3) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-10 (3) | |||
| CCI: | CCI-003166 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | Require the developer of the system, system component, or system service to employ tools for comparing newly generated versions of security-relevant hardware descriptions with previous versions. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-10 (4) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-10 (4) | |||
| CCI: | CCI-003167 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | Require the developer of the system, system component, or system service to employ tools for comparing newly generated versions of source code with previous versions. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-10 (4) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-10 (4) | |||
| CCI: | CCI-003168 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | Require the developer of the system, system component, or system service to employ tools for comparing newly generated versions of object code with previous versions. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-10 (4) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-10 (4) | |||
| CCI: | CCI-003169 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | Require the developer of the system, system component, or system service to maintain the integrity of the mapping between the master build data describing the current version of security-relevant hardware, software, and firmware and the on-site master copy of the data for the current version. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-10 (5) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-10 (5) | |||
| CCI: | CCI-003170 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | Require the developer of the system, system component, or system service to execute procedures for ensuring that security-relevant hardware, software, and firmware updates distributed to the organization are exactly as specified by the master copies. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-10 (6) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-10 (6) | |||
| CCI: | CCI-004795 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Require organization-defined security and privacy representatives to be included in the organization-defined configuration change management and control process. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-10 (7) | ||
| CCI: | CCI-004796 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the security and privacy representatives to be included the organization-defined configuration change management and control process. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-10 (7) | ||
| CCI: | CCI-004797 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the configuration change management and control process required for the organization-defined security and privacy representatives. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-10 (7) | ||
| CCI: | CCI-003171 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | Require the developer of the system, system component, or system service, at all post-design phases of the system development life cycle, to develop a plan for ongoing security control assessment. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-11 a | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-11 a | |||
| CCI: | CCI-003172 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | Require the developer of the system, system component, or system service to implement a plan for ongoing security control assessment. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-11 a | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-11 a | |||
| CCI: | CCI-004798 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Require the developer of the system, system component, or system service, at all post-design phases of the system development life cycle, to develop a plan for ongoing privacy control assessment. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-11 a | ||
| CCI: | CCI-004799 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Require the developer of the system, system component, or system service to implement a plan for ongoing privacy control assessment. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-11 a | ||
| CCI: | CCI-003173 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | Requires the developer of the system, system component, or system service, at all post-design phases of the system development life cycle, to perform unit, integration, system, and/or regression testing/evaluation on an organization-defined frequency, at an organization-defined depth and coverage. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-11 b | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-11 b | |||
| CCI: | CCI-003174 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | Defines the depth and coverage at which to perform unit, integration, system, and/or regression testing/evaluation on an organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-11 b | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-11 b | |||
| CCI: | CCI-004800 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the frequency that the unit, integration, system, and/or regression testing/evaluation is performed at an organization-defined depth and coverage. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-11 b | ||
| CCI: | CCI-003175 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | Requires the developer of the system, system component, or system service, at all post-design phases of the system development life cycle, to produce evidence of the execution of the assessment plan. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-11 c | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-11 c | |||
| CCI: | CCI-003176 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | Requires the developer of the system, system component, or system service, at all post-design phases of the system development life cycle, to produce the results of the testing and evaluation. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-11 c | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-11 c | |||
| CCI: | CCI-003177 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | Requires the developer of the system, system component, or system service, at all post-design phases of the system development life cycle, to implement a verifiable flaw remediation process. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-11 d | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-11 d | |||
| CCI: | CCI-003178 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | Requires the developer of the system, system component, or system service, at all post-design phases of the system development life cycle, to correct flaws identified during testing/evaluation. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-11 e | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-11 e | |||
| CCI: | CCI-003179 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | Require the developer of the system, system component, or system service to employ static code analysis tools to identify common flaws. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-11 (1) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-11 (1) | |||
| CCI: | CCI-003180 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | Require the developer of the system, system component, or system service to document the results of static code analysis. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-11 (1) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-11 (1) | |||
| CCI: | CCI-003181 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | Require the developer of the system, system component, or system service to perform threat modeling and vulnerability analyses during development. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-11 (2) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-11 (2) | |||
| CCI: | CCI-003182 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | Require the developer of the system, system component, or system service to perform threat modeling and vulnerability analysis during subsequent testing and evaluation of the system, component, or service. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-11 (2) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-11 (2) | |||
| CCI: | CCI-004801 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Use the following contextual information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-11 (2) (a) | ||
| CCI: | CCI-004802 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the information concerning impact, environment of operations, known or assumed threats, and acceptable risk levels. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-11 (2) (a) | ||
| CCI: | CCI-004803 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Employ the following tools and methods. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-11 (2) (b) | ||
| CCI: | CCI-004804 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the tools and methods to be employed. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-11 (2) (b) | ||
| CCI: | CCI-004805 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Conduct the modeling and analyses as the following level of rigor. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-11 (2) (c) | ||
| CCI: | CCI-004806 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the breadth and depth of modeling and analyses the level of rigor will be conducted. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-11 (2) (c) | ||
| CCI: | CCI-004807 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Produces evidence that meets the following acceptance criteria. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-11 (2) (d) | ||
| CCI: | CCI-004808 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the acceptance criteria that meets the requirement for producing evidence. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-11 (2) (d) | ||
| CCI: | CCI-003183 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | Require an independent agent satisfying organization-defined independence criteria to verify the correct implementation of the developer security assessment plan. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-11 (3) (a) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-11 (3) (a) | |||
| CCI: | CCI-003184 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | Require an independent agent satisfying organization-defined independence criteria to verify the evidence produced during security testing and evaluation. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-11 (3) (a) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-11 (3) (a) | |||
| CCI: | CCI-003185 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | Defines the independence criteria the independent agent must satisfy prior to verifying the correct implementation of the developer security assessment plan and the evidence produced during security testing and evaluation. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-11 (3) (a) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-11 (3) (a) | |||
| CCI: | CCI-004809 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Require an independent agent satisfying organization-defined independence criteria to verify the correct implementation of the developer privacy assessment plan. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-11 (3) (a) | ||
| CCI: | CCI-004810 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Require an independent agent satisfying organization-defined independence criteria to verify the evidence produced during privacy testing and evaluation. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-11 (3) (a) | ||
| CCI: | CCI-004811 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the independence criteria the independent agent must satisfy prior to verifying the correct implementation of the developer privacy assessment plan and the evidence produced during privacy testing and evaluation. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-11 (3) (a) | ||
| CCI: | CCI-003186 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | Verify that the independent agent either is provided with sufficient information to complete the verification process or has been granted the authority to obtain such information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-11 (3) (b) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-11 (3) (b) | |||
| CCI: | CCI-003187 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | Require the developer of the system, system component, or system service to perform a manual code review of organization-defined specific code using organization-defined processes, procedures, and/or techniques. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-11 (4) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-11 (4) | |||
| CCI: | CCI-003188 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | Defines the specific code for which the developer of the system, system component, or system service is required to perform a manual code review using organization-defined process, procedures, and/or techniques. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-11 (4) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-11 (4) | |||
| CCI: | CCI-003189 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | Defines the processes, procedures, and/or techniques to be used by the developer of the system, system component, or system service to perform a manual code review of organization-defined specific code. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-11 (4) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-11 (4) | |||
| CCI: | CCI-003191 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | Defines the breadth and depth at which the developer of the system, system component, or system service is required to perform penetration testing. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-11 (5) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-11 (5) (a) | |||
| CCI: | CCI-004812 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Require the developer of the system, system component, or system service to perform penetration testing at an organization-defined breadth and depth of testing. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-11 (5) (a) | ||
| CCI: | CCI-003192 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | Defines the constraints on penetration testing performed by the developer of the system, system component, or system service. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-11 (5) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-11 (5) (b) | |||
| CCI: | CCI-004813 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Require the developer of the system, system component, or system service to perform penetration testing under organization-defined constraints. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-11 (5) (b) | ||
| CCI: | CCI-003193 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | Require the developer of the system, system component, or system service to perform attack surface reviews. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-11 (6) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-11 (6) | |||
| CCI: | CCI-003194 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | Require the developer of the system, system component, or system service to verify that the scope of testing and evaluation provides complete coverage of required controls at an organization-defined depth of testing and evaluation. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-11 (7) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-11 (7) | |||
| CCI: | CCI-003195 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | Defines the depth of testing and evaluation to which the developer of the system, system component, or system service is required to verify that the scope of security testing and evaluation provides complete coverage of the required controls. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-11 (7) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-11 (7) | |||
| CCI: | CCI-003196 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | Require the developer of the system, system component, or system service to employ dynamic code analysis tools to identify common flaws. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-11 (8) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-11 (8) | |||
| CCI: | CCI-003197 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | Require the developer of the system, system component, or system service to document the results of the dynamic code analysis. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-11 (8) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-11 (8) | |||
| CCI: | CCI-004814 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Require the developer of the system, system component, or system service to employ interactive application security testing tools to identify flaws. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-11 (9) | ||
| CCI: | CCI-004815 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Require the developer of the system, system component, or system service to employ interactive application security testing tools to document the results. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-11 (9) | ||
| CCI: | CCI-003233 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | Require the developer of the system, system component, or system service to follow a documented development process. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-15 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-15 a | |||
| CCI: | CCI-003234 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | Require the developer of the system, system component, or system service to follow a documented development process that explicitly addresses security requirements. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-15 a 1 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-15 a 1 | |||
| CCI: | CCI-003235 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | Require the developer of the system, system component, or system service to follow a documented development process that identifies the standards used in the development process. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-15 a 2 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-15 a 2 | |||
| CCI: | CCI-003236 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | Require the developer of the system, system component, or system service to follow a documented development process that identifies the tools used in the development process. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-15 a 2 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-15 a 2 | |||
| CCI: | CCI-003237 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | Require the developer of the system, system component, or system service to follow a documented development process that documents the specific tool options and tool configurations used in the development process. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-15 a 3 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-15 a 3 | |||
| CCI: | CCI-003238 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | Require the developer of the system, system component, or system service to follow a documented development process that documents changes to the process and/or tools used in development. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-15 a 4 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-15 a 4 | |||
| CCI: | CCI-003239 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | Require the developer of the system, system component, or system service to follow a documented development process that manages changes to the process and/or tools used in development. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-15 a 4 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-15 a 4 | |||
| CCI: | CCI-003240 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | Require the developer of the system, system component, or system service to follow a documented development process that ensures the integrity of changes to the process and/or tools used in development. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-15 a 4 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-15 a 4 | |||
| CCI: | CCI-004816 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Require the developer of the system, system component, or system service to follow a documented development process that explicitly addresses privacy requirements. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-15 a 1 | ||
| CCI: | CCI-003241 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | Review the development process in accordance with organization-defined frequency to determine if the development process selected and employed can satisfy organization-defined security requirements. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-15 b | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-15 b | |||
| CCI: | CCI-003242 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | Review the development standards in accordance with organization-defined frequency to determine if the development standards selected and employed can satisfy organization-defined security requirements. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-15 b | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-15 b | |||
| CCI: | CCI-003243 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | Review the development tools in accordance with organization-defined frequency to determine if the development tools selected and employed can satisfy organization-defined security requirements. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-15 b | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-15 b | |||
| CCI: | CCI-003244 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | Review the development tool options/configurations in accordance with organization-defined frequency to determine if the development tool options and tool configurations selected and employed can satisfy organization-defined security requirements. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-15 b | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-15 b | |||
| CCI: | CCI-003245 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | Defines the frequency on which to review the development process, standards, tools, and tool options/configurations to determine if the process, standards, tools, and tool options and tool configurations selected and employed can satisfy organization-defined security requirements. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-15 b | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-15 b | |||
| CCI: | CCI-003246 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | Defines the security requirements that must be satisfied by conducting a review of the development process, standards, tools, and tool options and tool configurations. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-15 b | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-15 b | |||
| CCI: | CCI-004817 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Review the development process in accordance with organization-defined frequency to determine if the development process selected and employed can satisfy organization-defined privacy requirements. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-15 b | ||
| CCI: | CCI-004818 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Review the development standards in accordance with organization-defined frequency to determine if the development standards selected and employed can satisfy organization-defined privacy requirements. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-15 b | ||
| CCI: | CCI-004819 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Review the development tools in accordance with organization-defined frequency to determine if the development tools selected and employed can satisfy organization-defined privacy requirements. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-15 b | ||
| CCI: | CCI-004820 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Review the development tool options/configurations in accordance with organization-defined frequency to determine if the development tool options and tool configurations selected and employed can satisfy organization-defined privacy requirements. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-15 b | ||
| CCI: | CCI-004821 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the frequency on which to review the development process, standards, tools, and tool options/configurations to determine if the process, standards, tools, and tool options and tool configurations selected and employed can satisfy organization-defined privacy requirements. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-15 b | ||
| CCI: | CCI-004822 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the privacy requirements that must be satisfied by conducting a review of the development process, standards, tools, and tool options and tool configurations. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-15 b | ||
| CCI: | CCI-003247 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | Require the developer of the system, system component, or system service to define quality metrics at the beginning of the development process. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-15 (1) (a) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-15 (1) (a) | |||
| CCI: | CCI-003248 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | Require the developer of the system, system component, or system service to provide evidence of meeting the quality metrics in accordance with organization-defined frequency, organization-defined program review milestones, and/or upon delivery. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-15 (1) (b) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-15 (1) (b) | |||
| CCI: | CCI-003249 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | Defines the frequency on which the developer of the system, system component, or system service is required to provide evidence of meeting the quality metrics. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-15 (1) (b) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-15 (1) (b) | |||
| CCI: | CCI-003250 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | Defines the program review milestones at which the developer of the information system, system component, or information system service is required to provide evidence of meeting the quality metrics. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-15 (1) (b) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-15 (1) (b) | |||
| CCI: | CCI-003251 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | Require the developer of the system, system component, or system service to select a security tracking tool for use during the development process. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-15 (2) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-15 (2) | |||
| CCI: | CCI-003252 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | Require the developer of the system, system component, or system service to employ a security tracking tool for use during the development process. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-15 (2) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-15 (2) | |||
| CCI: | CCI-004823 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Require the developer of the system, system component, or system service to select a privacy tracking tool for use during the development process. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-15 (2) | ||
| CCI: | CCI-004824 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Require the developer of the system, system component, or system service to employ a privacy tracking tool for use during the development process. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-15 (2) | ||
| CCI: | CCI-003255 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | Defines decision points in the system development life cycle at which the developer of the system, system component, or system service is required to perform a criticality analysis. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-15 (3) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-15 (3) (a) | |||
| CCI: | CCI-004825 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Require the developer of the system, system component, or system service to perform a criticality analysis at the organization-defined decision points in the system development life cycle. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-15 (3) (a) | ||
| CCI: | CCI-003254 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | Defines the breadth/depth of criticality analysis at which the developer of the system, system component, or system service is required to perform a criticality analysis. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-15 (3) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-15 (3) (b) | |||
| CCI: | CCI-004826 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Require the developer of the system, system component, or system service to perform a criticality analysis at an organization-defined breadth/depth of criticality analysis. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-15 (3) (b) | ||
| CCI: | CCI-003272 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | Require the developer of the system, system component, or system service to reduce attack surfaces to organization-defined thresholds. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-15 (5) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-15 (5) | |||
| CCI: | CCI-003273 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | Defines the thresholds to which the developer of the system, system component, or system service is required to reduce attack surfaces. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-15 (5) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-15 (5) | |||
| CCI: | CCI-003274 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | Require the developer of the system, system component, or system service to implement an explicit process to continuously improve the development process. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-15 (6) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-15 (6) | |||
| CCI: | CCI-003275 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | Require the developer of the system, system component, or system services, on an organization-defined frequency, to perform an automated vulnerability analysis using organization-defined tools. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-15 (7) (a) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-15 (7) (a) | |||
| CCI: | CCI-003276 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | Defines the tools the developer of the system, system component, or system services uses to perform an automated vulnerability analysis. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-15 (7) (a) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-15 (7) (a) | |||
| CCI: | CCI-004827 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the frequency for performing an automated vulnerability analysis using organization-defined tools. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-15 (7) (a) | ||
| CCI: | CCI-003277 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | Require the developer of the system, system component, or system services, on an organization-defined frequency, to determine the exploitation potential for discovered vulnerabilities. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-15 (7) (b) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-15 (7) (b) | |||
| CCI: | CCI-004828 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the frequency for determining the exploitation potential for discovered vulnerabilities. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-15 (7) (b) | ||
| CCI: | CCI-003278 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | Require the developer of the system, system component, or system services, on an organization-defined frequency, to determine potential risk mitigations for delivered vulnerabilities. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-15 (7) (c) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-15 (7) (c) | |||
| CCI: | CCI-004829 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the frequency for determining potential risk mitigations for delivered vulnerabilities. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-15 (7) (c) | ||
| CCI: | CCI-003279 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | Require the developer of the system, system component, or system services, on an organization-defined frequency, to deliver the outputs of the tools and results of the vulnerability analysis to organization-defined personnel or roles. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-15 (7) (d) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-15 (7) (d) | |||
| CCI: | CCI-003280 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | Defines the personnel or roles to whom the outputs of the tools and results of the vulnerability analysis are delivered. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-15 (7) (d) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-15 (7) (d) | |||
| CCI: | CCI-004830 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the frequency for delivering the outputs of the tools and results of the vulnerability analysis to organization-defined personnel or roles. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-15 (7) (d) | ||
| CCI: | CCI-003281 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | Require the developer of the system, system component, or system service to use threat modeling from similar systems, components, or services to inform the current development process. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-15 (8) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-15 (8) | |||
| CCI: | CCI-003282 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | Require the developer of the system, system component, or system service to use vulnerability analysis from similar systems, components, or services to inform the current development process. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-15 (8) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-15 (8) | |||
| CCI: | CCI-003289 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | Require the developer of the system, system component, or system service to provide an incident response plan. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-15 (10) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-15 (10) | |||
| CCI: | CCI-004831 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Require the developer of the system, system component, or system service to implement an incident response plan. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-15 (10) | ||
| CCI: | CCI-004832 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Require the developer of the system, system component, or system service to test an incident response plan. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-15 (10) | ||
| CCI: | CCI-003290 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | Require the developer of the system or system component to archive the system or component to be released or delivered together with the corresponding evidence supporting the final security review. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-15 (11) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-15 (11) | |||
| CCI: | CCI-004833 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Require the developer of the system or system component to archive the system or component to be released or delivered together with the corresponding evidence supporting the final privacy review. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-15 (11) | ||
| CCI: | CCI-004834 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Require the developer of the system or system component to minimize the use of personally identifiable information in development and test environments. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-15 (12) | ||
| CCI: | CCI-003291 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | Require the developer of the system, system component, or system service to provide organization-defined training on the correct use and operation of the implemented security functions, controls, and/or mechanisms. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-16 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-16 | |||
| CCI: | CCI-003292 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | Defines the training the developer of the system, system component, or system service is required to provide on the correct use and operation of the implemented security functions, controls, and/or mechanisms. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-16 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-16 | |||
| CCI: | CCI-004835 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Require the developer of the system, system component, or system service to provide organization-defined training on the correct use and operation of the implemented privacy functions, controls, and/or mechanisms. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-16 | ||
| CCI: | CCI-004836 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the training the developer of the system, system component, or information system service is required to provide on the correct use and operation of the implemented privacy functions, controls, and/or mechanisms. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-16 | ||
| CCI: | CCI-003293 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | Require the developer of the system, system component, or system service to produce a design specification and security architecture. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-17 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-17 | |||
| CCI: | CCI-004837 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Require the developer of the system, system component, or system service to produce a privacy architecture. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-17 | ||
| CCI: | CCI-003294 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | Require the developer of the system, system component, or system service to produce a design specification and security architecture that is consistent with and supportive of the organization's security architecture which is established within and is an integrated part of the organization's enterprise architecture. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-17 a | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-17 a | |||
| CCI: | CCI-004838 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Require the developer of the system, system component, or system service to produce a privacy architecture that is consistent with and supportive of the organization's privacy architecture which is established within and is an integrated part of the organization's enterprise architecture. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-17 a | ||
| CCI: | CCI-003295 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | Require the developer of the system, system component, or system service to produce a design specification and security architecture that accurately and completely describes the required security functionality. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-17 b | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-17 b | |||
| CCI: | CCI-003296 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | Require the developer of the system, system component, or system service to produce a design specification and security architecture that accurately and completely describes the allocation of security controls among physical and logical components. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-17 b | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-17 b | |||
| CCI: | CCI-004839 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Require the developer of the system, system component, or system service to produce a privacy architecture that accurately and completely describes the required privacy functionality. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-17 b | ||
| CCI: | CCI-004840 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Require the developer of the system, system component, or system service to produce a privacy architecture that accurately and completely describes the allocation of privacy controls among physical and logical components. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-17 b | ||
| CCI: | CCI-003297 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | Require the developer of the system, system component, or system service to produce a design specification and security architecture that expresses how individual security functions, mechanisms, and services work together to provide required security capabilities and a unified approach to protection. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-17 c | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-17 c | |||
| CCI: | CCI-004841 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Require the developer of the system, system component, or system service to produce a privacy architecture that expresses how individual privacy functions, mechanisms, and services work together to provide required privacy capabilities and a unified approach to protection. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-17 c | ||
| CCI: | CCI-003298 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | Require the developer of the system, system component, or system to produce, as an integral part of the development process, a formal policy model describing the organization-defined elements of organizational security policy to be enforced. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-17 (1) (a) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-17 (1) (a) | |||
| CCI: | CCI-003299 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | Defines the elements of organizational security policy to be described in the formal policy model for enforcement on the system, system component, or system service. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-17 (1) (a) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-17 (1) (a) | |||
| CCI: | CCI-004842 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Require the developer of the system, system component, or system to produce, as an integral part of the development process, a formal policy model describing the organization-defined elements of organizational privacy policy to be enforced. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-17 (1) (a) | ||
| CCI: | CCI-004843 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the elements of organizational privacy policy to be described in the formal policy model for enforcement on the system, system component, or system service. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-17 (1) (a) | ||
| CCI: | CCI-003300 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | Require the developer of the system, system component, or system service to prove that the formal policy model is internally consistent and sufficient to enforce the defined elements of the organizational security policy when implemented. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-17 (1) (b) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-17 (1) (b) | |||
| CCI: | CCI-004844 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Require the developer of the system, system component, or system service to prove that the formal policy model is internally consistent and sufficient to enforce the defined elements of the organizational privacy policy when implemented. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-17 (1) (b) | ||
| CCI: | CCI-003301 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | Require the developer of the system, system component, or system service to define security-relevant hardware. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-17 (2) (a) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-17 (2) (a) | |||
| CCI: | CCI-003303 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | Require the developer of the system, system component, or system service to define security-relevant software. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-17 (2) (a) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-17 (2) (a) | |||
| CCI: | CCI-003304 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | Require the developer of the system, system component, or system service to define security-relevant firmware. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-17 (2) (a) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-17 (2) (a) | |||
| CCI: | CCI-003305 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | Require the developer of the system, system component, or system service to provide a rationale that the definition for security-relevant hardware is complete. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-17 (2) (a) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-17 (2) (b) | |||
| CCI: | CCI-003306 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | Require the developer of the system, system component, or system service to provide a rationale that the definition for security-relevant software is complete. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-17 (2) (b) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-17 (2) (b) | |||
| CCI: | CCI-003307 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | Require the developer of the system, system component, or system service to provide a rationale that the definition for security-relevant firmware is complete. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-17 (2) (b) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-17 (2) (b) | |||
| CCI: | CCI-003308 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | Require the developer of the system, system component, or system service to produce, as an integral part of the development process, a formal top-level specification that specifies the interfaces to security-relevant hardware in terms of exceptions, error messages, and effects. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-17 (3) (a) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-17 (3) (a) | |||
| CCI: | CCI-003309 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | Require the developer of the system, system component, or system service to produce, as an integral part of the development process, a formal top-level specification that specifies the interfaces to security-relevant software in terms of exceptions, error messages, and effects. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-17 (3) (a) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-17 (3) (a) | |||
| CCI: | CCI-003310 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | Require the developer of the system, system component, or system service to produce, as an integral part of the development process, a formal top-level specification that specifies the interfaces to security-relevant firmware in terms of exceptions, error messages, and effects. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-17 (3) (a) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-17 (3) (a) | |||
| CCI: | CCI-003311 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | Require the developer of the system, system component, or system service to show via proof to the extent feasible with additional informal demonstration as necessary, that the formal top-level specification is consistent with the formal policy model. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-17 (3) (b) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-17 (3) (b) | |||
| CCI: | CCI-003312 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | Require the developer of the system, system component, or system service to show via informal demonstration, that the formal top-level specification completely covers the interfaces to security-relevant hardware. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-17 (3) (c) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-17 (3) (c) | |||
| CCI: | CCI-003313 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | Require the developer of the system, system component, or system service to show via informal demonstration, that the formal top-level specification completely covers the interfaces to security-relevant software. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-17 (3) (c) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-17 (3) (c) | |||
| CCI: | CCI-003314 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | Require the developer of the system, system component, or system service to show via informal demonstration, that the formal top-level specification completely covers the interfaces to security-relevant firmware. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-17 (3) (c) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-17 (3) (c) | |||
| CCI: | CCI-003315 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | Require the developer of the system, system component, or system service to show that the formal top-level specification is an accurate description of the implemented security-relevant hardware. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-17 (3) (d) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-17 (3) (d) | |||
| CCI: | CCI-003316 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | Require the developer of the system, system component, or system service to show that the formal top-level specification is an accurate description of the implemented security-relevant software. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-17 (3) (d) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-17 (3) (d) | |||
| CCI: | CCI-003317 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | Require the developer of the system, system component, or system service to show that the formal top-level specification is an accurate description of the implemented security-relevant firmware. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-17 (3) (d) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-17 (3) (d) | |||
| CCI: | CCI-003318 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | Require the developer of the system, system component, or system service to describe the security-relevant hardware mechanisms not addressed in the formal top-level specification but strictly internal to the security-relevant hardware. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-17 (3) (e) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-17 (3) (e) | |||
| CCI: | CCI-003319 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | Require the developer of the system, system component, or system service to describe the security-relevant software mechanisms not addressed in the formal top-level specification but strictly internal to the security-relevant software. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-17 (3) (e) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-17 (3) (e) | |||
| CCI: | CCI-003320 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | Require the developer of the system, system component, or system service to describe the security-relevant firmware mechanisms not addressed in the formal top-level specification but strictly internal to the security-relevant firmware. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-17 (3) (e) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-17 (3) (e) | |||
| CCI: | CCI-003321 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | Require the developer of the system, system component, or system service to produce, as an integral part of the development process, an informal descriptive top-level specification that specifies the interfaces to security-relevant hardware in terms of exceptions, error messages, and effects. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-17 (4) (a) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-17 (4) (a) | |||
| CCI: | CCI-003322 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | Require the developer of the system, system component, or system service to produce, as an integral part of the development process, an informal descriptive top-level specification that specifies the interfaces to security-relevant software in terms of exceptions, error messages, and effects. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-17 (4) (a) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-17 (4) (a) | |||
| CCI: | CCI-003323 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | Require the developer of the system, system component, or system service to produce, as an integral part of the development process, an informal descriptive top-level specification that specifies the interfaces to security-relevant firmware in terms of exceptions, error messages, and effects. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-17 (4) (a) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-17 (4) (a) | |||
| CCI: | CCI-003324 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | Require the developer of the system, system component, or system service to show via informal demonstration or convincing argument with formal methods as feasible that the descriptive top-level specification is consistent with the formal policy model. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-17 (4) (b) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-17 (4) (b) | |||
| CCI: | CCI-003325 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | Require the developer of the system, system component, or system service to show via informal demonstration, that the descriptive top-level specification completely covers the interfaces to security-relevant hardware. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-17 (4) (c) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-17 (4) (c) | |||
| CCI: | CCI-003326 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | Require the developer of the system, system component, or system service to show via informal demonstration, that the descriptive top-level specification completely covers the interfaces to security-relevant software. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-17 (4) (c) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-17 (4) (c) | |||
| CCI: | CCI-003327 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | Require the developer of the system, system component, or system service to show via informal demonstration, that the descriptive top-level specification completely covers the interfaces to security-relevant firmware. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-17 (4) (c) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-17 (4) (c) | |||
| CCI: | CCI-003328 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | Require the developer of the system, system component, or system service to show that the descriptive top-level specification is an accurate description of the interfaces to security-relevant hardware. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-17 (4) (d) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-17 (4) (d) | |||
| CCI: | CCI-003329 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | Require the developer of the system, system component, or system service to show that the descriptive top-level specification is an accurate description of the interfaces to security-relevant software. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-17 (4) (d) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-17 (4) (d) | |||
| CCI: | CCI-003330 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | Require the developer of the system, system component, or system service to show that the descriptive top-level specification is an accurate description of the interfaces to security-relevant firmware. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-17 (4) (d) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-17 (4) (d) | |||
| CCI: | CCI-003331 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | Require the developer of the system, system component, or system service to describe the security-relevant hardware mechanisms not addressed in the descriptive top-level specification but strictly internal to the security-relevant hardware. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-17 (4) (e) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-17 (4) (e) | |||
| CCI: | CCI-003332 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | Require the developer of the system, system component, or system service to describe the security-relevant software mechanisms not addressed in the descriptive top-level specification but strictly internal to the security-relevant software. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-17 (4) (e) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-17 (4) (e) | |||
| CCI: | CCI-003333 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | Require the developer of the system, system component, or system service to describe the security-relevant firmware mechanisms not addressed in the descriptive top-level specification but strictly internal to the security-relevant firmware. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-17 (4) (e) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-17 (4) (e) | |||
| CCI: | CCI-003334 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | Require the developer of the system, system component, or system service to design and structure the security-relevant hardware to use a complete, conceptually simple protection mechanism with precisely defined semantics. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-17 (5) (a) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-17 (5) (a) | |||
| CCI: | CCI-003335 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | Require the developer of the system, system component, or system service to design and structure the security-relevant software to use a complete, conceptually simple protection mechanism with precisely defined semantics. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-17 (5) (a) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-17 (5) (a) | |||
| CCI: | CCI-003336 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | Require the developer of the system, system component, or system service to design and structure the security-relevant firmware to use a complete, conceptually simple protection mechanism with precisely defined semantics. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-17 (5) (a) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-17 (5) (a) | |||
| CCI: | CCI-003337 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | Require the developer of the system, system component, or system service to internally structure the security-relevant hardware with specific regard for the complete, conceptually simple protection mechanism with precisely defined semantics. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-17 (5) (b) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-17 (5) (b) | |||
| CCI: | CCI-003338 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | Require the developer of the system, system component, or system service to internally structure the security-relevant software with specific regard for the complete, conceptually simple protection mechanism with precisely defined semantics. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-17 (5) (b) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-17 (5) (b) | |||
| CCI: | CCI-003339 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | Require the developer of the system, system component, or system service to internally structure the security-relevant firmware with specific regard for the complete, conceptually simple protection mechanism with precisely defined semantics. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-17 (5) (b) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-17 (5) (b) | |||
| CCI: | CCI-003340 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | Require the developer of the system, component, or system service to structure security-relevant hardware to facilitate testing. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-17 (6) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-17 (6) | |||
| CCI: | CCI-003341 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | Require the developer of the system, component, or system service to structure security-relevant software to facilitate testing. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-17 (6) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-17 (6) | |||
| CCI: | CCI-003342 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | Require the developer of the system, component, or system service to structure security-relevant firmware to facilitate testing. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-17 (6) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-17 (6) | |||
| CCI: | CCI-003343 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | Require the developer of the system, component, or system service to structure security-relevant hardware to facilitate controlling access with least privilege. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-17 (7) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-17 (7) | |||
| CCI: | CCI-003344 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | Require the developer of the system, component, or system service to structure security-relevant software to facilitate controlling access with least privilege. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-17 (7) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-17 (7) | |||
| CCI: | CCI-003345 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | Require the developer of the system, component, or system service to structure security-relevant firmware to facilitate controlling access with least privilege. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-17 (7) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-17 (7) | |||
| CCI: | CCI-004845 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Design organization-defined critical systems or system components with coordinated behavior to implement organization-defined capabilities, by system or component. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-17 (8) | ||
| CCI: | CCI-004846 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the critical systems or system components for implementing organization-defined capabilities, by system or component. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-17 (8) | ||
| CCI: | CCI-004847 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the capabilities, by system or component, for designing organization-defined critical systems or system components. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-17 (8) | ||
| CCI: | CCI-004848 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Use different designs for organization-defined critical systems or system components to satisfy a common set of requirements or to provide equivalent functionality. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-17 (9) | ||
| CCI: | CCI-004849 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the critical systems or system components for satisfying a common set of requirements or to provide equivalent functionality. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-17 (9) | ||
| CCI: | CCI-003386 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | Defines the critical system components to re-implement or custom develop. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-20 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-20 | |||
| CCI: | CCI-003387 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | Re-implement or custom develops organization-defined critical system components. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-20 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-20 | |||
| CCI: | CCI-003384 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | Defines the system, system component, or system service which requires the system developer to have appropriate access authorizations, satisfy additional personnel screening criteria, and provide information that the access authorizations and screening criteria are satisfied. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-21 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-21 | |||
| CCI: | CCI-003383 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | Defines the official government duties to be assigned to the developer of an organization-defined system, system component, or system service. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-21 a | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-21 a | |||
| CCI: | CCI-003385 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | Require that the developer of an organization-defined system, system component, or system service has appropriate access authorizations as determined by assigned organization-defined official government duties. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-21 a | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-21 a | |||
| CCI: | CCI-003381 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | Defines additional personnel screening criteria that must be satisfied by the developer of an organization-defined system, system component, or system service. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-21 b | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-21 b | |||
| CCI: | CCI-003382 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | Require that the developer of an organization-defined system, system component, or system service satisfies organization-defined additional personnel screening criteria. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-21 b | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-21 b | |||
| CCI: | CCI-003376 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | Replace system components when support for the components is no longer available from the developer, vendor, or manufacturer. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-22 a | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-22 a | |||
| CCI: | CCI-003372 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | Define the support from external providers to be provided for alternative sources for continued support for unsupported system components. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-22 (1) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-22 b | |||
| CCI: | CCI-003373 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | Provide in-house support and/or organization-defined support from external providers for alternative sources for continued support for unsupported components. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-22 (1) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SA-22 b | |||
| CCI: | CCI-004850 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Employ design; modification; augmentation; and/or reconfiguration on organization-defined systems or system components supporting mission essential services or functions to increase the trustworthiness in those systems or components. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-23 | ||
| CCI: | CCI-004851 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the systems or system components for supporting mission essential services or functions. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SA-23 | ||
| CCI: | CCI-001075 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Disseminates to organization-defined personnel or roles the organization-level; mission/business process-level; and/or system-level system and communications protection policy. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SC-1 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SC-1 a 1 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-1 a 1 | |||
| NIST: NIST SP 800-53A (v1): SC-1.1 (iii) | |||
| CCI: | CCI-001079 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Disseminates to organization-defined personnel or roles the procedures to facilitate the implementation of the system and communications protection policy and associated system and communications protection controls. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SC-1 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SC-1 a 2 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-1 a 2 | |||
| NIST: NIST SP 800-53A (v1): SC-1.1 (vi) | |||
| CCI: | CCI-002378 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Defines the personnel or roles to be recipients of the organization-level; mission/business process-level; and/or system-level system and communications protection policy. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-1 a 1 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-1 a 1 | |||
| CCI: | CCI-002380 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Defines the personnel or roles to be recipients of the procedures to facilitate the implementation of the system and communications protection policy and associated system and communications protection controls. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-1 a 2 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-1 a 2 | |||
| CCI: | CCI-004852 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Develop and document an organization-level; mission/business process-level; and/or system-level system and communications protection policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SC-1 a 1 (a) | ||
| CCI: | CCI-004853 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Develop and document an organization-level; mission/business process-level; and/or system-level a system and communications protection policy that is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SC-1 a 1 (b) | ||
| CCI: | CCI-004854 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Develop and document system and communications protection procedures to facilitate the implementation of the system and communications protection policy and associated system and communications protection controls. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SC-1 a 2 | ||
| CCI: | CCI-004855 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Designate an organization-defined official to manage the development and documentation of the system and communications protection policy. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SC-1 b | ||
| CCI: | CCI-004856 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Designate an organization-defined official to manage the development and documentation of the system and communications protection procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SC-1 b | ||
| CCI: | CCI-004857 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Designate an organization-defined official to manage the dissemination of the system and communications protection policy. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SC-1 b | ||
| CCI: | CCI-004858 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Designate an organization-defined official to manage the dissemination of the system and communications protection procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SC-1 b | ||
| CCI: | CCI-004859 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the official to manage the development, documentation, and dissemination of the system and communications protection policy. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SC-1 b | ||
| CCI: | CCI-004860 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the official to manage the development, documentation, and dissemination of the system and communications protection procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SC-1 b | ||
| CCI: | CCI-001076 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Review and update the current system and communications protection policy in accordance with organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SC-1 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SC-1 b 1 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-1 c 1 | |||
| NIST: NIST SP 800-53A (v1): SC-1.2 (ii) | |||
| CCI: | CCI-001077 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Defines the frequency for reviewing and updating the current system and communications protection policy. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SC-1 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SC-1 b 1 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-1 c 1 | |||
| NIST: NIST SP 800-53A (v1): SC-1.2 (i) | |||
| CCI: | CCI-001080 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Review and update the current system and communications protection procedures in accordance with organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SC-1 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SC-1 b 2 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-1 c 2 | |||
| NIST: NIST SP 800-53A (v1): SC-1.2 (iv) | |||
| CCI: | CCI-001081 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Defines the frequency for reviewing and updating the current system and communications protection procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SC-1 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SC-1 b 2 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-1 c 2 | |||
| NIST: NIST SP 800-53A (v1): SC-1.2 (iii) | |||
| CCI: | CCI-004861 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Review and update the current system and communications protection policy following organization-defined events. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SC-1 c 1 | ||
| CCI: | CCI-004862 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the events following reviewing and updating the current system and communications protection policy. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SC-1 c 1 | ||
| CCI: | CCI-004863 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Review and update the current system and communications protection procedures following organization-defined events. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SC-1 c 2 | ||
| CCI: | CCI-004864 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the events following reviewing and updating the current system and communications protection procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SC-1 c 2 | ||
| CCI: | CCI-001082 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Separate user functionality, including user interface services, from system management functionality. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): SC-2 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SC-2 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-2 | |||
| NIST: NIST SP 800-53A (v1): SC-2.1 | |||
| CCI: | CCI-001083 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Prevent the presentation of system management functionality at an interface for non-privileged users. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): SC-2 (1) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SC-2 (1) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-2 (1) | |||
| NIST: NIST SP 800-53A (v1): SC-2 (1).1 | |||
| CCI: | CCI-004865 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Store state information from applications and software separately. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SC-2 (2) | ||
| CCI: | CCI-001084 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Isolate security functions from nonsecurity functions. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): SC-3 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SC-3 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-3 | |||
| NIST: NIST SP 800-53A (v1): SC-3.1 (ii) | |||
| CCI: | CCI-001085 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Employ hardware separation mechanisms to implement security function isolation. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): SC-3 (1) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SC-3 (1) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-3 (1) | |||
| NIST: NIST SP 800-53A (v1): SC-3 (1).1 | |||
| CCI: | CCI-001086 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Isolate security functions enforcing access and information flow control from both nonsecurity functions and from other security functions. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): SC-3 (2) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SC-3 (2) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-3 (2) | |||
| NIST: NIST SP 800-53A (v1): SC-3 (2).1 | |||
| CCI: | CCI-002381 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Minimize the number of nonsecurity functions included within the isolation boundary containing security functions. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-3 (3) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-3 (3) | |||
| CCI: | CCI-002382 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Implement security functions as largely independent modules that maximize internal cohesiveness within modules and minimize coupling between modules. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-3 (4) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-3 (4) | |||
| CCI: | CCI-001089 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Implement security functions as a layered structure minimizing interactions between layers of the design and avoiding any dependence by lower layers on the functionality or correctness of higher layers. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): SC-3 (5) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SC-3 (5) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-3 (5) | |||
| NIST: NIST SP 800-53A (v1): SC-3 (5).1 | |||
| CCI: | CCI-001090 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Prevent unauthorized and unintended information transfer via shared system resources. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): SC-4 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SC-4 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-4 | |||
| NIST: NIST SP 800-53A (v1): SC-4.1 | |||
| CCI: | CCI-002383 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Defines the procedures to be employed to prevent unauthorized information transfer via shared resources when system processing explicitly switches between different information classification levels or security categories. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-4 (2) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-4 (2) | |||
| CCI: | CCI-002384 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Prevent unauthorized information transfer via shared resources in accordance with organization-defined procedures when system processing explicitly switches between different information classification levels or security categories. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-4 (2) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-4 (2) | |||
| CCI: | CCI-001093 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Defines the types of denial-of-service events for protecting against or limiting the effects of the denial-of-service events. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SC-5 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SC-5 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-5 a | |||
| NIST: NIST SP 800-53A (v1): SC-5.1 (i) | |||
| CCI: | CCI-002385 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Protect against or limit the effects of organization-defined types of denial-of-service events. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-5 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-5 a | |||
| CCI: | CCI-004866 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Employ organization-defined controls by type of denial-of-service to achieve the denial-of-service objective. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SC-5 b | ||
| CCI: | CCI-004867 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the controls by type of denial-of-service event by employing the controls to achieve the denial-of-service objective. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SC-5 b | ||
| CCI: | CCI-001094 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Restrict the ability of individuals to launch organization-defined denial of service attacks against other systems. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): SC-5 (1) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SC-5 (1) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-5 (1) | |||
| NIST: NIST SP 800-53A (v1): SC-5 (1).1 | |||
| CCI: | CCI-002387 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Defines the denial of service attacks against other systems that the system is to restrict the ability of individuals to launch. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-5 (1) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-5 (1) | |||
| CCI: | CCI-001095 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Manage capacity, bandwidth, or other redundancy to limit the effects of information flooding types of denial-of-service attacks. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): SC-5 (2) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SC-5 (2) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-5 (2) | |||
| NIST: NIST SP 800-53A (v1): SC-5 (2).1 | |||
| CCI: | CCI-002388 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Defines the monitoring tools to be employed to detect indicators of denial-of-service attacks against the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-5 (3) (a) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-5 (3) (a) | |||
| CCI: | CCI-002389 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Employ organization-defined monitoring tools to detect indicators of denial-of-service attacks against, or launched from, the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-5 (3) (a) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-5 (3) (a) | |||
| CCI: | CCI-002390 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Defines the system resources to be monitored to determine if sufficient resources exist to prevent effective denial-of-service attacks. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-5 (3) (b) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-5 (3) (b) | |||
| CCI: | CCI-002391 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Monitor organization-defined system resources to determine if sufficient resources exist to prevent effective denial-of-service attacks. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-5 (3) (b) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-5 (3) (b) | |||
| CCI: | CCI-002392 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Defines the resources to be allocated to protect the availability of system resources. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-6 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-6 | |||
| CCI: | CCI-002393 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Defines the controls to be employed to protect the availability of system resources. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-6 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-6 | |||
| CCI: | CCI-002394 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Protect the availability of resources by allocating organization-defined resources based on priority, quota, and/or organization-defined controls. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-6 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-6 | |||
| CCI: | CCI-001097 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Monitor and control communications at the external managed interfaces to the system and at key managed interfaces within the system. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 (v3): SC-7 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SC-7 a | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-7 a | |||
| NIST: NIST SP 800-53A (v1): SC-7.1 (iii) | |||
| CCI: | CCI-002395 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Implement subnetworks for publicly accessible system components that are physically and/or logically separated from internal organizational networks. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-7 b | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-7 b | |||
| CCI: | CCI-001098 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Connect to external networks or systems only through managed interfaces consisting of boundary protection devices arranged in accordance with an organizational security architecture. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SC-7 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SC-7 c | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-7 c | |||
| NIST: NIST SP 800-53A (v1): SC-7.1 (iv) | |||
| CCI: | CCI-004868 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Connect to external networks or systems only through managed interfaces consisting of boundary protection devices arranged in accordance with an organizational privacy architecture. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SC-7 c | ||
| CCI: | CCI-001101 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Limit the number of external network connections to the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SC-7 (3) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SC-7 (3) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (3) | |||
| NIST: NIST SP 800-53A (v1): SC-7 (3).1 | |||
| CCI: | CCI-001102 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Implement a managed interface for each external telecommunication service. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SC-7 (4) (a) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SC-7 (4) (a) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (4) (a) | |||
| NIST: NIST SP 800-53A (v1): SC-7 (4).1 (ii) | |||
| CCI: | CCI-001103 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Establish a traffic flow policy for each managed interface for each external telecommunication service. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SC-7 (4) (b) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SC-7 (4) (b) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (4) (b) | |||
| NIST: NIST SP 800-53A (v1): SC-7 (4).1 (iii) | |||
| CCI: | CCI-002396 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Protect the confidentiality and integrity of the information being transmitted across each interface for each external telecommunication service. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-7 (4) (c) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (4) (c) | |||
| CCI: | CCI-001105 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Document each exception to the traffic flow policy with a supporting mission or business need and duration of that need. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SC-7 (4) (d) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SC-7 (4) (d) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (4) (d) | |||
| NIST: NIST SP 800-53A (v1): SC-7 (4).1 (v) | |||
| CCI: | CCI-001106 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Review exceptions to the traffic flow policy on an organization-defined frequency for each external telecommunication service. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SC-7 (4) (e) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SC-7 (4) (e) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (4) (e) | |||
| NIST: NIST SP 800-53A (v1): SC-7 (4).1 (vi) | |||
| CCI: | CCI-001107 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Defines a frequency for the review of exceptions to the traffic flow policy for each external telecommunication service. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SC-7 (4) (e) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SC-7 (4) (e) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (4) (e) | |||
| NIST: NIST SP 800-53A (v1): SC-7 (4).1 (i) | |||
| CCI: | CCI-001108 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Remove traffic flow policy exceptions that are no longer supported by an explicit mission or business need for each external telecommunication service. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SC-7 (4) (f) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SC-7 (4) (e) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (4) (e) | |||
| NIST: NIST SP 800-53A (v1): SC-7 (4).1 (vii) | |||
| CCI: | CCI-004869 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Prevent unauthorized exchange of control plane traffic with external networks. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (4) (f) | ||
| CCI: | CCI-004870 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Publish information to enable remote networks to detect unauthorized control plane traffic from internal networks. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (4) (g) | ||
| CCI: | CCI-004871 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Filter unauthorized control plane traffic from external networks. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (4) (h) | ||
| CCI: | CCI-001109 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Deny network communications traffic by default and allow network communications traffic by exception at managed interfaces; and/or for organization-defined systems. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): SC-7 (5) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SC-7 (5) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (5) | |||
| NIST: NIST SP 800-53A (v1): SC-7 (5).1 (i) (ii) | |||
| CCI: | CCI-004872 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the systems that will deny network communications traffic by default and allow network communications traffic by exception. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (5) | ||
| CCI: | CCI-002397 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Prevent split tunneling for remote devices connecting to organizational systems unless the split tunnel is securely provisioned using organization-defined safeguards. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-7 (7) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (7) | |||
| CCI: | CCI-004873 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the safeguards to prevent split tunneling for remote devices connecting to organizational systems. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (7) | ||
| CCI: | CCI-001112 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Route organization-defined internal communications traffic to organization-defined external networks through authenticated proxy servers at managed interfaces. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SC-7 (8) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SC-7 (8) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (8) | |||
| NIST: NIST SP 800-53A (v1): SC-7 (8).1 (iii) | |||
| CCI: | CCI-001113 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Defines the internal communications traffic to be routed to external networks. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SC-7 (8) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SC-7 (8) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (8) | |||
| NIST: NIST SP 800-53A (v1): SC-7 (8).1 (i) | |||
| CCI: | CCI-001114 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Defines the external networks to which organization-defined internal communications traffic should be routed. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SC-7 (8) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SC-7 (8) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (8) | |||
| NIST: NIST SP 800-53A (v1): SC-7 (8).1 (ii) | |||
| CCI: | CCI-002398 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Detect outgoing communications traffic posing a threat to external systems. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-7 (9) (a) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (9) (a) | |||
| CCI: | CCI-002399 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Deny outgoing communications traffic posing a threat to external systems. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-7 (9) (a) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (9) (a) | |||
| CCI: | CCI-002400 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Audit the identity of internal users associated with denied outgoing communications traffic posing a threat to external systems. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-7 (9) (b) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (9) (b) | |||
| CCI: | CCI-001116 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Prevent the exfiltration of information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SC-7 (10) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SC-7 (10) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (10) (a) | |||
| NIST: NIST SP 800-53A (v1): SC-7 (10).1 | |||
| CCI: | CCI-004874 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Conduct exfiltration tests at an organization-defined frequency. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (10) (b) | ||
| CCI: | CCI-004875 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the frequency to conduct exfiltration tests. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (10) (b) | ||
| CCI: | CCI-002401 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Defines the authorized sources from which the system will allow incoming communications. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-7 (11) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (11) | |||
| CCI: | CCI-002402 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Defines the authorized destinations for routing inbound communications. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-7 (11) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (11) | |||
| CCI: | CCI-002403 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Only allow incoming communications from organization-defined authorized sources routed to organization-defined authorized destinations. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-7 (11) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (11) | |||
| CCI: | CCI-002404 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Defines the host-based boundary protection mechanisms that are to be implemented at organization-defined system components. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-7 (12) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (12) | |||
| CCI: | CCI-002405 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Defines the system components at which organization-defined host-based boundary protection mechanisms will be implemented. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-7 (12) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (12) | |||
| CCI: | CCI-002406 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Implement organization-defined host-based boundary protection mechanisms at organization-defined system components. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-7 (12) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (12) | |||
| CCI: | CCI-001119 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Isolate organization-defined information security tools, mechanisms, and support components from other internal system components by implementing physically separate subnetworks with managed interfaces to other components of the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SC-7 (13) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SC-7 (13) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (13) | |||
| NIST: NIST SP 800-53A (v1): SC-7 (13).1 (ii) | |||
| CCI: | CCI-001120 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Defines the information security tools, mechanisms, and support components to be isolated. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SC-7 (13) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SC-7 (13) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (13) | |||
| NIST: NIST SP 800-53A (v1): SC-7 (13).1 (iii) | |||
| CCI: | CCI-001121 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Protect against unauthorized physical connections at organization-defined managed interfaces. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SC-7 (14) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SC-7 (14) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (14) | |||
| NIST: NIST SP 800-53A (v1): SC-7 (14).1 (iii) | |||
| CCI: | CCI-002407 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Defines the managed interfaces at which protect against unauthorized physical connections. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-7 (14) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (14) | |||
| CCI: | CCI-001123 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Route networked, privileged accesses through a dedicated, managed interface for purposes of access control and auditing. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 (v3): SC-7 (15) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SC-7 (15) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (15) | |||
| NIST: NIST SP 800-53A (v1): SC-7 (15).1 (i) (ii) | |||
| CCI: | CCI-001124 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Prevent discovery of specific system components that represent a managed interface. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): SC-7 (16) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SC-7 (16) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (16) | |||
| NIST: NIST SP 800-53A (v1): SC-7 (16).1 | |||
| CCI: | CCI-001125 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Enforce adherence to protocol formats. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): SC-7 (17) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SC-7 (17) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (17) | |||
| NIST: NIST SP 800-53A (v1): SC-7 (17).1 | |||
| CCI: | CCI-001126 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Prevent systems from entering unsecure states in the event of an operational failure of a boundary protection device. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): SC-7 (18) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SC-7 (18) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (18) | |||
| NIST: NIST SP 800-53A (v1): SC-7 (18) | |||
| CCI: | CCI-002408 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Defines the communication clients that are independently configured by end users and external service providers which will block both inbound and outbound communications traffic. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-7 (19) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (19) | |||
| CCI: | CCI-002409 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Block inbound and outbound communications traffic between organization-defined communication clients that are independently configured by end users and external service providers. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-7 (19) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (19) | |||
| CCI: | CCI-002410 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Defines system components that are to be dynamically isolated from other system components. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-7 (20) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (20) | |||
| CCI: | CCI-002411 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Provide the capability to dynamically isolate organization-defined system components from other system components. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-7 (20) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (20) | |||
| CCI: | CCI-002413 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Defines the system components supporting organization-defined missions and/or business functions that are to be isolated using boundary protection mechanisms. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-7 (21) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (21) | |||
| CCI: | CCI-002414 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Defines the missions and/or business functions for which boundary protection mechanisms will be employed to isolate the supporting organization-defined system components. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-7 (21) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (21) | |||
| CCI: | CCI-002415 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Employ boundary protection mechanisms to isolate organization-defined system components supporting organization-defined missions and/or business functions. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-7 (21) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (21) | |||
| CCI: | CCI-002416 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Implement separate network addresses to connect to systems in different security domains. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-7 (22) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (22) | |||
| CCI: | CCI-002417 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Disable feedback to senders on protocol format validation failure. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-7 (23) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (23) | |||
| CCI: | CCI-004876 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | For systems that process personally identifiable information, apply organization-defined processing rules to data elements of personally identifiable information. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (24) (a) | ||
| CCI: | CCI-004877 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines processing rules to be applied to data elements of personally identifiable information. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (24) (a) | ||
| CCI: | CCI-004878 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | For systems that process personally identifiable information, monitor for permitted processing at the external boundary of the system and at key internal boundaries within the system. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (24) (b) | ||
| CCI: | CCI-004879 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | For systems that process personally identifiable information, document each processing exception. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (24) (c) | ||
| CCI: | CCI-004880 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | For systems that process personally identifiable information, review and remove exceptions that are no longer supported. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (24) (d) | ||
| CCI: | CCI-004881 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Prohibit the direct connection of organization-defined unclassified national security system to an external network without the use of organization-defined boundary protection device. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (25) | ||
| CCI: | CCI-004882 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the unclassified national security system that is prohibited from connecting to an external network without the use of organization-defined boundary protection device. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (25) | ||
| CCI: | CCI-004883 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the boundary protection device that prohibits the direct connection of organization-defined unclassified national security system to an external system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (25) | ||
| CCI: | CCI-004884 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Prohibit the direct connection of a classified national security system to an external network without the use of organization-defined boundary protection device. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (26) | ||
| CCI: | CCI-004885 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the boundary protection device that prohibits the direct connection of a classified national security system to an external system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (26) | ||
| CCI: | CCI-004886 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Prohibit the direct connection of organization-defined unclassified non-national security system to an external network without the use of organization-defined boundary protection device. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (27) | ||
| CCI: | CCI-004887 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the unclassified non-national security system that is prohibited from connecting to an external network without the use of organization-defined boundary protection device. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (27) | ||
| CCI: | CCI-004888 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the boundary protection device that prohibits the direct connection of organization-defined unclassified non-national security system to an external system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (27) | ||
| CCI: | CCI-004889 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Prohibit the direct connection of organization-defined system to a public network. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (28) | ||
| CCI: | CCI-004890 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the system that prohibits the direct connection to a public network. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (28) | ||
| CCI: | CCI-004891 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Implement physically or logically separate subnetworks to isolate organization-defined critical system components and functions. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (29) | ||
| CCI: | CCI-004892 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the critical system components to implement physically or logically separate subnetworks. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SC-7 (29) | ||
| CCI: | CCI-002418 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Protect the confidentiality and/or integrity of transmitted information. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-8 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-8 | |||
| CCI: | CCI-002421 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Implement cryptographic mechanisms to prevent unauthorized disclosure of information and/or detect changes to information during transmission. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-8 (1) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-8 (1) | |||
| CCI: | CCI-002420 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Maintain the confidentiality and/or integrity of information during preparation for transmission. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-8 (2) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-8 (2) | |||
| CCI: | CCI-002422 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Maintain the confidentiality and/or integrity of information during reception. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-8 (2) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-8 (2) | |||
| CCI: | CCI-002423 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Implement cryptographic mechanisms to protect message externals unless otherwise protected by organization-defined alternative physical controls. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-8 (3) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-8 (3) | |||
| CCI: | CCI-002427 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Defines the alternative physical controls to be employed to protect message externals when cryptographic mechanisms are not implemented. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-8 (3) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-8 (3) | |||
| CCI: | CCI-002424 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Defines the alternative physical controls to be employed when cryptographic mechanisms to conceal or randomize communication patterns are not implemented. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-8 (4) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-8 (4) | |||
| CCI: | CCI-002425 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Implement cryptographic mechanisms to conceal or randomize communication patterns unless otherwise protected by organization-defined alternative physical controls. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-8 (4) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-8 (4) | |||
| CCI: | CCI-004893 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Implement organization-defined protection distribution system to prevent unauthorized disclosure of information, and/or detect changes to information during transmission. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SC-8 (5) | ||
| CCI: | CCI-004894 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the protected distribution system for preventing unauthorized disclosure of information, and/or detect changes to information during transmission. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SC-8 (5) | ||
| CCI: | CCI-001133 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Terminate the network connection associated with a communications session at the end of the session or after an organization-defined time period of inactivity. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): SC-10 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SC-10 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-10 | |||
| NIST: NIST SP 800-53A (v1): SC-10.1 (ii) | |||
| CCI: | CCI-001134 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Defines the time period of inactivity after which the system terminates a network connection associated with a communications session. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SC-10 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SC-10 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-10 | |||
| NIST: NIST SP 800-53A (v1): SC-10.1 (i) | |||
| CCI: | CCI-001135 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Provide a physically or logically isolated trusted communication path for communication between the user and the trusted components of the system. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 (v3): SC-11 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SC-11 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-11 a | |||
| NIST: NIST SP 800-53A (v1): SC-11.1 (iii) | |||
| CCI: | CCI-001661 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-12 |
| Definition: | Defines the security functions, to at a minimum, include system authentication and re-authentication, for permitting users to invoke the trusted communications path. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SC-11 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SC-11 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-11 b | |||
| NIST: NIST SP 800-53A (v1): SC-11.1 (i) | |||
| CCI: | CCI-004895 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Permit users to invoke the trusted communications path for communications between the user and the organization-defined security functions, including at a minimum, authentication and re-authentication. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SC-11 b | ||
| CCI: | CCI-002426 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Provide a trusted communications path that is irrefutably distinguishable from other communications paths. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-11 (1) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-11 (1) (a) | |||
| CCI: | CCI-004896 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Initiates the trusted communications path for communications between the organization-defined security functions of the system and the user. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SC-11 (1) (b) | ||
| CCI: | CCI-004897 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the security functions to be initiated between the system and the user for trusted communications path for communications. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SC-11 (1) (b) | ||
| CCI: | CCI-002428 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Defines the requirements for cryptographic key generation to be employed within the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-12 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-12 | |||
| CCI: | CCI-002429 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Defines the requirements for cryptographic key distribution to be employed within the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-12 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-12 | |||
| CCI: | CCI-002430 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Defines the requirements for cryptographic key storage to be employed within the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-12 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-12 | |||
| CCI: | CCI-002431 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Defines the requirements for cryptographic key access to be employed within the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-12 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-12 | |||
| CCI: | CCI-002432 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Defines the requirements for cryptographic key destruction to be employed within the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-12 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-12 | |||
| CCI: | CCI-002433 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Establish cryptographic keys when cryptography is employed within the system in accordance with organization-defined requirements for key generation. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-12 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-12 | |||
| CCI: | CCI-002434 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Establish cryptographic keys when cryptography employed within the system in accordance with organization-defined requirements for key distribution. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-12 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-12 | |||
| CCI: | CCI-002435 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Establish cryptographic keys when cryptography employed within the system in accordance with organization-defined requirements for key storage. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-12 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-12 | |||
| CCI: | CCI-002436 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Establish cryptographic keys when cryptography employed within the system in accordance with organization-defined requirements for key access. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-12 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-12 | |||
| CCI: | CCI-002437 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Establish cryptographic keys when cryptography employed within the system in accordance with organization-defined requirements for key destruction. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-12 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-12 | |||
| CCI: | CCI-002438 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Manage cryptographic keys when cryptography employed within the system in accordance with organization-defined requirements for key generation. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-12 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-12 | |||
| CCI: | CCI-002439 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Manage cryptographic keys when cryptography employed within the system in accordance with organization-defined requirements for key distribution. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-12 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-12 | |||
| CCI: | CCI-002440 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Manage cryptographic keys when cryptography employed within the system in accordance with organization-defined requirements for key storage. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-12 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-12 | |||
| CCI: | CCI-002441 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Manage cryptographic keys when cryptography employed within the system in accordance with organization-defined requirements for key access. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-12 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-12 | |||
| CCI: | CCI-002442 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Manage cryptographic keys when cryptography employed within the system in accordance with organization-defined requirements for key destruction. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-12 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-12 | |||
| CCI: | CCI-001139 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Maintain availability of information in the event of the loss of cryptographic keys by users. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SC-12 (1) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SC-12 (1) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-12 (1) | |||
| NIST: NIST SP 800-53A (v1): SC-12 (1).1 | |||
| CCI: | CCI-002443 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Produce symmetric cryptographic keys using NIST FIPS-validated or NSA-approved key management technology and processes. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-12 (2) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-12 (2) | |||
| CCI: | CCI-002444 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Control symmetric cryptographic keys using NIST FIPS-validated or NSA-approved key management technology and processes. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-12 (2) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-12 (2) | |||
| CCI: | CCI-002445 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Distribute symmetric cryptographic keys using NIST FIPS-validated or NSA-approved key management technology and processes. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-12 (2) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-12 (2) | |||
| CCI: | CCI-002446 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Produce asymmetric cryptographic keys using: NSA-approved key management technology and processes; prepositioned keying material; DoD-approved or DoD-issued Medium Assurance PKI certificates; DoD-approved or DoD-issued Medium Hardware Assurance PKI certificates and hardware security tokens that protect the user's private key; or certificates issued in accordance with organization-defined requirements. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-12 (3) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-12 (3) | |||
| CCI: | CCI-002447 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Control asymmetric cryptographic keys using: NSA-approved key management technology and processes; prepositioned keying material; DoD-approved or DoD-issued Medium Assurance PKI certificates; DoD-approved or DoD-issued Medium Hardware Assurance PKI certificates and hardware security tokens that protect the user's private key; or certificates issued in accordance with organization-defined requirements. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-12 (3) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-12 (3) | |||
| CCI: | CCI-002448 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Distribute asymmetric cryptographic keys using: NSA-approved key management technology and processes; prepositioned keying material; DoD-approved or DoD-issued Medium Assurance PKI certificates; DoD-approved or DoD-issued Medium Hardware Assurance PKI certificates and hardware security tokens that protect the user's private key; or certificates issued in accordance with organization-defined requirements. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-12 (3) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-12 (3) | |||
| CCI: | CCI-004898 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines requirements for certificates that are issued for producing, controlling, and distributing asymmetric cryptographic keys. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SC-12 (3) | ||
| CCI: | CCI-004899 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Maintain physical control of cryptographic keys when store information is encrypted by external service providers. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SC-12 (6) | ||
| CCI: | CCI-002449 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Defines the cryptographic uses, and type of cryptography required for each use, to be implemented by the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-13 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-13 | |||
| CCI: | CCI-004900 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Determine the organization-defined cryptographic uses. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SC-13 a | ||
| CCI: | CCI-002450 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Implement organization-defined types of cryptography for each specified cryptography use. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-13 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-13 b | |||
| CCI: | CCI-001150 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Prohibit remote activation of collaborative computing devices and applications, excluding the organization-defined exceptions where remote activation is to be allowed. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): SC-15 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SC-15 a | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-15 a | |||
| NIST: NIST SP 800-53A (v1): SC-15.1 (ii) | |||
| CCI: | CCI-001151 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Defines exceptions to the prohibition of collaborative computing devices where remote activation is to be allowed. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SC-15 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SC-15 a | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-15 a | |||
| NIST: NIST SP 800-53A (v1): SC-15.1 (i) | |||
| CCI: | CCI-001152 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Provide an explicit indication of use to users physically present at collaborative computing devices. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): SC-15 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SC-15 b | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-15 b | |||
| NIST: NIST SP 800-53A (v1): SC-15.1 (iii) | |||
| CCI: | CCI-001153 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Provide physical or logical disconnect of collaborative computing devices in a manner that supports ease of use. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): SC-15 (1) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SC-15 (1) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-15 (1) | |||
| NIST: NIST SP 800-53A (v1): SC-15 (1).1 | |||
| CCI: | CCI-001155 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Disable or remove collaborative computing devices and applications from organization-defined systems or system components in organization-defined secure work areas. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SC-15 (3) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SC-15 (3) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-15 (3) | |||
| NIST: NIST SP 800-53A (v1): SC-15 (3).1 (ii) | |||
| CCI: | CCI-001156 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Defines secure work areas where collaborative computing devices and applications are to be disabled or removed. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SC-15 (3) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SC-15 (3) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-15 (3) | |||
| NIST: NIST SP 800-53A (v1): SC-15 (3).1 (i) | |||
| CCI: | CCI-002451 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Defines the systems or system components from which collaborative computing devices and applications in organization-defined secure work areas are to be disabled or removed. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-15 (3) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-15 (3) | |||
| CCI: | CCI-002452 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Defines the online meetings and teleconferences for which the system provides an explicit indication of current participants. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-15 (4) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-15 (4) | |||
| CCI: | CCI-002453 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Provide an explicit indication of current participants in organization-defined online meetings and teleconferences. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-15 (4) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-15 (4) | |||
| CCI: | CCI-001157 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Associate organization-defined security attributes with information exchanged between systems. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 (v3): SC-16 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SC-16 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-16 | |||
| NIST: NIST SP 800-53A (v1): SC-16.1 | |||
| CCI: | CCI-002454 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Defines the security attributes to associate with the information being exchanged between systems and between system components. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-16 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-16 | |||
| CCI: | CCI-002455 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Associate organization-defined security attributes with information exchanged between system components. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-16 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-16 | |||
| CCI: | CCI-004901 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Associate organization-defined privacy attributes with information exchanged between systems. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SC-16 | ||
| CCI: | CCI-004902 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Associate organization-defined privacy attributes with information exchanged between system components. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SC-16 | ||
| CCI: | CCI-004903 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the privacy attributes to associate with the information being exchanged between systems and between system components. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SC-16 | ||
| CCI: | CCI-001158 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Verify the integrity of transmitted security attributes. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): SC-16 (1) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SC-16 (1) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-16 (1) | |||
| NIST: NIST SP 800-53A (v1): SC-16 (1).1 | |||
| CCI: | CCI-004904 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Verify the integrity of transmitted privacy attributes. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SC-16 (1) | ||
| CCI: | CCI-004905 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Implement anti-spoofing mechanisms to prevent adversaries from falsifying the security attributes indicating the successful application of the security process. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SC-16 (2) | ||
| CCI: | CCI-004906 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Implement organization-defined mechanisms or techniques to bind security attributes to transmitted information. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SC-16 (3) | ||
| CCI: | CCI-004907 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Implement organization-defined mechanisms or techniques to bind privacy attributes to transmitted information. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SC-16 (3) | ||
| CCI: | CCI-004908 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the mechanisms or techniques for binding security and privacy attributes to transmitted information. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SC-16 (3) | ||
| CCI: | CCI-001159 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Issue public key certificates under an organization-defined certificate policy or obtain public key certificates from an approved service provider. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SC-17 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SC-17 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-17 a | |||
| NIST: NIST SP 800-53A (v1): SC-17.1 | |||
| CCI: | CCI-002456 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Defines the certificate policy employed to issue public key certificates. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-17 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-17 a | |||
| CCI: | CCI-004909 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Include only approved trust anchors in trust stores or certificate stores managed by the organization. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SC-17 b | ||
| CCI: | CCI-001160 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Defines acceptable and unacceptable mobile code and mobile code technologies. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SC-18 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SC-18 a | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-18 a | |||
| NIST: NIST SP 800-53A (v1): SC-18.1 (i) | |||
| CCI: | CCI-001163 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Authorize the use of mobile code within the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SC-18 c | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SC-18 c | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-18 b | |||
| NIST: NIST SP 800-53A (v1): SC-18.1 (iii) | |||
| CCI: | CCI-001164 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Monitor the use of mobile code within the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SC-18 c | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SC-18 c | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-18 b | |||
| NIST: NIST SP 800-53A (v1): SC-18.1 (iii) | |||
| CCI: | CCI-001165 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Control the use of mobile code within the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SC-18 c | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SC-18 c | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-18 b | |||
| NIST: NIST SP 800-53A (v1): SC-18.1 (iii) | |||
| CCI: | CCI-001166 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Identify organization-defined unacceptable mobile code. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): SC-18 (1) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SC-18 (1) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-18 (1) | |||
| NIST: NIST SP 800-53A (v1): SC-18 (1).1 (i) | |||
| CCI: | CCI-001662 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-12 |
| Definition: | Take organization-defined corrective action when organization-defined unacceptable mobile code is identified. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): SC-18 (1) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SC-18 (1) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-18 (1) | |||
| NIST: NIST SP 800-53A (v1): SC-18 (1).1 (ii) | |||
| CCI: | CCI-002457 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Defines the corrective actions to be taken when organization-defined unacceptable mobile code is identified. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-18 (1) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-18 (1) | |||
| CCI: | CCI-002458 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Defines what constitutes unacceptable mobile code by using corrective actions. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-18 (1) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-18 (1) | |||
| CCI: | CCI-001167 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Verify that the development of mobile code to be deployed in information systems meets organization-defined mobile code requirements. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SC-18 (2) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SC-18 (2) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-18 (2) | |||
| NIST: NIST SP 800-53A (v1): SC-18 (2).1 (ii) | |||
| CCI: | CCI-001168 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Defines mobile code requirements for the acquisition, development, and use of mobile code. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SC-18 (2) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SC-18 (2) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-18 (2) | |||
| NIST: NIST SP 800-53A (v1): SC-18 (2).1 (i) | |||
| CCI: | CCI-001687 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2011-05-03 |
| Definition: | Verify that the use of mobile code deployed in system meets organization-defined mobile code requirements. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SC-18 (2) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SC-18 (2) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-18 (2) | |||
| NIST: NIST SP 800-53A (v1): SC-18 (2).1 (ii) | |||
| CCI: | CCI-001688 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2011-05-03 |
| Definition: | Verify the acquisition of mobile code deployed in the system meets organization-defined mobile code requirements. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SC-18 (2) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SC-18 (2) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-18 (2) | |||
| NIST: NIST SP 800-53A (v1): SC-18 (2).1 (ii) | |||
| CCI: | CCI-001169 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Prevent the download of organization-defined unacceptable mobile code. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): SC-18 (3) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SC-18 (3) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-18 (3) | |||
| NIST: NIST SP 800-53A (v1): SC-18 (3).1 | |||
| CCI: | CCI-001695 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2011-10-07 |
| Definition: | Prevent the execution of organization-defined unacceptable mobile code. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): SC-18 (3) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SC-18 (3) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-18 (3) | |||
| NIST: NIST SP 800-53A (v1): SC-18 (3).1 | |||
| CCI: | CCI-002459 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Defines the unacceptable mobile code to prevent download and execution. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-18 (3) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-18 (3) | |||
| CCI: | CCI-001170 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Prevents the automatic execution of mobile code in organization-defined software applications. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): SC-18 (4) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SC-18 (4) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-18 (4) | |||
| NIST: NIST SP 800-53A (v1): SC-18 (4).1 (iii) (iv) | |||
| CCI: | CCI-001171 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Defines software applications in which automatic mobile code execution is to be prohibited. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SC-18 (4) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SC-18 (4) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-18 (4) | |||
| NIST: NIST SP 800-53A (v1): SC-18 (4).1 (i) | |||
| CCI: | CCI-001172 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Defines actions to be enforced before executing mobile code. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SC-18 (4) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SC-18 (4) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-18 (4) | |||
| NIST: NIST SP 800-53A (v1): SC-18 (4).1 (ii) | |||
| CCI: | CCI-002460 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Enforce organization-defined actions prior to executing mobile code. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-18 (4) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-18 (4) | |||
| CCI: | CCI-002461 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Allow execution of permitted mobile code only in confined virtual machine environments. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-18 (5) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-18 (5) | |||
| CCI: | CCI-001178 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Provide additional data origin authentication artifacts along with the authoritative name resolution data the system returns in response to external name/address resolution queries. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): SC-20 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SC-20 a | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-20 a | |||
| NIST: NIST SP 800-53A (v1): SC-20.1 | |||
| CCI: | CCI-002462 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Provide additional data integrity verification artifacts along with the authoritative name resolution data the system returns in response to external name/address resolution queries. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-20 a | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-20 a | |||
| CCI: | CCI-001179 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Provides the means to indicate the security status of child zones, when operating as part of a distributed, hierarchical namespace. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): SC-20 (1) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SC-20 b | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-20 b | |||
| NIST: NIST SP 800-53A (v1): SC-20 (1).1 (i) | |||
| CCI: | CCI-001663 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-12 |
| Definition: | The information system, when operating as part of a distributed, hierarchical namespace, provides the means to enable verification of a chain of trust among parent and child domains (if the child supports secure resolution services). | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): SC-20 (1) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SC-20 b | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-20 b | |||
| NIST: NIST SP 800-53A (v1): SC-20 (1).1 (ii) | |||
| CCI: | CCI-002463 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Provide data origin artifacts for internal name/address resolution queries. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-20 (2) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-20 (2) | |||
| CCI: | CCI-002464 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Provide data integrity protection artifacts for internal name/address resolution queries. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-20 (2) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-20 (2) | |||
| CCI: | CCI-002465 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Request data origin authentication verification on the name/address resolution responses the system receives from authoritative sources. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-21 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-21 | |||
| CCI: | CCI-002466 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Request data integrity verification on the name/address resolution responses the system receives from authoritative sources. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-21 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-21 | |||
| CCI: | CCI-002467 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Perform data integrity verification on the name/address resolution responses the system receives from authoritative sources. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-21 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-21 | |||
| CCI: | CCI-002468 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Perform data origin verification authentication on the name/address resolution responses the system receives from authoritative sources. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-21 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-21 | |||
| CCI: | CCI-001182 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Ensure the systems that collectively provide name/address resolution service for an organization are fault-tolerant. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SC-22 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SC-22 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-22 | |||
| NIST: NIST SP 800-53A (v1): SC-22.1 (i) | |||
| CCI: | CCI-001183 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Ensure the systems that collectively provide name/address resolution service for an organization implement internal/external role separation. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SC-22 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SC-22 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-22 | |||
| NIST: NIST SP 800-53A (v1): SC-22.1 (ii) | |||
| CCI: | CCI-001184 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Protect the authenticity of communications sessions. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): SC-23 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SC-23 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-23 | |||
| NIST: NIST SP 800-53A (v1): SC-23.1 | |||
| CCI: | CCI-001185 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Invalidate session identifiers upon user logout or other session termination. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): SC-23 (1) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SC-23 (1) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-23 (1) | |||
| NIST: NIST SP 800-53A (v1): SC-23 (1).1 | |||
| CCI: | CCI-001188 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Generate a unique session identifier for each session with organization-defined randomness requirements. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): SC-23 (4) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SC-23 (3) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-23 (3) | |||
| NIST: NIST SP 800-53A (v1): SC-23 (4).1 (ii) | |||
| CCI: | CCI-001189 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Defines randomness requirements for generating unique session identifiers. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SC-23 (4) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SC-23 (3) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-23 (3) | |||
| NIST: NIST SP 800-53A (v1): SC-23 (4).1 (i) | |||
| CCI: | CCI-001664 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-12 |
| Definition: | Recognize only session identifiers that are system-generated. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): SC-23 (3) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SC-23 (3) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-23 (3) | |||
| NIST: NIST SP 800-53A (v1): SC-23 (3).1 (ii) | |||
| CCI: | CCI-002469 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Defines the certificate authorities allowed to be used for verification of the establishment of protected sessions. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-23 (5) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-23 (5) | |||
| CCI: | CCI-002470 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Only allow the use of organization-defined certificate authorities for verification of the establishment of protected sessions. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-23 (5) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-23 (5) | |||
| CCI: | CCI-001190 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Fail to an organization-defined known-system state for the list of organization-defined types of system failures on organization-defined system components on the indicated components while preserving organization-defined system state information in failure. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): SC-24 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SC-24 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-24 | |||
| NIST: NIST SP 800-53A (v1): SC-24.1 (iv) | |||
| CCI: | CCI-001191 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Defines the known system state the system should fail to in the event of an organization-defined system failure. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SC-24 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SC-24 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-24 | |||
| NIST: NIST SP 800-53A (v1): SC-24.1 (i) | |||
| CCI: | CCI-001192 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Defines types of system failures for which should fail to an organization-defined known system state. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SC-24 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SC-24 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-24 | |||
| NIST: NIST SP 800-53A (v1): SC-24.1 (ii) | |||
| CCI: | CCI-001193 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Defines system state information that should be preserved in the event of a system failure. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SC-24 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SC-24 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-24 | |||
| NIST: NIST SP 800-53A (v1): SC-24.1 (iii) | |||
| CCI: | CCI-001665 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-12 |
| Definition: | Preserve organization-defined system state information in the event of a system failure. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): SC-24 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SC-24 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-24 | |||
| NIST: NIST SP 800-53A (v1): SC-24.1 (v) | |||
| CCI: | CCI-001194 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Employ minimal functionality and information storage on organization-defined information system components. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SC-25 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SC-25 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-25 | |||
| NIST: NIST SP 800-53A (v1): SC-25.1 | |||
| CCI: | CCI-002471 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Defines the system components, with minimal functionality and information storage, to be employed. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-25 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-25 | |||
| CCI: | CCI-001195 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Include components within organizational systems specifically designed to be the target of malicious attacks for detecting, deflecting, and analyzing such attacks. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SC-26 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SC-26 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-26 | |||
| NIST: NIST SP 800-53A (v1): SC-26.1 | |||
| CCI: | CCI-001197 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Include within organizational systems organization-defined platform-independent applications. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SC-27 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SC-27 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-27 | |||
| NIST: NIST SP 800-53A (v1): SC-27.1 (ii) | |||
| CCI: | CCI-001198 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Defines applications that are platform independent. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SC-27 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SC-27 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-27 | |||
| NIST: NIST SP 800-53A (v1): SC-27.1 (i) | |||
| CCI: | CCI-001199 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Protects the confidentiality and/or integrity of organization-defined information at rest. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): SC-28 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SC-28 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-28 | |||
| NIST: NIST SP 800-53A (v1): SC-28.1 | |||
| CCI: | CCI-002472 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Defines the information at rest that is to be protected. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-28 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-28 | |||
| CCI: | CCI-002473 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Defines the information at rest for which cryptographic mechanisms will be implemented. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-28 (1) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-28 (1) | |||
| CCI: | CCI-002474 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Defines the system components which require the implementation of cryptographic mechanisms to prevent unauthorized disclosure and modification of organization-defined information at rest. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-28 (1) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-28 (1) | |||
| CCI: | CCI-002475 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Implement cryptographic mechanisms to prevent unauthorized modification of organization-defined information at rest on organization-defined system components. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-28 (1) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-28 (1) | |||
| CCI: | CCI-002476 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Implement cryptographic mechanisms to prevent unauthorized disclosure of organization-defined information at rest on organization-defined system components. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-28 (1) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-28 (1) | |||
| CCI: | CCI-002477 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Defines the information to be removed from online storage and stored in an offline secure location. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-28 (2) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-28 (2) | |||
| CCI: | CCI-002478 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Remove organization-defined information from online storage. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-28 (2) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-28 (2) | |||
| CCI: | CCI-002479 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Store organization-defined information in an offline secure location. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-28 (2) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-28 (2) | |||
| CCI: | CCI-004910 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Provide protected storage for cryptographic keys with organization-defined safeguards and/or hardware protected key store. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SC-28 (3) | ||
| CCI: | CCI-004911 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the safeguards for providing protected storage for cryptographic keys. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SC-28 (3) | ||
| CCI: | CCI-001201 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Employ a diverse set of information technologies for organization-defined system components in the implementation of the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SC-29 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SC-29 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-29 | |||
| NIST: NIST SP 800-53A (v1): SC-29.1 | |||
| CCI: | CCI-002480 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Defines the system components for which a diverse set of information technologies are to be employed. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-29 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-29 | |||
| CCI: | CCI-001203 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Employ virtualization techniques to support the deployment of a diversity of operating systems that are changed on an organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SC-30 (1) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SC-29 (1) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-29 (1) | |||
| NIST: NIST SP 800-53A (v1): SC-30 (1).1 (ii) | |||
| CCI: | CCI-001204 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Defines the frequency of changes to operating systems and applications to support a diversity of deployments. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SC-30 (1) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SC-29 (1) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-29 (1) | |||
| NIST: NIST SP 800-53A (v1): SC-30 (1).1 (i) | |||
| CCI: | CCI-002481 | Status: | draft |
| Contributor: | DISA FSP | Published Date: | 2013-07-02 |
| Definition: | Employ virtualization techniques to support the deployment of a diversity of applications that are changed per organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-29 (1) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-29 (1) | |||
| CCI: | CCI-002482 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Defines the concealment and misdirection techniques employed for organization-defined systems to confuse and mislead adversaries. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-30 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-30 | |||
| CCI: | CCI-002483 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Defines the systems for which organization-defined concealment and misdirection techniques are to be employed. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-30 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-30 | |||
| CCI: | CCI-002484 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Defines the time periods at which to employ organization-defined concealment and misdirection techniques on organization-defined systems. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-30 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-30 | |||
| CCI: | CCI-002485 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Employ organization-defined concealment and misdirection techniques for organization-defined systems at organization-defined time periods to confuse and mislead adversaries. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-30 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-30 | |||
| CCI: | CCI-002486 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Defines the techniques to be employed to introduce randomness into organizational operations and assets. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-30 (2) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-30 (2) | |||
| CCI: | CCI-002487 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Employ organization-defined techniques to introduce randomness into organizational operations. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-30 (2) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-30 (2) | |||
| CCI: | CCI-002488 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Employ organization-defined techniques to introduce randomness into organizational assets. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-30 (2) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-30 (2) | |||
| CCI: | CCI-002489 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Defines the processing and/or storage locations to be changed at random intervals or at an organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-30 (3) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-30 (3) | |||
| CCI: | CCI-002490 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Defines the frequency at which the location of organization-defined processing and/or storage changes. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-30 (3) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-30 (3) | |||
| CCI: | CCI-002492 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Change the location of organization-defined processing and/or storage at an organization-defined time frequency or at random time intervals. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-30 (3) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-30 (3) | |||
| CCI: | CCI-002493 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Defines the system components in which it will employ realistic but misleading information regarding its security state or posture. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-30 (4) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-30 (4) | |||
| CCI: | CCI-002494 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Employ realistic, but misleading, information in organization-defined system components about its security state or posture. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-30 (4) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-30 (4) | |||
| CCI: | CCI-002495 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Defines the techniques to be employed to hide or conceal organization-defined system components. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-30 (5) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-30 (5) | |||
| CCI: | CCI-002496 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Defines the system components to be hidden or concealed. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-30 (5) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-30 (5) | |||
| CCI: | CCI-002497 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Employ organization-defined techniques to hide or conceal organization-defined system components. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-30 (5) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-30 (5) | |||
| CCI: | CCI-002498 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Perform a covert channel analysis to identify those aspects of communications within the system that are potential avenues for covert storage and/or timing channels. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-31 a | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-31 a | |||
| CCI: | CCI-002499 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Estimate the maximum bandwidth of the covert storage and timing channels. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-31 b | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-31 b | |||
| CCI: | CCI-001207 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Test a subset of the identified covert channels to determine which channels are exploitable. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SC-31 (1) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SC-31 (1) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-31 (1) | |||
| NIST: NIST SP 800-53A (v1): SC-31 (1).1 | |||
| CCI: | CCI-002500 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Defines the maximum bandwidth values to which covert storage and/or timing channels are to be reduced. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-31 (2) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-31 (2) | |||
| CCI: | CCI-002501 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Reduce the maximum bandwidth for identified covert storage and/or timing channels to organization-defined values. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-31 (2) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-31 (2) | |||
| CCI: | CCI-002502 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Defines the subset of identified covert channels in the operational environment of the system that are to have the bandwidth measured. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-31 (3) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-31 (3) | |||
| CCI: | CCI-002503 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Measure the bandwidth of an organization-defined subset of identified covert channels in the operational environment of the information system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-31 (3) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-31 (3) | |||
| CCI: | CCI-002504 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Defines the system components into which the system is partitioned. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-32 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-32 | |||
| CCI: | CCI-002505 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Defines the circumstances under which the system components are to be physically or logically separated to support partitioning. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-32 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-32 | |||
| CCI: | CCI-002506 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Partition the system into organization-defined system components residing in separate physical or logical domains or environments based on organization-defined circumstances for physical or logical separation of components. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-32 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-32 | |||
| CCI: | CCI-004912 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Partition privileged functions into separate physical domains. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SC-32 (1) | ||
| CCI: | CCI-001212 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Defines system components on which the operating environment and organization-defined applications are loaded and executed from hardware-enforced, read-only media. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SC-34 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SC-34 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-34 | |||
| NIST: NIST SP 800-53A (v1): SC-34.1 (ii) | |||
| CCI: | CCI-001210 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | For organization-defined system components, load and execute the operating environment from hardware-enforced, read-only media. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): SC-34 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SC-34 a | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-34 a | |||
| NIST: NIST SP 800-53A (v1): SC-34.1 (iii) | |||
| CCI: | CCI-001211 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | For organization-defined system components, load and execute organization-defined applications from hardware-enforced, read-only media. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): SC-34 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SC-34 b | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-34 b | |||
| NIST: NIST SP 800-53A (v1): SC-34.1 (iii) | |||
| CCI: | CCI-001213 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Defines applications that will be loaded and executed from hardware-enforced, read-only media. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SC-34 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SC-34 b | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-34 b | |||
| NIST: NIST SP 800-53A (v1): SC-34.1 (i) | |||
| CCI: | CCI-001214 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Employ organization-defined system components with no writeable storage that is persistent across component restart or power on/off. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SC-34 (1) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SC-34 (1) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-34 (1) | |||
| NIST: NIST SP 800-53A (v1): SC-34 (1).1 (ii) | |||
| CCI: | CCI-001215 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Defines the system components to be employed with no writeable storage. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SC-34 (1) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SC-34 (1) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-34 (1) | |||
| NIST: NIST SP 800-53A (v1): SC-34 (1).1 (i) | |||
| CCI: | CCI-001216 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Protect the integrity of information prior to storage on read-only media. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SC-34 (2) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SC-34 (2) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-34 (2) | |||
| NIST: NIST SP 800-53A (v1): SC-34 (2).1 | |||
| CCI: | CCI-002507 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Control read-only media after information has been recorded onto the media. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-34 (2) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-34 (2) | |||
| CCI: | CCI-001196 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Include system components that proactively seek to identify network-based malicious code or malicious websites. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SC-26 (1) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SC-35 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-35 | |||
| NIST: NIST SP 800-53A (v1): SC-26 (1).1 | |||
| CCI: | CCI-002513 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Defines the processing that is to be distributed across multiple physical locations or logical domains. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-36 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-36 | |||
| CCI: | CCI-002514 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Defines the storage components that is to be distributed across multiple physical locations or logical domains. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-36 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-36 | |||
| CCI: | CCI-002515 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Distributes organization-defined processing across multiple physical locations or logical domains. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-36 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-36 | |||
| CCI: | CCI-002516 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Distributes organization-defined storage components across multiple physical locations or logical domains. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-36 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-36 | |||
| CCI: | CCI-002517 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Defines the distributed processing components that are to be polled to identify potential faults, errors, or compromises. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-36 (1) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-36 (1) (a) | |||
| CCI: | CCI-002518 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Defines the distributed storage components that are to be polled to identify potential faults, errors, or compromises. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-36 (1) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-36 (1) (a) | |||
| CCI: | CCI-002519 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Employ polling techniques to identify potential faults, errors, or compromises to organization-defined distributed processing components. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-36 (1) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-36 (1) (a) | |||
| CCI: | CCI-002520 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Employ polling techniques to identify potential faults, errors, or compromises to organization-defined distributed storage components. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-36 (1) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-36 (1) (a) | |||
| CCI: | CCI-004913 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Takes organization-defined actions in response to identified faults, errors, or compromises. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SC-36 (1) (b) | ||
| CCI: | CCI-004914 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines actions to take in response to identified faults, errors, or compromises. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SC-36 (1) (b) | ||
| CCI: | CCI-004915 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Synchronize the organization-defined duplicate systems or system components. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SC-36 (2) | ||
| CCI: | CCI-004916 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the duplicate systems or system components to be synchronized. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SC-36 (2) | ||
| CCI: | CCI-002521 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Defines the out-of-band channels to be employed for the physical delivery or electronic transmission of organization-defined information, system components, or devices. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-37 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-37 | |||
| CCI: | CCI-002522 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Defines the information, system components, or devices that are to be electronically transmitted or physically delivered via organization-defined out-of-band channels. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-37 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-37 | |||
| CCI: | CCI-002524 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Employ organization-defined out-of-band channels for the physical delivery or electronic transmission of organization-defined information, system components, or devices to organization-defined individuals or systems. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-37 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-37 | |||
| CCI: | CCI-002525 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Defines the controls to be employed to ensure only organization-defined individuals or systems receive organization-defined information, system components, or devices. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-37 (1) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-37 (1) | |||
| CCI: | CCI-002526 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Defines the information, system components, or devices which are to be received only by organization-defined individuals or systems. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-37 (1) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-37 (1) | |||
| CCI: | CCI-002527 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Employ organization-defined controls to ensure only organization-defined individuals or systems receive the organization-defined information, system components, or devices. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-37 (1) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-37 (1) | |||
| CCI: | CCI-002528 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Defines the operations security controls to be employed to protect key organizational information throughout the system development life cycle. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-38 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-38 | |||
| CCI: | CCI-002529 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Employ organization-defined operations security controls to protect key organizational information throughout the system development life cycle. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-38 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-38 | |||
| CCI: | CCI-002530 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Maintain a separate execution domain for each executing system process. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-39 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-39 | |||
| CCI: | CCI-002531 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Implement hardware separation mechanisms to facilitate process isolation. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-39 (1) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-39 (1) | |||
| CCI: | CCI-002532 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Defines the multi-threaded processing in which a separate execution domain is maintained by the system for each thread. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-39 (2) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-39 (2) | |||
| CCI: | CCI-002533 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Maintain a separate execution domain for each thread in organization-defined multi-threaded processing. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-39 (2) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-39 (2) | |||
| CCI: | CCI-002534 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Defines types of signal parameter attacks or references to sources for such attacks from which the system protects organization-defined wireless links. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-40 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-40 | |||
| CCI: | CCI-002535 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Defines the external and internal wireless links the system is to protect from organization-defined types of signal parameter attacks or references to sources for such attacks. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-40 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-40 | |||
| CCI: | CCI-002536 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Protect organization-defined external and internal wireless links from organization-defined types of signal parameter attacks or references to sources for such attacks. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-40 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-40 | |||
| CCI: | CCI-002537 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Defines the level of protection against the effects of intentional electromagnetic interference to be achieved by implemented cryptographic mechanisms. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-40 (1) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-40 (1) | |||
| CCI: | CCI-002538 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Implement cryptographic mechanisms that achieve an organization-defined level of protection against the effects of intentional electromagnetic interference. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-40 (1) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-40 (1) | |||
| CCI: | CCI-002539 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Defines the level of reduction the system is to implement to reduce the detection potential of wireless links. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-40 (2) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-40 (2) | |||
| CCI: | CCI-002540 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Implement cryptographic mechanisms to reduce the detection potential of wireless links to an organization-defined level of reduction. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-40 (2) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-40 (2) | |||
| CCI: | CCI-002541 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Implement cryptographic mechanisms to identify and reject wireless transmissions that are deliberate attempts to achieve imitative or manipulative communications deception based on signal parameters. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-40 (3) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-40 (3) | |||
| CCI: | CCI-002542 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Defines the wireless transmitters that are to have cryptographic mechanisms implemented to prevent the identification of the wireless transmitters. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-40 (4) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-40 (4) | |||
| CCI: | CCI-002543 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Implement cryptographic mechanisms to prevent the identification of organization-defined wireless transmitters by using the transmitter signal parameters. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-40 (4) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-40 (4) | |||
| CCI: | CCI-002544 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Defines the systems or system components on which organization-defined connection ports or input/output devices are to be physically or logically disabled or removed. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-41 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-41 | |||
| CCI: | CCI-002545 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Defines the connection ports or input/output devices that are to be physically or logically disabled or removed from organization-defined systems or system components. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-41 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-41 | |||
| CCI: | CCI-002546 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Physically or logically disable or remove organization-defined connection ports or input/output devices on organization-defined systems or system components. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-41 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-41 | |||
| CCI: | CCI-002547 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Defines the exceptions where remote activation of sensors is allowed. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-42 a | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-42 a | |||
| CCI: | CCI-002548 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Prohibit the use of devices possessing organization-defined environmental sensing capabilities in organization-defined facilities, areas, or systems; and/or the remote activation of environmental sensing capabilities on organizational systems or system components except for the organization-defined exceptions where remote activation of sensors is allowed. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-42 a | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-42 a | |||
| CCI: | CCI-002556 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Defines the environmental sensing capabilities prohibited on devices used in organization-defined facilities, areas, or systems. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-42 (3) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-42 a | |||
| CCI: | CCI-002557 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Defines the facilities, areas, or systems where devices processing organization-defined environmental sensing capabilities are prohibited. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-42 (3) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-42 a | |||
| CCI: | CCI-002549 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Defines the class of users to receive explicit indication of sensor use. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-42 b | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-42 b | |||
| CCI: | CCI-002550 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Provide an explicit indication of sensor use to the organization-defined class of users. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-42 b | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-42 b | |||
| CCI: | CCI-002551 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Defines the sensors to be configured so that collected data or information is reported only to authorized individuals or roles. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-42 (1) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-42 (1) | |||
| CCI: | CCI-002552 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Verify that the system is configured so that data or information collected by the organization-defined sensors is only reported to authorized individuals or roles. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-42 (1) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-42 (1) | |||
| CCI: | CCI-002553 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Defines the measures to be employed to ensure data or information collected by organization-defined sensors is used only for authorized purposes. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-42 (2) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-42 (2) | |||
| CCI: | CCI-002554 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Defines the sensors that are to collect data or information for authorized purposes. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-42 (2) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-42 (2) | |||
| CCI: | CCI-002555 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Employ organization-defined measures, so that data or information collected by organization-defined sensors is only used for authorized purposes. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-42 (2) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-42 (2) | |||
| CCI: | CCI-004917 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines sensors to facilitate an individual's awareness that personally identifiable information is being collected. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SC-42 (4) | ||
| CCI: | CCI-004918 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines measures to facility an individual's awareness that personally identifiable information is being collected. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SC-42 (4) | ||
| CCI: | CCI-004919 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Employ organization-defined measures to facilitate an individual's awareness that personally identifiable information is being collected by organization-defined sensors. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SC-42 (4) | ||
| CCI: | CCI-004920 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines sensors that are configured to minimize the collection of information about individuals that is not needed. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SC-42 (5) | ||
| CCI: | CCI-004921 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Employ organization-defined sensors that are configured to minimize the collection of information about individuals that is not needed. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SC-42 (5) | ||
| CCI: | CCI-002559 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Defines the system components for which usage restrictions and implementation guidance are to be established. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-43 a | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-43 a | |||
| CCI: | CCI-002560 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Establish usage restrictions and implementation guidance for organization-defined system components based on the potential to cause damage to the system if used maliciously. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-43 a | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-43 a | |||
| CCI: | CCI-002561 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Authorize the use of organization-defined system components which have the potential to cause damage to the system if used maliciously. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-43 b | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-43 b | |||
| CCI: | CCI-002562 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Monitor the use of organization-defined system components which have the potential to cause damage to the system if used maliciously. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-43 b | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-43 b | |||
| CCI: | CCI-002563 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Control the use of organization-defined system components which have the potential to cause damage to the system if used maliciously. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-43 b | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-43 b | |||
| CCI: | CCI-002564 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Defines the system, system component, or location where a detonation chamber capability is employed. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-44 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-44 | |||
| CCI: | CCI-002565 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Employ a detonation chamber capability within an organization-defined system, system component, or location. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-44 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-44 | |||
| CCI: | CCI-004922 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Synchronize system clocks within and between systems or system components. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SC-45 | ||
| CCI: | CCI-004923 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Compare the internal system clocks on an organization-defined frequency with organization-defined authoritative time source. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SC-45 (1) (a) | ||
| CCI: | CCI-004924 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the frequency for comparing the internal system clocks with organization-defined authoritative time source. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SC-45 (1) (a) | ||
| CCI: | CCI-004925 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the time source used for comparing the internal system clocks. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SC-45 (1) (a) | ||
| CCI: | CCI-004926 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Synchronize the internal system clocks to the authoritative time source when the time difference is greater than organization-defined time period. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SC-45 (1) (b) | ||
| CCI: | CCI-004927 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the time period for synchronizing the internal system clocks to the authoritative time source. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SC-45 (1) (b) | ||
| CCI: | CCI-004928 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Identify a secondary authoritative time source that is in a different geographic region than the primary authoritative time source. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SC-45 (2) (a) | ||
| CCI: | CCI-004929 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Synchronize the internal system clocks to the secondary authoritative time source if the primary authoritative time source is unavailable. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SC-45 (2) (b) | ||
| CCI: | CCI-004930 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Implement a policy enforcement mechanism physically or logically between the physical and/or network interfaces for the connecting security domains. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SC-46 | ||
| CCI: | CCI-004931 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Establish organization-defined alternate communications paths for system operations organizational command and control. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SC-47 | ||
| CCI: | CCI-004932 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Relocate organization-defined sensors and monitoring capabilities to organization-defined locations under organization-defined conditions or circumstances. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SC-48 | ||
| CCI: | CCI-004933 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the sensors and monitoring capabilities to be relocated to organization-defined locations. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SC-48 | ||
| CCI: | CCI-004934 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the locations of which the organization-defined sensors and monitoring capabilities will be relocated. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SC-48 | ||
| CCI: | CCI-004935 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the conditions or circumstances of which the organization-defined sensors and monitoring capabilities are relocated. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SC-48 | ||
| CCI: | CCI-004936 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Dynamically relocate organization-defined sensors and monitoring capabilities to organization-defined locations under organization-defined conditions or circumstances. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SC-48 (1) | ||
| CCI: | CCI-004937 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the sensors and monitoring capabilities to be dynamically relocated to organization-defined locations. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SC-48 (1) | ||
| CCI: | CCI-004938 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the locations of which the organization-defined sensors and monitoring capabilities will be dynamically relocated. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SC-48 (1) | ||
| CCI: | CCI-004939 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the conditions or circumstances of which the organization-defined sensors and monitoring capabilities are dynamically relocated. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SC-48 (1) | ||
| CCI: | CCI-004940 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Implement hardware-enforced separation and policy enforcement mechanisms between organization-defined security domains. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SC-49 | ||
| CCI: | CCI-004941 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the security domains for implementing hardware-enforced separation and policy enforcement mechanisms. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SC-49 | ||
| CCI: | CCI-004942 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Implement software-enforced separation and policy enforcement mechanisms between organization-defined security domains. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SC-50 | ||
| CCI: | CCI-004943 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the security domains for implementing software-enforced separation and policy enforcement mechanisms. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SC-50 | ||
| CCI: | CCI-002508 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Defines the system firmware components for which hardware-based, write-protect is employed. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-34 (3) (a) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-51 a | |||
| CCI: | CCI-002509 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Employ hardware-based, write-protect for organization-defined information system firmware components. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-34 (3) (a) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-51 a | |||
| CCI: | CCI-002510 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Defines the individuals authorized to manually disable hardware-based, write-protect for firmware modifications and re-enable the write-protect prior to returning to operational mode. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-34 (3) (b) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-51 b | |||
| CCI: | CCI-002511 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Implement specific procedures for organization-defined authorized individuals to manually disable hardware-based, write-protect for firmware modifications. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-34 (3) (b) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-51 b | |||
| CCI: | CCI-002512 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Implement specific procedures for organization-defined authorized individuals to manually re-enable hardware write-protect prior to returning to operational mode. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-34 (3) (b) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-51 b | |||
| CCI: | CCI-002523 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | Defines the individuals or systems authorized to be recipients of organization-defined information, system components, or devices to be delivered by employing organization-defined out-of-band channels for electronic transmission or physical delivery. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-37 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SC-37, SC-37 (1) | |||
| CCI: | CCI-001217 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | Develop and document an organization-level; mission/business process-level; and/or system level system and information integrity policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SI-1 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SI-1 a 1 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-1 a 1 (a) | |||
| NIST: NIST SP 800-53A (v1): SI-1.1 (i) (ii) | |||
| CCI: | CCI-001218 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | Disseminate an organization-level; mission/business process-level; and/or system level system and information integrity policy to organization-defined personnel or roles. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SI-1 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SI-1 a 1 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-1 a 1 | |||
| NIST: NIST SP 800-53A (v1): SI-1.1 (iii) | |||
| CCI: | CCI-001220 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | Develop and document procedures to facilitate the implementation of the organization-level; mission/business process-level; and/or system level system and information integrity policy and associated system integrity controls. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SI-1 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SI-1 a 2 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-1 a 2 | |||
| NIST: NIST SP 800-53A (v1): SI-1.1 (iv) (v) | |||
| CCI: | CCI-001221 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | Disseminate to organization-defined personnel or roles procedures to facilitate the implementation of the system and information integrity policy and associated system and information integrity controls. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SI-1 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SI-1 a 2 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-1 a 2 | |||
| NIST: NIST SP 800-53A (v1): SI-1.1 (vi) | |||
| CCI: | CCI-002601 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Defines the personnel or roles to whom the system and information integrity policy and procedures are to be disseminated. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-1 a | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-1 a | |||
| CCI: | CCI-004944 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Develop and document an organization-level; mission/business process-level; and/or system level system and information integrity policy that is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SI-1 a 1 (b) | ||
| CCI: | CCI-004945 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Designate an organization-defined official to manage the development and documentation of the system and information integrity policy. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SI-1 b | ||
| CCI: | CCI-004946 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Designate an organization-defined official to manage the dissemination of the system and information integrity policy. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SI-1 b | ||
| CCI: | CCI-004947 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Designate an organization-defined official to manage the development and documentation of the system and information integrity procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SI-1 b | ||
| CCI: | CCI-004948 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Designate an organization-defined official to manage the dissemination of the system and information integrity procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SI-1 b | ||
| CCI: | CCI-004949 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the official designated for managing the development, documentation, and dissemination of the system and information integrity policy. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SI-1 b | ||
| CCI: | CCI-004950 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the official designated for managing the development, documentation, and dissemination of the system and information integrity procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SI-1 b | ||
| CCI: | CCI-001219 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | Review and update the current system and information integrity policy in accordance with organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SI-1 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SI-1 b 1 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-1 c 1 | |||
| NIST: NIST SP 800-53A (v1): SI-1.2 (ii) | |||
| CCI: | CCI-001222 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | Review and update the current system and information integrity procedures in accordance with organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SI-1 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SI-1 b 2 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-1 c 2 | |||
| NIST: NIST SP 800-53A (v1): SI-1.2 (iv) | |||
| CCI: | CCI-001223 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | Defines the frequency for reviewing and updating the current system and information integrity policy. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SI-1 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SI-1 b 1 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-1 c 1 | |||
| NIST: NIST SP 800-53A (v1): SI-1.2 (i) | |||
| CCI: | CCI-001224 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | Defines the frequency for reviewing and updating the current system and information integrity procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SI-1 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SI-1 b 2 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-1 c 2 | |||
| NIST: NIST SP 800-53A (v1): SI-1.2 (iii) | |||
| CCI: | CCI-004951 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Review and update the current system and information integrity policy following organization-defined events. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SI-1 c 1 | ||
| CCI: | CCI-004952 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the events following reviewing and updating the current system and information integrity policy. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SI-1 c 1 | ||
| CCI: | CCI-004953 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Review and update the current system and information integrity procedures following organization-defined events. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SI-1 c 2 | ||
| CCI: | CCI-004954 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the events following reviewing and updating the current system and information integrity procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SI-1 c 2 | ||
| CCI: | CCI-001225 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | Identify system flaws. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SI-2 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SI-2 a | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-2 a | |||
| NIST: NIST SP 800-53A (v1): SI-2.1 (i) | |||
| CCI: | CCI-001226 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | Report system flaws. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SI-2 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SI-2 a | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-2 a | |||
| NIST: NIST SP 800-53A (v1): SI-2.1 (i) | |||
| CCI: | CCI-001227 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | Correct system flaws. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SI-2 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SI-2 a | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-2 a | |||
| NIST: NIST SP 800-53A (v1): SI-2.1 (i) | |||
| CCI: | CCI-001228 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | Test software updates related to flaw remediation for effectiveness before installation. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SI-2 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SI-2 b | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-2 b | |||
| NIST: NIST SP 800-53A (v1): SI-2.1 (ii) | |||
| CCI: | CCI-001229 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | Test software updates related to flaw remediation for potential side effects before installation. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SI-2 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SI-2 b | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-2 b | |||
| NIST: NIST SP 800-53A (v1): SI-2.1 (iii) | |||
| CCI: | CCI-002602 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Test firmware updates related to flaw remediation for effectiveness before installation. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-2 b | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-2 b | |||
| CCI: | CCI-002603 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Test firmware updates related to flaw remediation for potential side effects before installation. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-2 b | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-2 b | |||
| CCI: | CCI-002604 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Defines the time period following the release of updates within which security-related software updates are to be installed. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-2 c | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-2 c | |||
| CCI: | CCI-002605 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Install security-relevant software updates within an organization-defined time period of the release of the updates. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-2 c | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-2 c | |||
| CCI: | CCI-002606 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Defines the time period following the release of updates within which security-related firmware updates are to be installed. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-2 c | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-2 c | |||
| CCI: | CCI-002607 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Install security-relevant firmware updates within an organization-defined time period of the release of the updates. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-2 c | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-2 c | |||
| CCI: | CCI-001230 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | Incorporate flaw remediation into the organizational configuration management process. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SI-2 c | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SI-2 d | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-2 d | |||
| NIST: NIST SP 800-53A (v1): SI-2.1 (iv) | |||
| CCI: | CCI-004955 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Determine if system components have applicable security-related software updates installed using organization-defined mechanisms on an organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SI-2 (2) | ||
| CCI: | CCI-004956 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Determine if system components have applicable security-related firmware updates installed using organization-defined mechanisms on an organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SI-2 (2) | ||
| CCI: | CCI-004957 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines a frequency for installing security-relevant software updates using organization-defined automated mechanisms. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SI-2 (2) | ||
| CCI: | CCI-004958 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines a frequency for installing security-relevant firmware updates using organization-defined automated mechanisms. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SI-2 (2) | ||
| CCI: | CCI-004959 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the automated mechanisms for determining if system components have applicable security-related software updates installed. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SI-2 (2) | ||
| CCI: | CCI-004960 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the automated mechanisms for determining if system components have applicable security-related firmware updates installed. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SI-2 (2) | ||
| CCI: | CCI-001235 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | Measure the time between flaw identification and flaw remediation. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SI-2 (3) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SI-2 (3) (a) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-2 (3) (a) | |||
| NIST: NIST SP 800-53A (v1): SI-2 (3).1 (ii) | |||
| CCI: | CCI-001236 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | Defines benchmarks for the time taken to apply corrective actions after flaw identification. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SI-2 (3) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SI-2 (3) (b) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-2 (3) (b) | |||
| NIST: NIST SP 800-53A (v1): SI-2 (3).1 (i) | |||
| CCI: | CCI-002608 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Establish organization-defined benchmarks for the time taken to apply corrective actions after flaw identification. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-2 (3) (b) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-2 (3) (b) | |||
| CCI: | CCI-004961 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Employ automated patch management tools to facilitate flaw remediation to the organization-defined system components. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SI-2 (4) | ||
| CCI: | CCI-004962 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the system components on which patch management tools to facilitate flaw remediation are employed. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SI-2 (4) | ||
| CCI: | CCI-002609 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Defines the system components on which organization-defined security-relevant software updates will be automatically installed. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-2 (5) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-2 (5) | |||
| CCI: | CCI-002610 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Defines the system components on which organization-defined security-relevant firmware updates will be automatically installed. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-2 (5) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-2 (5) | |||
| CCI: | CCI-002611 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Defines the security-relevant software updates to be automatically installed on organization-defined system components. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-2 (5) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-2 (5) | |||
| CCI: | CCI-002612 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Defines the security-relevant firmware updates to be automatically installed on organization-defined system components. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-2 (5) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-2 (5) | |||
| CCI: | CCI-002613 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Install organization-defined security-relevant software updates automatically to organization-defined system components. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-2 (5) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-2 (5) | |||
| CCI: | CCI-002614 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Install organization-defined security-relevant firmware updates automatically to organization-defined system components. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-2 (5) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-2 (5) | |||
| CCI: | CCI-002615 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Defines the software components to remove previous versions after updated versions have been installed. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-2 (6) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-2 (6) | |||
| CCI: | CCI-002616 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Defines the firmware components to remove previous versions after updated versions have been installed. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-2 (6) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-2 (6) | |||
| CCI: | CCI-002617 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Remove previous versions of organization-defined software components after updated versions have been installed. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-2 (6) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-2 (6) | |||
| CCI: | CCI-002618 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Remove previous versions of organization-defined firmware components after updated versions have been installed. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-2 (6) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-2 (6) | |||
| CCI: | CCI-004963 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Implement signature based and/or non-signature based malicious code protection mechanisms at system entry and exit points to detect and eradicate malicious code. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SI-3 a | ||
| CCI: | CCI-004964 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Automatically update malicious code protection mechanisms as new releases are available in accordance with organizational configuration management policy. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SI-3 b | ||
| CCI: | CCI-004965 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Automatically update malicious code protection mechanisms as new releases are available in accordance with organizational configuration management procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SI-3 b | ||
| CCI: | CCI-001241 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | Configure malicious code protection mechanisms to perform periodic scans of the system on an organization-defined frequency. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): SI-3 c | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SI-3 c 1 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-3 c 1 | |||
| NIST: NIST SP 800-53A (v1): SI-3.1 (vi) | |||
| CCI: | CCI-001243 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | Configure malicious code protection mechanisms to block malicious code; quarantine malicious code; and/or take organization-defined action(s) in response to malicious code detection. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): SI-3 c | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SI-3 c 2 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-3 c 2 | |||
| NIST: NIST SP 800-53A (v1): SI-3.1 (vi) | |||
| CCI: | CCI-001244 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | Defines one or more actions to perform in response to malicious code detection, such as blocking malicious code, quarantining malicious code, or sending alerts to administrators. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SI-3 c | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SI-3 c 2 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-3 c 2 | |||
| NIST: NIST SP 800-53A (v1): SI-3.1 (v) | |||
| CCI: | CCI-002623 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Defines the frequency for performing periodic scans of the system for malicious code. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-3 c 1 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-3 c 1 | |||
| CCI: | CCI-002624 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Configure malicious code protection mechanisms to perform real-time scans of files from external sources at endpoint; and/or network entry and exit points as the files are downloaded, opened, or executed in accordance with organizational policy. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-3 c 1 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-3 c 1 | |||
| CCI: | CCI-004966 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Configure malicious code protection mechanisms to send alerts to organization-defined personnel in response to malicious code detection. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SI-3 c 2 | ||
| CCI: | CCI-001245 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | Address the receipt of false positives during malicious code detection and eradication, and the resulting potential impact on the availability of the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SI-3 d | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SI-3 d | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-3 d | |||
| NIST: NIST SP 800-53A (v1): SI-3.1 (vii) | |||
| CCI: | CCI-001249 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | Update malicious code protection mechanisms only when directed by a privileged user. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): SI-3 (4) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SI-3 (4) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-3 (4) | |||
| NIST: NIST SP 800-53A (v1): SI-3 (4).1 | |||
| CCI: | CCI-001251 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | Test malicious code protection mechanisms on an organization-defined frequency by introducing a known benign code into the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SI-3 (6) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SI-3 (6) (a) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-3 (6) (a) | |||
| NIST: NIST SP 800-53A (v1): SI-3 (6).1 (ii) | |||
| CCI: | CCI-001669 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-12 |
| Definition: | Defines the frequency of testing malicious code protection mechanisms. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SI-3 (6) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SI-3 (6) (a) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-3 (6) (a) | |||
| NIST: NIST SP 800-53A (v1): SI-3 (6).1 (i) | |||
| CCI: | CCI-002625 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | When testing malicious code protection mechanisms, verify the detection of the code. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-3 (6) (b) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-3 (6) (b) | |||
| CCI: | CCI-002626 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | When testing malicious code protection mechanisms, verify the associated incident reporting of the code occurs. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-3 (6) (b) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-3 (6) (b) | |||
| CCI: | CCI-002628 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Defines the unauthorized operating system commands that are to be detected through the kernel application programming interface on organization-defined system hardware components. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-3 (8) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-3 (8) (a) | |||
| CCI: | CCI-002629 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Defines the system hardware components that are to detect organization-defined unauthorized operating system commands through the kernel programming application interface. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-3 (8) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-3 (8) (a) | |||
| CCI: | CCI-002630 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Detect organization-defined unauthorized operating system commands through the kernel application programming interface at organization-defined system hardware components. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-3 (8) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-3 (8) (a) | |||
| CCI: | CCI-002631 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Issue a warning; audit the command execution; and/or prevent the execution of the command when organization-defined unauthorized operating system commands are detected. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-3 (8) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-3 (8) (b) | |||
| CCI: | CCI-002634 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Defines the tools to be employed to analyze the characteristics and behavior of malicious code. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-3 (10) (a) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-3 (10) (a) | |||
| CCI: | CCI-002635 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Defines the techniques to be employed to analyze the characteristics and behavior of malicious code. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-3 (10) (a) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-3 (10) (a) | |||
| CCI: | CCI-002636 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Employ organization-defined tools to analyze the characteristics and behavior of malicious code. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-3 (10) (a) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-3 (10) (a) | |||
| CCI: | CCI-002638 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Employ organization-defined techniques to analyze the characteristics and behavior of malicious code. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-3 (10) (a) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-3 (10) (a) | |||
| CCI: | CCI-002639 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Incorporate the results from malicious code analysis into organizational incident response processes. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-3 (10) (b) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-3 (10) (b) | |||
| CCI: | CCI-002640 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Incorporate the results from malicious code analysis into organizational flaw remediation processes. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-3 (10) (b) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-3 (10) (b) | |||
| CCI: | CCI-001253 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | Defines the objectives of monitoring for attacks and indicators of potential attacks on the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SI-4 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SI-4 a 1 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-4 a 1 | |||
| NIST: NIST SP 800-53A (v1): SI-4.1 (i) | |||
| CCI: | CCI-002641 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Monitor the system to detect attacks and indicators of potential attacks in accordance with organization-defined monitoring objectives. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-4 a 1 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-4 a 1 | |||
| CCI: | CCI-002642 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Monitor the system to detect unauthorized local connections. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-4 a 2 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-4 a 2 | |||
| CCI: | CCI-002643 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Monitor the system to detect unauthorized network connections. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-4 a 2 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-4 a 2 | |||
| CCI: | CCI-002644 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Monitor the system to detect unauthorized remote connections. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-4 a 2 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-4 a 2 | |||
| CCI: | CCI-002645 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Defines the techniques and methods to be used to identify unauthorized use of the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-4 b | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-4 b | |||
| CCI: | CCI-002646 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Identify unauthorized use of the system through organization-defined techniques and methods. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-4 b | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-4 b | |||
| CCI: | CCI-001255 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | Invoke internal monitoring capabilities or deploy monitoring devices strategically within the system to collect organization-determined essential information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SI-4 c | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SI-4 c | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-4 c 1 | |||
| NIST: NIST SP 800-53A (v1): SI-4.1 (iv) | |||
| CCI: | CCI-001256 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | Invoke internal monitoring capabilities or deploy monitoring devices at ad hoc locations within the system to track specific types of transactions of interest to the organization. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SI-4 c | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SI-4 c | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-4 c 2 | |||
| NIST: NIST SP 800-53A (v1): SI-4.1 (iv) | |||
| CCI: | CCI-004967 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Analyze detected events and anomalies. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SI-4 d | ||
| CCI: | CCI-001257 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | Adjust the level of system monitoring activity when there is a change in increased risk to organizational operations and assets, individuals, other organizations, or the Nation. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SI-4 d | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SI-4 e | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-4 e | |||
| NIST: NIST SP 800-53A (v1): SI-4.1 (v) | |||
| CCI: | CCI-001258 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | Obtain legal opinion with regard to system monitoring activities. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SI-4 e | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SI-4 f | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-4 f | |||
| NIST: NIST SP 800-53A (v1): SI-4.1 (vi) | |||
| CCI: | CCI-002650 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Defines the system monitoring information that is to be provided the organization-defined personnel or roles. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-4 g | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-4 g | |||
| CCI: | CCI-002651 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Defines the personnel or roles that are to be provided organization-defined system monitoring information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-4 g | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-4 g | |||
| CCI: | CCI-002652 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Defines the frequency at which the organization will provide the organization-defined system monitoring information to organization-defined personnel or roles. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-4 g | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-4 g | |||
| CCI: | CCI-002654 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Provide organization-defined system monitoring information to organization-defined personnel or roles as needed, and/or per organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-4 g | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-4 g | |||
| CCI: | CCI-002655 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Connect individual intrusion detection tools into a system-wide intrusion detection system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-4 (1) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (1) | |||
| CCI: | CCI-002656 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Configure individual intrusion detection tools into a system-wide intrusion detection system. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-4 (1) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (1) | |||
| CCI: | CCI-001260 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | Employ automated tools to support near real-time analysis of events. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SI-4 (2) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SI-4 (2) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (2) | |||
| NIST: NIST SP 800-53A (v1): SI-4 (2).1 | |||
| CCI: | CCI-004968 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Employ automated mechanisms to support near real-time analysis of events. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (2) | ||
| CCI: | CCI-002657 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Employ automated tools to integrate intrusion detection tools into access control mechanisms. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-4 (3) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (3) | |||
| CCI: | CCI-002658 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Employ automated tools to integrate intrusion detection tools into flow control mechanisms. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-4 (3) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (3) | |||
| CCI: | CCI-004969 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Employ automated mechanisms to integrate intrusion detection mechanisms into access control mechanisms. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (3) | ||
| CCI: | CCI-004970 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Employ automated mechanisms to integrate intrusion detection mechanisms into flow control mechanisms. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (3) | ||
| CCI: | CCI-004971 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Determine criteria for unusual or unauthorized activities or conditions for inbound communications traffic. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (4) (a) | ||
| CCI: | CCI-004972 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Determine criteria for unusual or unauthorized activities or conditions for outbound communications traffic. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (4) (a) | ||
| CCI: | CCI-002659 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Defines the frequency on which it will monitor inbound communications for unusual or unauthorized activities or conditions. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-4 (4) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (4) (b) | |||
| CCI: | CCI-002660 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Defines the frequency on which it will monitor outbound communications for unusual or unauthorized activities or conditions. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-4 (4) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (4) (b) | |||
| CCI: | CCI-002661 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Monitor inbound communications traffic per organization-defined frequency for organization-defined unusual or unauthorized activities or conditions. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-4 (4) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (4) (b) | |||
| CCI: | CCI-002662 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Monitor outbound communications traffic per organization-defined frequency for organization-defined unusual or unauthorized activities or conditions. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-4 (4) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (4) (b) | |||
| CCI: | CCI-004973 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the unusual or unauthorized activities or conditions that will be monitored for inbound communications traffic. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (4) (b) | ||
| CCI: | CCI-004974 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the unusual or unauthorized activities or conditions that will be monitored for outbound communications traffic. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (4) (b) | ||
| CCI: | CCI-001264 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | Defines the indicators of compromise or potential compromise which will result in system alerts being provided to organization-defined personnel or roles. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SI-4 (5) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SI-4 (5) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (5) | |||
| NIST: NIST SP 800-53A (v1): SI-4 (5).1 (i) | |||
| CCI: | CCI-002663 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Defines the personnel or roles to receive alerts when organization-defined indicators of compromise or potential compromise occur. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-4 (5) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (5) | |||
| CCI: | CCI-002664 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Alert organization-defined personnel or roles when organization-defined compromise indicators generate the occurrence of a compromise or a potential compromise. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-4 (5) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (5) | |||
| CCI: | CCI-001266 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | Notify an organization-defined incident response personnel (identified by name and/or by role) of detected suspicious events. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): SI-4 (7) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SI-4 (7) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (7) (a) | |||
| NIST: NIST SP 800-53A (v1): SI-4 (7).1 (iii) | |||
| CCI: | CCI-001267 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | Defines incident response personnel (identified by name and/or by role) to be notified of detected suspicious events. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SI-4 (7) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SI-4 (7) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (7) (a) | |||
| NIST: NIST SP 800-53A (v1): SI-4 (7).1 (i) | |||
| CCI: | CCI-001268 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | Defines the least-disruptive actions to be taken by system to terminate suspicious events. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SI-4 (7) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SI-4 (7) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (7) (b) | |||
| NIST: NIST SP 800-53A (v1): SI-4 (7).1 (ii) | |||
| CCI: | CCI-001670 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-12 |
| Definition: | Take organization-defined least-disruptive actions to terminate suspicious events. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): SI-4 (7) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SI-4 (7) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (7) (b) | |||
| NIST: NIST SP 800-53A (v1): SI-4 (7).1 (iv) | |||
| CCI: | CCI-001270 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | Test intrusion monitoring tools at an organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SI-4 (9) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SI-4 (9) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (9) | |||
| NIST: NIST SP 800-53A (v1): SI-4 (9).1 (ii) | |||
| CCI: | CCI-001271 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | Defines the frequency for testing intrusion monitoring tools. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SI-4 (9) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SI-4 (9) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (9) | |||
| NIST: NIST SP 800-53A (v1): SI-4 (9).1 (i) | |||
| CCI: | CCI-004975 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Test intrusion monitoring mechanisms at an organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (9) | ||
| CCI: | CCI-004976 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the frequency for testing intrusion monitoring mechanisms. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (9) | ||
| CCI: | CCI-002665 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Defines the encrypted communications traffic that is to be visible to organization-defined system monitoring tools. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-4 (10) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (10) | |||
| CCI: | CCI-002666 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Defines the system monitoring tools that will have visibility into organization-defined encrypted communications traffic. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-4 (10) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (10) | |||
| CCI: | CCI-002667 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Make provisions so that organization-defined encrypted communications traffic is visible to organization-defined system monitoring tools. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-4 (10) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (10) | |||
| CCI: | CCI-004977 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the encrypted communications traffic that is to be visible to organization-defined system monitoring mechanisms. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (10) | ||
| CCI: | CCI-004978 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the system monitoring mechanisms that will have visibility into organization-defined encrypted communications traffic. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (10) | ||
| CCI: | CCI-004979 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Make provisions so that organization-defined encrypted communications traffic is visible to organization-defined system monitoring mechanisms. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (10) | ||
| CCI: | CCI-001273 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | Analyze outbound communications traffic at the external interfaces to the system to discover anomalies. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SI-4 (11) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SI-4 (11) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (11) | |||
| NIST: NIST SP 800-53A (v1): SI-4 (11).1 | |||
| CCI: | CCI-001671 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-12 |
| Definition: | Analyze outbound communications traffic at selected organization-defined interior points within the system to discover anomalies. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SI-4 (11) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SI-4 (11) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (11) | |||
| NIST: NIST SP 800-53A (v1): SI-4 ( 11).1 | |||
| CCI: | CCI-002668 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Defines the interior points within the system where outbound communications will be analyzed to discover anomalies. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-4 (11) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (11) | |||
| CCI: | CCI-001274 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | Alert organization-defined personnel or roles using organization-defined automated mechanisms when inappropriate or unusual activities with security or privacy implications. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SI-4 (12) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SI-4 (12) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (12) | |||
| NIST: NIST SP 800-53A (v1): SI-4 (12).1 (ii) | |||
| CCI: | CCI-001275 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | Defines the activities which will trigger alerts to security personnel of inappropriate or unusual activities. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SI-4 (12) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SI-4 (12) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (12) | |||
| NIST: NIST SP 800-53A (v1): SI-4 (12).1 (i) | |||
| CCI: | CCI-004980 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the personnel or roles to receive alerts when indications of inappropriate or unusual activities with security or privacy occur. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (12) | ||
| CCI: | CCI-001276 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | Analyze communications traffic and event patterns for the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SI-4 (13) (a) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SI-4 (13) (a) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (13) (a) | |||
| NIST: NIST SP 800-53A (v1): SI-4 (13).1 (i) | |||
| CCI: | CCI-001277 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | Develop profiles representing common traffic and event patterns. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SI-4 (13) (b) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SI-4 (13) (b) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (13) (b) | |||
| NIST: NIST SP 800-53A (v1): SI-4 (13).1 (ii) | |||
| CCI: | CCI-002669 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Use the traffic and event profiles in tuning system-monitoring devices. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-4 (13) (c) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (13) (c) | |||
| CCI: | CCI-001673 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-12 |
| Definition: | Employ a wireless intrusion detection system to identify rogue wireless devices and to detect attack attempts and potential compromises or breaches to the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SI-4 (14) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SI-4 (14) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (14) | |||
| NIST: NIST SP 800-53A (v1): SI-4 (14).1 (iii) | |||
| CCI: | CCI-001282 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | Employ an intrusion detection system to monitor wireless communications traffic as the traffic passes from wireless to wireline networks. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SI-4 (15) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SI-4 (15) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (15) | |||
| NIST: NIST SP 800-53A (v1): SI-4 (15).1 | |||
| CCI: | CCI-001283 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | Correlate information from monitoring tools employed throughout the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SI-4 (16) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SI-4 (16) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (16) | |||
| NIST: NIST SP 800-53A (v1): SI-4 (16).1 | |||
| CCI: | CCI-004981 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Correlate information from monitoring mechanisms employed throughout the system. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (16) | ||
| CCI: | CCI-001284 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | Correlate information from monitoring physical, cyber, and supply chain activities to achieve integrated, organization-wide situational awareness. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SI-4 (17) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SI-4 (17) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (17) | |||
| NIST: NIST SP 800-53A (v1): SI-4 (17).1 | |||
| CCI: | CCI-002670 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Defines the interior points within the system where outbound communications will be analyzed to detect covert exfiltration of information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-4 (18) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (18) | |||
| CCI: | CCI-002671 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Analyze outbound communications traffic at the external interfaces of the system to detect covert exfiltration of information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-4 (18) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (18) | |||
| CCI: | CCI-002672 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Analyze outbound communications traffic at organization-defined interior points within the system to detect covert exfiltration of information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-4 (18) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (18) | |||
| CCI: | CCI-002673 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Defines the additional monitoring to be implemented for individuals identified as posing an increased level of risk. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-4 (19) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (19) | |||
| CCI: | CCI-002674 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Defines the sources that may be used to identify individuals who pose an increased level of risk. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-4 (19) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (19) | |||
| CCI: | CCI-002675 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Implement organization-defined additional monitoring of individuals who have been identified by organization-defined sources as posing an increased level of risk. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-4 (19) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (19) | |||
| CCI: | CCI-002676 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Defines additional monitoring to be implemented for privileged users. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-4 (20) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (20) | |||
| CCI: | CCI-002677 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Implement organization-defined additional monitoring of privileged users. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-4 (20) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (20) | |||
| CCI: | CCI-002678 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Defines additional monitoring to be implemented for individuals during an organization-defined probationary period. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-4 (21) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (21) | |||
| CCI: | CCI-002679 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Defines the probationary period during which additional monitoring will be implemented for individuals. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-4 (21) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (21) | |||
| CCI: | CCI-002680 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Implement organization-defined additional monitoring of individuals during an organization-defined probationary period. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-4 (21) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (21) | |||
| CCI: | CCI-002681 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Defines the authorization or approval process for network services. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-4 (22) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (22) (a) | |||
| CCI: | CCI-002682 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Defines the personnel or roles to be alerted when unauthorized or unapproved network services are detected. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-4 (22) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (22) (a) | |||
| CCI: | CCI-002683 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Detect network services that have not been authorized or approved by the organization-defined authorization or approval processes. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-4 (22) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (22) (a) | |||
| CCI: | CCI-002684 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Audit and/or alert organization-defined personnel when unauthorized network services are detected. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-4 (22) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (22) (b) | |||
| CCI: | CCI-002685 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Defines the host-based monitoring mechanisms to be implemented at organization-defined system components. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-4 (23) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (23) | |||
| CCI: | CCI-002686 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Defines the system components at which organization-defined host-based monitoring mechanisms are to be implemented. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-4 (23) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (23) | |||
| CCI: | CCI-002687 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Implement organization-defined host-based monitoring mechanisms at organization-defined system components. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-4 (23) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (23) | |||
| CCI: | CCI-002688 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Discover indicators of compromise. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-4 (24) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (24) | |||
| CCI: | CCI-002689 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Collect indicators of compromise. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-4 (24) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (24) | |||
| CCI: | CCI-002690 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Distribute indicators of compromise provided by organization-defined sources, to organization-defined personnel or roles. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-4 (24) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (24) | |||
| CCI: | CCI-004982 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Provide visibility into network traffic at external and key internal system interfaces to optimize the effectiveness of monitoring devices. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (25) | ||
| CCI: | CCI-001285 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | Receive system security alerts, advisories, and directives from organization-defined external organizations on an ongoing basis. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SI-5 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SI-5 a | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-5 a | |||
| NIST: NIST SP 800-53A (v1): SI-5.1 (i) | |||
| CCI: | CCI-002692 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Defines the external organizations from which it receives information system security alerts, advisories, and directives. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-5 a | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-5 a | |||
| CCI: | CCI-001286 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | Generate internal security alerts, advisories, and directives as deemed necessary. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SI-5 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SI-5 b | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-5 b | |||
| NIST: NIST SP 800-53A (v1): SI-5.1 (ii) | |||
| CCI: | CCI-001287 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | Disseminate security alerts, advisories, and directives to organization-defined personnel or roles, organization-defined elements within the organization, and/or organization-defined external organizations. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SI-5 c | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SI-5 c | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-5 c | |||
| NIST: NIST SP 800-53A (v1): SI-5.1 (iv) | |||
| CCI: | CCI-001288 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | Defines the personnel or roles to whom the organization will disseminate security alerts, advisories, and directives. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SI-5 c | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SI-5 c | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-5 c | |||
| NIST: NIST SP 800-53A (v1): SI-5.1 (iii) | |||
| CCI: | CCI-002693 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Defines the elements within the organization to whom the organization will disseminate security alerts, advisories, and directives. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-5 c | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-5 c | |||
| CCI: | CCI-002694 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Defines the external organizations to which the organization will disseminate security alerts, advisories, and directives. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-5 c | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-5 c | |||
| CCI: | CCI-001289 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | Implement security directives in accordance with established time frames, or notify the issuing organization of the degree of noncompliance. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SI-5 d | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SI-5 d | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-5 d | |||
| NIST: NIST SP 800-53A (v1): SI-5.1 (v) | |||
| CCI: | CCI-001290 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | Broadcast security alert and advisory information throughout the organization using organization-defined automated mechanisms. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SI-5 (1) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SI-5 (1) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-5 (1) | |||
| NIST: NIST SP 800-53A (v1): SI-5 (1).1 | |||
| CCI: | CCI-004983 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the automated mechanisms for broadcasting security alert and advisory information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SI-5 (1) | ||
| CCI: | CCI-002695 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Defines the security functions that require verification of correct operation. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-6 a | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-6 a | |||
| CCI: | CCI-002696 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Verify correct operation of organization-defined security functions. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-6 a | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-6 a | |||
| CCI: | CCI-004984 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the privacy functions that require verification of correct operation. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SI-6 a | ||
| CCI: | CCI-004985 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Verify correct operation of organization-defined privacy functions. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SI-6 a | ||
| CCI: | CCI-002697 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Defines the frequency at which it will verify correct operation of organization-defined security functions. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-6 b | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-6 b | |||
| CCI: | CCI-002698 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Defines the system transitional states when the system will verify correct operation of organization-defined security functions. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-6 b | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-6 b | |||
| CCI: | CCI-002699 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Perform verification of the correct operation of organization-defined security functions: when the system is in an organization-defined transitional state; upon command by a user with appropriate privileges; and/or on an organization-defined frequency. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-6 b | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-6 b | |||
| CCI: | CCI-004986 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the frequency at which it will verify correct operation of organization-defined privacy functions. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SI-6 b | ||
| CCI: | CCI-004987 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the system transitional states when the system will verify correct operation of organization-defined privacy functions. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SI-6 b | ||
| CCI: | CCI-004988 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Perform verification of the correct operation of organization-defined privacy functions: when the system is in an organization-defined transitional state; upon command by a user with appropriate privileges; and/or on an organization-defined frequency. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SI-6 b | ||
| CCI: | CCI-001294 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | Alert organization-defined personnel or roles of failed security verification tests. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): SI-6 (1) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SI-6 c | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-6 c | |||
| NIST: NIST SP 800-53A (v1): SI-6 (1).1 | |||
| CCI: | CCI-002700 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Defines the personnel or roles to be notified when security verification tests fail. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-6 c | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-6 c | |||
| CCI: | CCI-004989 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Alert organization-defined personnel or roles of failed privacy verification tests. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SI-6 c | ||
| CCI: | CCI-004990 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the personnel or roles to be notified when privacy verification tests fail. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SI-6 c | ||
| CCI: | CCI-002701 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Defines alternative action(s) to be taken when anomalies in the operation of organization-defined security functions are discovered. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-6 d | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-6 d | |||
| CCI: | CCI-002702 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Shut the system down, restart the system, and/or initiate organization-defined alternative action(s) when anomalies in the operation of the organization-defined security functions are discovered. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-6 d | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-6 d | |||
| CCI: | CCI-004991 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines alternative action(s) to be taken when anomalies in the operation of organization-defined privacy functions are discovered. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SI-6 d | ||
| CCI: | CCI-004992 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Shut the system down, restart the system, and/or initiate organization-defined alternative action(s) when anomalies in the operation of the organization-defined privacy functions are discovered. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SI-6 d | ||
| CCI: | CCI-001295 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | Implement automated mechanisms to support the management of distributed security function testing. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): SI-6 (2) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SI-6 (2) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-6 (2) | |||
| NIST: NIST SP 800-53A (v1): SI-6 (2).1 | |||
| CCI: | CCI-004993 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Implement automated mechanisms to support the management of distributed privacy function testing. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SI-6 (2) | ||
| CCI: | CCI-001296 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | Report the results of security function verification to organization-defined personnel or roles. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SI-6 (3) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SI-6 (3) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-6 (3) | |||
| NIST: NIST SP 800-53A (v1): SI-6 (3).1 (ii) | |||
| CCI: | CCI-001675 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-12 |
| Definition: | Defines the personnel or roles that are to receive reports on the results of security function verification. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SI-6 (3) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SI-6 (3) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-6 (3) | |||
| NIST: NIST SP 800-53A (v1): SI-6 (3).1 (i) | |||
| CCI: | CCI-004994 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Report the results of privacy function verification to organization-defined personnel or roles. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SI-6 (3) | ||
| CCI: | CCI-004995 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the personnel or roles that are to receive reports on the results of privacy function verification. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SI-6 (3) | ||
| CCI: | CCI-002703 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Defines the software, firmware, and information which will be subjected to integrity verification tools to detect unauthorized changes. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-7 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-7 | |||
| CCI: | CCI-002704 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Employ integrity verification tools to detect unauthorized changes to organization-defined software, firmware, and information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-7 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-7 a | |||
| CCI: | CCI-004996 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Take organization-defined actions when unauthorized changes to the software, firmware, and information are detected. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SI-7 b | ||
| CCI: | CCI-004997 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the actions to be taken when unauthorized changes to the software, firmware, and information are detected. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SI-7 b | ||
| CCI: | CCI-002705 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Defines the software on which integrity checks will be performed. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-7 (1) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-7 (1) | |||
| CCI: | CCI-002706 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Defines the firmware on which integrity checks will be performed. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-7 (1) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-7 (1) | |||
| CCI: | CCI-002707 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Defines the information on which integrity checks will be performed. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-7 (1) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-7 (1) | |||
| CCI: | CCI-002708 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Defines the transitional state or security-relevant events when performing integrity checks on software, firmware, and information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-7 (1) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-7 (1) | |||
| CCI: | CCI-002709 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Defines the frequency at which integrity checks of software, firmware, and information will be performed. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-7 (1) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-7 (1) | |||
| CCI: | CCI-002710 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Perform an integrity check of organization-defined software at startup, at organization-defined transitional states or security-relevant events, or on an organization-defined frequency. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-7 (1) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-7 (1) | |||
| CCI: | CCI-002711 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Perform an integrity check of organization-defined firmware at startup, at organization-defined transitional states or security-relevant events, or on an organization-defined frequency. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-7 (1) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-7 (1) | |||
| CCI: | CCI-002712 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Perform an integrity check of organization-defined information at startup, at organization-defined transitional states or security-relevant events, or on an organization-defined frequency. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-7 (1) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-7 (1) | |||
| CCI: | CCI-001300 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | Employ automated tools that provide notification to organization-defined personnel or roles upon discovering discrepancies during integrity verification. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SI-7 (2) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SI-7 (2) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-7 (2) | |||
| NIST: NIST SP 800-53A (v1): SI-7 (2).1 | |||
| CCI: | CCI-002713 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Defines the personnel or roles to be notified when discrepancies are discovered during integrity verification. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-7 (2) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-7 (2) | |||
| CCI: | CCI-001301 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | Employ centrally managed integrity verification tools. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SI-7 (3) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SI-7 (3) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-7 (3) | |||
| NIST: NIST SP 800-53A (v1): SI-7 (3).1 | |||
| CCI: | CCI-002714 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Defines the controls that are to be employed when integrity violations are discovered. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-7 (5) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-7 (5) | |||
| CCI: | CCI-002715 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Automatically shut the system down, restart the system, and/or implement organization-defined controls when integrity violations are discovered. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-7 (5) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-7 (5) | |||
| CCI: | CCI-002716 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Implement cryptographic mechanisms to detect unauthorized changes to software. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-7 (6) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-7 (6) | |||
| CCI: | CCI-002717 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Implement cryptographic mechanisms to detect unauthorized changes to firmware. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-7 (6) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-7 (6) | |||
| CCI: | CCI-002718 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Implement cryptographic mechanisms to detect unauthorized changes to information. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-7 (6) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-7 (6) | |||
| CCI: | CCI-002719 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Defines the unauthorized security-relevant changes to the system that are to be incorporated into the organizational incident response capability. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-7 (7) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-7 (7) | |||
| CCI: | CCI-002720 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Incorporate the detection of organization-defined security-relevant unauthorized changes into the organizational incident response capability. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-7 (7) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-7 (7) | |||
| CCI: | CCI-002721 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Defines the personnel or roles that are to be alerted when a potential integrity violation is detected. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-7 (8) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-7 (8) | |||
| CCI: | CCI-002722 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Defines other actions that can be taken when a potential integrity violation is detected. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-7 (8) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-7 (8) | |||
| CCI: | CCI-002723 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Upon detection of a potential integrity violation, provides the capability to audit the event. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-7 (8) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-7 (8) | |||
| CCI: | CCI-002724 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Upon detection of a potential integrity violation, initiate one or more of the following actions: generate an audit record; alert the current user; alert organization-defined personnel or roles; and/or organization-defined other actions. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-7 (8) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-7 (8) | |||
| CCI: | CCI-002725 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Defines the system component which will have the integrity of the boot process verified. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-7 (9) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-7 (9) | |||
| CCI: | CCI-002726 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Verify the integrity of the boot process of organization-defined system components. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-7 (9) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-7 (9) | |||
| CCI: | CCI-002727 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Defines the mechanisms to be implemented to protect the integrity of the boot firmware in organization-defined system components. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-7 (10) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-7 (10) | |||
| CCI: | CCI-002728 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Defines the system components on which organization-defined mechanisms will be implemented to protect the integrity of the boot firmware. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-7 (10) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-7 (10) | |||
| CCI: | CCI-002729 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Implement organization-defined mechanisms to protect the integrity of boot firmware in organization-defined system components. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-7 (10) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-7 (10) | |||
| CCI: | CCI-002732 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Defines the user-installed software that is to have its integrity verified prior to execution. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-7 (12) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-7 (12) | |||
| CCI: | CCI-002733 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Require that the integrity of organization-defined user-installed software be verified prior to execution. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-7 (12) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-7 (12) | |||
| CCI: | CCI-002734 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Defines the personnel or roles which have the authority to explicitly approve binary or machine-executable code. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-7 (13) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-7 (13) | |||
| CCI: | CCI-002739 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Defines the software or firmware components on which cryptographic mechanisms are to be implemented to support authentication prior to installation. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-7 (15) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-7 (15) | |||
| CCI: | CCI-002740 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Implement cryptographic mechanisms to authenticate organization-defined software or firmware components prior to installation. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-7 (15) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-7 (15) | |||
| CCI: | CCI-001321 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | Prohibit processes from executing without supervision for more than an organization-defined time period. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SI-13 (2) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SI-7 (16) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-7 (16) | |||
| NIST: NIST SP 800-53A (v1): SI-13 (2).1 (ii) | |||
| CCI: | CCI-001322 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | Defines a time period that is the longest a process is allowed to execute without supervision. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SI-13 (2) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SI-7 (16) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-7 (16) | |||
| NIST: NIST SP 800-53A (v1): SI-13 (2).1 (i) | |||
| CCI: | CCI-004998 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Implement organization-defined controls for application self-protection at runtime. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SI-7 (17) | ||
| CCI: | CCI-004999 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the controls to be implemented for runtime application self-protection. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SI-7 (17) | ||
| CCI: | CCI-002741 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Employ spam protection mechanisms at system entry points to detect and take action on unsolicited messages. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-8 a | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-8 a | |||
| CCI: | CCI-002742 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Employ spam protection mechanisms at system exit points to detect and take action on unsolicited messages. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-8 a | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-8 a | |||
| CCI: | CCI-005000 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Update spam protection mechanisms when new releases are available in accordance with organizational configuration management policy. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SI-8 b | ||
| CCI: | CCI-005001 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Update spam protection mechanisms when new releases are available in accordance with organizational configuration management procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SI-8 b | ||
| CCI: | CCI-001308 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | Automatically update spam protection mechanisms on an organization-defined frequency. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): SI-8 (2) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SI-8 (2) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-8 (2) | |||
| NIST: NIST SP 800-53A (v1): SI-8 (2).1 | |||
| CCI: | CCI-005002 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the frequency for updating spam protection mechanisms. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SI-8 (2) | ||
| CCI: | CCI-002743 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Implement spam protection mechanisms with a learning capability to more effectively identify legitimate communications traffic. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-8 (3) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-8 (3) | |||
| CCI: | CCI-001310 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | Checks the validity of organization-defined information inputs to the system. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): SI-10 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SI-10 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-10 | |||
| NIST: NIST SP 800-53A (v1): SI-10.1 | |||
| CCI: | CCI-002744 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Defines the inputs on which the system is to conduct validity checks. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-10 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-10 | |||
| CCI: | CCI-002745 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Defines the inputs defined in base control (SI-10), which provide a manual override capability for input validation. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-10 (1) (a) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-10 (1) (a) | |||
| CCI: | CCI-002746 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Provide a manual override capability for input validation of organization-defined inputs defined in base control (SI-10). | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-10 (1) (a) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-10 (1) (a) | |||
| CCI: | CCI-002747 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Defines the individuals who have the authorization to use the manual override capability for input validation. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-10 (1) (b) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-10 (1) (b) | |||
| CCI: | CCI-002748 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Restrict the use of the manual override capability to only organization-defined authorized individuals. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-10 (1) (b) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-10 (1) (b) | |||
| CCI: | CCI-002749 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Audit the use of the manual override capability. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-10 (1) (c) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-10 (1) (c) | |||
| CCI: | CCI-002750 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Defines the time-period within which input validation errors are to be reviewed. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-10 (2) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-10 (2) | |||
| CCI: | CCI-002751 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Defines the time-period within which input validation errors are to be resolved. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-10 (2) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-10 (2) | |||
| CCI: | CCI-002752 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Review input validation errors within an organization-defined time period. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-10 (2) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-10 (2) | |||
| CCI: | CCI-002753 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Resolve input validation errors within an organization-defined time period. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-10 (2) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-10 (2) | |||
| CCI: | CCI-002754 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Verify that the system behaves in a predictable and documented manner that reflects organizational and system objectives when invalid inputs are received. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-10 (3) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-10 (3) | |||
| CCI: | CCI-002755 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Account for timing interactions among system components in determining appropriate responses for invalid inputs. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-10 (4) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-10 (4) | |||
| CCI: | CCI-002756 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Defines the trusted sources to which the usage of information inputs will be restricted (e.g., whitelisting). | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-10 (5) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-10 (5) | |||
| CCI: | CCI-002757 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Defines the acceptable formats to which information inputs are restricted. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-10 (5) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-10 (5) | |||
| CCI: | CCI-002758 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Restrict the use of information inputs to organization-defined trusted sources and/or organization-defined formats. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-10 (5) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-10 (5) | |||
| CCI: | CCI-005003 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Prevent untrusted data injections. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SI-10 (6) | ||
| CCI: | CCI-001312 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | Generate error messages that provide information necessary for corrective actions without revealing information that could be exploited. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): SI-11 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SI-11 a | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-11 a | |||
| NIST: NIST SP 800-53A (v1): SI-11.1 (iii) | |||
| CCI: | CCI-001314 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | Reveal error messages only to organization-defined personnel or roles. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): SI-11 c | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SI-11 b | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-11 b | |||
| NIST: NIST SP 800-53A (v1): SI-11.1 (iv) | |||
| CCI: | CCI-002759 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Defines the personnel or roles to whom error messages are to be revealed. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-11 b | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-11 b | |||
| CCI: | CCI-001315 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | Manage information within the system and information output from the system in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and operational requirements. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SI-12 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SI-12 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-12 | |||
| NIST: NIST SP 800-53A (v1): SI-12.1 (i) | |||
| CCI: | CCI-001678 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-12 |
| Definition: | Retain information within the system and information output from the system in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and operational requirements. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SI-12 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SI-12 | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-12 | |||
| NIST: NIST SP 800-53A (v1): SI-12.1 (ii) | |||
| CCI: | CCI-005004 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Limit personally identifiable information being processed in the information life cycle to the organization-defined elements of personally identifiable information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SI-12 (1) | ||
| CCI: | CCI-005005 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the elements of personally identifiable information being processed in the information life cycle. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SI-12 (1) | ||
| CCI: | CCI-005006 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Use organization-defined techniques to minimize the use of personally identifiable information for research, testing, or training, in accordance with the privacy risk assessment. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SI-12 (2) | ||
| CCI: | CCI-005007 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the techniques for minimizing the use of personally identifiable information for research, testing, or training. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SI-12 (2) | ||
| CCI: | CCI-005008 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Use organization-defined techniques to dispose of, destroy, or erase information following the retention period. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SI-12 (3) | ||
| CCI: | CCI-002760 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Determines mean time to failure (MTTF) for organization-defined system components in specific environments of operation. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-13 a | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-13 a | |||
| CCI: | CCI-002761 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Defines the system components in specific environments of operation for which the mean time to failure (MTTF) is to be determined. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-13 a | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-13 a | |||
| CCI: | CCI-001318 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | Provide substitute system components. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SI-13 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SI-13 b | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-13 b | |||
| NIST: NIST SP 800-53A (v1): SI-13.1 (iii) | |||
| CCI: | CCI-002762 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Defines the mean time to failure (MTTF) substitution criteria to be employed as a means to determine the need to exchange active and standby components. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-13 b | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-13 b | |||
| CCI: | CCI-002763 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Provide a means to exchange active and standby components in accordance with the organization-defined mean time to failure (MTTF) substitution criteria. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-13 b | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-13 b | |||
| CCI: | CCI-001319 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | Take system components out of service by transferring component responsibilities to a substitute component no later than an organization-defined fraction or percentage of mean time to failure (MTTF). | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SI-13 (1) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SI-13 (1) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-13 (1) | |||
| NIST: NIST SP 800-53A (v1): SI-13 (1).1 (ii) | |||
| CCI: | CCI-001320 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | Defines the maximum fraction or percentage of mean time to failure (MTTF) used to determine when system components are taken out of service by transferring component responsibilities to substitute components. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SI-13 (1) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SI-13 (1) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-13 (1) | |||
| NIST: NIST SP 800-53A (v1): SI-13 (1).1 (i) | |||
| CCI: | CCI-001323 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | Manually initiate transfers between active and standby system components when the use of the active component reaches an organization-defined percentage of the mean time to failure. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SI-13 (3) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SI-13 (3) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-13 (3) | |||
| NIST: NIST SP 800-53A (v1): SI-13 (3).1 (iii) | |||
| CCI: | CCI-005009 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the percentage of the mean time to failure used to manually initiate transfer between active and standby system components. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SI-13 (3) | ||
| CCI: | CCI-001326 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | If system component failures are detected, ensure standby components are successfully and transparently installed within an organization-defined time period. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SI-13 (4) (a) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SI-13 (4) (a) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-13 (4) (a) | |||
| NIST: NIST SP 800-53A (v1): SI-13 (4).1 (iii) | |||
| CCI: | CCI-001327 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | Defines a time period for a standby system component to be successfully and transparently installed for the system component that has failed. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SI-13 (4) (a) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SI-13 (4) (a) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-13 (4) (a) | |||
| NIST: NIST SP 800-53A (v1): SI-13 (4).1 (i) | |||
| CCI: | CCI-001328 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | If system component failures are detected, activate an organization-defined alarm, automatically shut down the system, and/or organization-defined action. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): SI-13 (4) (b) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SI-13 (4) (b) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-13 (4) (b) | |||
| NIST: NIST SP 800-53A (v1): SI-13 (4).1 (iii) | |||
| CCI: | CCI-001329 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | Defines the alarm to be activated when a system component failure is detected. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SI-13 (4) (b) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SI-13 (4) (b) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-13 (4) (b) | |||
| NIST: NIST SP 800-53A (v1): SI-13 (4).1 (ii) | |||
| CCI: | CCI-005010 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the action to be taken when system failures are detected. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SI-13 (4) (b) | ||
| CCI: | CCI-000558 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Defines the real-time or near-real-time failover capability to be provided for the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-10 (5) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SI-13 (5) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-13 (5) | |||
| NIST: NIST SP 800-53A (v1): CP-10 (5).1 (i) | |||
| CCI: | CCI-000559 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | Provide real-time or near-real-time organization-defined failover capability for the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-10 (5) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SI-13 (5) | |||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-13 (5) | |||
| NIST: NIST SP 800-53A (v1): CP-10 (5).1 (ii) | |||
| CCI: | CCI-002764 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Defines non-persistent system components and services to be implemented. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-14 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-14 | |||
| CCI: | CCI-002765 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Defines the frequency at which the organization-defined non-persistent system components and services will be terminated. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-14 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-14 | |||
| CCI: | CCI-002766 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Implement organization-defined non-persistence system components and services that are initiated in a known state. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-14 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-14 | |||
| CCI: | CCI-002767 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Implement organization-defined non-persistence system components and services that are terminated upon end of session of use and/or periodically at an organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-14 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-14 | |||
| CCI: | CCI-002768 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Defines the trusted sources from which it obtains software and data employed during the refreshing of non-persistent system components and services. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-14 (1) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-14 (1) | |||
| CCI: | CCI-002769 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Obtain software and data employed during non-persistent system component and service refreshes are obtained from organization-defined trusted sources. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-14 (1) | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-14 (1) | |||
| CCI: | CCI-005011 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Refresh organization-defined information on an organization-defined frequency, or generate organization-defined information on demand. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SI-14 (2) (a) | ||
| CCI: | CCI-005012 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the information to be refreshed on an organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SI-14 (2) (a) | ||
| CCI: | CCI-005013 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the frequency at which to refresh organization-defined information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SI-14 (2) (a) | ||
| CCI: | CCI-005014 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the information to be generated on demand. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SI-14 (2) (a) | ||
| CCI: | CCI-005015 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Delete information when no longer needed. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SI-14 (2) (b) | ||
| CCI: | CCI-005016 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Refresh connections to the system on demand. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SI-14 (3) | ||
| CCI: | CCI-005017 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Terminate connections after completion of a request, or a period of non-use. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SI-14 (3) | ||
| CCI: | CCI-002770 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Defines the software programs and/or applications from which the system is to validate the information output to ensure the information is consistent with expected content. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-15 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-15 | |||
| CCI: | CCI-002771 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Validate information output from organization-defined software programs and/or applications to ensure that the information is consistent with the expected content. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-15 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-15 | |||
| CCI: | CCI-002823 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-12 |
| Definition: | Defines the controls to be implemented to protect the system memory from unauthorized code execution. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-16 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-16 | |||
| CCI: | CCI-002824 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-12 |
| Definition: | Implement organization-defined controls to protect the system memory from unauthorized code execution. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-16 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-16 | |||
| CCI: | CCI-002773 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Defines the fail-safe procedures to be implemented when organization-defined failure conditions occur. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-17 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-17 | |||
| CCI: | CCI-002774 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Defines the failure conditions which, when they occur, will result in the information system implementing organization-defined fail-safe procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-17 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-17 | |||
| CCI: | CCI-002775 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | Implement organization-defined fail-safe procedures when organization-defined failure conditions occur. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-17 | ||
| NIST: NIST SP 800-53 Revision 5 (v5): SI-17 | |||
| CCI: | CCI-005018 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Check the accuracy, relevance, timeliness, and completeness of personally identifiable information across the information life cycle, on an organization-defined frequency. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SI-18 a | ||
| CCI: | CCI-005019 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the frequency for checking the accuracy, relevance, timeliness, and completeness of personally identifiable information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SI-18 a | ||
| CCI: | CCI-005020 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Correct or delete inaccurate or outdated personally identifiable information. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SI-18 b 1 | ||
| CCI: | CCI-005021 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Correct or delete personally identifiable information that is inaccurate or outdated, incorrectly determined regarding impact, or incorrectly de-identified using organization-defined mechanisms. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SI-18 (1) | ||
| CCI: | CCI-005022 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the automated mechanisms for identifying inaccurate or outdated, incorrectly determined regarding impact, or incorrectly de-identified personally identifiable information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SI-18 (1) | ||
| CCI: | CCI-005023 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Employ data tags to automate the correction or deletion of personally identifiable information across the information life cycle within organizational systems. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SI-18 (2) | ||
| CCI: | CCI-005024 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Collect personally identifiable information directly from the individual. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SI-18 (3) | ||
| CCI: | CCI-005025 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Correct or delete personally identifiable information upon request by individuals or their designated representatives. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SI-18 (4) | ||
| CCI: | CCI-005026 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Notify organization-defined recipients of personally identifiable information that the personally identifiable information has been corrected or deleted. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SI-18 (5) | ||
| CCI: | CCI-005027 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the recipients of personally identifiable information who are to be notified when the personally identifiable information is corrected or deleted. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SI-18 (5) | ||
| CCI: | CCI-005028 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Notify individuals that the personally identifiable information has been corrected or deleted. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SI-18 (5) | ||
| CCI: | CCI-005029 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Remove the following elements of personally identifiable information from datasets. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SI-19 a | ||
| CCI: | CCI-005030 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the elements of personally identifiable information to be removed from datasets. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SI-19 a | ||
| CCI: | CCI-005031 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Evaluate organization-defined frequency for effectiveness of de-identification. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SI-19 b | ||
| CCI: | CCI-005032 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the frequency for evaluating for effectiveness of de-identification. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SI-19 b | ||
| CCI: | CCI-005033 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | De-identify the dataset upon collection by not collecting personally identifiable information. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SI-19 (1) | ||
| CCI: | CCI-005034 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Prohibit archiving personally identifiable information elements if those elements in a dataset will not be needed after the dataset is archived. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SI-19 (2) | ||
| CCI: | CCI-005035 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Remove personally identifiable information elements from a dataset prior to its release if those elements in the dataset do not need to be part of the data release. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SI-19 (3) | ||
| CCI: | CCI-005036 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Remove, mask, encrypt, hash, or replace direct identifiers in a dataset. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SI-19 (4) | ||
| CCI: | CCI-005037 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Manipulate numerical data, contingency tables, and statistical findings so that no individual or organization is identifiable in the results of the analysis. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SI-19 (5) | ||
| CCI: | CCI-005038 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Prevent disclosure of personally identifiable information by adding non-deterministic noise to the results of mathematical operations before the results are reported. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SI-19 (6) | ||
| CCI: | CCI-005039 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Perform de-identification using validated algorithms and software that is validated to implement the algorithms. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SI-19 (7) | ||
| CCI: | CCI-005040 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Perform a motivated intruder test on the de-identified dataset to determine if the identified data remains or if the de-identified data can be re-identified. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SI-19 (8) | ||
| CCI: | CCI-005041 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Embed data or capabilities in the following systems or system components to determine if organizational data has been exfiltrated or improperly removed from the organization. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SI-20 | ||
| CCI: | CCI-005042 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the systems or system components used to determine if organizational data has been exfiltrated or improperly removed from the organization. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SI-20 | ||
| CCI: | CCI-005043 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Refresh organization-defined information at organization-defined frequencies or generate the information on demand and delete the information when no longer needed. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SI-21 | ||
| CCI: | CCI-005044 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the information to be refreshed at organization-defined frequencies or generate the information on demand and delete the information when no longer needed. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SI-21 | ||
| CCI: | CCI-005045 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the frequencies for refreshing organization-defined information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SI-21 | ||
| CCI: | CCI-005046 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Identify the following alternate sources of information for organization-defined essential functions and services. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SI-22 a | ||
| CCI: | CCI-005047 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the alternative information sources for identifying organization-defined essential functions and services. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SI-22 a | ||
| CCI: | CCI-005048 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Use an alternate information source for the execution of essential functions or services on organization-defined systems or system components when the primary source of information is corrupted or unavailable. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SI-22 b | ||
| CCI: | CCI-005049 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the systems or system components used as an alternate information source for the execution of essential functions or services when the primary source of information is corrupted or unavailable. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SI-22 b | ||
| CCI: | CCI-005050 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Based on organization-defined circumstances, fragment the following information. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SI-23 a | ||
| CCI: | CCI-005051 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the information for fragmentation. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SI-23 a | ||
| CCI: | CCI-005052 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the circumstances for fragmenting organization-defined information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SI-23 a | ||
| CCI: | CCI-005053 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Based on organization-defined circumstances, distribute the fragmented information across the following systems or system components. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SI-23 b | ||
| CCI: | CCI-005054 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the systems or system components used to distribute fragmented information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SI-23 b | ||
| CCI: | CCI-005055 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the circumstances for distributing fragmented information across organization-defined systems or system components. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SI-23 b | ||
| CCI: | CCI-005056 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Disseminate an organization-level, mission/business process-level, and/or system-level supply chain risk management policy to organization-defined personnel or roles. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SR-1 a 1 | ||
| CCI: | CCI-005057 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Develop and document an organization-level, mission/business process-level, and/or system-level supply chain risk management policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SR-1 a 1 (a) | ||
| CCI: | CCI-005058 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Develop and document organization-level, mission/business process-level, and/or system-level supply chain risk management policy that is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SR-1 a 1 (b) | ||
| CCI: | CCI-005059 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Develop and document procedures to facilitate the implementation of the supply chain risk management policy and the associated supply chain risk management controls. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SR-1 a 2 | ||
| CCI: | CCI-005060 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Designate an organization-defined official to manage the development and documentation of the supply chain risk management policy. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SR-1 b | ||
| CCI: | CCI-005061 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Designate an organization-defined official to manage the development and documentation of the supply chain risk management procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SR-1 b | ||
| CCI: | CCI-005062 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Designate an organization-defined official to manage the dissemination of the supply chain risk management policy. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SR-1 b | ||
| CCI: | CCI-005063 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Designate an organization-defined official to manage the dissemination of the supply chain risk management procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SR-1 b | ||
| CCI: | CCI-005064 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Review and update the current supply chain risk management policy on an organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SR-1 c 1 | ||
| CCI: | CCI-005065 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the frequency for reviewing and updating the current supply chain risk management policy. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SR-1 c 1 | ||
| CCI: | CCI-005066 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Review and update the current supply chain risk management policy following organization-defined events. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SR-1 c 1 | ||
| CCI: | CCI-005067 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the events following reviewing and updating the current supply chain risk management policy. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SR-1 c 1 | ||
| CCI: | CCI-005068 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Review and update the current supply chain risk management procedures on an organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SR-1 c 2 | ||
| CCI: | CCI-005069 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the frequency for reviewing and updating the current supply chain risk management procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SR-1 c 2 | ||
| CCI: | CCI-005070 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Review and update the current supply chain risk management procedures following organization-defined events. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SR-1 c 2 | ||
| CCI: | CCI-005071 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the events following reviewing and updating the current supply chain risk management procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SR-1 c 2 | ||
| CCI: | CCI-005072 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Develop a plan for managing supply chain risks associated with the research and development, design, manufacturing, acquisition, delivery, integration, operations and maintenance, and disposal of the following systems, system components, or system services. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SR-2 a | ||
| CCI: | CCI-005073 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the systems, system components, or system services that a plan for managing supply chain risks are developed. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SR-2 a | ||
| CCI: | CCI-005074 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Review and update the supply chain risk management plan on an organization-defined frequency, or as required, to address threat, organizational or environmental changes. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SR-2 b | ||
| CCI: | CCI-005075 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the frequency for reviewing and updating the supply chain risk management plan. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SR-2 b | ||
| CCI: | CCI-005076 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Protect the supply chain risk management plan from unauthorized disclosure and modification. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SR-2 c | ||
| CCI: | CCI-005077 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Establish a supply chain risk management team consisting of organization-defined personnel, roles, and responsibilities to lead and support the following SCRM activities. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SR-2 (1) | ||
| CCI: | CCI-005078 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the supply chain risk management activities that will be led by a supply chain risk management team consisting of organization-defined personnel, roles, and responsibilities. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SR-2 (1) | ||
| CCI: | CCI-005079 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the personnel, roles, and responsibilities who lead and support organization-defined supply chain risk management activities. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SR-2 (1) | ||
| CCI: | CCI-005080 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Establish a process of processes to identify and address weaknesses or deficiencies in the supply chain elements of organization-defined system or system components in coordination with organization-defined supply chain personnel. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SR-3 a | ||
| CCI: | CCI-005081 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the system or system processes which establish a process or processes for identifying and addressing weaknesses or deficiencies in the supply chain elements. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SR-3 a | ||
| CCI: | CCI-005082 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the supply chain personnel who, in coordination, establish a process or processes for identifying and addressing weaknesses or deficiencies in the supply chain elements. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SR-3 a | ||
| CCI: | CCI-005083 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Establish a process of processes to identify and address weaknesses or deficiencies in the processes of organization-defined system or system components in coordination with organization-defined supply chain personnel. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SR-3 a | ||
| CCI: | CCI-005084 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the system or system processes which establish a process or processes for identifying and addressing weaknesses or deficiencies in the supply chain processes. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SR-3 a | ||
| CCI: | CCI-005085 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the supply chain personnel who, in coordination, establish a process or processes for identifying and addressing weaknesses or deficiencies in the supply chain processes. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SR-3 a | ||
| CCI: | CCI-005086 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Employ the following controls to protect against supply chain risks to the system, system component, or system service. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SR-3 b | ||
| CCI: | CCI-005087 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Limit the harm or consequences from supply chain-related events. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SR-3 b | ||
| CCI: | CCI-005088 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the supply chain controls employed for protecting against supply chain risks to the system, system component, or system service. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SR-3 b | ||
| CCI: | CCI-005089 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Document the selected and implemented supply chain processes and controls in security and privacy plans, supply chain risk management plan, or organization-defined document. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SR-3 c | ||
| CCI: | CCI-005090 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the document which contains supply chain processes and controls. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SR-3 c | ||
| CCI: | CCI-005091 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Employ a diverse set of sources for the following system components and services. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SR-3 (1) | ||
| CCI: | CCI-005092 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the system or system components and services which employ a diverse set of sources. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SR-3 (1) | ||
| CCI: | CCI-005093 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Employ the following controls to limit harm from potential adversaries identifying and targeting the organizational supply chain. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SR-3 (2) | ||
| CCI: | CCI-005094 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the controls to be employed to limit harm from potential adversaries identifying and targeting the organizational supply chain. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SR-3 (2) | ||
| CCI: | CCI-005095 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Ensure that the controls included in the contracts of prime contractors are also included in the contracts of subcontractors. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SR-3 (3) | ||
| CCI: | CCI-005096 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Document valid provenance of the following systems, system components, and associated data. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SR-4 | ||
| CCI: | CCI-005097 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Monitor valid provenance of the following systems, system components, and associated data. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SR-4 | ||
| CCI: | CCI-005098 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Maintain valid provenance of the following systems, system components, and associated data. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SR-4 | ||
| CCI: | CCI-005099 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the systems, system components, and associated data for documenting, monitoring, and maintaining valid provenance. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SR-4 | ||
| CCI: | CCI-005100 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Establish and maintain unique identification of the following supply chain elements, processes, and personnel associated with the identified system and critical system components. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SR-4 (1) | ||
| CCI: | CCI-005101 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the supply chain elements, processes, and personnel associated with organization-defined systems and critical system components for establishing and maintaining unique identification. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SR-4 (1) | ||
| CCI: | CCI-005102 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Establish and maintain unique identification of the following systems and critical components for tracking through the supply chain. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SR-4 (2) | ||
| CCI: | CCI-005103 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the systems and critical system components for tracking through the supply chain. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SR-4 (2) | ||
| CCI: | CCI-005104 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Employ the following controls to validate that the system or system component received is genuine. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SR-4 (3) | ||
| CCI: | CCI-005105 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Employ the following controls to validate that the system or system component received has not been altered. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SR-4 (3) | ||
| CCI: | CCI-005106 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the controls for validating that the system or system component received is genuine. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SR-4 (3) | ||
| CCI: | CCI-005107 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the controls for validating that the system or system component received has not been altered. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SR-4 (3) | ||
| CCI: | CCI-005108 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Employ organization-defined controls to ensure the integrity of the system and system components by validating the internal composition and provenance of critical or mission essential technologies, products, and services. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SR-4 (4) | ||
| CCI: | CCI-005109 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the controls for ensuring the integrity of the system and system components. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SR-4 (4) | ||
| CCI: | CCI-005110 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Conduct organization-defined analysis to ensure the integrity of the system and system components by validating the internal composition and provenance of critical or mission essential technologies, products, and services. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SR-4 (4) | ||
| CCI: | CCI-005111 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the analysis for ensuring the integrity of the system and system components. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SR-4 (4) | ||
| CCI: | CCI-005112 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Employ the following acquisition strategies, contract tools, and procurement methods to protect against, identify, and mitigate supply chain risks. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SR-5 | ||
| CCI: | CCI-005113 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the acquisition strategies, contract tools, and procurement methods for protecting against, identifying, and mitigating supply chain risks. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SR-5 | ||
| CCI: | CCI-005114 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Employ the following controls to ensure an adequate supply of organization-defined critical system components. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SR-5 (1) | ||
| CCI: | CCI-005115 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the controls for ensuring an adequate supply of organization-defined critical system components. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SR-5 (1) | ||
| CCI: | CCI-005116 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the critical system components that the organization-defined controls ensure an adequate supply of. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SR-5 (1) | ||
| CCI: | CCI-005117 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Access the system, system component, or system service prior to selection, acceptance, modification, or update. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SR-5 (2) | ||
| CCI: | CCI-005118 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Access and review the supply chain-related risks associated with suppliers or contractors and the system, system component, or system service they provide on an organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SR-6 | ||
| CCI: | CCI-005119 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the frequency for assessing and reviewing the supply chain risks. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SR-6 | ||
| CCI: | CCI-005120 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Employ organizational analysis, independent third-party analysis, organizational testing, and/or independent third-party testing of the following supply chain elements, processes, and actors associated with the system, system component, or system service. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SR-6 (1) | ||
| CCI: | CCI-005121 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the supply chain elements, processes, and actors for employing organizational analysis, independent third-party analysis, organizational testing, and/or independent third-party testing. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SR-6 (1) | ||
| CCI: | CCI-005122 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Employ the following Operations Security (OPSEC) controls to protect supply chain-related information for the system, system component, or system service. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SR-7 | ||
| CCI: | CCI-005123 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the Operations Security (OPSEC) controls that protect supply chain-related information for the system, system component, or system service. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SR-7 | ||
| CCI: | CCI-005124 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Establish agreements and procedures with entities involved in the supply chain for the system, system component, or system service for the notification of supply chain compromises, results of assessments or audits, and/or organization-defined information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SR-8 | ||
| CCI: | CCI-005125 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the information for establishing agreements and procedures with entities involved in the supply chain for the system, system component, or system service. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SR-8 | ||
| CCI: | CCI-005126 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Implement a tamper protection program for the system, system component, or system service. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SR-9 | ||
| CCI: | CCI-005127 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Employ anti-tamper technologies, tool, and techniques throughout the system development life cycle. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SR-9 (1) | ||
| CCI: | CCI-005128 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Inspect the following systems or system components at random, at organization-defined frequency, and/or upon organization-defined indications of need for inspection to detect tampering. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SR-10 | ||
| CCI: | CCI-005129 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the frequency for inspecting systems or system components. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SR-10 | ||
| CCI: | CCI-005130 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the indications of need for inspection for detecting tampering. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SR-10 | ||
| CCI: | CCI-005131 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the system or system components which will be inspected at random, at organization-defined frequency, and/or upon organization-defined indications of need for inspection to detect tampering. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SR-10 | ||
| CCI: | CCI-005132 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Develop and document anti-counterfeit policy that include the means to detect and prevent counterfeit components from entering the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SR-11 a | ||
| CCI: | CCI-005133 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Develop and document anti-counterfeit procedures that include the means to detect and prevent counterfeit components from entering the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SR-11 a | ||
| CCI: | CCI-005134 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Report counterfeit system components to source of counterfeit component, organization-defined external reporting organizations, and/or organization-defined personnel or roles. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SR-11 b | ||
| CCI: | CCI-005135 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the external reporting organizations who report counterfeit system components. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SR-11 b | ||
| CCI: | CCI-005136 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the personnel or roles who report counterfeit system components. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SR-11 b | ||
| CCI: | CCI-005137 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Train organization-defined personnel or roles to detect counterfeit system components including hardware, software, and firmware. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SR-11 (1) | ||
| CCI: | CCI-005138 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the personnel or roles who are trained to detect counterfeit system components (including hardware, software, and firmware). | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SR-11 (1) | ||
| CCI: | CCI-005139 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Maintain configuration control over the following system components awaiting service or repair. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SR-11 (2) | ||
| CCI: | CCI-005140 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Maintain configuration control over serviced or repaired components awaiting return to service. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SR-11 (2) | ||
| CCI: | CCI-005141 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the system components awaiting service or repair. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SR-11 (2) | ||
| CCI: | CCI-005142 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Scan for counterfeit system components on an organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SR-11 (3) | ||
| CCI: | CCI-005143 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the frequency for which the counterfeit system components are scanned. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SR-11 (3) | ||
| CCI: | CCI-005144 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Dispose of organization-defined data, documentation, tools, or system components using the following techniques and methods. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SR-12 | ||
| CCI: | CCI-005145 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the data, documentation, tools, or system components which are to be disposed of using organization-defined techniques and methods. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SR-12 | ||
| CCI: | CCI-005146 | Status: | draft |
| Contributor: | DISA | Published Date: | 2022-03-07 |
| Definition: | Defines the techniques or methods used to dispose of organization-defined data, documentation, tools, or system components. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 5 (v5): SR-12 | ||
| CCI: | CCI-000001 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-13 |
| Definition: | The organization develops an access control policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-1 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-1 a 1 | |||
| NIST: NIST SP 800-53A (v1): AC-1.1 (i and ii) | |||
| CCI: | CCI-000004 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-13 |
| Definition: | The organization develops procedures to facilitate the implementation of the access control policy and associated access controls. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-1 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-1 a 2 | |||
| NIST: NIST SP 800-53A (v1): AC-1.1 (iv and v) | |||
| CCI: | CCI-000007 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-13 |
| Definition: | The organization manages information system accounts by identifying account types (i.e., individual, group, system, application, guest/anonymous, and temporary). | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-2 a | ||
| NIST: NIST SP 800-53A (v1): AC-2.1 (i) | |||
| CCI: | CCI-000008 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-14 |
| Definition: | The organization establishes conditions for group membership. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-2 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-2 c | |||
| NIST: NIST SP 800-53A (v1): AC-2.1 (i) | |||
| CCI: | CCI-000009 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-13 |
| Definition: | The organization manages information system accounts by identifying authorized users of the information system and specifying access privileges. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-2 c | ||
| NIST: NIST SP 800-53A (v1): AC-2.1 (i) | |||
| CCI: | CCI-000013 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-14 |
| Definition: | The organization manages information system accounts by notifying account managers when temporary accounts are no longer required and when information system users are terminated, transferred, or information system usage or need-to-know/need-to-share changes. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-2 g | ||
| NIST: NIST SP 800-53A (v1): AC-2.1 (i) | |||
| CCI: | CCI-000014 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-14 |
| Definition: | The organization manages information system accounts by granting access to the system based on a valid access authorization; intended system usage; and other attributes as required by the organization or associated missions/business functions. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-2 i | ||
| NIST: NIST SP 800-53A (v1): AC-2.1 (i) | |||
| CCI: | CCI-000020 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-14 |
| Definition: | The information system dynamically manages user privileges and associated access authorizations. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AC-2 (6) | ||
| NIST: NIST SP 800-53A (v1): AC-2 (6).1 | |||
| CCI: | CCI-000022 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-13 |
| Definition: | The information system enforces one or more organization-defined nondiscretionary access control policies over an organization-defined set of users and resources. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AC-3 (3) (a) | ||
| NIST: NIST SP 800-53A (v1): AC-3 (3).1 (iii) | |||
| CCI: | CCI-000023 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-11-03 |
| Definition: | The organization develops an organization-wide information security program plan that provides sufficient information about the program management controls and common controls (including specification of parameters for any assignment and selection operations either explicitly or by reference) to enable an implementation that is unambiguously compliant with the intent of the plan, and a determination of the risk to be incurred if the plan is implemented as intended. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PM-1 a | ||
| NIST: NIST SP 800-53A (v1): PM-1.1 (i) | |||
| CCI: | CCI-000025 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-14 |
| Definition: | The information system enforces information flow control using explicit security attributes on information, source, and destination objects as a basis for flow control decisions. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AC-4 (1) | ||
| NIST: NIST SP 800-53A (v1): AC-4 (1).1 | |||
| CCI: | CCI-000033 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-13 |
| Definition: | The information system enforces the use of human review for organization-defined security policy filters when the system is not capable of making an information flow control decision. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-4 (9) | ||
| NIST: NIST SP 800-53A (v1): AC-4 (9).1 (ii) | |||
| CCI: | CCI-000036 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-19 |
| Definition: | The organization separates organization-defined duties of individuals. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-5 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-5 a | |||
| NIST: NIST SP 800-53A (v1): AC-5.1 (i) | |||
| CCI: | CCI-000037 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-14 |
| Definition: | The organization implements separation of duties through assigned information system access authorizations. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AC-5 c | ||
| NIST: NIST SP 800-53A (v1): AC-5.1 (iii) | |||
| CCI: | CCI-000038 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-19 |
| Definition: | The organization explicitly authorizes access to organization-defined security functions and security-relevant information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-6 (1) | ||
| NIST: NIST SP 800-53A (v1): AC-6 (1).1 (ii) | |||
| CCI: | CCI-000040 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-14 |
| Definition: | The organization audits any use of privileged accounts, or roles, with access to organization-defined security functions or security-relevant information, when accessing other system functions. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AC-6 (2) | ||
| NIST: NIST SP 800-53A (v1): AC-6 (2).1 (iii) | |||
| CCI: | CCI-000045 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-14 |
| Definition: | The organization defines in the security plan, explicitly or by reference, the time period for lock out mode or delay period. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-7 b | ||
| NIST: NIST SP 800-53A (v1): AC-7.1 (iii) | |||
| CCI: | CCI-000046 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-14 |
| Definition: | The organization selects either a lock out mode for the organization-defined time period or delays the next login prompt for the organization-defined delay period for information system responses to consecutive invalid access attempts. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-7 b | ||
| NIST: NIST SP 800-53A (v1): AC-7.1 (iv) | |||
| CCI: | CCI-000047 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-14 |
| Definition: | The information system delays next login prompt according to the organization-defined delay algorithm, when the maximum number of unsuccessful attempts is exceeded, automatically locks the account/node for an organization-defined time period or locks the account/node until released by an Administrator IAW organizational policy. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AC-7 b | ||
| NIST: NIST SP 800-53A (v1): AC-7.1 (iv) | |||
| CCI: | CCI-000049 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-19 |
| Definition: | The organization defines a system use notification message or banner displayed before granting access to the system that provides privacy and security notices consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance and states that: (i) users are accessing a U.S. Government information system; (ii) system usage may be monitored, recorded, and subject to audit; (iii) unauthorized use of the system is prohibited and subject to criminal and civil penalties; and (iv) use of the system indicates consent to monitoring and recording. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-8 a | ||
| NIST: NIST SP 800-53A (v1): AC-8.1 (i) | |||
| CCI: | CCI-000051 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-19 |
| Definition: | The organization approves the information system use notification message before its use. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-8 a | ||
| NIST: NIST SP 800-53A (v1): AC-8.1 (i) | |||
| CCI: | CCI-000058 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-19 |
| Definition: | The information system provides the capability for users to directly initiate session lock mechanisms. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AC-11 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-11 a | |||
| NIST: NIST SP 800-53A (v1): AC-11 | |||
| CCI: | CCI-000062 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-19 |
| Definition: | The organization permits actions to be performed without identification and authentication only to the extent necessary to accomplish mission/business objectives. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-14 (1) | ||
| NIST: NIST SP 800-53A (v1): AC-14 (1).1 | |||
| CCI: | CCI-000063 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-14 |
| Definition: | The organization defines allowed methods of remote access to the information system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-17 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-17 a | |||
| NIST: NIST SP 800-53A (v1): AC-17.1 (i) | |||
| CCI: | CCI-000064 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-19 |
| Definition: | The organization establishes usage restrictions and implementation guidance for each allowed remote access method. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-17 b | ||
| NIST: NIST SP 800-53A (v1): AC-17.1 (ii) | |||
| CCI: | CCI-000066 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-14 |
| Definition: | The organization enforces requirements for remote connections to the information system. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AC-17 e | ||
| NIST: NIST SP 800-53A (v1): AC-17.1 (v) | |||
| CCI: | CCI-000071 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-19 |
| Definition: | The organization monitors for unauthorized remote connections to the information system on an organization-defined frequency. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AC-17 (5) | ||
| NIST: NIST SP 800-53A (v1): AC-17 (5).1 (ii) | |||
| CCI: | CCI-000077 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-11-03 |
| Definition: | The organization updates the plan to address organizational changes and problems identified during plan implementation or security control assessments. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PM-1 c | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PM-1 c | |||
| NIST: NIST SP 800-53A (v1): PM-1.1 (iv) | |||
| CCI: | CCI-000079 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-14 |
| Definition: | The organization ensures that remote sessions for accessing an organization-defined list of security functions and security-relevant information employ organization-defined additional security measures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-17 (7) | ||
| NIST: NIST SP 800-53A (v1): AC-17 (7).1 (iii) | |||
| CCI: | CCI-000081 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-11-03 |
| Definition: | The organization employs a business case/Exhibit 300/Exhibit 53 to record the resources required. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PM-3 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PM-3 b | |||
| NIST: NIST SP 800-53A (v1): PM-3.1 (iii) | |||
| CCI: | CCI-000082 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-19 |
| Definition: | The organization establishes usage restrictions for organization-controlled mobile devices. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-19 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-19 a | |||
| NIST: NIST SP 800-53A (v1): AC-19.1 (i) | |||
| CCI: | CCI-000085 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-19 |
| Definition: | The organization monitors for unauthorized connections of mobile devices to organizational information systems. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AC-19 c | ||
| NIST: NIST SP 800-53A (v1): AC-19.1 (iii) | |||
| CCI: | CCI-000086 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-19 |
| Definition: | The organization enforces requirements for the connection of mobile devices to organizational information systems. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AC-19 d | ||
| NIST: NIST SP 800-53A (v1): AC-19.1 (iv) | |||
| CCI: | CCI-000087 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-19 |
| Definition: | The organization disables information system functionality that provides the capability for automatic execution of code on mobile devices without user direction. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AC-19 e | ||
| NIST: NIST SP 800-53A (v1): AC-19.1 (v) | |||
| CCI: | CCI-000088 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-14 |
| Definition: | The organization issues specially configured mobile devices to individuals traveling to locations that the organization deems to be of significant risk in accordance with organizational policies and procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-19 f | ||
| NIST: NIST SP 800-53A (v1): AC-19.1 (vi) | |||
| CCI: | CCI-000089 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-14 |
| Definition: | The organization applies organization-defined inspection and preventative measures to mobile devices returning from locations that the organization deems to be of significant risk in accordance with organizational policies and procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-19 g | ||
| NIST: NIST SP 800-53A (v1): AC-19.1 (viii) | |||
| CCI: | CCI-000090 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-19 |
| Definition: | The organization restricts the use of writable, removable media in organizational information systems. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-19 (1) | ||
| NIST: NIST SP 800-53A (v1): AC-19 (1).1 | |||
| CCI: | CCI-000091 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-19 |
| Definition: | The organization prohibits the use of personally-owned, removable media in organizational information systems. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-19 (2) | ||
| NIST: NIST SP 800-53A (v1): AC-19 (2).1 | |||
| CCI: | CCI-000092 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-19 |
| Definition: | The organization prohibits the use of removable media in organizational information systems when the media has no identifiable owner. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-19 (3) | ||
| NIST: NIST SP 800-53A (v1): AC-19 (3).1 | |||
| CCI: | CCI-000094 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-19 |
| Definition: | The organization establishes terms and conditions, consistent with any trust relationships established with other organizations owning, operating, and/or maintaining external information systems, allowing authorized individuals to process organization-controlled information using the external information systems. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-20 b | ||
| NIST: NIST SP 800-53A (v1): AC-20.1 | |||
| CCI: | CCI-000095 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-19 |
| Definition: | The organization prohibits authorized individuals from using an external information system to access the information system except in situations where the organization can verify the implementation of required security controls on the external system as specified in the organization's information security policy and security plan. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-20 (1) (a) | ||
| NIST: NIST SP 800-53A (v1): AC-20 (1).1 | |||
| CCI: | CCI-000096 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-19 |
| Definition: | The organization prohibits authorized individuals from using an external information system to access the information system or to process, store, or transmit organization-controlled information except in situations where the organization has approved information system connection or processing agreements with the organizational entity hosting the external information system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-20 (1) (b) | ||
| NIST: NIST SP 800-53A (v1): AC-20 (1).1 | |||
| CCI: | CCI-000110 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-20 |
| Definition: | The organization provides refresher role-based security training to personnel with assigned security roles and responsibilities in accordance with organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AT-3 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AT-3 c | |||
| NIST: NIST SP 800-53A (v1): AT-3.1 (iii) | |||
| CCI: | CCI-000111 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-20 |
| Definition: | The organization defines a frequency for providing refresher role-based security training. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AT-3 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AT-3 c | |||
| NIST: NIST SP 800-53A (v1): AT-3.1 (ii) | |||
| CCI: | CCI-000115 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-14 |
| Definition: | The organization establishes contact with selected groups and associations within the security community to facilitate ongoing security education and training; to stay up to date with the latest recommended security practices, techniques, and technologies; and to share current security-related information including threats, vulnerabilities, and incidents. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AT-5 | ||
| NIST: NIST SP 800-53A (v1): AT-5.1 | |||
| CCI: | CCI-000116 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-14 |
| Definition: | The organization institutionalizes contact with selected groups and associations within the security community to facilitate ongoing security education and training; to stay up to date with the latest recommended security practices, techniques, and technologies; and to share current security-related information including threats, vulnerabilities, and incidents. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AT-5 | ||
| NIST: NIST SP 800-53A (v1): AT-5.1 | |||
| CCI: | CCI-000118 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-20 |
| Definition: | The organization disseminates a formal, documented, audit and accountability policy to elements within the organization having associated audit and accountability roles and responsibilities. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AU-1 a | ||
| NIST: NIST SP 800-53A (v1): AU-1.1 (iii) | |||
| CCI: | CCI-000121 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-20 |
| Definition: | The organization disseminates formal, documented, procedures to elements within the organization having associated audit and accountability roles and responsibilities. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AU-1 b | ||
| NIST: NIST SP 800-53A (v1): AU-1.1 (vi) | |||
| CCI: | CCI-000127 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-20 |
| Definition: | The organization reviews and updates the list of organization-defined audited events on an organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AU-2 (3) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AU-2 (3) | |||
| NIST: NIST SP 800-53A (v1): AU-2 (3).1 (ii) | |||
| CCI: | CCI-000128 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-20 |
| Definition: | The organization includes execution of privileged functions in the list of events to be audited by the information system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AU-2 (4) | ||
| NIST: NIST SP 800-53A (v1): AU-2 (4).1 | |||
| CCI: | CCI-000129 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-15 |
| Definition: | The organization defines in the auditable events that the information system must be capable of auditing based on a risk assessment and mission/business needs. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AU-2 a | ||
| NIST: NIST SP 800-53A (v1): AU-2.1 (ii) | |||
| CCI: | CCI-000136 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-20 |
| Definition: | The organization centrally manages the content of audit records generated by organization-defined information system components. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AU-3 (2) | ||
| NIST: NIST SP 800-53A (v1): AU-3 (2).1 (ii) | |||
| CCI: | CCI-000137 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-20 |
| Definition: | The organization allocates audit record storage capacity. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 (v3): AU-4 | ||
| NIST: NIST SP 800-53A (v1): AU-4.1 (i) | |||
| CCI: | CCI-000138 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-20 |
| Definition: | The organization configures auditing to reduce the likelihood of storage capacity being exceeded. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AU-4 | ||
| NIST: NIST SP 800-53A (v1): AU-4.1 (ii) | |||
| CCI: | CCI-000143 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-20 |
| Definition: | The information system provides a warning when allocated audit record storage volume reaches an organization-defined percentage of maximum audit record storage capacity. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AU-5 (1) | ||
| NIST: NIST SP 800-53A (v1): AU-5 (1).1 (ii) | |||
| CCI: | CCI-000144 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-20 |
| Definition: | The information system provides a real-time alert when organization-defined audit failure events occur. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AU-5 (2) | ||
| NIST: NIST SP 800-53A (v1): AU-5 (2).1 (ii) | |||
| CCI: | CCI-000146 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-20 |
| Definition: | The organization defines the percentage of maximum audit record storage capacity that when exceeded, a warning is provided. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AU-5 (1) | ||
| NIST: NIST SP 800-53A (v1): AU-5 (1).1 (i) | |||
| CCI: | CCI-000150 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-15 |
| Definition: | The organization adjusts the level of audit review, analysis, and reporting within the information system when there is a change in risk to organizational operations, organizational assets, individuals, other organizations, or the Nation based on law enforcement information, intelligence information, or other credible sources of information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AU-6 b | ||
| NIST: NIST SP 800-53A (v1): AU-6.2 | |||
| CCI: | CCI-000152 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-22 |
| Definition: | The information system integrates audit review, analysis, and reporting processes to support organizational processes for investigation and response to suspicious activities. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AU-6 (1) | ||
| NIST: NIST SP 800-53A (v1): AU-6 (1).1 | |||
| CCI: | CCI-000155 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-15 |
| Definition: | The organization integrates analysis of audit records with analysis of vulnerability scanning information, performance data, and network monitoring information to further enhance the ability to identify inappropriate or unusual activity. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AU-6 (5) | ||
| NIST: NIST SP 800-53A (v1): AU-6 (5).1 | |||
| CCI: | CCI-000156 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-22 |
| Definition: | The information system provides an audit reduction capability. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AU-7 | ||
| NIST: NIST SP 800-53A (v1): AU-7.1 | |||
| CCI: | CCI-000157 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-22 |
| Definition: | The information system provides a report generation capability. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AU-7 | ||
| NIST: NIST SP 800-53A (v1): AU-7.1 | |||
| CCI: | CCI-000160 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-22 |
| Definition: | The information system synchronizes internal information system clocks on an organization-defined frequency with an organization-defined authoritative time source. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AU-8 (1) | ||
| NIST: NIST SP 800-53A (v1): AU-8 (1).1 (iii) | |||
| CCI: | CCI-000161 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-22 |
| Definition: | The organization defines the frequency for the synchronization of internal information system clocks. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AU-8 (1) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AU-8 (1) (a) | |||
| NIST: NIST SP 800-53A (v1): AU-8 (1).1 (i) | |||
| CCI: | CCI-000175 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-22 |
| Definition: | The organization manages information system authenticators for users and devices by verifying, as part of the initial authenticator distribution, the identity of the individual and/or device receiving the authenticator. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): IA-5 a | ||
| NIST: NIST SP 800-53A (v1): IA-5.1 (ii) | |||
| CCI: | CCI-000177 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-22 |
| Definition: | The organization manages information system authenticators for users and devices by establishing and implementing administrative procedures for initial authenticator distribution, for lost/compromised, or damaged authenticators, and for revoking authenticators. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): IA-5 d | ||
| NIST: NIST SP 800-53A (v1): IA-5.1 (ii) | |||
| CCI: | CCI-000178 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-22 |
| Definition: | The organization manages information system authenticators for users and devices by changing default content of authenticators upon information system installation. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): IA-5 e | ||
| NIST: NIST SP 800-53A (v1): IA-5.1 (ii) | |||
| CCI: | CCI-000179 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-22 |
| Definition: | The organization manages information system authenticators by establishing minimum lifetime restrictions for authenticators. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): IA-5 f | ||
| NIST: NIST SP 800-53 Revision 4 (v4): IA-5 f | |||
| NIST: NIST SP 800-53A (v1): IA-5.1 (ii) | |||
| CCI: | CCI-000180 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-22 |
| Definition: | The organization manages information system authenticators by establishing maximum lifetime restrictions for authenticators. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): IA-5 f | ||
| NIST: NIST SP 800-53 Revision 4 (v4): IA-5 f | |||
| NIST: NIST SP 800-53A (v1): IA-5.1 (ii) | |||
| CCI: | CCI-000181 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-22 |
| Definition: | The organization manages information system authenticators by establishing reuse conditions for authenticators. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): IA-5 f | ||
| NIST: NIST SP 800-53 Revision 4 (v4): IA-5 f | |||
| NIST: NIST SP 800-53A (v1): IA-5.1 (ii) | |||
| CCI: | CCI-000188 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-15 |
| Definition: | The organization requires that the registration process to receive an organizational-defined type of authenticator be carried out in person before a designated registration authority with authorization by a designated organizational official (e.g., a supervisor). | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): IA-5 (3) | ||
| NIST: NIST SP 800-53A (v1): IA-5 (3).1 (ii) | |||
| CCI: | CCI-000189 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-15 |
| Definition: | The organization employs automated tools to determine if authenticators are sufficiently strong to resist attacks intended to discover or otherwise compromise the authenticators. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): IA-5 (4) | ||
| NIST: NIST SP 800-53A (v1): IA-5 (4).1 | |||
| CCI: | CCI-000190 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-15 |
| Definition: | The organization requires vendors/manufacturers of information system components to provide unique authenticators or change default authenticators prior to delivery. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): IA-5 (5) | ||
| NIST: NIST SP 800-53A (v1): IA-5 (5).1 | |||
| CCI: | CCI-000191 | Status: | deprecated |
| Contributor: | DISA FSO | Published Date: | 2009-09-15 |
| Definition: | The organization enforces password complexity by the number of special characters used. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): IA-5 (1) (a) | ||
| NIST: NIST SP 800-53A (v1): IA-5 (1).1 (v) | |||
| CCI: | CCI-000192 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-15 |
| Definition: | The information system enforces password complexity by the minimum number of upper case characters used. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): IA-5 (1) (a) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): IA-5 (1) (a) | |||
| NIST: NIST SP 800-53A (v1): IA-5 (1).1 (v) | |||
| CCI: | CCI-000193 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-15 |
| Definition: | The information system enforces password complexity by the minimum number of lower case characters used. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): IA-5 (1) (a) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): IA-5 (1) (a) | |||
| NIST: NIST SP 800-53A (v1): IA-5 (1).1 (v) | |||
| CCI: | CCI-000194 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-15 |
| Definition: | The information system enforces password complexity by the minimum number of numeric characters used. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): IA-5 (1) (a) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): IA-5 (1) (a) | |||
| NIST: NIST SP 800-53A (v1): IA-5 (1).1 (v) | |||
| CCI: | CCI-000195 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-15 |
| Definition: | The information system, for password-based authentication, when new passwords are created, enforces that at least an organization-defined number of characters are changed. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): IA-5 (1) (b) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): IA-5 (1) (b) | |||
| NIST: NIST SP 800-53A (v1): IA-5 (1).1 (v) | |||
| CCI: | CCI-000196 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-15 |
| Definition: | The information system, for password-based authentication, stores only cryptographically-protected passwords. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): IA-5 (1) (c) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): IA-5 (1) (c) | |||
| NIST: NIST SP 800-53A (v1): IA-5 (1).1 (v) | |||
| CCI: | CCI-000198 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-15 |
| Definition: | The information system enforces minimum password lifetime restrictions. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): IA-5 (1) (d) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): IA-5 (1) (d) | |||
| NIST: NIST SP 800-53A (v1): IA-5 (1).1 (v) | |||
| CCI: | CCI-000199 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-15 |
| Definition: | The information system enforces maximum password lifetime restrictions. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): IA-5 (1) (d) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): IA-5 (1) (d) | |||
| NIST: NIST SP 800-53A (v1): IA-5 (1).1 (v) | |||
| CCI: | CCI-000200 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-22 |
| Definition: | The information system prohibits password reuse for the organization-defined number of generations. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): IA-5 (1) (e) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): IA-5 (1) (e) | |||
| NIST: NIST SP 800-53A (v1): IA-5 (1).1 (v) | |||
| CCI: | CCI-000202 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-22 |
| Definition: | The organization ensures unencrypted static authenticators are not embedded in access scripts. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): IA-5 (7) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): IA-5 (7) | |||
| NIST: NIST SP 800-53A (v1): IA-5 (7).1 | |||
| CCI: | CCI-000203 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-22 |
| Definition: | The organization ensures unencrypted static authenticators are not stored on function keys. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): IA-5 (7) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): IA-5 (7) | |||
| NIST: NIST SP 800-53A (v1): IA-5 (7).1 | |||
| CCI: | CCI-000205 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-22 |
| Definition: | The information system enforces minimum password length. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): IA-5 (1) (a) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): IA-5 (1) (a) | |||
| NIST: NIST SP 800-53A (v1): IA-5 (1).1 (i) | |||
| CCI: | CCI-000207 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-11-03 |
| Definition: | The organization develops and maintains an inventory of its information systems. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PM-5 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PM-5 | |||
| NIST: NIST SP 800-53A (v1): PM-5.1 (i and ii) | |||
| CCI: | CCI-000208 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-14 |
| Definition: | The organization determines normal time-of-day and duration usage for information system accounts. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-2 (5) (b) | ||
| NIST: NIST SP 800-53A (v1): AC-2 (5).1 (iii) | |||
| CCI: | CCI-000214 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-14 |
| Definition: | The organization establishes a Discretionary Access Control (DAC) policy that limits propagation of access rights. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-3 (4) (b) | ||
| NIST: NIST SP 800-53A (v1): AC-3 (4).1 | |||
| CCI: | CCI-000215 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-14 |
| Definition: | The organization establishes a Discretionary Access Control (DAC) policy that includes or excludes access to the granularity of a single user. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-3 (4) (c) | ||
| NIST: NIST SP 800-53A (v1): AC-3 (4).1 | |||
| CCI: | CCI-000218 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-14 |
| Definition: | The information system, when transferring information between different security domains, identifies information flows by data type specification and usage. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AC-4 (12) | ||
| NIST: NIST SP 800-53A (v1): AC-4 (12).1 | |||
| CCI: | CCI-000220 | Status: | deprecated |
| Contributor: | DISA FSO | Published Date: | 2009-09-14 |
| Definition: | The information system, when transferring information between different security domains, implements policy filters that constrain data structure and content to [Assignment: organization-defined information security policy requirements]. | ||
| Type: | technical | ||
| CCI: | CCI-000221 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-14 |
| Definition: | The information system enforces security policies regarding information on interconnected systems. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AC-4 (16) | ||
| NIST: NIST SP 800-53A (v1): AC-4 (16).1 | |||
| CCI: | CCI-000222 | Status: | deprecated |
| Contributor: | DISA FSO | Published Date: | 2009-09-14 |
| Definition: | The information system uniquely identifies and authenticates source and destination domains for information transfer. | ||
| Type: | technical | ||
| CCI: | CCI-000223 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-14 |
| Definition: | The information system binds security attributes to information to facilitate information flow policy enforcement. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AC-4 (17) (b) | ||
| NIST: NIST SP 800-53A (v1): AC-4 (17).1 (v) | |||
| CCI: | CCI-000224 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-14 |
| Definition: | The information system tracks problems associated with the security attribute binding. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AC-4 (17) (c) | ||
| NIST: NIST SP 800-53A (v1): AC-4 (17).1 (vi) | |||
| CCI: | CCI-000226 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-14 |
| Definition: | The information system provides the capability for a privileged administrator to configure organization-defined security policy filters to support different security policies. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AC-6 (4) | ||
| NIST: NIST SP 800-53A (v1): AC-6 (4).1 | |||
| CCI: | CCI-000229 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-11-03 |
| Definition: | The organization documents the security state of organizational information systems and the environments in which those systems operate through security authorization processes. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PM-10 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PM-10 a | |||
| NIST: NIST SP 800-53A (v1): PM-10.1 (i) | |||
| CCI: | CCI-000230 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-11-03 |
| Definition: | The organization tracks the security state of organizational information systems and the environments in which those systems operate through security authorization processes. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PM-10 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PM-10 a | |||
| NIST: NIST SP 800-53A (v1): PM-10.1 (i) | |||
| CCI: | CCI-000231 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-11-03 |
| Definition: | The organization reports the security state of organizational information systems and the environments in which those systems operate through security authorization processes. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PM-10 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PM-10 a | |||
| NIST: NIST SP 800-53A (v1): PM-10.1 (i) | |||
| CCI: | CCI-000237 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-06-23 |
| Definition: | The organization manages information system accounts by specifically authorizing and monitoring the use of guest/anonymous accounts and temporary accounts. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-2 f | ||
| NIST: NIST SP 800-53A (v1): AC-2.1 (i) | |||
| CCI: | CCI-000245 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-15 |
| Definition: | The organization develops a security assessment plan for the information system and its environment of operation. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CA-2 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CA-2 a | |||
| NIST: NIST SP 800-53A (v1): CA-2.1 (i) | |||
| CCI: | CCI-000249 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-15 |
| Definition: | The organizations security assessment plan describes the assessment team. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CA-2 a | ||
| NIST: NIST SP 800-53A (v1): CA-2.1 (ii) | |||
| CCI: | CCI-000250 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-15 |
| Definition: | The organization's security assessment plan describes assessment roles and responsibilities. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CA-2 a | ||
| NIST: NIST SP 800-53A (v1): CA-2.1 (ii) | |||
| CCI: | CCI-000257 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-15 |
| Definition: | The organization authorizes connections from the information system to other information systems through the use of Interconnection Security Agreements. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CA-3 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CA-3 a | |||
| NIST: NIST SP 800-53A (v1): CA-3.1 (ii) | |||
| CCI: | CCI-000260 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-15 |
| Definition: | The organization documents, for each interconnection, the nature of the information communicated. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CA-3 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CA-3 b | |||
| NIST: NIST SP 800-53A (v1): CA-3.1 (iii) | |||
| CCI: | CCI-000261 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-15 |
| Definition: | The organization monitors the information system connections on an ongoing basis to verify enforcement of security requirements. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CA-3 c | ||
| NIST: NIST SP 800-53A (v1): CA-3.1 (iv) | |||
| CCI: | CCI-000262 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-15 |
| Definition: | The organization prohibits the direct connection of an organization-defined unclassified, national security system to an external network without the use of an organization-defined boundary protection device. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CA-3 (1) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CA-3 (1) | |||
| NIST: NIST SP 800-53A (v1): CA-3 (1).1 | |||
| CCI: | CCI-000263 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-15 |
| Definition: | The organization prohibits the direct connection of a classified, national security system to an external network without the use of organization-defined boundary protection device. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CA-3 (2) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CA-3 (2) | |||
| NIST: NIST SP 800-53A (v1): CA-3 (2).1 | |||
| CCI: | CCI-000275 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-15 |
| Definition: | The organization implements a continuous monitoring program that includes a configuration management process for the information system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CA-7 a | ||
| NIST: NIST SP 800-53A (v1): CA-7.1 (iv) | |||
| CCI: | CCI-000276 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-15 |
| Definition: | The organization implements a continuous monitoring program that includes a configuration management process for the information system constituent components. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CA-7 a | ||
| NIST: NIST SP 800-53A (v1): CA-7.1 (iv) | |||
| CCI: | CCI-000277 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-15 |
| Definition: | The organization implements a continuous monitoring program that includes a determination of the security impact of changes to the information system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CA-7 b | ||
| NIST: NIST SP 800-53A (v1): CA-7.1 (iv) | |||
| CCI: | CCI-000278 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-15 |
| Definition: | The organization implements a continuous monitoring program that includes a determination of the security impact of changes to the environment of operation. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CA-7 b | ||
| NIST: NIST SP 800-53A (v1): CA-7.1 (iv) | |||
| CCI: | CCI-000283 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-15 |
| Definition: | The organization plans announced or unannounced assessments (in-depth monitoring, malicious user testing, penetration testing, red team exercises, or other organization-defined forms of security assessment), on an organization-defined frequency, to ensure compliance with all vulnerability mitigation procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CA-7 (2) | ||
| NIST: NIST SP 800-53A (v1): CA-7 (2).1 (ii) | |||
| CCI: | CCI-000284 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-15 |
| Definition: | The organization schedules announced or unannounced assessments (in-depth monitoring, malicious user testing, penetration testing, red team exercises, or other organization-defined forms of security assessment), on an organization-defined frequency, to ensure compliance with all vulnerability mitigation procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CA-7 (2) | ||
| NIST: NIST SP 800-53A (v1): CA-7 (2).1 (ii) | |||
| CCI: | CCI-000285 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-15 |
| Definition: | The organization conducts announced or unannounced assessments (in-depth monitoring, malicious user testing, penetration testing, red team exercises, or other organization-defined forms of security assessment), on an organization-defined frequency, to ensure compliance with all vulnerability mitigation procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CA-7 (2) | ||
| NIST: NIST SP 800-53A (v1): CA-7 (2).1 (ii) | |||
| CCI: | CCI-000288 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-17 |
| Definition: | The organization disseminates formal, documented configuration management policy to elements within the organization having associated configuration management roles and responsibilities. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-1 a | ||
| NIST: NIST SP 800-53A (v1): CM-1.1 (iii) | |||
| CCI: | CCI-000291 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-17 |
| Definition: | The organization disseminates formal, documented procedures to facilitate the implementation of the configuration management policy and associated configuration management controls. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-1 b | ||
| NIST: NIST SP 800-53A (v1): CM-1.1 (vi) | |||
| CCI: | CCI-000293 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-17 |
| Definition: | The organization develops a current baseline configuration of the information system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-2 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CM-2 | |||
| NIST: NIST SP 800-53A (v1): CM-2.1 (i) | |||
| CCI: | CCI-000294 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-17 |
| Definition: | The organization documents a baseline configuration of the information system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-2 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CM-2 | |||
| NIST: NIST SP 800-53A (v1): CM-2.1 (i) | |||
| CCI: | CCI-000298 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-17 |
| Definition: | The organization reviews and updates the baseline configuration of the information system as an integral part of information system component installations. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-2 (1) (c) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CM-2 (1) (c) | |||
| NIST: NIST SP 800-53A (v1): CM-2 (1).1 (ii) | |||
| CCI: | CCI-000299 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-17 |
| Definition: | The organization reviews and updates the baseline configuration of the information system as an integral part of information system component upgrades. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-2 (1) (c) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CM-2 (1) (c) | |||
| NIST: NIST SP 800-53A (v1): CM-2 (1).1 (ii) | |||
| CCI: | CCI-000305 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-17 |
| Definition: | The organization develops a list of software programs not authorized to execute on the information system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-2 (4) (a) | ||
| NIST: NIST SP 800-53 (v3): CM-7 (2) | |||
| NIST: NIST SP 800-53A (v1): CM-2 (4).1 (i) | |||
| NIST: NIST SP 800-53A (v1): CM-7 (2).1 (i) | |||
| CCI: | CCI-000306 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-17 |
| Definition: | The organization maintains the list of software programs not authorized to execute on the information system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-2 (4) (a) | ||
| NIST: NIST SP 800-53 (v3): CM-7 (2) | |||
| NIST: NIST SP 800-53A (v1): CM-2 (4).1 (i) | |||
| NIST: NIST SP 800-53A (v1): CM-7 (2).1 (i) | |||
| CCI: | CCI-000307 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-17 |
| Definition: | The organization employs an allow-all, deny-by-exception authorization policy to identify software allowed to execute on the information system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-2 (4) (b) | ||
| NIST: NIST SP 800-53A (v1): CM-2 (4).1 (ii) | |||
| CCI: | CCI-000308 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-17 |
| Definition: | The organization develops the list of software programs authorized to execute on the information system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-2 (5) (a) | ||
| NIST: NIST SP 800-53 (v3): CM-7 (2) | |||
| NIST: NIST SP 800-53A (v1): CM-2 (5).1 (i) | |||
| NIST: NIST SP 800-53A (v1): CM-7 (2).1 (i) | |||
| CCI: | CCI-000309 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-17 |
| Definition: | The organization maintains the list of software programs authorized to execute on the information system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-2 (5) (a) | ||
| NIST: NIST SP 800-53 (v3): CM-7 (2) | |||
| NIST: NIST SP 800-53A (v1): CM-2 (5).1 (i) | |||
| NIST: NIST SP 800-53A (v1): CM-7 (2).1 (i) | |||
| CCI: | CCI-000310 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-17 |
| Definition: | The organization employs a deny-all, permit-by-exception authorization policy to identify software allowed to execute on the information system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-2 (5) (b) | ||
| NIST: NIST SP 800-53A (v1): CM-2 (5).1 (ii) | |||
| CCI: | CCI-000315 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-17 |
| Definition: | The organization documents approved configuration-controlled changes to the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-3 c | ||
| NIST: NIST SP 800-53A (v1): CM-3.1 (iii) | |||
| CCI: | CCI-000317 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-17 |
| Definition: | The organization reviews records of configuration-controlled changes to the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-3 d | ||
| NIST: NIST SP 800-53A (v1): CM-3.1 (iv) | |||
| CCI: | CCI-000334 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | The organization analyzes new software in a separate test environment before installation in an operational environment. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-4 (1) | ||
| NIST: NIST SP 800-53A (v1): CM-4 (1).1 (i) | |||
| CCI: | CCI-000338 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | The organization defines physical access restrictions associated with changes to the information system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-5 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CM-5 | |||
| NIST: NIST SP 800-53A (v1): CM-5.1 | |||
| CCI: | CCI-000339 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | The organization documents physical access restrictions associated with changes to the information system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-5 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CM-5 | |||
| NIST: NIST SP 800-53A (v1): CM-5.1 | |||
| CCI: | CCI-000342 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | The organization defines logical access restrictions associated with changes to the information system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-5 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CM-5 | |||
| NIST: NIST SP 800-53A (v1): CM-5.1 | |||
| CCI: | CCI-000343 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | The organization documents logical access restrictions associated with changes to the information system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-5 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CM-5 | |||
| NIST: NIST SP 800-53A (v1): CM-5.1 | |||
| CCI: | CCI-000346 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | The organization employs automated mechanisms to enforce access restrictions. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): CM-5 (1) | ||
| NIST: NIST SP 800-53A (v1): CM-5 (1).1 | |||
| CCI: | CCI-000347 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | The organization employs automated mechanisms to support auditing of the enforcement actions. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): CM-5 (1) | ||
| NIST: NIST SP 800-53A (v1): CM-5 (1).1 | |||
| CCI: | CCI-000348 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | The organization defines a frequency with which to conduct reviews of information system changes. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-5 (2) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CM-5 (2) | |||
| NIST: NIST SP 800-53A (v1): CM-5 (2).1 (i) | |||
| CCI: | CCI-000349 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | The organization reviews information system changes per organization-defined frequency to determine whether unauthorized changes have occurred. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-5 (2) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CM-5 (2) | |||
| NIST: NIST SP 800-53A (v1): CM-5 (2).1 (ii) | |||
| CCI: | CCI-000350 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | The organization reviews information system changes upon organization-defined circumstances to determine whether unauthorized changes have occurred. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-5 (2) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CM-5 (2) | |||
| NIST: NIST SP 800-53A (v1): CM-5 (2).1 (ii) | |||
| CCI: | CCI-000351 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | The organization defines critical software programs that the information system will prevent from being installed if such software programs are not signed with a recognized and approved certificate. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-5 (3) | ||
| NIST: NIST SP 800-53A (v1): CM-5 (3).1 (i) | |||
| CCI: | CCI-000352 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | The information system prevents the installation of organization-defined critical software programs that are not signed with a certificate that is recognized and approved by the organization. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): CM-5 (3) | ||
| NIST: NIST SP 800-53A (v1): CM-5 (3).1 (ii) | |||
| CCI: | CCI-000355 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | The organization limits information system developer/integrator privileges to change hardware components directly within a production environment. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-5 (5) (a) | ||
| NIST: NIST SP 800-53A (v1): CM-5 (5).1 (i) | |||
| CCI: | CCI-000356 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | The organization limits information system developer/integrator privileges to change software components directly within a production environment. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-5 (5) (a) | ||
| NIST: NIST SP 800-53A (v1): CM-5 (5).1 (i) | |||
| CCI: | CCI-000357 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | The organization limits information system developer/integrator privileges to change firmware components directly within a production environment. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-5 (5) (a) | ||
| NIST: NIST SP 800-53A (v1): CM-5 (5).1 (i) | |||
| CCI: | CCI-000358 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | The organization limits information system developer/integrator privileges to change system information directly within a production environment. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-5 (5) (a) | ||
| NIST: NIST SP 800-53A (v1): CM-5 (5).1 (i) | |||
| CCI: | CCI-000359 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | The organization defines the frequency to review information system developer/integrator privileges. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-5 (5) (b) | ||
| NIST: NIST SP 800-53A (v1): CM-5 (5).1 (ii) | |||
| CCI: | CCI-000360 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | The organization defines the frequency to reevaluate information system developer/integrator privileges. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-5 (5) (b) | ||
| NIST: NIST SP 800-53A (v1): CM-5 (5).1 (ii) | |||
| CCI: | CCI-000361 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | The organization reviews information system developer/integrator privileges per organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-5 (5) (b) | ||
| NIST: NIST SP 800-53A (v1): CM-5 (5).1 (iii) | |||
| CCI: | CCI-000362 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | The organization reevaluates information system developer/integrator privileges per organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-5 (5) (b) | ||
| NIST: NIST SP 800-53A (v1): CM-5 (5).1 (iii) | |||
| CCI: | CCI-000363 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | The organization defines security configuration checklists to be used to establish and document configuration settings for the information system technology products employed. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-6 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CM-6 a | |||
| NIST: NIST SP 800-53A (v1): CM-6.1 (i) | |||
| CCI: | CCI-000364 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | The organization establishes configuration settings for information technology products employed within the information system using organization-defined security configuration checklists. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-6 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CM-6 a | |||
| NIST: NIST SP 800-53A (v1): CM-6.1 (iii) | |||
| CCI: | CCI-000365 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | The organization documents configuration settings for information technology products employed within the information system using organization-defined security configuration checklists that reflect the most restrictive mode consistent with operational requirements. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-6 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CM-6 a | |||
| NIST: NIST SP 800-53A (v1): CM-6.1 (iii) | |||
| CCI: | CCI-000373 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | The organization defines configuration settings for which unauthorized changes are responded to by automated mechanisms. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-6 (2) | ||
| NIST: NIST SP 800-53A (v1): CM-6 (2).1 (i) | |||
| CCI: | CCI-000374 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | The organization employs automated mechanisms to respond to unauthorized changes to organization-defined configuration settings. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): CM-6 (2) | ||
| NIST: NIST SP 800-53A (v1): CM-6 (2).1 (ii) | |||
| CCI: | CCI-000375 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | The organization incorporates detection of unauthorized, security-relevant configuration changes into the organizations incident response capability. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-6 (3) | ||
| NIST: NIST SP 800-53A (v1): CM-6 (3).1 (i) | |||
| CCI: | CCI-000376 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | The organization ensures unauthorized, security-relevant configuration changes detected are monitored. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-6 (3) | ||
| NIST: NIST SP 800-53A (v1): CM-6 (3).1 (ii) | |||
| CCI: | CCI-000377 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | The organization ensures unauthorized, security-relevant configuration changes detected are corrected. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-6 (3) | ||
| NIST: NIST SP 800-53A (v1): CM-6 (3).1 (ii) | |||
| CCI: | CCI-000378 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | The organization ensures unauthorized, security-relevant configuration changes detected are available for historical purposes. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-6 (3) | ||
| NIST: NIST SP 800-53A (v1): CM-6 (3).1 (ii) | |||
| CCI: | CCI-000379 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | The information system (including modifications to the baseline configuration) demonstrates conformance to security configuration guidance (i.e., security checklists) prior to being introduced into a production environment. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-6 (4) | ||
| NIST: NIST SP 800-53A (v1): CM-6 (4).1 | |||
| CCI: | CCI-000383 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | The organization defines the frequency of information system reviews to identify and eliminate unnecessary functions, ports, protocols and/or services. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-7 (1) | ||
| NIST: NIST SP 800-53A (v1): CM-7 (1).1 (i) | |||
| CCI: | CCI-000385 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | The organization reviews the information system per organization-defined frequency to eliminate unnecessary functions, ports, protocols, and/or services. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-7 (1) | ||
| NIST: NIST SP 800-53A (v1): CM-7 (1).1 (ii) | |||
| CCI: | CCI-000386 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | The organization employs automated mechanisms to prevent program execution on the information system in accordance with the organization-defined specifications. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): CM-7 (2) | ||
| NIST: NIST SP 800-53A (v1): CM-7 (2).1 (ii) | |||
| CCI: | CCI-000389 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | The organization develops an inventory of information system components that accurately reflects the current information system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-8 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CM-8 a 1 | |||
| NIST: NIST SP 800-53A (v1): CM-8.1 (ii) | |||
| CCI: | CCI-000390 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | The organization documents an inventory of information system components that accurately reflects the current information system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-8 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CM-8 a 1 | |||
| NIST: NIST SP 800-53A (v1): CM-8.1 (ii) | |||
| CCI: | CCI-000391 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | The organization maintains an inventory of information system components that accurately reflects the current information system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-8 a | ||
| NIST: NIST SP 800-53A (v1): CM-8.1 (ii) | |||
| CCI: | CCI-000392 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | The organization develops an inventory of information system components that includes all components within the authorization boundary of the information system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-8 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CM-8 a 2 | |||
| NIST: NIST SP 800-53A (v1): CM-8.1 (ii) | |||
| CCI: | CCI-000393 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | The organization documents an inventory of information system components that includes all components within the authorization boundary of the information system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-8 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CM-8 a 2 | |||
| NIST: NIST SP 800-53A (v1): CM-8.1 (ii) | |||
| CCI: | CCI-000394 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | The organization maintains an inventory of information system components that is consistent with the authorization boundary of the information system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-8 b | ||
| NIST: NIST SP 800-53A (v1): CM-8.1 (ii) | |||
| CCI: | CCI-000395 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | The organization develops an inventory of information system components that is at the level of granularity deemed necessary for tracking and reporting. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-8 c | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CM-8 a 3 | |||
| NIST: NIST SP 800-53A (v1): CM-8.1 (ii) | |||
| CCI: | CCI-000396 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | The organization documents an inventory of information system components that is at the level of granularity deemed necessary for tracking and reporting. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-8 c | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CM-8 a 3 | |||
| NIST: NIST SP 800-53A (v1): CM-8.1 (ii) | |||
| CCI: | CCI-000397 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | The organization maintains an inventory of information system components that is at the level of granularity deemed necessary for tracking and reporting. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-8 c | ||
| NIST: NIST SP 800-53A (v1): CM-8.1 (i) | |||
| CCI: | CCI-000399 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | The organization develops an inventory of information system components that includes organization-defined information deemed necessary to achieve effective information system component accountability. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-8 d | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CM-8 a 4 | |||
| NIST: NIST SP 800-53A (v1): CM-8.1 (ii) | |||
| CCI: | CCI-000400 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | The organization documents an inventory of information system components that includes organization-defined information deemed necessary to achieve effective information system component accountability. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-8 d | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CM-8 a 4 | |||
| NIST: NIST SP 800-53A (v1): CM-8.1 (ii) | |||
| CCI: | CCI-000401 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | The organization maintains an inventory of information system components that includes organization-defined information deemed necessary to achieve effective property accountability. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-8 d | ||
| NIST: NIST SP 800-53A (v1): CM-8.1 (ii) | |||
| CCI: | CCI-000402 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | The organization develops an inventory of information system components that is available for review by designated organizational officials. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-8 e | ||
| NIST: NIST SP 800-53A (v1): CM-8.1 (ii) | |||
| CCI: | CCI-000403 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | The organization documents an inventory of information system components that is available for review by designated organizational officials. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-8 e | ||
| NIST: NIST SP 800-53A (v1): CM-8.1 (ii) | |||
| CCI: | CCI-000404 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | The organization maintains an inventory of information system components that is available for review by designated organizational officials. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-8 e | ||
| NIST: NIST SP 800-53A (v1): CM-8.1 (ii) | |||
| CCI: | CCI-000405 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | The organization develops an inventory of information system components that is available for audit by designated organizational officials. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-8 e | ||
| NIST: NIST SP 800-53A (v1): CM-8.1 (ii) | |||
| CCI: | CCI-000406 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | The organization documents an inventory of information system components that is available for audit by designated organizational officials. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-8 e | ||
| NIST: NIST SP 800-53A (v1): CM-8.1 (ii) | |||
| CCI: | CCI-000407 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | The organization maintains an inventory of information system components that is available for audit by designated organizational officials. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-8 e | ||
| NIST: NIST SP 800-53A (v1): CM-8.1 (ii) | |||
| CCI: | CCI-000417 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | The organization disables network access by unauthorized components/devices or notifies designated organizational officials. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): CM-8 (3) (b) | ||
| NIST: NIST SP 800-53A (v1): CM-8 (3).1 (iii) | |||
| CCI: | CCI-000419 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | The organization verifies that all components within the authorization boundary of the information system are not duplicated in other information system component inventories. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-8 (5) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CM-8 (5) | |||
| NIST: NIST SP 800-53A (v1): CM-8 (5).1 | |||
| CCI: | CCI-000421 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | The organization develops a configuration management plan for the information system that addresses roles, responsibilities, and configuration management processes and procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-9 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CM-9 a | |||
| NIST: NIST SP 800-53A (v1): CM-9.1 (i) | |||
| CCI: | CCI-000422 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | The organization documents a configuration management plan for the information system that addresses roles, responsibilities, and configuration management processes and procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-9 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CM-9 a | |||
| NIST: NIST SP 800-53A (v1): CM-9.1 (i) | |||
| CCI: | CCI-000424 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | The organization develops a configuration management plan for the information system that defines the configuration items for the information system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-9 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CM-9 c | |||
| NIST: NIST SP 800-53A (v1): CM-9.1 (i) | |||
| CCI: | CCI-000425 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | The organization documents a configuration management plan for the information system that defines the configuration items for the information system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-9 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CM-9 c | |||
| NIST: NIST SP 800-53A (v1): CM-9.1 (i) | |||
| CCI: | CCI-000427 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | The organization develops a configuration management plan for the information system when in the system development life cycle the configuration items are placed under configuration management. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-9 b | ||
| NIST: NIST SP 800-53A (v1): CM-9.1 (i) | |||
| CCI: | CCI-000428 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | The organization documents a configuration management plan for the information system when in the system development life cycle the configuration items are placed under configuration management. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-9 b | ||
| NIST: NIST SP 800-53A (v1): CM-9.1 (i) | |||
| CCI: | CCI-000429 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | The organization implements a configuration management plan for the information system when in the system development life cycle the configuration items are placed under configuration management. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-9 b | ||
| NIST: NIST SP 800-53A (v1): CM-9.1 (i) | |||
| CCI: | CCI-000430 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | The organization develops a configuration management plan for the information system that establishes the means for identifying configuration items throughout the system development life cycle. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-9 c | ||
| NIST: NIST SP 800-53A (v1): CM-9.1 (i) | |||
| CCI: | CCI-000431 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | The organization documents a configuration management plan for the information system that establishes the means for identifying configuration items throughout the system development life cycle. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-9 c | ||
| NIST: NIST SP 800-53A (v1): CM-9.1 (i) | |||
| CCI: | CCI-000432 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | The organization implements a configuration management plan for the information system that establishes the means for identifying configuration items throughout the system development life cycle. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-9 c | ||
| NIST: NIST SP 800-53A (v1): CM-9.1 (i) | |||
| CCI: | CCI-000433 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | The organization develops a configuration management plan for the information system that establishes a process for managing the configuration of the configuration items. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-9 c | ||
| NIST: NIST SP 800-53A (v1): CM-9.1 (i) | |||
| CCI: | CCI-000434 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | The organization documents a configuration management plan for the information system that establishes a process for managing the configuration of the configuration items. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-9 c | ||
| NIST: NIST SP 800-53A (v1): CM-9.1 (i) | |||
| CCI: | CCI-000435 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | The organization implements a configuration management plan for the information system that establishes a process for managing the configuration of the configuration items. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-9 c | ||
| NIST: NIST SP 800-53A (v1): CM-9.1 (i) | |||
| CCI: | CCI-000442 | Status: | deprecated |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | The organization develops a contingency plan for the information system. | ||
| Type: | policy | ||
| CCI: | CCI-000450 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | The organization develops a contingency plan for the information system that addresses maintaining essential missions despite an information system disruption. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-2 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-2 a 4 | |||
| NIST: NIST SP 800-53A (v1): CP-2.1 (i) | |||
| CCI: | CCI-000451 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | The organization develops a contingency plan for the information system that addresses maintaining essential business functions despite an information system disruption. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-2 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-2 a 4 | |||
| NIST: NIST SP 800-53A (v1): CP-2.1 (i) | |||
| CCI: | CCI-000452 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | The organization develops a contingency plan for the information system that addresses maintaining essential missions despite an information system compromise. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-2 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-2 a 4 | |||
| NIST: NIST SP 800-53A (v1): CP-2.1 (i) | |||
| CCI: | CCI-000453 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | The organization develops a contingency plan for the information system that addresses maintaining essential business functions despite an information system compromise. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-2 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-2 a 4 | |||
| NIST: NIST SP 800-53A (v1): CP-2.1 (i) | |||
| CCI: | CCI-000454 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | The organization develops a contingency plan for the information system that addresses maintaining essential missions despite an information system failure. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-2 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-2 a 4 | |||
| NIST: NIST SP 800-53A (v1): CP-2.1 (i) | |||
| CCI: | CCI-000455 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | The organization develops a contingency plan for the information system that addresses maintaining essential business functions despite an information system failure. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-2 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-2 a 4 | |||
| NIST: NIST SP 800-53A (v1): CP-2.1 (i) | |||
| CCI: | CCI-000467 | Status: | deprecated |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | The organization defines a list of key contingency personnel (identified by name and/or by role) and organizational elements. | ||
| Type: | policy | ||
| CCI: | CCI-000477 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | The organization defines the time period for planning the resumption of all missions as a result of contingency plan activation. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-2 (4) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-2 (4) | |||
| NIST: NIST SP 800-53A (v1): CP-2 (4).1 (i) | |||
| CCI: | CCI-000478 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | The organization defines the time period for planning the resumption of all business functions as a result of contingency plan activation. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-2 (4) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-2 (4) | |||
| NIST: NIST SP 800-53A (v1): CP-2 (4).1 (i) | |||
| CCI: | CCI-000479 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | The organization plans for the resumption of all missions within an organization-defined time period of contingency plan activation. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-2 (4) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-2 (4) | |||
| NIST: NIST SP 800-53A (v1): CP-2 (4).1 (ii) | |||
| CCI: | CCI-000480 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | The organization plans for the resumption of all business functions within an organization-defined time period of contingency plan activation. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-2 (4) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-2 (4) | |||
| NIST: NIST SP 800-53A (v1): CP-2 (4).1 (ii) | |||
| CCI: | CCI-000491 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization defines the frequency to exercise the contingency plan for the information system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-4 | ||
| NIST: NIST SP 800-53A (v1): CP-4.1 (ii) | |||
| CCI: | CCI-000493 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization defines contingency plan exercises to be conducted for the information system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-4 | ||
| NIST: NIST SP 800-53A (v1): CP-4.1 (i) | |||
| CCI: | CCI-000495 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization exercises the contingency plan using organization-defined exercises in accordance with organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-4 a | ||
| NIST: NIST SP 800-53A (v1): CP-4.1 (iii) | |||
| CCI: | CCI-000499 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization coordinates contingency plan exercises with organizational elements responsible for related plans. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-4 (1) | ||
| NIST: NIST SP 800-53A (v1): CP-4 (1).1 | |||
| CCI: | CCI-000501 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization exercises the contingency plan at the alternate processing site to familiarize contingency personnel with the facility and available resources and to evaluate the site's capabilities to support contingency operations. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-4 (2) | ||
| NIST: NIST SP 800-53A (v1): CP-4 (2).1 | |||
| CCI: | CCI-000503 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization employs automated mechanisms to more thoroughly and effectively exercise the contingency plan by providing more complete coverage of contingency issues, selecting more realistic exercise scenarios and environments, and more effectively stressing the information and supported missions. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-4 (3) | ||
| NIST: NIST SP 800-53A (v1): CP-4 (3).1 | |||
| CCI: | CCI-000506 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization initiates necessary alternate storage site agreements to permit the storage and recovery of information system backup information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-6 | ||
| NIST: NIST SP 800-53A (v1): CP-6.1 (ii) | |||
| CCI: | CCI-000511 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization defines the time period for achieving the recovery time objectives for business functions within which processing must be resumed at the alternate processing site. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-7 | ||
| NIST: NIST SP 800-53A (v1): CP-7.1 (ii) | |||
| CCI: | CCI-000512 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization establishes an alternate processing site. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-7 a | ||
| NIST: NIST SP 800-53A (v1): CP-7.1 (i) | |||
| CCI: | CCI-000528 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization requests Telecommunications Service Priority for all telecommunications services used for national security emergency preparedness in the event that the primary telecommunications services are provided by a common carrier. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-8 (1) (b) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-8 (1) (b) | |||
| NIST: NIST SP 800-53A (v1): CP-8 (1).1 (ii) | |||
| CCI: | CCI-000529 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization requests Telecommunications Service Priority for all telecommunications services used for national security emergency preparedness in the event that the alternate telecommunications services are provided by a common carrier. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-8 (1) (b) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-8 (1) (b) | |||
| NIST: NIST SP 800-53A (v1): CP-8 (1).1 (ii) | |||
| CCI: | CCI-000540 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization protects the confidentiality, integrity, and availability of backup information at storage locations. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-9 (d) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-9 (d) | |||
| NIST: NIST SP 800-53A (v1): CP-9.2 | |||
| CCI: | CCI-000544 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization stores backup copies of the operating system in a separate facility or in a fire-rated container that is not colocated with the operational system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-9 (3) | ||
| NIST: NIST SP 800-53A (v1): CP-9 (3).1 | |||
| CCI: | CCI-000545 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization stores backup copies of critical information system software in a separate facility or in a fire-rated container that is not colocated with the operational system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-9 (3) | ||
| NIST: NIST SP 800-53A (v1): CP-9 (3).1 | |||
| CCI: | CCI-000546 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization stores backup copies of the information system inventory (including hardware, software, and firmware components) in a separate facility or in a fire-rated container that is not colocated with the operational system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-9 (3) | ||
| NIST: NIST SP 800-53A (v1): CP-9 (3).1 | |||
| CCI: | CCI-000550 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization provides for the recovery and reconstitution of the information system to a known state after a disruption. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-10 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-10 | |||
| NIST: NIST SP 800-53A (v1): CP-10.1 | |||
| CCI: | CCI-000551 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization provides for the recovery and reconstitution of the information system to a known state after a compromise. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-10 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-10 | |||
| NIST: NIST SP 800-53A (v1): CP-10.1 | |||
| CCI: | CCI-000552 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization provides for the recovery and reconstitution of the information system to a known state after a failure. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-10 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-10 | |||
| NIST: NIST SP 800-53A (v1): CP-10.1 | |||
| CCI: | CCI-000554 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization defines in the security plan, explicitly or by reference, the circumstances that can inhibit recovery and reconstitution of the information system to a known state. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-10 (3) | ||
| NIST: NIST SP 800-53A (v1): CP-10 (3).1 (i) | |||
| CCI: | CCI-000555 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization provides compensating security controls for organization-defined circumstances that can inhibit recovery and reconstitution of the information system to a known state. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-10 (3) | ||
| NIST: NIST SP 800-53A (v1): CP-10 (3).1 (ii) | |||
| CCI: | CCI-000560 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization protects backup and restoration hardware. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-10 (6) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-10 (6) | |||
| NIST: NIST SP 800-53A (v1): CP-10 (6).1 | |||
| CCI: | CCI-000561 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization protects backup and restoration firmware. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-10 (6) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-10 (6) | |||
| NIST: NIST SP 800-53A (v1): CP-10 (6).1 | |||
| CCI: | CCI-000562 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization protects backup and restoration software. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-10 (6) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CP-10 (6) | |||
| NIST: NIST SP 800-53A (v1): CP-10 (6).1 | |||
| CCI: | CCI-000565 | Status: | deprecated |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization reviews/updates, per organization-defined frequency, a formal, documented security planning policy. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PL-1 a | ||
| NIST: NIST SP 800-53A (v1): PL-1.2 (ii) | |||
| CCI: | CCI-000569 | Status: | deprecated |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization develops a security plan for the information system. | ||
| Type: | policy | ||
| CCI: | CCI-000570 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization develops a security plan for the information system that is consistent with the organization's enterprise architecture; explicitly defines the authorization boundary for the system; describes the operational context of the information system in terms of mission and business processes; provides the security category and impact level of the information system, including supporting rationale; describes the operational environment for the information system; describes relationships with, or connections to, other information systems; provides an overview of the security requirements for the system; and describes the security controls in place or planned for meeting those requirements, including a rationale for the tailoring and supplemental decisions. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PL-2 a | ||
| NIST: NIST SP 800-53A (v1): PL-2.1 (i) | |||
| CCI: | CCI-000575 | Status: | deprecated |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization develops a security Concept of Operations (CONOPS) for the information system. | ||
| Type: | policy | ||
| CCI: | CCI-000576 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization develops a security Concept of Operations (CONOPS) for the information system containing, at a minimum: the purpose of the system; a description of the system architecture; the security authorization schedule; and the security categorization and associated factors considered in determining the categorization. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PL-2 (1) (a) | ||
| NIST: NIST SP 800-53A (v1): PL-2 (1).1 (i) (ii) (iii) (iv) (v) | |||
| CCI: | CCI-000579 | Status: | deprecated |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization develops a functional architecture for the information system. | ||
| Type: | policy | ||
| CCI: | CCI-000580 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization develops a functional architecture for the information system that identifies and maintains external interfaces. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PL-2 (2) (a) | ||
| NIST: NIST SP 800-53A (v1): PL-2 (2).1 | |||
| CCI: | CCI-000581 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization develops a functional architecture for the information system that identifies and maintains the information being exchanged across the interfaces. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PL-2 (2) (a) | ||
| NIST: NIST SP 800-53A (v1): PL-2 (2).1 | |||
| CCI: | CCI-000582 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization develops a functional architecture for the information system that identifies and maintains the protection mechanisms associated with each interface. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PL-2 (2) (a) | ||
| NIST: NIST SP 800-53A (v1): PL-2 (2).1 | |||
| CCI: | CCI-000583 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization develops a functional architecture for the information system that identifies and maintains user roles. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PL-2 (2) (b) | ||
| NIST: NIST SP 800-53A (v1): PL-2 (2).1 | |||
| CCI: | CCI-000584 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization develops a functional architecture for the information system that identifies and maintains the access privileges assigned to each role. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PL-2 (2) (b) | ||
| NIST: NIST SP 800-53A (v1): PL-2 (2).1 | |||
| CCI: | CCI-000585 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization develops a functional architecture for the information system that identifies and maintains unique security requirements. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PL-2 (2) (c) | ||
| NIST: NIST SP 800-53A (v1): PL-2 (2).1 | |||
| CCI: | CCI-000586 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization develops a functional architecture for the information system that identifies and maintains types of information processed by the information system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PL-2 (2) (d) | ||
| NIST: NIST SP 800-53A (v1): PL-2 (2).1 | |||
| CCI: | CCI-000587 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization develops a functional architecture for the information system that identifies and maintains types of information stored by the information system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PL-2 (2) (d) | ||
| NIST: NIST SP 800-53A (v1): PL-2 (2).1 | |||
| CCI: | CCI-000588 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization develops a functional architecture for the information system that identifies and maintains types of information transmitted by the information system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PL-2 (2) (d) | ||
| NIST: NIST SP 800-53A (v1): PL-2 (2).1 | |||
| CCI: | CCI-000589 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization develops a functional architecture for the information system that identifies and maintains any specific protection needs in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PL-2 (2) (d) | ||
| NIST: NIST SP 800-53A (v1): PL-2 (2).1 | |||
| CCI: | CCI-000590 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization develops a functional architecture for the information system that identifies and maintains restoration priority of information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PL-2 (2) (e) | ||
| NIST: NIST SP 800-53A (v1): PL-2 (2).1 | |||
| CCI: | CCI-000591 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization develops a functional architecture for the information system that identifies and maintains restoration priority of information system services. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PL-2 (2) (e) | ||
| NIST: NIST SP 800-53A (v1): PL-2 (2).1 | |||
| CCI: | CCI-000596 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization includes in the rules of behavior, explicit restrictions on sharing information system account information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PL-4 (1) | ||
| NIST: NIST SP 800-53A (v1): PL-4 (1).1 | |||
| CCI: | CCI-000597 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization conducts a privacy impact assessment on the information system in accordance with OMB policy. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PL-5 | ||
| NIST: NIST SP 800-53A (v1): PL-5.1 (i) (ii) | |||
| CCI: | CCI-000598 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization plans and coordinates security-related activities affecting the information system before conducting such activities in order to reduce the impact on organizational operations (i.e., mission, functions, image, and reputation). | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PL-6 | ||
| NIST: NIST SP 800-53A (v1): PL-6.1 | |||
| CCI: | CCI-000599 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization plans and coordinates security-related activities affecting the information system before conducting such activities in order to reduce the impact on organizational assets. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PL-6 | ||
| NIST: NIST SP 800-53A (v1): PL-6.1 | |||
| CCI: | CCI-000600 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization plans and coordinates security-related activities affecting the information system before conducting such activities in order to reduce the impact on organizational individuals. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PL-6 | ||
| NIST: NIST SP 800-53A (v1): PL-6.1 | |||
| CCI: | CCI-000608 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization includes a determination of information security requirements for the information system in mission process planning. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-2 a | ||
| NIST: NIST SP 800-53A (v1): SA-2.1 (i) | |||
| CCI: | CCI-000609 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization includes a determination of information security requirements for the information system in business process planning. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-2 a | ||
| NIST: NIST SP 800-53A (v1): SA-2.1 (i) | |||
| CCI: | CCI-000617 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization documents information system security roles and responsibilities throughout the system development life cycle. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-3 b | ||
| NIST: NIST SP 800-53A (v1): SA-3.1 (ii) | |||
| CCI: | CCI-000619 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization includes security functional requirements/specifications, explicitly or by reference, in information system acquisition contracts based on an assessment of risk and in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-4 a | ||
| NIST: NIST SP 800-53A (v1): SA-4.1 | |||
| CCI: | CCI-000620 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization includes security-related documentation requirements, explicitly or by reference, in information system acquisition contracts based on an assessment of risk and in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-4 b | ||
| NIST: NIST SP 800-53A (v1): SA-4.1 | |||
| CCI: | CCI-000621 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization includes developmental and evaluation-related assurance requirements, explicitly or by reference, in information system acquisition contracts based on an assessment of risk and in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-4 c | ||
| NIST: NIST SP 800-53A (v1): SA-4.1 | |||
| CCI: | CCI-000622 | Status: | deprecated |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization includes the following requirements and/or specifications, explicitly or by reference, in information system acquisition contracts based on an assessment of risk and in accordance with applicable federal laws, Executive Orders, directives. | ||
| Type: | policy | ||
| CCI: | CCI-000624 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization requires in acquisition documents that vendors/contractors provide information describing the design details of the security controls to be employed within the information system, information system components, or information system services (including functional interfaces among control components) in sufficient detail to permit analysis and testing of the controls. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-4 (2) | ||
| NIST: NIST SP 800-53A (v1): SA-4 (2).1 | |||
| CCI: | CCI-000625 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization requires in acquisition documents that vendors/contractors provide information describing the implementation details of the security controls to be employed within the information system, information system components, or information system services (including functional interfaces among control components) in sufficient detail to permit analysis and testing of the controls. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-4 (2) | ||
| NIST: NIST SP 800-53A (v1): SA-4 (2).1 | |||
| CCI: | CCI-000626 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization requires software vendors/manufacturers to minimize flawed or malformed software by demonstrating that their software development process employs state-of-the-practice software and security engineering methods. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-4 (3) | ||
| NIST: NIST SP 800-53A (v1): SA-4 (3).1 | |||
| CCI: | CCI-000627 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization requires software vendors/manufacturers to minimize flawed or malformed software by demonstrating that their software development process employs quality control processes. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-4 (3) | ||
| NIST: NIST SP 800-53A (v1): SA-4 (3).1 | |||
| CCI: | CCI-000628 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization requires software vendors/manufacturers to minimize flawed or malformed software by demonstrating that their software development processes employ validation techniques. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-4 (3) | ||
| NIST: NIST SP 800-53A (v1): SA-4 (3).1 | |||
| CCI: | CCI-000629 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization ensures each information system component acquired is explicitly assigned to an information system, and that the owner of the system acknowledges this assignment. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-4 (4) | ||
| NIST: NIST SP 800-53A (v1): SA-4 (4).1 (i) (ii) | |||
| CCI: | CCI-000630 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization requires in acquisition documents, that information system components are delivered in a secure, documented configuration, and that the secure configuration is the default configuration for any software reinstalls or upgrades. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-4 (5) | ||
| NIST: NIST SP 800-53A (v1): SA-4 (5).1 (i) (ii) | |||
| CCI: | CCI-000632 | Status: | deprecated |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization employs only commercial off-the-shelf (COTS) information assurance (IA) and IA-enabled information technology products that compose an NSA-approved solution to protect classified information when the networks used to transmit the information are at a lower classification level than the information being transmitted. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-4 (6) (a) | ||
| NIST: NIST SP 800-53A (v1): SA-4 (6).1 (i) | |||
| CCI: | CCI-000636 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization obtains administrator documentation for the information system that describes secure configuration, installation, and operation of the information system; effective use and maintenance of the security features/functions; and known vulnerabilities regarding configuration and use of administrative (i.e., privileged) functions. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-5 a | ||
| NIST: NIST SP 800-53A (v1): SA-5.1 (i) | |||
| CCI: | CCI-000637 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization protects, as required, administrator documentation for the information system that describes secure configuration, installation, and operation of the information system; effective use and maintenance of the security features/functions; and known vulnerabilities regarding configuration and use of administrative (i.e., privileged) functions. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-5 a | ||
| NIST: NIST SP 800-53A (v1): SA-5.1 (i) | |||
| CCI: | CCI-000638 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization makes available to authorized personnel administrator documentation for the information system that describes secure configuration, installation, and operation of the information system; effective use and maintenance of the security features/functions; and known vulnerabilities regarding configuration and use of administrative (i.e., privileged) functions. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-5 a | ||
| NIST: NIST SP 800-53A (v1): SA-5.1 (i) | |||
| CCI: | CCI-000639 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization obtains user documentation for the information system that describes user-accessible security features/functions and how to effectively use those security features/functions; methods for user interaction with the information system, which enables individuals to use the system in a more secure manner; and user responsibilities in maintaining the security of the information and information system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-5 b | ||
| NIST: NIST SP 800-53A (v1): SA-5.1 (ii) | |||
| CCI: | CCI-000640 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization protects, as required, user documentation for the information system that describes user-accessible security features/functions and how to effectively use those security features/functions; methods for user interaction with the information system, which enables individuals to use the system in a more secure manner; and user responsibilities in maintaining the security of the information and information system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-5 b | ||
| NIST: NIST SP 800-53A (v1): SA-5.1 (ii) | |||
| CCI: | CCI-000641 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization makes available to authorized personnel user documentation for the information system that describes user-accessible security features/functions and how to effectively use those security features/functions; methods for user interaction with the information system, which enables individuals to use the system in a more secure manner; and user responsibilities in maintaining the security of the information and information system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-5 b | ||
| NIST: NIST SP 800-53A (v1): SA-5.1 (ii) | |||
| CCI: | CCI-000643 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization obtains vendor/manufacturer documentation that describes the functional properties of the security controls employed within the information system with sufficient detail to permit analysis and testing. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-5 (1) | ||
| NIST: NIST SP 800-53A (v1): SA-5 (1).1 (i) SA-5(2).1 (i) | |||
| CCI: | CCI-000644 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization protects, as required, vendor/manufacturer documentation that describes the functional properties of the security controls employed within the information system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-5 (1) | ||
| NIST: NIST SP 800-53A (v1): SA-5 (1).1 (i) SA-5(2).1 (i) | |||
| CCI: | CCI-000645 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization makes available to authorized personnel vendor/manufacturer documentation that describes the functional properties of the security controls employed within the information system with sufficient detail to permit analysis and testing. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-5 (2) | ||
| NIST: NIST SP 800-53A (v1): SA-5 (1).1 SA-5(2).1 SA-5(3).1 SA-5(4).1 (i)s | |||
| CCI: | CCI-000646 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization obtains vendor/manufacturer documentation that describes the security-relevant external interfaces to the information system with sufficient detail to permit analysis and testing. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-5 (2) | ||
| NIST: NIST SP 800-53A (v1): SA-5 (1).1 SA-5(2).1 SA-5(3).1 SA-5(4) (ii)s | |||
| CCI: | CCI-000647 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization obtains vendor/manufacturer documentation that describes the high-level design of the information system in terms of subsystems and implementation details of the security controls employed within the system with sufficient detail to permit analysis and testing. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-5 (3) | ||
| NIST: NIST SP 800-53A (v1): SA-5 (3).1 (ii) | |||
| CCI: | CCI-000648 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization protects, as required, vendor/manufacturer documentation that describes the high-level design of the information system in terms of subsystems and implementation details of the security controls employed within the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-5 (3) | ||
| NIST: NIST SP 800-53A (v1): SA-5 (3).1 (ii) | |||
| CCI: | CCI-000649 | Status: | deprecated |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization obtains, protects as required, and makes available to authorized personnel, vendor/manufacturer documentation that describes the high-level design of the information system in terms of implementation details of the security controls emplo. | ||
| Type: | policy | ||
| CCI: | CCI-000650 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization obtains vendor/manufacturer documentation that describes the low-level design of the information system in terms of modules and implementation details of the security controls employed within the system with sufficient detail to permit analysis and testing. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-5 (4) | ||
| NIST: NIST SP 800-53A (v1): SA-5 (4).1 (ii) | |||
| CCI: | CCI-000651 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization protects, as required, vendor/manufacturer documentation that describes the low-level design of the information system in terms of modules and implementation details of the security controls employed within the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-5 (4) | ||
| NIST: NIST SP 800-53A (v1): SA-5 (4).1 (ii) | |||
| CCI: | CCI-000652 | Status: | deprecated |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization obtains, protects as required, and makes available to authorized personnel, vendor/manufacturer documentation that describes the low-level design of the information system in terms of implementation details of the security controls employ. | ||
| Type: | policy | ||
| CCI: | CCI-000653 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization obtains the source code for the information system to permit analysis and testing. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-5 (5) | ||
| NIST: NIST SP 800-53A (v1): SA-5 (5).1 | |||
| CCI: | CCI-000654 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization protects, as required, the source code for the information system to permit analysis and testing. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-5 (5) | ||
| NIST: NIST SP 800-53A (v1): SA-5 (5).1 | |||
| CCI: | CCI-000655 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization uses software and associated documentation in accordance with contract agreements and copyright laws. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-6 a | ||
| NIST: NIST SP 800-53A (v1): SA-6.1 (i) | |||
| CCI: | CCI-000656 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization employs tracking systems for software and associated documentation protected by quantity licenses to control copying and distribution. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-6 b | ||
| NIST: NIST SP 800-53A (v1): SA-6.1 (ii) | |||
| CCI: | CCI-000657 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization controls the use of peer-to-peer file sharing technology to ensure this capability is not used for the unauthorized distribution, display, performance, or reproduction of copyrighted work. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-6 c | ||
| NIST: NIST SP 800-53A (v1): SA-6.1 (iii) | |||
| CCI: | CCI-000658 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization documents the use of peer-to-peer file sharing technology to ensure this capability is not used for the unauthorized distribution, display, performance, or reproduction of copyrighted work. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-6 c | ||
| NIST: NIST SP 800-53A (v1): SA-6.1 (iii) | |||
| CCI: | CCI-000659 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization prohibits the use of binary executable code from sources with limited or no warranty without accompanying source code. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-6 (1) (a) | ||
| NIST: NIST SP 800-53A (v1): SA-6 (1).1 (i) | |||
| CCI: | CCI-000660 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization prohibits the use of machine executable code from sources with limited or no warranty without accompanying source code. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-6 (1) (a) | ||
| NIST: NIST SP 800-53A (v1): SA-6 (1).1 (i) | |||
| CCI: | CCI-000661 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization provides exceptions to the source code requirement only when no alternative solutions are available to support compelling mission/operational requirements. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-6 (1) (b) | ||
| NIST: NIST SP 800-53A (v1): SA-6 (1).1 (ii) | |||
| CCI: | CCI-000662 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization obtains express written consent of the authorizing official for exceptions to the source code requirement. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-6 (1) (b) | ||
| NIST: NIST SP 800-53A (v1): SA-6 (1).1 (iii) | |||
| CCI: | CCI-000663 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization (or information system) enforces explicit rules governing the installation of software by users. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): SA-7 | ||
| NIST: NIST SP 800-53A (v1): SA-7.1 (ii) | |||
| CCI: | CCI-000670 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization requires that providers of external information system services employ organization-defined security controls in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-9 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SA-9 a | |||
| NIST: NIST SP 800-53A (v1): SA-9.1 (i) | |||
| CCI: | CCI-000671 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization defines government oversight with regard to external information system services. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-9 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SA-9 b | |||
| NIST: NIST SP 800-53A (v1): SA-9.1 (ii) | |||
| CCI: | CCI-000672 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization documents government oversight with regard to external information system services. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-9 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SA-9 b | |||
| NIST: NIST SP 800-53A (v1): SA-9.1 (ii) | |||
| CCI: | CCI-000673 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization defines user roles and responsibilities with regard to external information system services. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-9 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SA-9 b | |||
| NIST: NIST SP 800-53A (v1): SA-9.1 (ii) | |||
| CCI: | CCI-000674 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization documents user roles and responsibilities with regard to external information system services. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-9 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SA-9 b | |||
| NIST: NIST SP 800-53A (v1): SA-9.1 (ii) | |||
| CCI: | CCI-000675 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization monitors security control compliance by external service providers. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-9 c | ||
| NIST: NIST SP 800-53A (v1): SA-9.1 (iii) | |||
| CCI: | CCI-000676 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization conducts an organizational assessment of risk prior to the acquisition of dedicated information security services. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-9 (1) (a) | ||
| NIST: NIST SP 800-53A (v1): SA-9 (1).1 (i) | |||
| CCI: | CCI-000677 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization conducts an organizational assessment of risk prior to the outsourcing of dedicated information security services. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-9 (1) (a) | ||
| NIST: NIST SP 800-53A (v1): SA-9 (1).1 (i) | |||
| CCI: | CCI-000678 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization defines the senior organizational official designated to approve acquisition of dedicated information security services. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-9 (1) (b) | ||
| NIST: NIST SP 800-53A (v1): SA-9 (1).1 (ii) | |||
| CCI: | CCI-000679 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization defines the senior organizational official designated to approve outsourcing of dedicated information security services. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-9 (1) (b) | ||
| NIST: NIST SP 800-53A (v1): SA-9 (1).1 (ii) | |||
| CCI: | CCI-000680 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization ensures the acquisition of dedicated information security services is approved by an organization-designated senior organizational official. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-9 (1) (b) | ||
| NIST: NIST SP 800-53A (v1): SA-9 (1).1 (iii) | |||
| CCI: | CCI-000681 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization ensures the outsourcing of dedicated information security services is approved by an organization-designated senior organizational official. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-9 (1) (b) | ||
| NIST: NIST SP 800-53A (v1): SA-9 (1).1 (iii) | |||
| CCI: | CCI-000682 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization requires information system developers to perform configuration management during information system design. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-10 (a) | ||
| NIST: NIST SP 800-53A (v1): SA-10.1 (i) | |||
| CCI: | CCI-000683 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization requires information system developers to perform configuration management during information system development. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-10 (a) | ||
| NIST: NIST SP 800-53A (v1): SA-10.1 (i) | |||
| CCI: | CCI-000684 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization requires information system developers to perform configuration management during information system implementation. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-10 (a) | ||
| NIST: NIST SP 800-53A (v1): SA-10.1 (i) | |||
| CCI: | CCI-000685 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization requires information system developers to perform configuration management during information system operation. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-10 (a) | ||
| NIST: NIST SP 800-53A (v1): SA-10.1 (i) | |||
| CCI: | CCI-000686 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization requires information system integrators to perform configuration management during information system design. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-10 (a) | ||
| NIST: NIST SP 800-53A (v1): SA-10.1 (i) | |||
| CCI: | CCI-000687 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization requires information system integrators to perform configuration management during information system development. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-10 (a) | ||
| NIST: NIST SP 800-53A (v1): SA-10.1 (i) | |||
| CCI: | CCI-000688 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization requires information system integrators to perform configuration management during information system implementation. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-10 (a) | ||
| NIST: NIST SP 800-53A (v1): SA-10.1 (i) | |||
| CCI: | CCI-000689 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization requires information system integrators to perform configuration management during information system operation. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-10 (a) | ||
| NIST: NIST SP 800-53A (v1): SA-10.1 (i) | |||
| CCI: | CCI-000690 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization requires information system developers to manage and control changes to the information system during design. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-10 (b) | ||
| NIST: NIST SP 800-53A (v1): SA-10.1 (ii) | |||
| CCI: | CCI-000691 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization requires information system integrators to manage and control changes to the information system during design. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-10 (b) | ||
| NIST: NIST SP 800-53A (v1): SA-10.1 (ii) | |||
| CCI: | CCI-000693 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization requires information system integrators to implement only organization-approved changes. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-10 (c) | ||
| NIST: NIST SP 800-53A (v1): SA-10.1 (iii) | |||
| CCI: | CCI-000695 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization requires information system integrators to document approved changes to the information system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-10 (d) | ||
| NIST: NIST SP 800-53A (v1): SA-10.1 (iv) | |||
| CCI: | CCI-000696 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization requires that information system developers track security flaws and flaw resolution. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-10 (e) | ||
| NIST: NIST SP 800-53A (v1): SA-10.1 (v) | |||
| CCI: | CCI-000697 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization requires information system integrators to track security flaws and flaw resolution. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-10 (e) | ||
| NIST: NIST SP 800-53A (v1): SA-10.1 (v) | |||
| CCI: | CCI-000699 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization requires information system integrators to provide an integrity check of software to facilitate organizational verification of software integrity after delivery. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-10 (1) | ||
| NIST: NIST SP 800-53A (v1): SA-10 (1).1 | |||
| CCI: | CCI-000701 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization provides an alternative configuration management process with organizational personnel in the absence of a dedicated integrator configuration management team. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-10 (2) | ||
| NIST: NIST SP 800-53A (v1): SA-10 (2).1 | |||
| CCI: | CCI-000702 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization requires information system developers, in consultation with associated security personnel (including security engineers), to create a security test and evaluation plan. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-11 (a) | ||
| NIST: NIST SP 800-53A (v1): SA-11.1 SA-11(3).1 (i) | |||
| CCI: | CCI-000703 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization requires information system developers, in consultation with associated security personnel (including security engineers), to implement a security test and evaluation plan. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-11 (a) | ||
| NIST: NIST SP 800-53A (v1): SA-11.1 | |||
| CCI: | CCI-000704 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization requires information system integrators, in consultation with associated security personnel (including security engineers), to create a security test and evaluation plan. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-11 (a) | ||
| NIST: NIST SP 800-53A (v1): SA-11.1 SA-11(3).1 (i) | |||
| CCI: | CCI-000705 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization requires information system integrators, in consultation with associated security personnel (including security engineers), to implement a security test and evaluation plan. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-11 (a) | ||
| NIST: NIST SP 800-53A (v1): SA-11.1 | |||
| CCI: | CCI-000706 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization requires information system developers, in consultation with associated security personnel (including security engineers), to implement a verifiable flaw remediation process to correct weaknesses and deficiencies identified during the security testing and evaluation process. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-11 (b) | ||
| NIST: NIST SP 800-53A (v1): SA-11.1 | |||
| CCI: | CCI-000707 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization requires information system integrators, in consultation with associated security personnel (including security engineers), to implement a verifiable flaw remediation process to correct weaknesses and deficiencies identified during the security testing and evaluation process. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-11 (b) | ||
| NIST: NIST SP 800-53A (v1): SA-11.1 | |||
| CCI: | CCI-000708 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization requires information system developers, in consultation with associated security personnel (including security engineers), to document the results of the security testing/evaluation processes. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-11 (c) | ||
| NIST: NIST SP 800-53A (v1): SA-11.1 | |||
| CCI: | CCI-000709 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization requires information system developers, in consultation with associated security personnel (including security engineers), to document the results of the security flaw remediation processes. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-11 (c) | ||
| NIST: NIST SP 800-53A (v1): SA-11.1 | |||
| CCI: | CCI-000710 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization requires information system integrators, in consultation with associated security personnel (including security engineers), to document the results of the security testing/evaluation processes. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-11 (c) | ||
| NIST: NIST SP 800-53A (v1): SA-11.1 | |||
| CCI: | CCI-000711 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization requires information system integrators, in consultation with associated security personnel (including security engineers), to document the results of the security flaw remediation processes. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-11 (c) | ||
| NIST: NIST SP 800-53A (v1): SA-11.1 | |||
| CCI: | CCI-000712 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization requires information system developers to employ code analysis tools to examine software for common flaws and document the results of the analysis. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-11 (1) | ||
| NIST: NIST SP 800-53A (v1): SA-11 (1).1 (i) (ii) | |||
| CCI: | CCI-000713 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization requires information system integrators to employ code analysis tools to examine software for common flaws and document the results of the analysis. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-11 (1) | ||
| NIST: NIST SP 800-53A (v1): SA-11 (1).1 (i) (ii) | |||
| CCI: | CCI-000714 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization requires information system developers to perform a vulnerability analysis to document vulnerabilities. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-11 (2) | ||
| NIST: NIST SP 800-53A (v1): SA-11 (*2).1 | |||
| CCI: | CCI-000715 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization requires information system developers to perform a vulnerability analysis to document exploitation potential. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-11 (2) | ||
| NIST: NIST SP 800-53A (v1): SA-11 (2).1 | |||
| CCI: | CCI-000716 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization requires information system developers to perform a vulnerability analysis to document risk mitigations. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-11 (2) | ||
| NIST: NIST SP 800-53A (v1): SA-11 (2).1 | |||
| CCI: | CCI-000717 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization requires information system integrators to perform a vulnerability analysis to document vulnerabilities. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-11 (2) | ||
| NIST: NIST SP 800-53A (v1): SA-11 (2).1 | |||
| CCI: | CCI-000718 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization requires information system integrators to perform a vulnerability analysis to document exploitation potential. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-11 (2) | ||
| NIST: NIST SP 800-53A (v1): SA-11 (2).1 | |||
| CCI: | CCI-000719 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization requires information system integrators perform a vulnerability analysis to document risk mitigations. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-11 (2) | ||
| NIST: NIST SP 800-53A (v1): SA-11 (2).1 | |||
| CCI: | CCI-000720 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization requires information system developers implement the security test and evaluation plan under the witness of an independent verification and validation agent. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-11 (3) | ||
| NIST: NIST SP 800-53A (v1): SA-1 1(3).1 (ii) | |||
| CCI: | CCI-000721 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization requires information system integrators to implement the security test and evaluation plan under the witness of an independent verification and validation agent. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-11 (3) | ||
| NIST: NIST SP 800-53A (v1): SA-1 1(3).1 (ii) | |||
| CCI: | CCI-000722 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization defines the security safeguards to employ to protect against supply chain threats to the information system, system component, or information system service. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-12 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SA-12 | |||
| NIST: NIST SP 800-53A (v1): SA-12.1 (i) | |||
| CCI: | CCI-000723 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization protects against supply chain threats to the information system, system component, or information system service by employing organization-defined security safeguards as part of a comprehensive, defense-in-breadth information security strategy. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-12 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SA-12 | |||
| NIST: NIST SP 800-53A (v1): SA-12.1 (ii) | |||
| CCI: | CCI-000724 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization purchases all anticipated information system components and spares in the initial acquisition. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-12 (1) | ||
| NIST: NIST SP 800-53A (v1): SA-12 (1).1 | |||
| CCI: | CCI-000725 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization conducts a due diligence review of suppliers prior to entering into contractual agreements to acquire information system hardware. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-12 (2) | ||
| NIST: NIST SP 800-53A (v1): SA-12 (2).1 | |||
| CCI: | CCI-000726 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization conducts a due diligence review of suppliers prior to entering into contractual agreements to acquire information system software. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-12 (2) | ||
| NIST: NIST SP 800-53A (v1): SA-12 (2).1 | |||
| CCI: | CCI-000727 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization conducts a due diligence review of suppliers prior to entering into contractual agreements to acquire information system firmware. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-12 (2) | ||
| NIST: NIST SP 800-53A (v1): SA-12 (2).1 | |||
| CCI: | CCI-000728 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization conducts a due diligence review of suppliers prior to entering into contractual agreements to acquire information system services. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-12 (2) | ||
| NIST: NIST SP 800-53A (v1): SA-12 (2).1 | |||
| CCI: | CCI-000729 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization uses trusted shipping for information systems. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-12 (3) | ||
| NIST: NIST SP 800-53A (v1): SA-12 (3).1 | |||
| CCI: | CCI-000730 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization uses trusted shipping for information system components. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-12 (3) | ||
| NIST: NIST SP 800-53A (v1): SA-12 (3).1 | |||
| CCI: | CCI-000731 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization uses trusted shipping for information technology products. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-12 (3) | ||
| NIST: NIST SP 800-53A (v1): SA-12 (3).1 | |||
| CCI: | CCI-000732 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization uses trusted warehousing for information systems. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-12 (3) | ||
| NIST: NIST SP 800-53A (v1): SA-12 (3).1 | |||
| CCI: | CCI-000733 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization uses trusted warehousing for information system components. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-12 (3) | ||
| NIST: NIST SP 800-53A (v1): SA-12 (3).1 | |||
| CCI: | CCI-000734 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization uses trusted warehousing for information technology products. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-12 (3) | ||
| NIST: NIST SP 800-53A (v1): SA-12 (3).1 | |||
| CCI: | CCI-000735 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization employs a diverse set of suppliers for information systems. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-12 (4) | ||
| NIST: NIST SP 800-53A (v1): SA-12 (4).1 | |||
| CCI: | CCI-000736 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization employs a diverse set of suppliers for information system components. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-12 (4) | ||
| NIST: NIST SP 800-53A (v1): SA-12 (4).1 | |||
| CCI: | CCI-000737 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization employs a diverse set of suppliers for information technology products. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-12 (4) | ||
| NIST: NIST SP 800-53A (v1): SA-12 (4).1 | |||
| CCI: | CCI-000738 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization employs a diverse set of suppliers for information system services. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-12 (4) | ||
| NIST: NIST SP 800-53A (v1): SA-12 (4).1 | |||
| CCI: | CCI-000739 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization employs standard configurations for information systems. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-12 (5) | ||
| NIST: NIST SP 800-53A (v1): SA-12 (5).1 | |||
| CCI: | CCI-000740 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization employs standard configurations for information system components. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-12 (5) | ||
| NIST: NIST SP 800-53A (v1): SA-12 (5).1 | |||
| CCI: | CCI-000741 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization employs standard configurations for information technology products. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-12 (5) | ||
| NIST: NIST SP 800-53A (v1): SA-12 (5).1 | |||
| CCI: | CCI-000742 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization minimizes the time between purchase decisions and delivery of information systems. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-12 (6) | ||
| NIST: NIST SP 800-53A (v1): SA-12 (6).1 | |||
| CCI: | CCI-000743 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization minimizes the time between purchase decisions and delivery of information system components. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-12 (6) | ||
| NIST: NIST SP 800-53A (v1): SA-12 (6).1 | |||
| CCI: | CCI-000744 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization minimizes the time between purchase decisions and delivery of information technology products. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-12 (6) | ||
| NIST: NIST SP 800-53A (v1): SA-12 (6).1 | |||
| CCI: | CCI-000745 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization employs independent analysis and penetration testing against delivered information systems. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-12 (7) | ||
| NIST: NIST SP 800-53A (v1): SA-12 (7).1 | |||
| CCI: | CCI-000746 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization employs independent analysis and penetration testing against delivered information system components. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-12 (7) | ||
| NIST: NIST SP 800-53A (v1): SA-12 (7).1 | |||
| CCI: | CCI-000747 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization employs independent analysis and penetration testing against delivered information technology products. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-12 (7) | ||
| NIST: NIST SP 800-53A (v1): SA-12 (7).1 | |||
| CCI: | CCI-000748 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization defines level of trustworthiness for the information system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-13 | ||
| NIST: NIST SP 800-53A (v1): SA-13.1 (i) | |||
| CCI: | CCI-000749 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization requires that the information system meets the organization-defined level of trustworthiness. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-13 | ||
| NIST: NIST SP 800-53A (v1): SA-13.1 (ii) | |||
| CCI: | CCI-000750 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization defines the list of critical information system components that require re-implementation. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-14 | ||
| NIST: NIST SP 800-53A (v1): SA-14.1 (i) | |||
| CCI: | CCI-000751 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization determines the organization-defined list of critical information system components that require re-implementation. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-14 a | ||
| NIST: NIST SP 800-53A (v1): SA-14 | |||
| CCI: | CCI-000752 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization re-implements organization-defined critical information system components. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-14 b | ||
| NIST: NIST SP 800-53A (v1): SA-14.1 (ii) | |||
| CCI: | CCI-000753 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization identifies information system components for which alternative sourcing is not viable. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-14 (1) (a) | ||
| NIST: NIST SP 800-53A (v1): SA-14 (1).1 (i) | |||
| CCI: | CCI-000754 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization defines measures to be employed to prevent critical security controls for information system components from being compromised. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-14 (1) (b) | ||
| NIST: NIST SP 800-53A (v1): SA-14 (1).1 (ii) | |||
| CCI: | CCI-000755 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization employs organization-defined measures to ensure critical security controls for the information system components are not compromised. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-14 (1) (b) | ||
| NIST: NIST SP 800-53A (v1): SA-14 (1).1 (iii) | |||
| CCI: | CCI-000756 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-17 |
| Definition: | The organization develops an identification and authentication policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): IA-1 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): IA-1 a 1 | |||
| NIST: NIST SP 800-53A (v1): IA-1.1 (i) (ii) | |||
| CCI: | CCI-000760 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-17 |
| Definition: | The organization develops procedures to facilitate the implementation of the identification and authentication policy and associated identification and authentication controls. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): IA-1 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): IA-1 a 2 | |||
| NIST: NIST SP 800-53A (v1): IA-1.1 (v) | |||
| CCI: | CCI-000761 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-17 |
| Definition: | The organization disseminates to organization-defined personnel or roles procedures to facilitate the implementation of the identification and authentication policy and associated identification and authentication controls. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): IA-1 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): IA-1 a 2 | |||
| NIST: NIST SP 800-53A (v1): IA-1.1 (vi) | |||
| CCI: | CCI-000767 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-17 |
| Definition: | The information system implements multifactor authentication for local access to privileged accounts. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): IA-2 (3) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): IA-2 (3) | |||
| NIST: NIST SP 800-53A (v1): IA-2 (3).1 | |||
| CCI: | CCI-000768 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-17 |
| Definition: | The information system implements multifactor authentication for local access to non-privileged accounts. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): IA-2 (4) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): IA-2 (4) | |||
| NIST: NIST SP 800-53A (v1): IA-2 (4).1 | |||
| CCI: | CCI-000769 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-17 |
| Definition: | The organization allows the use of group authenticators only when used in conjunction with an individual/unique authenticator. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): IA-2 (5) (a) | ||
| NIST: NIST SP 800-53A (v1): IA-2 (5).1 (i) | |||
| CCI: | CCI-000770 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-17 |
| Definition: | The organization requires individuals to be authenticated with an individual authenticator when a group authenticator is employed. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 (v3): IA-2 (5) (b) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): IA-2 (5) | |||
| NIST: NIST SP 800-53A (v1): IA-2 (5).2 (ii) | |||
| CCI: | CCI-000771 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-17 |
| Definition: | The information system uses multifactor authentication for network access to privileged accounts where one of the factors is provided by a device separate from the information system being accessed. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): IA-2 (6) | ||
| NIST: NIST SP 800-53A (v1): IA-2 (6).1 | |||
| CCI: | CCI-000772 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-17 |
| Definition: | The information system uses multifactor authentication for network access to non-privileged accounts where one of the factors is provided by a device separate from the information system being accessed. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): IA-2 (7) | ||
| NIST: NIST SP 800-53A (v1): IA-2 (7).1 | |||
| CCI: | CCI-000773 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-17 |
| Definition: | The organization defines replay-resistant authentication mechanisms to be used for network access to privileged accounts. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): IA-2 (8) | ||
| NIST: NIST SP 800-53A (v1): IA-2 (8).1 (i) | |||
| CCI: | CCI-000774 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-17 |
| Definition: | The information system uses organization-defined replay-resistant authentication mechanisms for network access to privileged accounts. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): IA-2 (8) | ||
| NIST: NIST SP 800-53A (v1): IA-2 (8).1 (ii) | |||
| CCI: | CCI-000775 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-17 |
| Definition: | The organization defines replay-resistant authentication mechanisms to be used for network access to non-privileged accounts. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): IA-2 (9) | ||
| NIST: NIST SP 800-53A (v1): IA-2 (9).1 (i) | |||
| CCI: | CCI-000776 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-17 |
| Definition: | The information system uses organization-defined replay-resistant authentication mechanisms for network access to non-privileged accounts. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): IA-2 (9) | ||
| NIST: NIST SP 800-53A (v1): IA-2 (9).1 (ii) | |||
| CCI: | CCI-000779 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-17 |
| Definition: | The information system authenticates devices before establishing remote network connections using bidirectional authentication between devices that is cryptographically based. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): IA-3 (1) | ||
| NIST: NIST SP 800-53A (v1): IA-3 (1).1 (i) | |||
| CCI: | CCI-000780 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-17 |
| Definition: | The information system authenticates devices before establishing wireless network connections using bidirectional authentication between devices that is cryptographically based. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): IA-3 (1) | ||
| NIST: NIST SP 800-53A (v1): IA-3 (1).1 (ii) | |||
| CCI: | CCI-000781 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-17 |
| Definition: | The information system authenticates devices before establishing network connections using bidirectional authentication between devices that is cryptographically based. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): IA-3 (2) | ||
| NIST: NIST SP 800-53A (v1): IA-3 (2).1 | |||
| CCI: | CCI-000782 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-17 |
| Definition: | The organization standardizes, with regard to dynamic address allocation, Dynamic Host Control Protocol (DHCP) lease information and the time assigned to DHCP-enabled devices. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): IA-3 (3) | ||
| NIST: NIST SP 800-53A (v1): IA-3 (3).1 (i) | |||
| CCI: | CCI-000784 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-17 |
| Definition: | The organization manages information system identifiers for users and devices by receiving authorization from a designated organizational official to assign a user identifier. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): IA-4 a | ||
| NIST: NIST SP 800-53A (v1): IA-4.1 (iii) | |||
| CCI: | CCI-000785 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-17 |
| Definition: | The organization manages information system identifiers for users and devices by receiving authorization from a designated organizational official to assign a device identifier. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): IA-4 a | ||
| NIST: NIST SP 800-53A (v1): IA-4.1 (iii) | |||
| CCI: | CCI-000786 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-17 |
| Definition: | The organization manages information system identifiers for users and devices by selecting an identifier that uniquely identifies an individual. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): IA-4 b | ||
| NIST: NIST SP 800-53A (v1): IA-4.1 (iii) | |||
| CCI: | CCI-000787 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-17 |
| Definition: | The organization manages information system identifiers for users and devices by selecting an identifier that uniquely identifies a device. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): IA-4 b | ||
| NIST: NIST SP 800-53A (v1): IA-4.1 (iii) | |||
| CCI: | CCI-000788 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-17 |
| Definition: | The organization manages information system identifiers for users and devices by assigning the user identifier to the intended party. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): IA-4 c | ||
| NIST: NIST SP 800-53A (v1): IA-4.1 (iii) | |||
| CCI: | CCI-000789 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-17 |
| Definition: | The organization manages information system identifiers for users and devices by assigning the device identifier to the intended device. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): IA-4 c | ||
| NIST: NIST SP 800-53A (v1): IA-4.1 (iii) | |||
| CCI: | CCI-000790 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-17 |
| Definition: | The organization defines a time period for which the reuse of user identifiers is prohibited. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): IA-4 d | ||
| NIST: NIST SP 800-53A (v1): IA-4.1 (i) | |||
| CCI: | CCI-000791 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-17 |
| Definition: | The organization defines a time period for which the reuse of device identifiers is prohibited. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): IA-4 d | ||
| NIST: NIST SP 800-53A (v1): IA-4.1 (i) | |||
| CCI: | CCI-000792 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-17 |
| Definition: | The organization manages information system identifiers for users and devices by preventing reuse of user identifiers for an organization-defined time period. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): IA-4 d | ||
| NIST: NIST SP 800-53A (v1): IA-4.1 (iii) | |||
| CCI: | CCI-000793 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-17 |
| Definition: | The organization manages information system identifiers for users and devices by preventing reuse of device identifiers for an organization-defined time period. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): IA-4 d | ||
| NIST: NIST SP 800-53A (v1): IA-4.1 (iii) | |||
| CCI: | CCI-000794 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-17 |
| Definition: | The organization defines a time period of inactivity after which the identifier is disabled. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): IA-4 e | ||
| NIST: NIST SP 800-53 Revision 4 (v4): IA-4 e | |||
| NIST: NIST SP 800-53A (v1): IA-4.1 (ii) | |||
| CCI: | CCI-000795 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-17 |
| Definition: | The organization manages information system identifiers by disabling the identifier after an organization-defined time period of inactivity. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 (v3): IA-4 e | ||
| NIST: NIST SP 800-53 Revision 4 (v4): IA-4 e | |||
| NIST: NIST SP 800-53A (v1): IA-4.1 (iii) | |||
| CCI: | CCI-000797 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-17 |
| Definition: | The organization requires that registration to receive a user ID and password include authorization by a supervisor. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): IA-4 (2) | ||
| NIST: NIST SP 800-53A (v1): IA-4 (2) (i) | |||
| CCI: | CCI-000798 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-17 |
| Definition: | The organization requires that registration to receive a user ID and password be done in person before a designated registration authority. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): IA-4 (2) | ||
| NIST: NIST SP 800-53A (v1): IA-4 (2) (ii) | |||
| CCI: | CCI-000799 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-17 |
| Definition: | The organization requires multiple forms of certification of individual identification, such as documentary evidence or a combination of documents and biometrics, be presented to the registration authority. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): IA-4 (3) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): IA-4 (3) | |||
| NIST: NIST SP 800-53A (v1): IA-4 (3).1 | |||
| CCI: | CCI-000802 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-17 |
| Definition: | The information system dynamically manages identifiers, attributes, and associated access authorizations. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): IA-4 (5) | ||
| NIST: NIST SP 800-53A (v1): IA-4 (5).1 | |||
| CCI: | CCI-000824 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | The organization incorporates lessons learned from ongoing incident handling activities into incident response procedures, training, and testing/exercises. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): IR-4 c | ||
| NIST: NIST SP 800-53 Revision 4 (v4): IR-4 c | |||
| NIST: NIST SP 800-53A (v1): IR-4.1 (iii) | |||
| CCI: | CCI-000833 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | The organization employs automated mechanisms to assist in the tracking of security incidents. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): IR-5 (1) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): IR-5 (1) | |||
| NIST: NIST SP 800-53A (v1): IR-5 (1).1 (i) | |||
| CCI: | CCI-000840 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | The organization employs automated mechanisms to increase the availability of incident response-related information and support. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): IR-7 (1) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): IR-7 (1) | |||
| NIST: NIST SP 800-53A (v1): IR-7 (1).1 | |||
| CCI: | CCI-000843 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | The organization develops an incident response plan that provides the organization with a roadmap for implementing its incident response capability; describes the structure and organization of the incident response capability; provides a high-level approach for how the incident response capability fits into the overall organization; meets the unique requirements of the organization, which relate to mission, size, structure, and functions; defines reportable incidents; provides metrics for measuring the incident response capability within the organization; and defines the resources and management support needed to effectively maintain and mature an incident response capability. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): IR-8 a | ||
| NIST: NIST SP 800-53A (v1): IR-8.1 | |||
| CCI: | CCI-000847 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | The organization defines the frequency for reviewing the incident response plan. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): IR-8 c | ||
| NIST: NIST SP 800-53 Revision 4 (v4): IR-8 c | |||
| NIST: NIST SP 800-53A (v1): IR-8.2 (iii) | |||
| CCI: | CCI-000848 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | The organization reviews the incident response plan on an organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): IR-8 c | ||
| NIST: NIST SP 800-53 Revision 4 (v4): IR-8 c | |||
| NIST: NIST SP 800-53A (v1): IR-8.2 (iv) | |||
| CCI: | CCI-000858 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | The organization schedules, performs, documents, and reviews records of maintenance and repairs on information system components in accordance with manufacturer or vendor specifications and/or organizational requirements. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): MA-2 a | ||
| NIST: NIST SP 800-53A (v1): MA-2.1 (i) | |||
| CCI: | CCI-000859 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | The organization approves and monitors all maintenance activities, whether performed on site or remotely and whether the equipment is serviced on site or removed to another location. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): MA-2 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): MA-2 b | |||
| NIST: NIST SP 800-53A (v1): MA-2.1 (ii) | |||
| CCI: | CCI-000863 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | The organization maintains maintenance records for the information system that include the date and time of maintenance, the name of the individual performing the maintenance, the name of escort, if necessary, a description of the maintenance performed, and a list of equipment removed or replaced (including identification numbers, if applicable). | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): MA-2 (1) (a)(b)(c)(d)(e) | ||
| NIST: NIST SP 800-53A (v1): MA-2 (1).1 | |||
| CCI: | CCI-000864 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | The organization employs automated mechanisms to schedule, conduct, and document maintenance and repairs as required. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): MA-2 (2) | ||
| NIST: NIST SP 800-53A (v1): MA-2 (2).1(i) | |||
| CCI: | CCI-000868 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | The organization maintains, on an ongoing basis, information system maintenance tools. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): MA-3 | ||
| NIST: NIST SP 800-53A (v1): MA-3.1 (ii) | |||
| CCI: | CCI-000872 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | The organization employs automated mechanisms to restrict the use of maintenance tools to authorized personnel only. | ||
| Type: | policy, technical | ||
| References: | NIST: NIST SP 800-53 (v3): MA-3 (4) | ||
| NIST: NIST SP 800-53A (v1): MA-3 (4).1 | |||
| CCI: | CCI-000875 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | The organization controls non-local maintenance and diagnostic activities. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): MA-4 a | ||
| NIST: NIST SP 800-53A (v1): MA-4.1 (i) | |||
| CCI: | CCI-000879 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | The organization terminates sessions and network connections when nonlocal maintenance is completed. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): MA-4 e | ||
| NIST: NIST SP 800-53 Revision 4 (v4): MA-4 e | |||
| NIST: NIST SP 800-53A (v1): MA-4.1 (vi) | |||
| CCI: | CCI-000880 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | The organization audits non-local maintenance and diagnostic sessions. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): MA-4 (1) | ||
| NIST: NIST SP 800-53A (v1): MA-4 (1).1 (i) | |||
| CCI: | CCI-000881 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | The organization documents, in the security plan for the information system, the policies and procedures for the establishment and use of nonlocal maintenance and diagnostic connections. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): MA-4 (2) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): MA-4 (2) | |||
| NIST: NIST SP 800-53A (v1): MA-4 (2).1 | |||
| CCI: | CCI-000885 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | The organization requires that maintenance personnel notify organization-defined personnel when non-local maintenance is planned (i.e., date/time). | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): MA-4 (5) (a) | ||
| NIST: NIST SP 800-53A (v1): MA-4 (5).1 (ii) | |||
| CCI: | CCI-000888 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | The organization employs cryptographic mechanisms to protect the integrity and confidentiality of non-local maintenance and diagnostic communications. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): MA-4 (6) | ||
| NIST: NIST SP 800-53A (v1): MA-4 (6).1 | |||
| CCI: | CCI-000889 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | The organization employs remote disconnect verification at the termination of non-local maintenance and diagnostic sessions. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): MA-4 (7) | ||
| NIST: NIST SP 800-53A (v1): MA-4 (7).1 | |||
| CCI: | CCI-000892 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | The organization ensures that personnel performing maintenance on the information system have required access authorizations or designates organizational personnel with required access authorizations and technical competence deemed necessary to supervise information system maintenance. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): MA-5 b | ||
| NIST: NIST SP 800-53A (v1): MA-5.1 (iii) | |||
| CCI: | CCI-000896 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | The organization requires that in the event an information system component cannot be sanitized, the procedures contained in the security plan for the system be enforced. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): MA-5 (1) (c) | ||
| NIST: NIST SP 800-53A (v1): MA-5 (1).1 | |||
| CCI: | CCI-000901 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | The organization defines a list of security-critical information system components and/or key information technology components for which it will obtain maintenance support and/or spare parts. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): MA-6 | ||
| NIST: NIST SP 800-53A (v1): MA-6.1 (i) | |||
| CCI: | CCI-000902 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-18 |
| Definition: | The organization defines a time period for obtaining maintenance support and/or spare parts for security-critical information system components and/or key information technology components. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): MA-6 | ||
| NIST: NIST SP 800-53A (v1): MA-6.1 (ii) | |||
| CCI: | CCI-000918 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization restricts physical access to the facility containing an information system that processes classified information to authorized personnel with appropriate clearances and access authorizations. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PE-2 (3) | ||
| NIST: NIST SP 800-53A (v1): PE-2 (3).1 (ii) | |||
| CCI: | CCI-000919 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization enforces physical access authorizations at organization-defined entry/exit points to the facility where the information system resides. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PE-3 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PE-3 a | |||
| NIST: NIST SP 800-53A (v1): PE-3.1 (i) | |||
| CCI: | CCI-000921 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization controls ingress/egress to the facility where the information system resides using one or more organization-defined physical access control systems/devices or guards. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PE-3 c | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PE-3 a 2 | |||
| NIST: NIST SP 800-53A (v1): PE-3.1 (iii) | |||
| CCI: | CCI-000922 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization controls access to areas officially designated as publicly accessible in accordance with the organization's assessment of risk. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PE-3 d | ||
| NIST: NIST SP 800-53A (v1): PE-3.1 (iv) | |||
| CCI: | CCI-000934 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization employs a penetration testing process that includes unannounced attempts to bypass or circumvent security controls associated with physical access points to the facility on an organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PE-3 (6) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PE-3 (6) | |||
| NIST: NIST SP 800-53A (v1): PE-3 (6).1 (ii) | |||
| CCI: | CCI-000935 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization defines the frequency of unannounced attempts to be included in a penetration testing process to bypass or circumvent security controls associated with physical access points to the facility. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PE-3 (6) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PE-3 (6) | |||
| NIST: NIST SP 800-53A (v1): PE-3 (6).1 (i) | |||
| CCI: | CCI-000938 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization monitors physical access to the information system to detect and respond to physical security incidents. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PE-6 a | ||
| NIST: NIST SP 800-53A (v1): PE-6.1 (i) | |||
| CCI: | CCI-000943 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization employs automated mechanisms to recognize potential intrusions and initiate designated response actions. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PE-6 (2) | ||
| NIST: NIST SP 800-53A (v1): PE-6 (2).1 | |||
| CCI: | CCI-000944 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization controls physical access to the information system by authenticating visitors before authorizing access to the facility where the information system resides other than areas designated as publicly accessible. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PE-7 | ||
| NIST: NIST SP 800-53A (v1): PE-7.1 | |||
| CCI: | CCI-000945 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization escorts visitors and monitors visitor activity, when required. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PE-7 (1) | ||
| NIST: NIST SP 800-53A (v1): PE-7 (1).1 | |||
| CCI: | CCI-000946 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization requires two forms of identification for visitor access to the facility. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PE-7 (2) | ||
| NIST: NIST SP 800-53A (v1): PE-7 (2).1 | |||
| CCI: | CCI-000951 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization maintains a record of all physical access, both visitor and authorized individuals. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PE-8 (2) | ||
| NIST: NIST SP 800-53A (v1): PE-8 (2).1 | |||
| CCI: | CCI-000953 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization employs redundant and parallel power cabling paths. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PE-9 (1) | ||
| NIST: NIST SP 800-53A (v1): PE-9 (1).1 | |||
| CCI: | CCI-000960 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization provides a short-term uninterruptible power supply to facilitate an orderly shutdown of the information system in the event of a primary power source loss. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PE-11 | ||
| NIST: NIST SP 800-53A (v1): PE-11.1 | |||
| CCI: | CCI-000962 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization provides a long-term alternate power supply for the information system that is self-contained and not reliant on external power generation. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PE-11 (2) | ||
| NIST: NIST SP 800-53A (v1): PE-11 (2).1 | |||
| CCI: | CCI-000964 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization provides emergency lighting for all areas within the facility supporting essential missions and business functions. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PE-12 (1) | ||
| NIST: NIST SP 800-53A (v1): PE-12 (1).1 | |||
| CCI: | CCI-000966 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization employs fire detection devices/systems for the information system that activate automatically and notify the organization and emergency responders in the event of a fire. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PE-13 (1) | ||
| NIST: NIST SP 800-53A (v1): PE-13 (1).1 | |||
| CCI: | CCI-000967 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization employs fire suppression devices/systems for the information system that provide automatic notification of any activation to the organization and emergency responders. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PE-13 (2) | ||
| NIST: NIST SP 800-53A (v1): PE-13 (2).1 | |||
| CCI: | CCI-000969 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization ensures that the facility undergoes, on an organization-defined frequency, fire marshal inspections and promptly resolves identified deficiencies. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PE-13 (4) | ||
| NIST: NIST SP 800-53A (v1): PE-13 (4).1 (ii and iii) | |||
| CCI: | CCI-000970 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization defines a frequency for fire marshal inspections. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PE-13 (4) | ||
| NIST: NIST SP 800-53A (v1): PE-13 (4).1 (i) | |||
| CCI: | CCI-000980 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization employs mechanisms that, without the need for manual intervention, protect the information system from water damage in the event of a water leak. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PE-15 (1) | ||
| NIST: NIST SP 800-53A (v1): PE-15 (1).1 | |||
| CCI: | CCI-000982 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization monitors organization-defined types of information system components entering and exiting the facility. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PE-16 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PE-16 | |||
| NIST: NIST SP 800-53A (v1): PE-16.1 (ii) | |||
| CCI: | CCI-000986 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization defines management, operational, and technical information system security controls to be employed at alternate work sites. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PE-17 a | ||
| NIST: NIST SP 800-53A (v1): PE-17.1 (i) | |||
| CCI: | CCI-000990 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization positions information system components within the facility to minimize potential damage from environmental hazards. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PE-18 | ||
| NIST: NIST SP 800-53A (v1): PE-18.1 (i) | |||
| CCI: | CCI-000992 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization plans the location or site of the facility where the information system resides with regard to physical and environmental hazards, and for existing facilities, considers the physical and environmental hazards in its risk mitigation strategy. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PE-18 (1) | ||
| NIST: NIST SP 800-53A (v1): PE-18 (1).1 (i and ii) | |||
| CCI: | CCI-000994 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization ensures that information system components, associated data communications, and networks are protected in accordance with national emissions and TEMPEST policies and procedures based on the security category or classification of the information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PE-19 (1) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PE-19 (1) | |||
| NIST: NIST SP 800-53A (v1): PE-19 (1).1 | |||
| CCI: | CCI-001006 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization defines security measures for restricting access to media. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): MP-2 | ||
| NIST: NIST SP 800-53A (v1): MP-2.1 (i) | |||
| CCI: | CCI-001009 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The information system uses cryptographic mechanisms to protect and restrict access to information on portable digital media. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): MP-2 (2) | ||
| NIST: NIST SP 800-53A (v1): MP-2 (2).1 | |||
| CCI: | CCI-001014 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization physically controls and securely stores organization-defined types of digital and/or non-digital media within organization-defined controlled areas. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): MP-4 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): MP-4 a | |||
| NIST: NIST SP 800-53A (v1): MP-4.1 (ii) | |||
| CCI: | CCI-001017 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization defines security measures for securing media storage. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): MP-4 a | ||
| NIST: NIST SP 800-53A (v1): MP-4.1 (i) | |||
| CCI: | CCI-001018 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization protects information system media until the media are destroyed or sanitized using approved equipment, techniques, and procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): MP-4 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): MP-4 b | |||
| NIST: NIST SP 800-53A (v1): MP-4.1 (iii) | |||
| CCI: | CCI-001019 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization employs cryptographic mechanisms to protect information in storage. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): MP-4 (1) | ||
| NIST: NIST SP 800-53A (v1): MP-4 (1).1 | |||
| CCI: | CCI-001020 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization protects and controls organization-defined types of information system media during transport outside of controlled areas using organization-defined security safeguards. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): MP-5 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): MP-5 a | |||
| NIST: NIST SP 800-53A (v1): MP-5.1 (ii) | |||
| CCI: | CCI-001027 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The information system implements cryptographic mechanisms to protect the confidentiality and integrity of information stored on digital media during transport outside of controlled areas. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): MP-5 (4) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): MP-5 (4) | |||
| NIST: NIST SP 800-53A (v1): MP-5 (4).1 | |||
| CCI: | CCI-001029 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization tracks, documents, and verifies media sanitization and disposal actions. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): MP-6 (1) | ||
| NIST: NIST SP 800-53A (v1): MP-6 (1).1 | |||
| CCI: | CCI-001030 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization tests sanitization equipment and procedures in accordance with the organization-defined frequency to verify that the intended sanitization is being achieved. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): MP-6 (2) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): MP-6 (2) | |||
| NIST: NIST SP 800-53A (v1): MP-6 (2).1 (ii) | |||
| CCI: | CCI-001034 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization sanitizes information system media containing Controlled Unclassified Information (CUI) or other sensitive information in accordance with applicable organizational and/or federal standards and policies. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): MP-6 (4) | ||
| NIST: NIST SP 800-53A (v1): MP-6 (4).1 (ii) | |||
| CCI: | CCI-001035 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization sanitizes information system media containing classified information in accordance with NSA standards and policies. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): MP-6 (5) | ||
| NIST: NIST SP 800-53A (v1): MP-6 (5).1 (ii) | |||
| CCI: | CCI-001036 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization destroys information system media that cannot be sanitized. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): MP-6 (6) | ||
| NIST: NIST SP 800-53A (v1): MP-6 (6).1 (ii) | |||
| CCI: | CCI-001045 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization categorizes information and the information system in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): RA-2 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): RA-2 a | |||
| NIST: NIST SP 800-53A (v1): RA-2.1 (i) | |||
| CCI: | CCI-001062 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization employs vulnerability scanning tools that include the capability to readily update the information system vulnerabilities to be scanned. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): RA-5 (1) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): RA-5 (1) | |||
| NIST: NIST SP 800-53A (v1): RA-5 (1).1 | |||
| CCI: | CCI-001065 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization employs vulnerability scanning procedures that can demonstrate the breadth of coverage (i.e., information system components scanned). | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): RA-5 (3) | ||
| NIST: NIST SP 800-53A (v1): RA-5 (3).1 (i) | |||
| CCI: | CCI-001069 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization employs automated mechanisms to detect the presence of unauthorized software on organizational information systems and notify designated organizational officials in accordance with the organization-defined frequency. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): RA-5 (7) | ||
| NIST: NIST SP 800-53A (v1): RA-5 (7).1 (ii) | |||
| CCI: | CCI-001070 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization defines a frequency for employing automated mechanisms to detect the presence of unauthorized software on organizational information systems and notify designated organizational officials. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): RA-5 (7) | ||
| NIST: NIST SP 800-53A (v1): RA-5 (7).1 (i) | |||
| CCI: | CCI-001072 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization employs an independent penetration agent or penetration team to conduct a vulnerability analysis on the information system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): RA-5 (9) (a) | ||
| NIST: NIST SP 800-53A (v1): RA-5 (9).1 | |||
| CCI: | CCI-001073 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization employs an independent penetration agent or penetration team to perform penetration testing on the information system based on the vulnerability analysis to determine the exploitability of identified vulnerabilities. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): RA-5 (9) (b) | ||
| NIST: NIST SP 800-53A (v1): RA-5 (9).1 | |||
| CCI: | CCI-001074 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization develops a system and communications protection policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SC-1 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SC-1 a 1 | |||
| NIST: NIST SP 800-53A (v1): SC-1.1 (i) (ii) | |||
| CCI: | CCI-001078 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization develops system and communications protection procedures to facilitate the implementation of the system and communications protection policy and associated system and communications protection controls. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SC-1 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SC-1 a 2 | |||
| NIST: NIST SP 800-53A (v1): SC-1.1 (iv) (v) | |||
| CCI: | CCI-001087 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization implements an information system isolation boundary to minimize the number of nonsecurity functions included within the boundary containing security functions. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): SC-3 (3) | ||
| NIST: NIST SP 800-53A (v1): SC-3 (3).1 | |||
| CCI: | CCI-001088 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization implements security functions as largely independent modules that avoid unnecessary interactions between modules. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SC-3 (4) | ||
| NIST: NIST SP 800-53A (v1): SC-3 (4).1 | |||
| CCI: | CCI-001091 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The information system does not share resources that are used to interface with systems operating at different security levels. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): SC-4 (1) | ||
| NIST: NIST SP 800-53A (v1): SC-4 (1).1 | |||
| CCI: | CCI-001092 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The information system protects against or limits the effects of the organization-defined or referenced types of denial of service attacks. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): SC-5 | ||
| NIST: NIST SP 800-53A (v1): SC-5.1 (ii) | |||
| CCI: | CCI-001096 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The information system limits the use of resources by priority. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): SC-6 | ||
| NIST: NIST SP 800-53A (v1): SC-6.1 | |||
| CCI: | CCI-001099 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization physically allocates publicly accessible information system components to separate subnetworks with separate physical network interfaces. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SC-7 (1) | ||
| NIST: NIST SP 800-53A (v1): SC-7 (1).1 | |||
| CCI: | CCI-001100 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The information system prevents public access into the organization's internal networks except as appropriately mediated by managed interfaces employing boundary protection devices. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): SC-7 (2) | ||
| NIST: NIST SP 800-53A (v1): SC-7 (2).1 (ii) | |||
| CCI: | CCI-001104 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization employs security controls as needed to protect the confidentiality and integrity of the information being transmitted. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SC-7 (4) (c) | ||
| NIST: NIST SP 800-53A (v1): SC-7 (4).1 (iv) | |||
| CCI: | CCI-001110 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization prevents the unauthorized release of information outside of the information system boundary or any unauthorized communication through the information system boundary when there is an operational failure of the boundary protection mechanisms. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SC-7 (6) | ||
| NIST: NIST SP 800-53A (v1): SC-7 (6).1 (i) (ii) | |||
| CCI: | CCI-001111 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The information system prevents remote devices that have established a non-remote connection with the system from communicating outside of that communications path with resources in external networks. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): SC-7 (7) | ||
| NIST: NIST SP 800-53A (v1): SC-7 (7).1 | |||
| CCI: | CCI-001115 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The information system, at managed interfaces, denies network traffic and audits internal users (or malicious code) posing a threat to external information systems. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): SC-7 (9) | ||
| NIST: NIST SP 800-53A (v1): SC-7 (9).1 (i) (ii) | |||
| CCI: | CCI-001117 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The information system checks incoming communications to ensure the communications are coming from an authorized source and routed to an authorized destination. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): SC-7 (11) | ||
| NIST: NIST SP 800-53A (v1): SC-7 (11).1 | |||
| CCI: | CCI-001118 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The information system implements host-based boundary protection mechanisms for servers, workstations, and mobile devices. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): SC-7 (12) | ||
| NIST: NIST SP 800-53A (v1): SC-7 (12).1 | |||
| CCI: | CCI-001122 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization defines the managed interfaces where boundary protections against unauthorized physical connections are to be implemented. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SC-7 (14) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SC-7 (14) | |||
| NIST: NIST SP 800-53A (v1): SC-7 (14).1 (i) | |||
| CCI: | CCI-001127 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The information system protects the integrity of transmitted information. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): SC-8 | ||
| NIST: NIST SP 800-53A (v1): SC-8.1 | |||
| CCI: | CCI-001128 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization employs cryptographic mechanisms to recognize changes to information during transmission unless otherwise protected by alternative physical measures. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): SC-8 (1) | ||
| NIST: NIST SP 800-53A (v1): SC-8 (1).1 | |||
| CCI: | CCI-001129 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The information system maintains the integrity of information during aggregation, packaging, and transformation in preparation for transmission. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): SC-8 (2) | ||
| NIST: NIST SP 800-53A (v1): SC-8 (2).1 | |||
| CCI: | CCI-001130 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The information system protects the confidentiality of transmitted information. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): SC-9 | ||
| NIST: NIST SP 800-53A (v1): SC-9.1 | |||
| CCI: | CCI-001131 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization employs cryptographic mechanisms to prevent unauthorized disclosure of information during transmission unless otherwise protected by alternative physical measures. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): SC-9 (1) | ||
| NIST: NIST SP 800-53A (v1): SC-9 (1).1 | |||
| CCI: | CCI-001132 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The information system maintains the confidentiality of information during aggregation, packaging, and transformation in preparation for transmission. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): SC-9 (2) | ||
| NIST: NIST SP 800-53A (v1): SC-9 (2).1 | |||
| CCI: | CCI-001136 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization defines security functions include information system authentication and reauthentication. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SC-11 | ||
| NIST: NIST SP 800-53A (v1): SC-11.1 (ii) | |||
| CCI: | CCI-001137 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization establishes cryptographic keys for required cryptography employed within the information system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SC-12 | ||
| NIST: NIST SP 800-53A (v1): SC-12.1 | |||
| CCI: | CCI-001138 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization manages cryptographic keys for required cryptography employed within the information system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SC-12 | ||
| NIST: NIST SP 800-53A (v1): SC-12.1 | |||
| CCI: | CCI-001140 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization produces, controls, and distributes symmetric cryptographic keys using NIST-approved or NSA-approved key management technology and processes. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): SC-12 (2) | ||
| NIST: NIST SP 800-53A (v1): SC-12 (2).1 | |||
| CCI: | CCI-001141 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization produces, controls, and distributes symmetric and asymmetric cryptographic keys using NSA-approved key management technology and processes. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): SC-12 (3) | ||
| NIST: NIST SP 800-53A (v1): SC-12 (3).1 | |||
| CCI: | CCI-001142 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization produces, controls, and distributes asymmetric cryptographic keys using approved PKI Class 3 certificates or prepositioned keying material. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): SC-12 (4) | ||
| NIST: NIST SP 800-53A (v1): SC-12 (4).1 | |||
| CCI: | CCI-001143 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization produces, controls, and distributes asymmetric cryptographic keys using approved PKI Class 3 or Class 4 certificates and hardware security tokens that protect the user's private key. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): SC-12 (5) | ||
| NIST: NIST SP 800-53A (v1): SC-12 (5).1 | |||
| CCI: | CCI-001144 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The information system implements required cryptographic protections using cryptographic modules that comply with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): SC-13 | ||
| NIST: NIST SP 800-53A (v1): SC-13.1 | |||
| CCI: | CCI-001145 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization employs, at a minimum, FIPS-validated cryptography to protect unclassified information. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): SC-13 (1) | ||
| NIST: NIST SP 800-53A (v1): SC-13 (1).1 | |||
| CCI: | CCI-001146 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization employs NSA-approved cryptography to protect classified information. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): SC-13 (2) | ||
| NIST: NIST SP 800-53A (v1): SC-13 (2).1 | |||
| CCI: | CCI-001147 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization employs, at a minimum, FIPS-validated cryptography to protect information when such information must be separated from individuals who have the necessary clearances yet lack the necessary access approvals. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): SC-13 (3) | ||
| NIST: NIST SP 800-53A (v1): SC-13 (3).1 | |||
| CCI: | CCI-001148 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization employs FIPS-validated or NSA-approved cryptography to implement digital signatures. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): SC-13 (4) | ||
| NIST: NIST SP 800-53 (v3): AU-10 (5) | |||
| NIST: NIST SP 800-53A (v1): SC-13 (4).1 | |||
| NIST: NIST SP 800-53A (v1): AU-10 (5).1 (ii) | |||
| CCI: | CCI-001149 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The information system protects the integrity and availability of publicly available information and applications. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): SC-14 | ||
| NIST: NIST SP 800-53A (v1): SC-14.1 | |||
| CCI: | CCI-001154 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The information system or supporting environment blocks both inbound and outbound traffic between instant messaging clients that are independently configured by end users and external service providers. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): SC-15 (2) | ||
| NIST: NIST SP 800-53A (v1): SC-15 (2).1 | |||
| CCI: | CCI-001161 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization establishes usage restrictions for acceptable mobile code and mobile code technologies. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SC-18 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SC-18 b | |||
| NIST: NIST SP 800-53A (v1): SC-18.1 (ii) | |||
| CCI: | CCI-001162 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization establishes implementation guidance for acceptable mobile code and mobile code technologies. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SC-18 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SC-18 b | |||
| NIST: NIST SP 800-53A (v1): SC-18.1 (ii) | |||
| CCI: | CCI-001173 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization establishes usage restrictions for Voice over Internet Protocol (VoIP) technologies based on the potential to cause damage to the information system if used maliciously. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SC-19 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SC-19 a | |||
| NIST: NIST SP 800-53A (v1): SC-19.1 (i) | |||
| CCI: | CCI-001174 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization establishes implementation guidance for Voice over Internet Protocol (VoIP) technologies based on the potential to cause damage to the information system if used maliciously. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SC-19 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SC-19 a | |||
| NIST: NIST SP 800-53A (v1): SC-19.1 (i) | |||
| CCI: | CCI-001175 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization authorizes the use of VoIP within the information system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SC-19 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SC-19 b | |||
| NIST: NIST SP 800-53A (v1): SC-19.1 (ii) | |||
| CCI: | CCI-001176 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization monitors the use of VoIP within the information system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SC-19 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SC-19 b | |||
| NIST: NIST SP 800-53A (v1): SC-19.1 (ii) | |||
| CCI: | CCI-001177 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization controls the use of VoIP within the information system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SC-19 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SC-19 b | |||
| NIST: NIST SP 800-53A (v1): SC-19.1 (ii) | |||
| CCI: | CCI-001180 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The information system performs data origin authentication and data integrity verification on the name/address resolution responses the system receives from authoritative sources when requested by client systems. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): SC-21 | ||
| NIST: NIST SP 800-53A (v1): SC-21.1 | |||
| CCI: | CCI-001181 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The information system performs data origin authentication and data integrity verification on all resolution responses received whether or not local client systems explicitly request this service. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): SC-21 (1) | ||
| NIST: NIST SP 800-53A (v1): SC-21 (1).1 | |||
| CCI: | CCI-001186 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The information system provides a readily observable logout capability whenever authentication is used to gain access to web pages. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): SC-23 (2) | ||
| NIST: NIST SP 800-53A (v1): SC-23 (2).1 | |||
| CCI: | CCI-001187 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The information system generates a unique session identifier for each session. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): SC-23 (3) | ||
| NIST: NIST SP 800-53A (v1): SC-23 (3).1 (i) | |||
| CCI: | CCI-001200 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization employs cryptographic mechanisms to prevent unauthorized disclosure of information at rest unless otherwise protected by alternative physical measures. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): SC-28 (1) | ||
| NIST: NIST SP 800-53A (v1): SC-28 (1).1 (i) | |||
| CCI: | CCI-001202 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization employs virtualization techniques to present information system components as other types of components, or components with differing configurations. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SC-30 | ||
| NIST: NIST SP 800-53A (v1): SC-30.1 | |||
| CCI: | CCI-001205 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization employs randomness in the implementation of the virtualization techniques. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SC-30 (2) | ||
| NIST: NIST SP 800-53A (v1): SC-30 (2).1 | |||
| CCI: | CCI-001206 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization requires that information system developers/integrators perform a covert channel analysis to identify those aspects of system communication that are potential avenues for covert storage and timing channels. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SC-31 | ||
| NIST: NIST SP 800-53A (v1): SC-31.1 | |||
| CCI: | CCI-001208 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The organization partitions the information system into components residing in separate physical domains (or environments) as deemed necessary. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SC-32 | ||
| NIST: NIST SP 800-53A (v1): SC-32.1 | |||
| CCI: | CCI-001209 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-21 |
| Definition: | The information system protects the integrity of information during the processes of data aggregation, packaging, and transformation in preparation for transmission. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): SC-33 | ||
| NIST: NIST SP 800-53A (v1): SC-33.1 | |||
| CCI: | CCI-001231 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization centrally manages the flaw remediation process. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SI-2 (1) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SI-2 (1) | |||
| NIST: NIST SP 800-53A (v1): SI-2 (1).1 | |||
| CCI: | CCI-001232 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization installs software updates automatically. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): SI-2 (1) | ||
| NIST: NIST SP 800-53A (v1): SI-2 (1).1 | |||
| CCI: | CCI-001233 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization employs automated mechanisms on an organization-defined frequency to determine the state of information system components with regard to flaw remediation. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): SI-2 (2) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SI-2 (2) | |||
| NIST: NIST SP 800-53A (v1): SI-2 (2).1 (ii) | |||
| CCI: | CCI-001234 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization defines a frequency for employing automated mechanisms to determine the state of information system components with regard to flaw remediation. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SI-2 (2) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SI-2 (2) | |||
| NIST: NIST SP 800-53A (v1): SI-2 (2).1 (i) | |||
| CCI: | CCI-001237 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization employs automated patch management tools to facilitate flaw remediation to organization-defined information system components. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): SI-2 (4) | ||
| NIST: NIST SP 800-53A (v1): SI-2 (4).1 (ii) | |||
| CCI: | CCI-001238 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization defines information system components for which automated patch management tools are to be employed to facilitate flaw remediation. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SI-2 (4) | ||
| NIST: NIST SP 800-53A (v1): SI-2 (4).1 (i) | |||
| CCI: | CCI-001239 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization employs malicious code protection mechanisms at information system entry and exit points to detect and eradicate malicious code transported by electronic mail, electronic mail attachments, web accesses, removable media, or other common means or inserted through the exploitation of information system vulnerabilities. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): SI-3 a | ||
| NIST: NIST SP 800-53A (v1): SI-3.1 (i) | |||
| CCI: | CCI-001240 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization updates malicious code protection mechanisms whenever new releases are available in accordance with organizational configuration management policy and procedures. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): SI-3 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SI-3 b | |||
| NIST: NIST SP 800-53A (v1): SI-3.1 (iii) | |||
| CCI: | CCI-001242 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization configures malicious code protection mechanisms to perform real-time scans of files from external sources at endpoints as the files are downloaded, opened, or executed in accordance with organizational security policy. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): SI-3 c | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SI-3 c 1 | |||
| NIST: NIST SP 800-53A (v1): SI-3.1 (vi) | |||
| CCI: | CCI-001246 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization centrally manages malicious code protection mechanisms. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SI-3 (1) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SI-3 (1) | |||
| NIST: NIST SP 800-53A (v1): SI-3 (1).1 | |||
| CCI: | CCI-001247 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The information system automatically updates malicious code protection mechanisms. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): SI-3 (2) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SI-3 (2) | |||
| NIST: NIST SP 800-53A (v1): SI-3 (2).1 | |||
| CCI: | CCI-001248 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The information system prevents non-privileged users from circumventing malicious code protection capabilities. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): SI-3 (3) | ||
| NIST: NIST SP 800-53A (v1): SI-3 (3).1 | |||
| CCI: | CCI-001250 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization does not allow users to introduce removable media into the information system. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): SI-3 (5) | ||
| NIST: NIST SP 800-53A (v1): SI-3 (5).1 | |||
| CCI: | CCI-001252 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization monitors events on the information system in accordance with organization-defined monitoring objectives and detects information system attacks. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SI-4 a | ||
| NIST: NIST SP 800-53A (v1): SI-4.1 (ii) | |||
| CCI: | CCI-001254 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization identifies unauthorized use of the information system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SI-4 b | ||
| NIST: NIST SP 800-53A (v1): SI-4.1 (iii) | |||
| CCI: | CCI-001259 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization interconnects and configures individual intrusion detection tools into a systemwide intrusion detection system using common protocols. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): SI-4 (1) | ||
| NIST: NIST SP 800-53A (v1): SI-4 (1).1 | |||
| CCI: | CCI-001261 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization employs automated tools to integrate intrusion detection tools into access control and flow control mechanisms for rapid response to attacks by enabling reconfiguration of these mechanisms in support of attack isolation and elimination. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SI-4 (3) | ||
| NIST: NIST SP 800-53A (v1): SI-4 (3).1 | |||
| CCI: | CCI-001262 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The information system monitors inbound and outbound communications for unusual or unauthorized activities or conditions. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): SI-4 (4) | ||
| NIST: NIST SP 800-53A (v1): SI-4 | |||
| CCI: | CCI-001263 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The information system provides near real-time alerts when any of the organization-defined list of compromise or potential compromise indicators occurs. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): SI-4 (5) | ||
| NIST: NIST SP 800-53A (v1): SI-4 (5).1 (ii) | |||
| CCI: | CCI-001265 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The information system prevents non-privileged users from circumventing intrusion detection and prevention capabilities. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): SI-4 (6) | ||
| NIST: NIST SP 800-53A (v1): SI-4 (6).1 | |||
| CCI: | CCI-001269 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization protects information obtained from intrusion monitoring tools from unauthorized access, modification, and deletion. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): SI-4 (8) | ||
| NIST: NIST SP 800-53A (v1): SI-4 (8).1 | |||
| CCI: | CCI-001272 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization makes provisions so encrypted traffic is visible to information system monitoring tools. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): SI-4 (10) | ||
| NIST: NIST SP 800-53A (v1): SI-4 (10).1 | |||
| CCI: | CCI-001278 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization uses the traffic/event profiles in tuning system monitoring devices to reduce the number of false positives to an organization-defined measure of false positives and the number of false negatives to an organization-defined measure of false negatives. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SI-4 (13) (c) | ||
| NIST: NIST SP 800-53A (v1): SI-4 (13).1 (iv) | |||
| CCI: | CCI-001279 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization defines the respective measurements to which the organization must tune system monitoring devices to reduce the number of false positives. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SI-4 (13) (c) | ||
| NIST: NIST SP 800-53A (v1): SI-4 (13).1 (iii) | |||
| CCI: | CCI-001280 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization defines the respective measurements to which the organization must tune system monitoring devices to reduce the number of false negatives. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SI-4 (13) (c) | ||
| NIST: NIST SP 800-53A (v1): SI-4 (13).1 (iii) | |||
| CCI: | CCI-001281 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization employs a wireless intrusion detection system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SI-4 (14) | ||
| NIST: NIST SP 800-53A (v1): SI-4 (14).1 (i) | |||
| CCI: | CCI-001291 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The information system verifies the correct operation of security functions in accordance with organization-defined conditions and in accordance with organization-defined frequency (if periodic verification). | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): SI-6 | ||
| NIST: NIST SP 800-53A (v1): SI-6.1 (iv) | |||
| CCI: | CCI-001292 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization defines the appropriate conditions, including the system transitional states if applicable, for verifying the correct operation of security functions. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SI-6 | ||
| NIST: NIST SP 800-53A (v1): SI-6.1 (i) | |||
| CCI: | CCI-001293 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization defines the information system responses and alternative action(s) to anomalies discovered during security function verification. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SI-6 | ||
| NIST: NIST SP 800-53A (v1): SI-6.1 (iii) | |||
| CCI: | CCI-001297 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The information system detects unauthorized changes to software and information. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): SI-7 | ||
| NIST: NIST SP 800-53A (v1): SI-7.1 | |||
| CCI: | CCI-001298 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization reassesses the integrity of software and information by performing, on an organization-defined frequency, integrity scans of the information system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SI-7 (1) | ||
| NIST: NIST SP 800-53A (v1): SI-7 (1).1 (ii) | |||
| CCI: | CCI-001299 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization defines the frequency of integrity scans to be performed on the information system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SI-7 (1) | ||
| NIST: NIST SP 800-53A (v1): SI-7 (1).1 (i) | |||
| CCI: | CCI-001302 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization requires use of tamper-evident packaging for organization-defined information system components during organization-defined conditions. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SI-7 (4) | ||
| NIST: NIST SP 800-53A (v1): SI-7 (4).1 (iii) | |||
| CCI: | CCI-001303 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization defines information system components that require tamper-evident packaging. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SI-7 (4) | ||
| NIST: NIST SP 800-53A (v1): SI-7 (4).1 (i) | |||
| CCI: | CCI-001304 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization defines conditions (i.e., transportation from vendor to operational site, during operation, both) under which tamper-evident packaging must be used for organization-defined information system components. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SI-7 (4) | ||
| NIST: NIST SP 800-53A (v1): SI-7 (4).1 (ii) | |||
| CCI: | CCI-001305 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization employs spam protection mechanisms at information system entry and exit points to detect and take action on unsolicited messages transported by electronic mail, electronic mail attachments, web accesses, removable media, or other common means. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): SI-8 a | ||
| NIST: NIST SP 800-53A (v1): SI-8.1 (i) | |||
| CCI: | CCI-001306 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization updates spam protection mechanisms when new releases are available in accordance with organizational configuration management policy and procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SI-8 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SI-8 b | |||
| NIST: NIST SP 800-53A (v1): SI-8.1 (iii) | |||
| CCI: | CCI-001307 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization centrally manages spam protection mechanisms. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SI-8 (1) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SI-8 (1) | |||
| NIST: NIST SP 800-53A (v1): SI-8 (1).1 | |||
| CCI: | CCI-001309 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization restricts the capability to input information to the information system to authorized personnel. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SI-9 | ||
| NIST: NIST SP 800-53A (v1): SI-9.1 | |||
| CCI: | CCI-001311 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The information system identifies potentially security-relevant error conditions. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): SI-11 a | ||
| NIST: NIST SP 800-53A (v1): SI-11.1 (i) | |||
| CCI: | CCI-001313 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization defines sensitive or potentially harmful information that should not be contained in error logs and administrative messages. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SI-11 b | ||
| NIST: NIST SP 800-53A (v1): SI-11.1 (ii) | |||
| CCI: | CCI-001316 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization protects the information system from harm by considering mean time to failure rates for an organization-defined list of information system components in specific environments of operation. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SI-13 a | ||
| NIST: NIST SP 800-53A (v1): SI-13.1 (ii) | |||
| CCI: | CCI-001317 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization defines a list of information system components for which mean time to failure rates should be considered to protect the information system from harm. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SI-13 a | ||
| NIST: NIST SP 800-53A (v1): SI-13.1 (i) | |||
| CCI: | CCI-001324 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization defines the minimum frequency at which the organization manually initiates a transfer between active and standby information system components if the mean time to failure (MTTF) exceeds the organization-defined time period. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SI-13 (3) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SI-13 (3) | |||
| NIST: NIST SP 800-53A (v1): SI-13 (3).1 (i) | |||
| CCI: | CCI-001325 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization defines a time period that the mean time to failure (MTTF) must exceed before the organization manually initiates a transfer between active and standby information system components. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SI-13 (3) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): SI-13 (3) | |||
| NIST: NIST SP 800-53A (v1): SI-13 (3).1 (ii) | |||
| CCI: | CCI-001338 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The information system associates the identity of the information producer with the information. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AU-10 (1) | ||
| NIST: NIST SP 800-53A (v1): AU-10 (1).1 | |||
| CCI: | CCI-001339 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The information system validates the binding of the information producer's identity to the information. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AU-10 (2) | ||
| NIST: NIST SP 800-53A (v1): AU-10 (2).1 | |||
| CCI: | CCI-001342 | Status: | deprecated |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization employs either FIPS-validated or NSA-approved cryptography to implement digital signatures. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AU-10 (5) | ||
| NIST: NIST SP 800-53A (v1): AU-10 (5).1 | |||
| CCI: | CCI-001343 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The information system invokes a system shutdown in the event of an audit failure, unless an alternative audit capability exists. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AU-5 (4) | ||
| NIST: NIST SP 800-53A (v1): AU-5 (4).1 | |||
| CCI: | CCI-001344 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization specifies the permitted actions for each authorized information system process, role, and/or user in the audit and accountability policy. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AU-6 (7) | ||
| NIST: NIST SP 800-53A (v1): AU-6 (7).1 | |||
| CCI: | CCI-001345 | Status: | deprecated |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization employs automated mechanisms to alert security personnel of any organization-defined inappropriate or unusual activities with security implications. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AU-6 (8) | ||
| NIST: NIST SP 800-53A (v1): AU-6 (8).1 (ii) | |||
| CCI: | CCI-001346 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization defines a list of inappropriate or unusual activities with security implications that are to result in alerts to security personnel. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AU-6 (8) | ||
| NIST: NIST SP 800-53A (v1): AU-6 (8).1 (i) | |||
| CCI: | CCI-001347 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization performs, in a physically dedicated information system, full-text analysis of privileged functions executed. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AU-6 (9) | ||
| NIST: NIST SP 800-53A (v1): AU-6 (9).1 | |||
| CCI: | CCI-001352 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization protects the audit records of non-local accesses to privileged accounts and the execution of privileged functions. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AU-9 (4) (b) | ||
| NIST: NIST SP 800-53A (v1): AU-9 (4).1 (ii) | |||
| CCI: | CCI-001354 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization manages information system accounts by deactivating temporary accounts that are no longer required. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-2 h | ||
| NIST: NIST SP 800-53A (v1): AC-2.1 (i) | |||
| CCI: | CCI-001355 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization manages information system accounts by deactivating accounts of terminated or transferred users. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-2 h | ||
| NIST: NIST SP 800-53A (v1): AC-2.1 (i) | |||
| CCI: | CCI-001356 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization monitors for atypical usage of information system accounts. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AC-2 (5) (c) | ||
| NIST: NIST SP 800-53A (v1): AC-2 (5).1 (iv) | |||
| CCI: | CCI-001357 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization reports atypical usage to designated organizational officials. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-2 (5) (d) | ||
| NIST: NIST SP 800-53A (v1): AC-2 (5).1 (v) | |||
| CCI: | CCI-001359 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization tracks privileged role assignments. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-2 (7) (b) | ||
| NIST: NIST SP 800-53A (v1): AC-2 (7).1 (ii) | |||
| CCI: | CCI-001362 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The information system enforces a Discretionary Access Control (DAC) policy that allows users to specify and control sharing by named individuals or groups of individuals, or by both. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AC-3 (4) | ||
| NIST: NIST SP 800-53A (v1): AC-3 (4).1 | |||
| CCI: | CCI-001363 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization establishes a Discretionary Access Control (DAC) policy that allows users to specify and control sharing by named individuals or groups of individuals, or by both. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-3 (4) (a) | ||
| NIST: NIST SP 800-53A (v1): AC-3 (4).1 | |||
| CCI: | CCI-001364 | Status: | deprecated |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization establishes a Discretionary Access Control (DAC) policy that limits propagation of access rights. | ||
| Type: | policy | ||
| CCI: | CCI-001366 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization defines user information to be encrypted or stored off-line in a secure location. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-3 (6) | ||
| NIST: NIST SP 800-53A (v1): AC-3 (6).1 (i) | |||
| CCI: | CCI-001367 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization defines system information to be encrypted or stored off-line in a secure location. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-3 (6) | ||
| NIST: NIST SP 800-53A (v1): AC-3 (6).1 (i) | |||
| CCI: | CCI-001369 | Status: | deprecated |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The information system, when transferring information between different security domains, identifies information flows by data type specification and usage. | ||
| Type: | technical | ||
| CCI: | CCI-001370 | Status: | deprecated |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The information system, when transferring information between different security domains, decomposes information into policy-relevant subcomponents for submission to policy enforcement mechanisms. | ||
| Type: | technical | ||
| CCI: | CCI-001375 | Status: | deprecated |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The information system enforces security policies regarding information on interconnected systems. | ||
| Type: | technical | ||
| CCI: | CCI-001376 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The information system uniquely identifies source domains for information transfer. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AC-4 (17) (a) | ||
| NIST: NIST SP 800-53A (v1): AC-4 (17).1 (i) | |||
| CCI: | CCI-001377 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The information system uniquely authenticates source domains for information transfer. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AC-4 (17) (a) | ||
| NIST: NIST SP 800-53A (v1): AC-4 (17).1 (ii) | |||
| CCI: | CCI-001378 | Status: | deprecated |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The information system binds security attributes to information to facilitate information flow policy enforcement. | ||
| Type: | technical | ||
| CCI: | CCI-001379 | Status: | deprecated |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The information system tracks problems associated with the security attribute binding and information transfer. | ||
| Type: | technical | ||
| CCI: | CCI-001380 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization documents separation of duties of individuals. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-5 b | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-5 b | |||
| NIST: NIST SP 800-53A (v1): AC-5.1 (ii) | |||
| CCI: | CCI-001381 | Status: | deprecated |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization employs the concept of least privilege, allowing only authorized accesses for users (and processes acting on behalf of users) which are necessary to accomplish assigned tasks in accordance with organizational missions and business functions. | ||
| Type: | policy | ||
| CCI: | CCI-001382 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization defines the number of consecutive, unsuccessful login attempts to the mobile device. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-7 (2) | ||
| NIST: NIST SP 800-53A (v1): AC-7 (2).1 (i) | |||
| CCI: | CCI-001383 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The information system provides additional protection for mobile devices accessed via login by purging information from the device after an organization-defined number of consecutive, unsuccessful login attempts to the mobile device. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AC-7 (2) | ||
| NIST: NIST SP 800-53A (v1): AC-7 (2).1 (i) | |||
| CCI: | CCI-001396 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization defines security attributes for which the information system supports and maintains the bindings for information in storage. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-16 | ||
| NIST: NIST SP 800-53A (v1): AC-16.1 (i) | |||
| CCI: | CCI-001397 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization defines security attributes for which the information system supports and maintains the bindings for information in process. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-16 | ||
| NIST: NIST SP 800-53A (v1): AC-16.1 (i) | |||
| CCI: | CCI-001398 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization defines security attributes for which the information system supports and maintains the bindings for information in transmission. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-16 | ||
| NIST: NIST SP 800-53A (v1): AC-16.1 (i) | |||
| CCI: | CCI-001399 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The information system supports and maintains the binding of organization-defined security attributes to information in storage. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AC-16 | ||
| NIST: NIST SP 800-53A (v1): AC-16.1 (ii) | |||
| CCI: | CCI-001400 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The information system supports and maintains the binding of organization-defined security attributes to information in process. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AC-16 | ||
| NIST: NIST SP 800-53A (v1): AC-16.1 (ii) | |||
| CCI: | CCI-001401 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The information system supports and maintains the binding of organization-defined security attributes to information in transmission. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AC-16 | ||
| NIST: NIST SP 800-53A (v1): AC-16.1 (ii) | |||
| CCI: | CCI-001402 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-22 |
| Definition: | The organization monitors for unauthorized remote access to the information system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-17 c | ||
| NIST: NIST SP 800-53A (v1): AC-17.1 (iii) | |||
| CCI: | CCI-001409 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-24 |
| Definition: | The organization defines nondiscretionary access control policies to be enforced over the organization-defined set of users and resources, where the rule set for each policy specifies access control information employed by the policy rule set (e.g., position, nationality, age, project, time of day) and required relationships among the access control information to permit access. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-3 (3) | ||
| NIST: NIST SP 800-53A (v1): AC-3 (3).1 (ii) | |||
| CCI: | CCI-001410 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-24 |
| Definition: | The organization defines the set of users and resources over which the information system is to enforce nondiscretionary access control policies. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-3 (3) | ||
| NIST: NIST SP 800-53A (v1): AC-3 (3).1 (i) | |||
| CCI: | CCI-001412 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-24 |
| Definition: | The organization encrypts or stores off-line, in a secure location, organization-defined user information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-3 (6) | ||
| NIST: NIST SP 800-53A (v1): AC-3 (6).1 (ii) | |||
| CCI: | CCI-001413 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-24 |
| Definition: | The organization encrypts or stores off-line, in a secure location, organization-defined system information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-3 (6) | ||
| NIST: NIST SP 800-53A (v1): AC-3 (6).1 (ii) | |||
| CCI: | CCI-001416 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-24 |
| Definition: | The organization defines one-way information flows to be enforced by the information system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-4 (7) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-4 (7) | |||
| NIST: NIST SP 800-53A (v1): AC-4 (7).1 (i) | |||
| CCI: | CCI-001418 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-24 |
| Definition: | The organization defines security policy filters for which the information system enforces the use of human review. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-4 (9) | ||
| NIST: NIST SP 800-53A (v1): AC-4 (9).1 (i) | |||
| CCI: | CCI-001421 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-25 |
| Definition: | The organization limits authorization to super user accounts on the information system to designated system administration personnel. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-6 (5) | ||
| NIST: NIST SP 800-53A (v1): AC-6 (5).1 | |||
| CCI: | CCI-001426 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-25 |
| Definition: | The information system maintains the binding of security attributes to information with sufficient assurance that the information--attribute association can be used as the basis for automated policy actions. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AC-16 (3) | ||
| NIST: NIST SP 800-53A (v1): AC-16 (3).1 | |||
| CCI: | CCI-001427 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-25 |
| Definition: | The information system allows authorized users to associate security attributes with information. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AC-16 (4) | ||
| NIST: NIST SP 800-53A (v1): AC-16 (4).1 (ii) | |||
| CCI: | CCI-001431 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-25 |
| Definition: | The organization defines a frequency for monitoring for unauthorized remote connections to the information system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-17 (5) | ||
| NIST: NIST SP 800-53A (v1): AC-17 (5).1 (i) | |||
| CCI: | CCI-001432 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-25 |
| Definition: | The organization takes appropriate action if an unauthorized remote connection to the information system is discovered. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-17 (5) | ||
| NIST: NIST SP 800-53A (v1): AC-17 (5).1 (iv) | |||
| CCI: | CCI-001433 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-25 |
| Definition: | The organization defines a list of security functions and security-relevant information that for remote access sessions have organization-defined security measures employed and are audited. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-17 (7) | ||
| NIST: NIST SP 800-53A (v1): AC-17 (7).1 (i) | |||
| CCI: | CCI-001434 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-25 |
| Definition: | The organization defines additional security measures to be employed when an organization-defined list of security functions and security-relevant information is accessed remotely. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-17 (7) | ||
| NIST: NIST SP 800-53A (v1): AC-17 (7).1 (ii) | |||
| CCI: | CCI-001435 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-25 |
| Definition: | The organization defines networking protocols within the information system deemed to be nonsecure. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-17 (8) | ||
| NIST: NIST SP 800-53A (v1): AC-17 (8).1 (i) | |||
| CCI: | CCI-001436 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-25 |
| Definition: | The organization disables organization-defined networking protocols within the information system deemed to be nonsecure except for explicitly identified components in support of specific operational requirements. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AC-17 (8) | ||
| NIST: NIST SP 800-53A (v1): AC-17 (8).1 (ii) | |||
| CCI: | CCI-001437 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-25 |
| Definition: | The organization documents the rationale for the execution of privileged commands and access to security-relevant information in the security plan for the information system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-17 (4) | ||
| NIST: NIST SP 800-53A (v1): AC-17 (4).1 (ii) | |||
| CCI: | CCI-001438 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-25 |
| Definition: | The organization establishes usage restrictions for wireless access. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-18 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-18 a | |||
| NIST: NIST SP 800-53A (v1): AC-18.1 (i) | |||
| CCI: | CCI-001440 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-25 |
| Definition: | The organization monitors for unauthorized wireless access to the information system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-18 b | ||
| NIST: NIST SP 800-53A (v1): AC-18.1 (ii) | |||
| CCI: | CCI-001442 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-25 |
| Definition: | The organization enforces requirements for wireless connections to the information system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-18 d | ||
| NIST: NIST SP 800-53A (v1): AC-18.1 (iv) | |||
| CCI: | CCI-001445 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-25 |
| Definition: | The organization monitors for unauthorized wireless connections to the information system on an organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-18 (2) | ||
| NIST: NIST SP 800-53A (v1): AC-18 (2).1 (ii) | |||
| CCI: | CCI-001446 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-25 |
| Definition: | The organization scans for unauthorized wireless access points on an organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-18 (2) | ||
| NIST: NIST SP 800-53A (v1): AC-18 (2).1 (ii) | |||
| CCI: | CCI-001447 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-25 |
| Definition: | The organization defines a frequency of monitoring for unauthorized wireless connections to information system, including scans for unauthorized wireless access points. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-18 (2) | ||
| NIST: NIST SP 800-53A (v1): AC-18 (2).1 (i) | |||
| CCI: | CCI-001448 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-25 |
| Definition: | The organization takes appropriate action if an unauthorized wireless connection is discovered. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-18 (2) | ||
| NIST: NIST SP 800-53A (v1): AC-18 (2).1 (iv) | |||
| CCI: | CCI-001450 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-25 |
| Definition: | The organization does not allow users to independently configure wireless networking capabilities. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-18 (4) | ||
| NIST: NIST SP 800-53A (v1): AC-18 (4).1 | |||
| CCI: | CCI-001452 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-05-25 |
| Definition: | The information system enforces the organization-defined time period during which the limit of consecutive invalid access attempts by a user is counted. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AC-7 a | ||
| NIST: NIST SP 800-53A (v1): AC-7.1 (ii) | |||
| CCI: | CCI-001454 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-29 |
| Definition: | The organization ensures that remote sessions for accessing an organization-defined list of security functions and security-relevant information are audited. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AC-17 (7) | ||
| NIST: NIST SP 800-53A (v1): AC-17 (7).1 (iv) | |||
| CCI: | CCI-001455 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-29 |
| Definition: | The organization explicitly identifies components needed in support of specific operational requirements. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-17 (8) | ||
| NIST: NIST SP 800-53A (v1): AC-17 (8).1 (ii) | |||
| CCI: | CCI-001456 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-29 |
| Definition: | The organization defines locations that the organization deems to be of significant risk in accordance with organizational policies and procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-19 f | ||
| NIST: NIST SP 800-53A (v1): AC-19.1 (vi) | |||
| CCI: | CCI-001457 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-29 |
| Definition: | The organization defines inspection and preventative measures to be applied on mobile devices returning from locations that the organization deems to be of significant risk in accordance with organizational policies and procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-19 g | ||
| NIST: NIST SP 800-53A (v1): AC-19.1 (vii) | |||
| CCI: | CCI-001462 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-29 |
| Definition: | The information system provides the capability for authorized users to capture/record and log content related to a user session. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AU-14 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AU-14 (2) | |||
| NIST: NIST SP 800-53A (v1): AU-14.1 (i) | |||
| CCI: | CCI-001463 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-29 |
| Definition: | The information system provides the capability to remotely view/hear all content related to an established user session in real time. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AU-14 b | ||
| NIST: NIST SP 800-53A (v1): AU-14.1 (ii) | |||
| CCI: | CCI-001465 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-29 |
| Definition: | The organization establishes terms and conditions, consistent with any trust relationships established with other organizations owning, operating, and/or maintaining external information systems, allowing authorized individuals to store organization-controlled information using the external information systems. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-20 b | ||
| NIST: NIST SP 800-53A (v1): AC-20.1 | |||
| CCI: | CCI-001466 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-29 |
| Definition: | The organization establishes terms and conditions, consistent with any trust relationships established with other organizations owning, operating, and/or maintaining external information systems, allowing authorized individuals to transmit organization-controlled information using the external information systems. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-20 b | ||
| NIST: NIST SP 800-53A (v1): AC-20.1 | |||
| CCI: | CCI-001467 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-29 |
| Definition: | The organization prohibits authorized individuals from using an external information system to process organization-controlled information except in situations where the organization can verify the implementation of required security controls on the external system as specified in the organization's information security policy and security plan. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-20 (1) (a) | ||
| NIST: NIST SP 800-53A (v1): AC-20 (1).1 | |||
| CCI: | CCI-001468 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-29 |
| Definition: | The organization prohibits authorized individuals from using an external information system to store organization-controlled information except in situations where the organization can verify the implementation of required security controls on the external system as specified in the organization's information security policy and security plan. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-20 (1) (a) | ||
| NIST: NIST SP 800-53A (v1): AC-20 (1).1 | |||
| CCI: | CCI-001469 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-29 |
| Definition: | The organization prohibits authorized individuals from using an external information system to transmit organization-controlled information except in situations where the organization can verify the implementation of required security controls on the external system as specified in the organization's information security policy and security plan. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-20 (1) (a) | ||
| NIST: NIST SP 800-53A (v1): AC-20 (1).1 | |||
| CCI: | CCI-001479 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-29 |
| Definition: | The organization provides refresher security awareness training to all information system users (including managers, senior executives, and contractors) in accordance with the organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AT-2 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AT-2 c | |||
| NIST: NIST SP 800-53A (v1): AT-2.1 (iii) | |||
| CCI: | CCI-001480 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-29 |
| Definition: | The organization defines the frequency for providing refresher security awareness training to all information system users (including managers, senior executives, and contractors). | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AT-2 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AT-2 | |||
| NIST: NIST SP 800-53A (v1): AT-2.1 (ii) | |||
| CCI: | CCI-001486 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-29 |
| Definition: | The organization defines a frequency for reviewing and updating the list of organization-defined auditable events. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AU-2 (3) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AU-2 (3) | |||
| NIST: NIST SP 800-53A (v1): AU-2 (3).1 (i) | |||
| CCI: | CCI-001489 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-29 |
| Definition: | The organization defines information system components for which generated audit records are centrally managed by the organization. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AU-3 (2) | ||
| NIST: NIST SP 800-53A (v1): AU-3 (2).1 (i) | |||
| CCI: | CCI-001492 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-29 |
| Definition: | The organization defines an authoritative time source for the synchronization of internal information system clocks. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AU-8 (1) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AU-8 (1) (a) | |||
| NIST: NIST SP 800-53A (v1): AU-8 (1).1 (ii) | |||
| CCI: | CCI-001500 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-29 |
| Definition: | The information system automatically implements organization-defined safeguards and countermeasures if security functions (or mechanisms) are changed inappropriately. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): CM-5 (7) | ||
| NIST: NIST SP 800-53A (v1): CM-5 (7).1 (ii) | |||
| CCI: | CCI-001501 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-29 |
| Definition: | The organization defines safeguards and countermeasures to be employed by the information system if security functions (or mechanisms) are changed inappropriately. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-5 (7) | ||
| NIST: NIST SP 800-53A (v1): CM-5 (7).1 (i) | |||
| CCI: | CCI-001502 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-29 |
| Definition: | The organization monitors changes to the configuration settings in accordance with organizational policies and procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-6 d | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CM-6 d | |||
| NIST: NIST SP 800-53A (v1): CM-6.1 (vi) | |||
| CCI: | CCI-001503 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-09-29 |
| Definition: | The organization controls changes to the configuration settings in accordance with organizational policies and procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-6 d | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CM-6 d | |||
| NIST: NIST SP 800-53A (v1): CM-6.1 (vi) | |||
| CCI: | CCI-001531 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-11-03 |
| Definition: | The organization ensures that individuals requiring access to organizational information and information systems sign appropriate access agreements prior to being granted access. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PS-6 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PS-6 c 1 | |||
| NIST: NIST SP 800-53A (v1): PS-6.1 (i) (ii) | |||
| CCI: | CCI-001534 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-11-03 |
| Definition: | The organization ensures that access to information with special protection measures is granted only to individuals who have a valid access authorization that is demonstrated by assigned official government duties. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PS-6 (1) (a) | ||
| NIST: NIST SP 800-53A (v1): PS-6 (1).1 | |||
| CCI: | CCI-001535 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-11-03 |
| Definition: | The organization ensures that access to information with special protection measures is granted only to individuals who satisfy associated personnel security criteria. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PS-6 (1) (b) | ||
| NIST: NIST SP 800-53A (v1): PS-6 (1).1 | |||
| CCI: | CCI-001542 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-11-03 |
| Definition: | The organization employs a formal sanctions process for individuals failing to comply with established information security policies and procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PS-8 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PS-8 a | |||
| NIST: NIST SP 800-53A (v1): PS-8.1 | |||
| CCI: | CCI-001543 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2009-11-03 |
| Definition: | The organization disseminates the most recent information security program plan to appropriate entities in the organization that includes roles, responsibilities, management commitment, coordination among organizational entities, and compliance. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PM-1 a | ||
| NIST: NIST SP 800-53A (v1): PM-1.1 (v) | |||
| CCI: | CCI-001550 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-11 |
| Definition: | The organization defines approved authorizations for controlling the flow of information within the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-4 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-4 | |||
| NIST: NIST SP 800-53A (v1): AC-4.1 (ii) | |||
| CCI: | CCI-001551 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-11 |
| Definition: | The organization defines approved authorizations for controlling the flow of information between interconnected systems. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-4 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-4 | |||
| NIST: NIST SP 800-53A (v1): AC-4.1 (ii) | |||
| CCI: | CCI-001552 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-11 |
| Definition: | The organization defines policy that allows or disallows information flows based on changing conditions or operational considerations. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-4 (3) | ||
| NIST: NIST SP 800-53A (v1): AC-4 (3).1 (i) | |||
| CCI: | CCI-001555 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-11 |
| Definition: | The information system uniquely identifies destination domains for information transfer. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AC-4 (17) (a) | ||
| NIST: NIST SP 800-53A (v1): AC-4 (17).1 (iii) | |||
| CCI: | CCI-001556 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-11 |
| Definition: | The information system uniquely authenticates destination domains for information transfer. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AC-4 (17) (a) | ||
| NIST: NIST SP 800-53A (v1): AC-4 (17).1 (iv) | |||
| CCI: | CCI-001557 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-11 |
| Definition: | The information system tracks problems associated with the information transfer. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AC-4 (17) c | ||
| NIST: NIST SP 800-53A (v1): AC-4 (17).1 (vii) | |||
| CCI: | CCI-001559 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-11 |
| Definition: | The organization identifies the individuals authorized to change the value of associated security attributes. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-16 (2) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-16 (2) | |||
| NIST: NIST SP 800-53A (v1): AC-16 (2).1 (i) | |||
| CCI: | CCI-001560 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-11 |
| Definition: | The organization identifies individuals (or processes acting on behalf of individuals) authorized to associate organization-defined security attributes with organization-defined objects. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-16 (4) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-16 (4) | |||
| NIST: NIST SP 800-53A (v1): AC-16 (4).1 (i) | |||
| CCI: | CCI-001561 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-11 |
| Definition: | The organization defines managed access control points for remote access to the information system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-17 (3) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-17 (3) | |||
| NIST: NIST SP 800-53A (v1): AC-17 (3).1 (i) | |||
| CCI: | CCI-001562 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-11 |
| Definition: | The organization defines the appropriate action(s) to be taken if an unauthorized remote connection is discovered. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-17 (5) | ||
| NIST: NIST SP 800-53A (v1): AC-17 (5).1 (iii) | |||
| CCI: | CCI-001563 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-11 |
| Definition: | The organization defines the appropriate action(s) to be taken if an unauthorized wireless connection is discovered. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AC-18 (2) | ||
| NIST: NIST SP 800-53A (v1): AC-18 (2).1 (iii) | |||
| CCI: | CCI-001574 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-11 |
| Definition: | The information system rejects or delays, as defined by the organization, network traffic which exceed the organization-defined thresholds. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AU-5 (3) | ||
| NIST: NIST SP 800-53A (v1): AU-5 (3).1 (iii) | |||
| CCI: | CCI-001575 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-11 |
| Definition: | The organization defines the system or system component for storing audit records that is a different system or system component than the system or component being audited. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): AU-9 (2) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AU-9 (2) | |||
| NIST: NIST SP 800-53A (v1): AU-9 (2).1 (i) | |||
| CCI: | CCI-001576 | Status: | deprecated |
| Contributor: | DISA FSO | Published Date: | 2010-05-11 |
| Definition: | The information system produces a system-wide (logical or physical) audit trail of information system audit records. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AU-12 (1) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AU-12 (1) | |||
| NIST: NIST SP 800-53A (v1): AU-12 (1).1 (i) | |||
| CCI: | CCI-001579 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-11 |
| Definition: | The organization conducts security control assessments using organization-defined forms of testing in accordance with organization-defined frequency and assessment techniques. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CA-2 (2) | ||
| NIST: NIST SP 800-53A (v1): CA-2 (2).1 (ii) | |||
| CCI: | CCI-001580 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-11 |
| Definition: | The organization identifies connections to external information systems (i.e., information systems outside of the authorization boundary). | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CA-3 b | ||
| NIST: NIST SP 800-53A (v1): CA-3.1 (i) | |||
| CCI: | CCI-001581 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-11 |
| Definition: | The organization defines personnel or roles to whom the security status of the organization and the information system should be reported. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CA-7 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CA-7 g | |||
| NIST: NIST SP 800-53A (v1): CA-7.1 (iii) | |||
| CCI: | CCI-001583 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-11 |
| Definition: | The organization selects announced or unannounced assessments for each form of security control assessment. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CA-7 (2) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CA-2 (2) | |||
| NIST: NIST SP 800-53A (v1): CA-7 (2).1 (i) | |||
| CCI: | CCI-001587 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-12 |
| Definition: | The organization, when analyzing new software in a separate test environment, looks for security impacts due to flaws, weaknesses, incompatibility, or intentional malice. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-4 (1) | ||
| NIST: NIST SP 800-53A (v1): CM-4 (1).1 (ii) | |||
| CCI: | CCI-001588 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-12 |
| Definition: | The organization-defined security configuration checklists reflect the most restrictive mode consistent with operational requirements. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-6 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CM-6 a | |||
| NIST: NIST SP 800-53A (v1): CM-6.1 (ii) | |||
| CCI: | CCI-001589 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-12 |
| Definition: | The organization incorporates detection of unauthorized, security-relevant configuration changes into the organization's incident response capability to ensure they are tracked. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): CM-6 (3) | ||
| NIST: NIST SP 800-53A (v1): CM-6 (3).1 (ii) | |||
| CCI: | CCI-001590 | Status: | deprecated |
| Contributor: | DISA FSO | Published Date: | 2010-05-12 |
| Definition: | The organization develops a list of software programs authorized to execute on the information system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-7 (2) | ||
| NIST: NIST SP 800-53A (v1): CM-7 (2).1 (i) | |||
| CCI: | CCI-001591 | Status: | deprecated |
| Contributor: | DISA FSO | Published Date: | 2010-05-12 |
| Definition: | The organization develops a list of software programs not authorized to execute on the information system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-7 (2) | ||
| NIST: NIST SP 800-53A (v1): CM-7 (2).1 (i) | |||
| CCI: | CCI-001593 | Status: | deprecated |
| Contributor: | DISA FSO | Published Date: | 2010-05-12 |
| Definition: | The organization maintains a list of software programs authorized to execute on the information system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-7 (2) | ||
| NIST: NIST SP 800-53A (v1): CM-7 (2).1 (i) | |||
| CCI: | CCI-001594 | Status: | deprecated |
| Contributor: | DISA FSO | Published Date: | 2010-05-12 |
| Definition: | The organization maintains a list of software programs not authorized to execute on the information system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-7 (2) | ||
| NIST: NIST SP 800-53A (v1): CM-7 (2).1 (i) | |||
| CCI: | CCI-001595 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-12 |
| Definition: | The organization maintains rules authorizing the terms and conditions of software program usage on the information system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CM-7 (2) | ||
| NIST: NIST SP 800-53A (v1): CM-7 (2).1 (i) | |||
| CCI: | CCI-001603 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-12 |
| Definition: | The contingency plan identifies the primary storage site hazards. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-6 (1) | ||
| NIST: NIST SP 800-53A (v1): CP-6 (1).1 (i) | |||
| CCI: | CCI-001605 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-12 |
| Definition: | The contingency plan identifies the primary processing site hazards. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-7 (1) | ||
| NIST: NIST SP 800-53A (v1): CP-7 (1).1 (i) | |||
| CCI: | CCI-001607 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-12 |
| Definition: | The organization establishes alternate telecommunications services to support the information system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-8 (2) | ||
| NIST: NIST SP 800-53A (v1): CP-8.1 (i) | |||
| CCI: | CCI-001608 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-12 |
| Definition: | The organization identifies the primary provider's telecommunications service hazards. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CP-8 (3) | ||
| NIST: NIST SP 800-53A (v1): CP-8 (3).1 (i) | |||
| CCI: | CCI-001611 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-12 |
| Definition: | The organization defines the minimum number of special characters for password complexity enforcement. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): IA-5 (1) (a) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): IA-5 (1) (a) | |||
| NIST: NIST SP 800-53A (v1): IA-5 (1).1 (i) | |||
| CCI: | CCI-001612 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-12 |
| Definition: | The organization defines the minimum number of upper case characters for password complexity enforcement. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): IA-5 (1) (a) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): IA-5 (1) (a) | |||
| NIST: NIST SP 800-53A (v1): IA-5 (1).1 (i) | |||
| CCI: | CCI-001613 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-12 |
| Definition: | The organization defines the minimum number of lower case characters for password complexity enforcement. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): IA-5 (1) (a) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): IA-5 (1) (a) | |||
| NIST: NIST SP 800-53A (v1): IA-5 (1).1 (i) | |||
| CCI: | CCI-001614 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-12 |
| Definition: | The organization defines the minimum number of numeric characters for password complexity enforcement. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): IA-5 (1) (a) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): IA-5 (1) (a) | |||
| NIST: NIST SP 800-53A (v1): IA-5 (1).1 (i) | |||
| CCI: | CCI-001615 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-12 |
| Definition: | The organization defines the minimum number of characters that are changed when new passwords are created. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): IA-5 (1) (b) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): IA-5 (1) (b) | |||
| NIST: NIST SP 800-53A (v1): IA-5 (1).1 (ii) | |||
| CCI: | CCI-001616 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-12 |
| Definition: | The organization defines minimum password lifetime restrictions. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): IA-5 (1) (b) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): IA-5 (1) (d) | |||
| NIST: NIST SP 800-53A (v1): IA-5 (1).1 (ii) | |||
| CCI: | CCI-001617 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-12 |
| Definition: | The organization defines maximum password lifetime restrictions. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): IA-5 (1) (d) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): IA-5 (1) (d) | |||
| NIST: NIST SP 800-53A (v1): IA-5 (1).1 (iii) | |||
| CCI: | CCI-001618 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-12 |
| Definition: | The organization defines the number of generations for which password reuse is prohibited. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): IA-5 (1) (d) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): IA-5 (1) (e) | |||
| NIST: NIST SP 800-53A (v1): IA-5 (1).1 (iv) | |||
| CCI: | CCI-001619 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-12 |
| Definition: | The information system enforces password complexity by the minimum number of special characters used. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): IA-5 (1) (a) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): IA-5 (1) (a) | |||
| NIST: NIST SP 800-53A (v1): IA-5 (1).1 (v) | |||
| CCI: | CCI-001620 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-12 |
| Definition: | The organization defines the types of and/or specific authenticators for which the registration process must be carried out in person before a designated registration authority with authorization by a designated organizational official (e.g., a supervisor). | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): IA-5 (3) | ||
| NIST: NIST SP 800-53A (v1): IA-5 (3).1 (i) | |||
| CCI: | CCI-001622 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-12 |
| Definition: | The organization identifies personnel with incident response roles and responsibilities with respect to the information system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): IR-2 | ||
| NIST: NIST SP 800-53A (v1): IR-2.1 (i) | |||
| CCI: | CCI-001623 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-12 |
| Definition: | The incident response training material addresses the procedures and activities necessary to fulfill identified organizational incident response roles and responsibilities. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): IR-2 | ||
| NIST: NIST SP 800-53A (v1): IR-2.1 (iii) | |||
| CCI: | CCI-001624 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-12 |
| Definition: | The organization documents the results of incident response tests. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): IR-3 | ||
| NIST: NIST SP 800-53 Revision 4 (v4): IR-3 | |||
| NIST: NIST SP 800-53A (v1): IR-3.1 (iv) | |||
| CCI: | CCI-001626 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-12 |
| Definition: | The organization employs automated mechanisms to assist in the collection of security incident information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): IR-5 (1) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): IR-5 (1) | |||
| NIST: NIST SP 800-53A (v1): IR-5 (1).1 (ii) | |||
| CCI: | CCI-001627 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-12 |
| Definition: | The organization employs automated mechanisms to assist in the analysis of security incident information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): IR-5 (1) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): IR-5 (1) | |||
| NIST: NIST SP 800-53A (v1): IR-5 (1).1 (iii) | |||
| CCI: | CCI-001629 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-12 |
| Definition: | The organization employs automated mechanisms to produce up-to-date, accurate, complete, and available records of all maintenance and repair actions needed, in process, and complete. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): MA-2 (2) | ||
| NIST: NIST SP 800-53A (v1): MA-2 (2).1 (ii) | |||
| CCI: | CCI-001630 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-12 |
| Definition: | Designated organizational personnel review the maintenance records of the non-local maintenance and diagnostic sessions. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): MA-4 (1) | ||
| NIST: NIST SP 800-53A (v1): MA-4 (1).1 (ii) | |||
| CCI: | CCI-001633 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-12 |
| Definition: | The organization defines removable media types and information output requiring marking. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): MP-3 a | ||
| NIST: NIST SP 800-53A (v1): MP-3.1 (i) | |||
| CCI: | CCI-001634 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-12 |
| Definition: | The organization identifies authorized personnel with appropriate clearances and access authorizations for gaining physical access to the facility containing an information system that processes classified information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PE-2 (3) | ||
| NIST: NIST SP 800-53A (v1): PE-2 (3).1 (i) | |||
| CCI: | CCI-001639 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-12 |
| Definition: | The organization makes readily available to individuals requiring access to the information system the rules that describe their responsibilities and expected behavior with regard to information and information system usage. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): PL-4 a | ||
| NIST: NIST SP 800-53 Revision 4 (v4): PL-4 a | |||
| NIST: NIST SP 800-53A (v1): PL-4.1 (ii) | |||
| CCI: | CCI-001644 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-12 |
| Definition: | The organization employs vulnerability scanning procedures that can demonstrate the depth of coverage (i.e., vulnerabilities checked). | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): RA-5 (3) | ||
| NIST: NIST SP 800-53A (v1): RA-5 (3).1 (ii) | |||
| CCI: | CCI-001647 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-12 |
| Definition: | The organization requires the use of a FIPS-validated, cryptographic module for a technology product that relies on cryptographic functionality to enforce its security policy when no U.S. Government Protection Profile exists for such a specific technology type. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-4 (7) (b) | ||
| NIST: NIST SP 800-53A (v1): SA-4 (7).1 (iii) | |||
| CCI: | CCI-001648 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-12 |
| Definition: | The organization makes available to authorized personnel the source code for the information system to permit analysis and testing. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-5 (5) | ||
| NIST: NIST SP 800-53A (v1): SA-5 (5).1 | |||
| CCI: | CCI-001649 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-12 |
| Definition: | The organization identifies and documents (as appropriate) explicit rules to be enforced when governing the installation of software by users. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-7 | ||
| NIST: NIST SP 800-53A (v1): SA-7.1 (i) | |||
| CCI: | CCI-001650 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-12 |
| Definition: | The organization requires the information system developers to manage and control changes to the information system during development. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-10 (b) | ||
| NIST: NIST SP 800-53A (v1): SA-10.1 (ii) | |||
| CCI: | CCI-001651 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-12 |
| Definition: | The organization requires the information system integrators to manage and control changes to the information system during development. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-10 (b) | ||
| NIST: NIST SP 800-53A (v1): SA-10.1 (ii) | |||
| CCI: | CCI-001652 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-12 |
| Definition: | The organization requires the information system developers to manage and control changes to the information system during implementation. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-10 (b) | ||
| NIST: NIST SP 800-53A (v1): SA-10.1 (ii) | |||
| CCI: | CCI-001653 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-12 |
| Definition: | The organization requires the information system integrators to manage and control changes to the information system during implementation. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-10 (b) | ||
| NIST: NIST SP 800-53A (v1): SA-10.1 (ii) | |||
| CCI: | CCI-001654 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-12 |
| Definition: | The organization requires the information system developers to manage and control changes to the information system during modification. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-10 (b) | ||
| NIST: NIST SP 800-53A (v1): SA-10.1 (ii) | |||
| CCI: | CCI-001655 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-12 |
| Definition: | The organization requires the information system integrators to manage and control changes to the information system during modification. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-10 (b) | ||
| NIST: NIST SP 800-53A (v1): SA-10.1 (ii) | |||
| CCI: | CCI-001656 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-12 |
| Definition: | The organization defines the security functions of the information system to be isolated from nonsecurity functions. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SC-3 | ||
| NIST: NIST SP 800-53A (v1): SC-3.1 (i) | |||
| CCI: | CCI-001657 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-12 |
| Definition: | The organization defines the external boundary of the information system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SC-7 a | ||
| NIST: NIST SP 800-53A (v1): SC-7.1 (i) | |||
| CCI: | CCI-001658 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-12 |
| Definition: | The organization defines key internal boundaries of the information system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SC-7 a | ||
| NIST: NIST SP 800-53A (v1): SC-7.1 (ii) | |||
| CCI: | CCI-001659 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-12 |
| Definition: | The organization defines the mediation necessary for public access to the organization's internal networks. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SC-7 (2) | ||
| NIST: NIST SP 800-53A (v1): SC-7 (2).1 (i) | |||
| CCI: | CCI-001660 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-12 |
| Definition: | The organization defines the measures to protect against unauthorized physical connections across boundary protections implemented at organization-defined managed interfaces. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SC-7 (14) | ||
| NIST: NIST SP 800-53A (v1): SC-7 (14).1 (ii) | |||
| CCI: | CCI-001666 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-12 |
| Definition: | The organization employs cryptographic mechanisms to prevent unauthorized modification of information at rest unless otherwise protected by alternative physical measures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SC-28 (1) | ||
| NIST: NIST SP 800-53A (v1): SC-28 (1).1 (ii) | |||
| CCI: | CCI-001667 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-12 |
| Definition: | The organization compares the time measured between flaw identification and flaw remediation with organization-defined benchmarks. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SI-2 (3) | ||
| NIST: NIST SP 800-53A (v1): SI-2 (3).1 (iii) | |||
| CCI: | CCI-001668 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-12 |
| Definition: | The organization employs malicious code protection mechanisms at workstations, servers, or mobile computing devices on the network to detect and eradicate malicious code transported by electronic mail, electronic mail attachments, web accesses, removable media, or other common means or inserted through the exploitation of information system vulnerabilities. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): SI-3 a | ||
| NIST: NIST SP 800-53A (v1): SI-3.1 (ii) | |||
| CCI: | CCI-001672 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-12 |
| Definition: | The organization employs a wireless intrusion detection system to identify rogue wireless devices. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): SI-4 (14) | ||
| NIST: NIST SP 800-53A (v1): SI-4 (14).1 (ii) | |||
| CCI: | CCI-001674 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-12 |
| Definition: | The information system responds to security function anomalies in accordance with organization-defined responses and alternative action(s). | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): SI-6 | ||
| NIST: NIST SP 800-53A (v1): SI-6.1 (v) | |||
| CCI: | CCI-001676 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-12 |
| Definition: | The organization defines, for periodic security function verification, the frequency of the verifications. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SI-6 | ||
| NIST: NIST SP 800-53A (v1): SI-6.1 (ii) | |||
| CCI: | CCI-001677 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-12 |
| Definition: | The organization employs spam protection mechanisms at workstations, servers, or mobile computing devices on the network to detect and take action on unsolicited messages transported by electronic mail, electronic mail attachments, web accesses, removable media, or other common means. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): SI-8 a | ||
| NIST: NIST SP 800-53A (v1): SI-8.1 (ii) | |||
| CCI: | CCI-001679 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2010-05-12 |
| Definition: | The organization provides a mechanism to exchange active and standby roles of the components. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SI-13 b | ||
| NIST: NIST SP 800-53A (v1): SI-13.1 (iv) | |||
| CCI: | CCI-001681 | Status: | deprecated |
| Contributor: | DISA FSO | Published Date: | 2011-04-26 |
| Definition: | The organization defines the frequency at which each form of security control assessment should be conducted. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): CA-7 (2) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): CA-2 (2) | |||
| NIST: NIST SP 800-53A (v1): CA-7 (2).1 (i) | |||
| CCI: | CCI-001683 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2011-05-03 |
| Definition: | The information system notifies organization-defined personnel or roles for account creation actions. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AC-2 (4) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-2 (4) | |||
| NIST: NIST SP 800-53A (v1): AC-2 (4).1 (i and ii) | |||
| CCI: | CCI-001684 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2011-05-03 |
| Definition: | The information system notifies organization-defined personnel or roles for account modification actions. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AC-2 (4) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-2 (4) | |||
| NIST: NIST SP 800-53A (v1): AC-2 (4).1 (i and ii) | |||
| CCI: | CCI-001685 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2011-05-03 |
| Definition: | The information system notifies organization-defined personnel or roles for account disabling actions. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AC-2 (4) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-2 (4) | |||
| NIST: NIST SP 800-53A (v1): AC-2 (4).1 (i and ii) | |||
| CCI: | CCI-001686 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2011-05-03 |
| Definition: | The information system notifies organization-defined personnel or roles for account removal actions. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AC-2 (4) | ||
| NIST: NIST SP 800-53 Revision 4 (v4): AC-2 (4) | |||
| NIST: NIST SP 800-53A (v1): AC-2 (4).1 (i and ii) | |||
| CCI: | CCI-001689 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2011-05-27 |
| Definition: | The organization, if an information system component failure is detected, automatically shuts down the information system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SI-13 (4) (b) | ||
| NIST: NIST SP 800-53A (v1): SI-13 (4).1 (iii) | |||
| CCI: | CCI-001690 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2011-10-07 |
| Definition: | The organization protects, as required, vendor/manufacturer documentation that describes the security-relevant external interfaces to the information system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-5 (1) | ||
| NIST: NIST SP 800-53A (v1): SA-5 (1).1 (i) | |||
| CCI: | CCI-001691 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2011-10-07 |
| Definition: | The organization makes available to authorized personnel vendor/manufacturer documentation that describes the security-relevant external interfaces to the information system with sufficient detail to permit analysis and testing. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-5 (1) | ||
| NIST: NIST SP 800-53A (v1): SA-5 (1).1 (i) | |||
| CCI: | CCI-001692 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2011-10-07 |
| Definition: | The organization makes available to authorized personnel vendor/manufacturer documentation that describes the low-level design of the information system in terms of modules and implementation details of the security controls employed within the system with sufficient detail to permit analysis and testing. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 (v3): SA-5 (4) | ||
| NIST: NIST SP 800-53A (v1): SA-5 (4).1 | |||
| CCI: | CCI-001693 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2011-10-07 |
| Definition: | The information system enforces a Discretionary Access Control (DAC) policy that limits propagation of access rights. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AC-3 (4) | ||
| NIST: NIST SP 800-53A (v1): AC-3 (4).1 | |||
| CCI: | CCI-001694 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2011-10-07 |
| Definition: | The information system enforces a Discretionary Access Control (DAC) policy that includes or excludes access to the granularity of a single user. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 (v3): AC-3 (4) | ||
| NIST: NIST SP 800-53A (v1): AC-3 (4).1 | |||
| CCI: | CCI-001747 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-02-28 |
| Definition: | The organization defines critical software components the information system will prevent from being installed without verification the component has been digitally signed using a certificate that is recognized and approved by the organization. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CM-5 (3) | ||
| CCI: | CCI-001748 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-02-28 |
| Definition: | The organization defines critical firmware components the information system will prevent from being installed without verification the component has been digitally signed using a certificate that is recognized and approved by the organization. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CM-5 (3) | ||
| CCI: | CCI-001749 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-02-28 |
| Definition: | The information system prevents the installation of organization-defined software components without verification the software component has been digitally signed using a certificate that is recognized and approved by the organization. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CM-5 (3) | ||
| CCI: | CCI-001750 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-02-28 |
| Definition: | The information system prevents the installation of organization-defined firmware components without verification the firmware component has been digitally signed using a certificate that is recognized and approved by the organization. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CM-5 (3) | ||
| CCI: | CCI-001769 | Status: | deprecated |
| Contributor: | DISA FSO | Published Date: | 2013-02-28 |
| Definition: | The organization defines the frequency on which it will update the list of unauthorized software programs. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CM-7 (4) (c) | ||
| CCI: | CCI-001771 | Status: | deprecated |
| Contributor: | DISA FSO | Published Date: | 2013-02-28 |
| Definition: | The organization updates the list of unauthorized software programs per organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CM-7 (4) (c) | ||
| CCI: | CCI-001776 | Status: | deprecated |
| Contributor: | DISA FSO | Published Date: | 2013-02-28 |
| Definition: | The organization defines the frequency on which it will update the list of authorized software programs. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CM-7 (5) (c) | ||
| CCI: | CCI-001778 | Status: | deprecated |
| Contributor: | DISA FSO | Published Date: | 2013-02-28 |
| Definition: | The organization updates the list of authorized software programs per organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CM-7 (5) (c) | ||
| CCI: | CCI-001781 | Status: | deprecated |
| Contributor: | DISA FSO | Published Date: | 2013-03-01 |
| Definition: | The organization defines the frequency on which the information system component inventory is to be updated. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CM-8 b | ||
| CCI: | CCI-001782 | Status: | deprecated |
| Contributor: | DISA FSO | Published Date: | 2013-03-01 |
| Definition: | The organization updates the information system component inventory per organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CM-8 b | ||
| CCI: | CCI-001787 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-01 |
| Definition: | The organization defines the acquired information system components that are to be assigned to an information system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CM-8 (9) (a) | ||
| CCI: | CCI-001790 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-01 |
| Definition: | The organization develops a configuration management plan for the information system that establishes a process for identifying configuration items throughout the system development life cycle. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CM-9 b | ||
| CCI: | CCI-001791 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-01 |
| Definition: | The organization documents a configuration management plan for the information system that establishes a process for identifying configuration items throughout the system development life cycle. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CM-9 b | ||
| CCI: | CCI-001793 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-01 |
| Definition: | The organization develops a configuration management plan for the information system that establishes a process for managing the configuration of the configuration items. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CM-9 b | ||
| CCI: | CCI-001794 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-01 |
| Definition: | The organization documents a configuration management plan for the information system that establishes a process for managing the configuration of the configuration items. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CM-9 b | ||
| CCI: | CCI-001796 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-01 |
| Definition: | The organization develops a configuration management plan for the information system that places the configuration items under configuration management. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CM-9 c | ||
| CCI: | CCI-001797 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-01 |
| Definition: | The organization documents a configuration management plan for the information system that places the configuration items under configuration management. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CM-9 c | ||
| CCI: | CCI-001800 | Status: | deprecated |
| Contributor: | DISA FSO | Published Date: | 2013-03-01 |
| Definition: | The organization documents a configuration management plan for the information system that protects the configuration management plan from unauthorized disclosure and modification. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CM-9 d | ||
| CCI: | CCI-001810 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-01 |
| Definition: | The organization defines the personnel or roles to be notified when unauthorized software is detected. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CM-11 (1) | ||
| CCI: | CCI-001811 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-01 |
| Definition: | The information system alerts organization-defined personnel or roles when the unauthorized installation of software is detected. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CM-11 (1) | ||
| CCI: | CCI-001812 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-01 |
| Definition: | The information system prohibits user installation of software without explicit privileged status. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CM-11 (2) | ||
| CCI: | CCI-001814 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-01 |
| Definition: | The Information system supports auditing of the enforcement actions. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CM-5 (1) | ||
| CCI: | CCI-001820 | Status: | deprecated |
| Contributor: | DISA FSO | Published Date: | 2013-03-01 |
| Definition: | The organization documents a configuration management policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CM-1 a 1 | ||
| CCI: | CCI-001823 | Status: | deprecated |
| Contributor: | DISA FSO | Published Date: | 2013-03-01 |
| Definition: | The organization documents the procedures to facilitate the implementation of the configuration management policy and associated configuration management controls. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CM-1 a 2 | ||
| CCI: | CCI-001826 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-05 |
| Definition: | The organization defines the circumstances upon which the organization reviews the information system changes to determine whether unauthorized changes have occurred. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CM-5 (2) | ||
| CCI: | CCI-001827 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-05 |
| Definition: | The organization defines the frequency with which to review information system privileges. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CM-5 (5) (b) | ||
| CCI: | CCI-001828 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-05 |
| Definition: | The organization defines the frequency with which to reevaluate information system privileges. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CM-5 (5) (b) | ||
| CCI: | CCI-001829 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-05 |
| Definition: | The organization reviews information system privileges per an organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CM-5 (5) (b) | ||
| CCI: | CCI-001830 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-05 |
| Definition: | The organization reevaluates information system privileges per an organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CM-5 (5) (b) | ||
| CCI: | CCI-001831 | Status: | deprecated |
| Contributor: | DISA FSO | Published Date: | 2013-03-14 |
| Definition: | The organization documents an audit and accountability policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AU-1 a 1 | ||
| CCI: | CCI-001833 | Status: | deprecated |
| Contributor: | DISA FSO | Published Date: | 2013-03-14 |
| Definition: | The organization documents procedures to facilitate the implementation of the audit and accountability policy and associated audit and accountability controls. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AU-1 a 2 | ||
| CCI: | CCI-001835 | Status: | deprecated |
| Contributor: | DISA FSO | Published Date: | 2013-03-14 |
| Definition: | The organization defines the frequency on which it will review the audit and accountability policy. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AU-1 b 1 | ||
| CCI: | CCI-001836 | Status: | deprecated |
| Contributor: | DISA FSO | Published Date: | 2013-03-14 |
| Definition: | The organization defines the frequency on which it will update the audit and accountability policy. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AU-1 b 1 | ||
| CCI: | CCI-001837 | Status: | deprecated |
| Contributor: | DISA FSO | Published Date: | 2013-03-14 |
| Definition: | The organization reviews the audit and accountability policy on an organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AU-1 b 1 | ||
| CCI: | CCI-001838 | Status: | deprecated |
| Contributor: | DISA FSO | Published Date: | 2013-03-14 |
| Definition: | The organization updates the audit and accountability policy on an organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AU-1 b 1 | ||
| CCI: | CCI-001839 | Status: | deprecated |
| Contributor: | DISA FSO | Published Date: | 2013-03-14 |
| Definition: | The organization defines the frequency on which it will review the audit and accountability procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AU-1 b 2 | ||
| CCI: | CCI-001840 | Status: | deprecated |
| Contributor: | DISA FSO | Published Date: | 2013-03-14 |
| Definition: | The organization defines the frequency on which it will update the audit and accountability procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AU-1 b 2 | ||
| CCI: | CCI-001841 | Status: | deprecated |
| Contributor: | DISA FSO | Published Date: | 2013-03-14 |
| Definition: | The organization reviews the audit and accountability procedures on an organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AU-1 b 2 | ||
| CCI: | CCI-001842 | Status: | deprecated |
| Contributor: | DISA FSO | Published Date: | 2013-03-14 |
| Definition: | The organization updates the audit and accountability procedures on an organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AU-1 b 2 | ||
| CCI: | CCI-001843 | Status: | deprecated |
| Contributor: | DISA FSO | Published Date: | 2013-03-14 |
| Definition: | The organization defines a frequency for updating the list of organization-defined auditable events. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AU-2 (3) | ||
| CCI: | CCI-001844 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-14 |
| Definition: | The information system provides centralized management and configuration of the content to be captured in audit records generated by organization-defined information system components. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AU-3 (2) | ||
| CCI: | CCI-001845 | Status: | deprecated |
| Contributor: | DISA FSO | Published Date: | 2013-03-14 |
| Definition: | The information system provides centralized configuration of the content to be captured in audit records generated by organization-defined information system components. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AU-3 (2) | ||
| CCI: | CCI-001846 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-14 |
| Definition: | The organization defines information system components that will generate the audit records which are to be captured for centralized management of the content. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AU-3 (2) | ||
| CCI: | CCI-001847 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-14 |
| Definition: | The organization defines information system components that will generate the audit records which are to be captured for centralized configuration of the content. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AU-3 (2) | ||
| CCI: | CCI-001872 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-15 |
| Definition: | The organization adjusts the level of audit review and analysis within the information system when there is a change in risk based on law enforcement information, intelligence information, or other credible sources of information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AU-6 (10) | ||
| CCI: | CCI-001873 | Status: | deprecated |
| Contributor: | DISA FSO | Published Date: | 2013-03-15 |
| Definition: | The organization adjusts the level of audit analysis within the information system when there is a change in risk based on law enforcement information, intelligence information, or other credible sources of information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AU-6 (10) | ||
| CCI: | CCI-001874 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-15 |
| Definition: | The organization adjusts the level of audit reporting within the information system when there is a change in risk based on law enforcement information, intelligence information, or other credible sources of information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AU-6 (10) | ||
| CCI: | CCI-001884 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-15 |
| Definition: | The organization defines the audit fields within audit records to be sorted for events of interest by the information system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AU-7 (2) | ||
| CCI: | CCI-001885 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-15 |
| Definition: | The organization defines the audit fields within audit records to be searched for events of interest by the information system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AU-7 (2) | ||
| CCI: | CCI-001886 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-15 |
| Definition: | The information system provides the capability to sort audit records for events of interest based on the content of organization-defined audit fields within audit records. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AU-7 (2) | ||
| CCI: | CCI-001887 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-15 |
| Definition: | The information system provides the capability to search audit records for events of interest based on the content of organization-defined audit fields within audit records. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AU-7 (2) | ||
| CCI: | CCI-001891 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-15 |
| Definition: | The information system compares internal information system clocks on an organization-defined frequency with an organization-defined authoritative time source. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AU-8 (1) (a) | ||
| CCI: | CCI-001892 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-15 |
| Definition: | The organization defines the time difference which, when exceeded, will require the information system to synchronize the internal information system clocks to the organization-defined authoritative time source. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AU-8 (1) (b) | ||
| CCI: | CCI-001893 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-15 |
| Definition: | The information system identifies a secondary authoritative time source that is located in a different geographic region than the primary authoritative time source. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AU-8 (2) | ||
| CCI: | CCI-001916 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-15 |
| Definition: | The organization employs automated mechanisms to determine if organizational information has been disclosed in an unauthorized manner. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AU-13 (1) | ||
| CCI: | CCI-001921 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-15 |
| Definition: | The organization defines the alternative audit functionality to be provided in the event of a failure in the primary audit capability. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AU-15 | ||
| CCI: | CCI-001922 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-03-15 |
| Definition: | The organization provides an alternative audit capability in the event of a failure in primary audit capability that provides organization-defined alternative audit functionality. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AU-15 | ||
| CCI: | CCI-001932 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-05-03 |
| Definition: | The organization documents an identification and authentication policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IA-1 a 1 | ||
| CCI: | CCI-001933 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-05-03 |
| Definition: | The organization defines the personnel or roles to be recipients of the identification and authentication policy and the procedures to facilitate the implementation of the identification and authentication policy and associated identification and authentication controls. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IA-1 a 1 | ||
| CCI: | CCI-001934 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-05-03 |
| Definition: | The organization documents procedures to facilitate the implementation of the identification and authentication policy and associated identification and authentication controls. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IA-1 a 2 | ||
| CCI: | CCI-001935 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-05-03 |
| Definition: | The organization defines the strength of mechanism requirements for the device that is separate from the system gaining access to privileged accounts. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IA-2 (6) | ||
| CCI: | CCI-001936 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-05-03 |
| Definition: | The information system implements multifactor authentication for network access to privileged accounts such that one of the factors is provided by a device separate from the system gaining access. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IA-2 (6) | ||
| CCI: | CCI-001937 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-05-03 |
| Definition: | The device used in the information system implementation of multifactor authentication for network access to privileged accounts meets organization-defined strength of mechanism requirements. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IA-2 (6) | ||
| CCI: | CCI-001938 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-05-03 |
| Definition: | The organization defines the strength of mechanism requirements for the device that is separate from the system gaining access to non-privileged accounts. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IA-2 (7) | ||
| CCI: | CCI-001939 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-05-03 |
| Definition: | The information system implements multifactor authentication for network access to non-privileged accounts such that one of the factors is provided by a device separate from the system gaining access. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IA-2 (7) | ||
| CCI: | CCI-001940 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-05-03 |
| Definition: | The device used in the information system implementation of multifactor authentication for network access to non-privileged accounts meets organization-defined strength of mechanism requirements. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IA-2 (7) | ||
| CCI: | CCI-001942 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-05-03 |
| Definition: | The information system implements replay-resistant authentication mechanisms for network access to non-privileged accounts. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IA-2 (9) | ||
| CCI: | CCI-001947 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-05-03 |
| Definition: | The organization defines the strength of mechanism requirements for the device that is separate from the system gaining access and is to provide one factor of a multifactor authentication for remote access to privileged accounts. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IA-2 (11) | ||
| CCI: | CCI-001948 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-05-03 |
| Definition: | The information system implements multifactor authentication for remote access to privileged accounts such that one of the factors is provided by a device separate from the system gaining access. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IA-2 (11) | ||
| CCI: | CCI-001949 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-05-03 |
| Definition: | The device used in the information system implementation of multifactor authentication for remote access to privileged accounts meets organization-defined strength of mechanism requirements. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IA-2 (11) | ||
| CCI: | CCI-001950 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-05-03 |
| Definition: | The organization defines the strength of mechanism requirements for the device that is separate from the system gaining access and is to provide one factor of a multifactor authentication for remote access to non-privileged accounts. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IA-2 (11) | ||
| CCI: | CCI-001951 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-05-03 |
| Definition: | The information system implements multifactor authentication for remote access to non-privileged accounts such that one of the factors is provided by a device separate from the system gaining access. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IA-2 (11) | ||
| CCI: | CCI-001952 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-05-03 |
| Definition: | The device used in the information system implementation of multifactor authentication for remote access to non-privileged accounts meets organization-defined strength of mechanism requirements. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IA-2 (11) | ||
| CCI: | CCI-001964 | Status: | deprecated |
| Contributor: | DISA FSO | Published Date: | 2013-05-03 |
| Definition: | The organization defines the configuration management process that is to handle the device identification procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IA-3 (4) | ||
| CCI: | CCI-001979 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-05-03 |
| Definition: | The organization requires the registration process to receive an individual identifier be conducted in person before a designated registration authority. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IA-4 (7) | ||
| CCI: | CCI-001982 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-05-03 |
| Definition: | The organization manages information system authenticators by establishing administrative procedures for lost/compromised authenticators. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IA-5 d | ||
| CCI: | CCI-001983 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-05-03 |
| Definition: | The organization manages information system authenticators by establishing administrative procedures for damaged authenticators. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IA-5 d | ||
| CCI: | CCI-001986 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-05-03 |
| Definition: | The organization manages information system authenticators by implementing administrative procedures for lost/compromised authenticators. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IA-5 d | ||
| CCI: | CCI-001987 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-05-03 |
| Definition: | The organization manages information system authenticators by implementing administrative procedures for damaged authenticators. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IA-5 d | ||
| CCI: | CCI-001989 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-05-03 |
| Definition: | The organization manages information system authenticators by changing default content of authenticators prior to information system installation. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IA-5 e | ||
| CCI: | CCI-001991 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-05-03 |
| Definition: | The information system, for PKI-based authentication, implements a local cache of revocation data to support path discovery and validation in case of inability to access revocation information via the network. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IA-5 (2) (d) | ||
| CCI: | CCI-001992 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-05-03 |
| Definition: | The organization defines the personnel or roles responsible for authorizing the organization's registration authority accountable for the authenticator registration process. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IA-5 (3) | ||
| CCI: | CCI-001993 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-05-03 |
| Definition: | The organization defines the registration authority accountable for the authenticator registration process. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IA-5 (3) | ||
| CCI: | CCI-001994 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-05-03 |
| Definition: | The organization defines the types of and/or specific authenticators that are subject to the authenticator registration process. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IA-5 (3) | ||
| CCI: | CCI-001995 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-05-03 |
| Definition: | The organization requires that the registration process, to receive organization-defined types of and/or specific authenticators, be conducted in person, or by a trusted third-party, before an organization-defined registration authority with authorization by organization-defined personnel or roles. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IA-5 (3) | ||
| CCI: | CCI-001996 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-05-03 |
| Definition: | The organization defines the requirements required by the automated tools to determine if password authenticators are sufficiently strong. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IA-5 (4) | ||
| CCI: | CCI-001997 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-05-03 |
| Definition: | The organization employs automated tools to determine if password authenticators are sufficiently strong to satisfy organization-defined requirements. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IA-5 (4) | ||
| CCI: | CCI-001999 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-05-03 |
| Definition: | The organization defines the external organizations to be coordinated with for cross-organization management of credentials. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IA-5 (9) | ||
| CCI: | CCI-002000 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-05-03 |
| Definition: | The organization coordinates with organization-defined external organizations for cross-organization management of credentials. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IA-5 (9) | ||
| CCI: | CCI-002002 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-05-03 |
| Definition: | The organization defines the token quality requirements to be employed by the information system mechanisms for token-based authentication. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IA-5 (11) | ||
| CCI: | CCI-002003 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-05-03 |
| Definition: | The information system, for token-based authentication, employs mechanisms that satisfy organization-defined token quality requirements. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IA-5 (11) | ||
| CCI: | CCI-002011 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-05-03 |
| Definition: | The information system accepts FICAM-approved third-party credentials. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IA-8 (2) | ||
| CCI: | CCI-002012 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-05-03 |
| Definition: | The organization defines the information systems which will employ only FICAM-approved information system components. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IA-8 (3) | ||
| CCI: | CCI-002013 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-05-03 |
| Definition: | The organization employs only FICAM-approved information system components in organization-defined information systems to accept third-party credentials. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IA-8 (3) | ||
| CCI: | CCI-002014 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-05-03 |
| Definition: | The information system conforms to FICAM-issued profiles. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IA-8 (4) | ||
| CCI: | CCI-002017 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-05-03 |
| Definition: | The organization defines the information system services requiring identification. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IA-9 | ||
| CCI: | CCI-002019 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-05-03 |
| Definition: | The organization defines the security safeguards to be used when identifying information system services. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IA-9 | ||
| CCI: | CCI-002020 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-05-03 |
| Definition: | The organization defines the security safeguards to be used when authenticating information system services. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IA-9 | ||
| CCI: | CCI-002023 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-05-03 |
| Definition: | The organization ensures that service providers receive identification information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IA-9 (1) | ||
| CCI: | CCI-002024 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-05-03 |
| Definition: | The organization ensures that service providers validate identification information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IA-9 (1) | ||
| CCI: | CCI-002025 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-05-03 |
| Definition: | The organization ensures that service providers transmit identification information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IA-9 (1) | ||
| CCI: | CCI-002026 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-05-03 |
| Definition: | The organization ensures that service providers receive authentication information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IA-9 (1) | ||
| CCI: | CCI-002027 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-05-03 |
| Definition: | The organization ensures that service providers validate authentication information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IA-9 (1) | ||
| CCI: | CCI-002028 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-05-03 |
| Definition: | The organization ensures that service providers transmit authentication information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IA-9 (1) | ||
| CCI: | CCI-002029 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-05-03 |
| Definition: | The organization defines the services between which identification decisions are to be transmitted. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IA-9 (2) | ||
| CCI: | CCI-002030 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-05-03 |
| Definition: | The organization defines the services between which authentication decisions are to be transmitted. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IA-9 (2) | ||
| CCI: | CCI-002031 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-05-03 |
| Definition: | The organization ensures that identification decisions are transmitted between organization-defined services consistent with organizational policies. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IA-9 (2) | ||
| CCI: | CCI-002032 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-05-03 |
| Definition: | The organization ensures that authentication decisions are transmitted between organization-defined services consistent with organizational policies. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IA-9 (2) | ||
| CCI: | CCI-002037 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-05-03 |
| Definition: | The organization defines the circumstances or situations under which devices will be required to reauthenticate. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IA-11 | ||
| CCI: | CCI-002038 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-05-03 |
| Definition: | The organization requires users to reauthenticate upon organization-defined circumstances or situations requiring reauthentication. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IA-11 | ||
| CCI: | CCI-002039 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-05-03 |
| Definition: | The organization requires devices to reauthenticate upon organization-defined circumstances or situations requiring reauthentication. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IA-11 | ||
| CCI: | CCI-002040 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-05-03 |
| Definition: | The organization requires that the registration process to receive an individual identifier includes supervisor authorization. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IA-4 (2) | ||
| CCI: | CCI-002041 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-05-03 |
| Definition: | The information system allows the use of a temporary password for system logons with an immediate change to a permanent password. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IA-5 (1) (f) | ||
| CCI: | CCI-002043 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-05-03 |
| Definition: | The organization uses only FICAM-approved path discovery and validation products and services. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IA-5 (15) | ||
| CCI: | CCI-002046 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-05-29 |
| Definition: | The information system synchronizes the internal system clocks to the authoritative time source when the time difference is greater than the organization-defined time period. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AU-8 (1) (b) | ||
| CCI: | CCI-002053 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-05 |
| Definition: | The organization provides training to its personnel on organization-defined indicators of malicious code to recognize suspicious communications and anomalous behavior in organizational information systems. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AT-3 (4) | ||
| CCI: | CCI-002054 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-05 |
| Definition: | The organization defines indicators of malicious code to recognize suspicious communications and anomalous behavior in organizational information systems. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AT-3 (4) | ||
| CCI: | CCI-002060 | Status: | deprecated |
| Contributor: | DISA FSO | Published Date: | 2013-06-21 |
| Definition: | The organization develops and documents a security assessment and authorization policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CA-1 a 1 | ||
| CCI: | CCI-002063 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-21 |
| Definition: | The organization defines the level of independence for assessors or assessment teams to conduct security control assessments of organizational information systems. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CA-2 (1) | ||
| CCI: | CCI-002064 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-21 |
| Definition: | The organization selects one or more security assessment techniques to be conducted. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CA-2 (2) | ||
| CCI: | CCI-002072 | Status: | draft |
| Contributor: | DISA FSP | Published Date: | 2013-06-21 |
| Definition: | The organization defines the unclassified, national security systems that are prohibited from directly connecting to an external network without the use of an organization-defined boundary protection device. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CA-3 (1) | ||
| CCI: | CCI-002073 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-21 |
| Definition: | The organization defines the boundary protection device to be used to connect organization-defined unclassified, national security systems to an external network. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CA-3 (1) | ||
| CCI: | CCI-002074 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-21 |
| Definition: | The organization defines the boundary protection device to be used for the direct connection of classified, national security system to an external network. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CA-3 (2) | ||
| CCI: | CCI-002075 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-21 |
| Definition: | The organization prohibits the direct connection of an organization-defined unclassified, non-national security system to an external network without the use of organization-defined boundary protection device. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CA-3 (3) | ||
| CCI: | CCI-002076 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-21 |
| Definition: | The organization defines the unclassified, non-national security system that is prohibited from directly connecting to an external network without the use of an organization-defined boundary protection device. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CA-3 (3) | ||
| CCI: | CCI-002077 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-21 |
| Definition: | The organization defines the boundary protection device to be used to directly connect an organization-defined unclassified, non-national security system to an external network. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CA-3 (3) | ||
| CCI: | CCI-002078 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-21 |
| Definition: | The organization prohibits the direct connection of an organization-defined information system to a public network. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CA-3 (4) | ||
| CCI: | CCI-002079 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-21 |
| Definition: | The organization defines the information system that is prohibited from directly connecting to a public network. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CA-3 (4) | ||
| CCI: | CCI-002080 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-21 |
| Definition: | The organization employs either an allow-all, deny-by-exception or a deny-all, permit-by-exception policy for allowing organization-defined information systems to connect to external information systems. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CA-3 (5) | ||
| CCI: | CCI-002081 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-21 |
| Definition: | The organization defines the information systems that employ either an allow-all, deny-by-exception or a deny-all, permit-by-exception policy for allowing connections to external information systems. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CA-3 (5) | ||
| CCI: | CCI-002082 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-21 |
| Definition: | The organization selects either an allow-all, deny-by-exception or a deny-all, permit-by-exception policy for allowing organization-defined information systems to connect to external information systems. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CA-3 (5) | ||
| CCI: | CCI-002085 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-21 |
| Definition: | The organization defines the level of independence the assessors or assessment teams must have to monitor the security controls in the information system on an ongoing basis. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CA-7 (1) | ||
| CCI: | CCI-002089 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-21 |
| Definition: | The organization establishes and defines the frequencies for assessments supporting continuous monitoring. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CA-7 b | ||
| CCI: | CCI-002098 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-21 |
| Definition: | The organization defines rules of engagement for red team exercises to simulate attempts by adversaries to compromise organizational information systems. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): CA-8 (2) | ||
| CCI: | CCI-002106 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | The organization documents the access control policy. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-1 a 1 | ||
| CCI: | CCI-002109 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | The organization documents procedures to facilitate the implementation of the access control policy and associated access controls. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-1 a 2 | ||
| CCI: | CCI-002110 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | The organization defines the information system account types that support the organizational missions/business functions. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-2 a | ||
| CCI: | CCI-002111 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | The organization identifies and selects the organization-defined information system account types of information system accounts which support organizational missions/business functions. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-2 a | ||
| CCI: | CCI-002113 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | The organization establishes conditions for role membership. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-2 c | ||
| CCI: | CCI-002114 | Status: | deprecated |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | The organization specifies authorized users of the information system for each account. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-2 d | ||
| CCI: | CCI-002131 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | The organization defines the personnel or roles to be notified on account creation, modification, enabling, disabling, and removal actions. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-2 (4) | ||
| CCI: | CCI-002132 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | The information system notifies organization-defined personnel or roles for account enabling actions. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-2 (4) | ||
| CCI: | CCI-002136 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | The organization defines the actions to be taken when privileged role assignments are no longer appropriate. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-2 (7) (c) | ||
| CCI: | CCI-002142 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | The information system terminates shared/group account credentials when members leave the group. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-2 (10) | ||
| CCI: | CCI-002167 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | The organization defines the subjects over which the information system will enforce a role-based access control policy. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-3 (7) | ||
| CCI: | CCI-002168 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | The organization defines the objects over which the information system will enforce a role-based access control policy. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-3 (7) | ||
| CCI: | CCI-002171 | Status: | deprecated |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | The information system enforces a role-based access control policy over organization-defined subjects. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-3 (7) | ||
| CCI: | CCI-002172 | Status: | deprecated |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | The information system enforces a role-based access control policy over organization-defined objects. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-3 (7) | ||
| CCI: | CCI-002175 | Status: | deprecated |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | The information system controls access based upon organization-defined roles authorized to assume such roles, employing the organization-defined role-based access control policy. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-3 (7) | ||
| CCI: | CCI-002176 | Status: | deprecated |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | The information system controls access based upon organization-defined users authorized to assume such roles, employing the organization-defined role-based access control policy. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-3 (7) | ||
| CCI: | CCI-002206 | Status: | deprecated |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | The information system uniquely authenticates source by organization, system, application, and/or individual for information transfer. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-4 (17) | ||
| CCI: | CCI-002208 | Status: | deprecated |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | The information system uniquely authenticates destination by organization, system, application, and/or individual for information transfer. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-4 (17) | ||
| CCI: | CCI-002209 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | The organization defines the techniques to be used to bind security attributes to information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-4 (18) | ||
| CCI: | CCI-002210 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | The information system binds security attributes to information using organization-defined binding techniques to facilitate information flow policy enforcement. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-4 (18) | ||
| CCI: | CCI-002251 | Status: | deprecated |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | The information system notifies the user, upon successful logon (access), of the date and time of the last logon (access). | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-9 (4) | ||
| CCI: | CCI-002253 | Status: | deprecated |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | The organization defines the account types for which the information system will limit the number of concurrent sessions. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-10 | ||
| CCI: | CCI-002254 | Status: | deprecated |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | The organization defines the conditions or trigger events requiring session disconnect to be employed by the information system when automatically terminating a user session. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-12 | ||
| CCI: | CCI-002255 | Status: | deprecated |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | The organization defines the user actions that can be performed on the information system without identification and authentication. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-14 a | ||
| CCI: | CCI-002276 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | The organization identifies the individuals authorized to define the value of associated security attributes. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-16 (2) | ||
| CCI: | CCI-002285 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | The organization identifies individuals (or processes acting on behalf of individuals) authorized to associate organization-defined security attributes with organization-defined subjects. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-16 (4) | ||
| CCI: | CCI-002305 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | The organization identifies individuals authorized to define or change the type and value of security attributes available for association with subjects and objects. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-16 (10) | ||
| CCI: | CCI-002313 | Status: | deprecated |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | The information system controls remote access methods. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-17 (1) | ||
| CCI: | CCI-002315 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | The organization defines the number of managed network access control points through which the information system routes all remote access. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-17 (3) | ||
| CCI: | CCI-002333 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | The organization permits authorized individuals to use an external information system to access the information system only when the organization verifies the implementation of required security controls on the external system as specified in the organization's information security policy and security plan. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-20 (1) (a) | ||
| CCI: | CCI-002334 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | The organization permits authorized individuals to use an external information system to process organization-controlled information only when the organization verifies the implementation of required security controls on the external system as specified in the organization's information security policy and security plan. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-20 (1) (a) | ||
| CCI: | CCI-002335 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | The organization permits authorized individuals to use an external information system to store organization-controlled information only when the organization verifies the implementation of required security controls on the external system as specified in the organization's information security policy and security plan. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-20 (1) (a) | ||
| CCI: | CCI-002336 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-24 |
| Definition: | The organization permits authorized individuals to use an external information system to transmit organization-controlled information only when the organization verifies the implementation of required security controls on the external system as specified in the organization's information security policy and security plan. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AC-20 (1) (a) | ||
| CCI: | CCI-002365 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-26 |
| Definition: | The organization manages information system authenticators by requiring individuals to take specific security safeguards to protect authenticators. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IA-5 i | ||
| CCI: | CCI-002366 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-26 |
| Definition: | The organization manages information system authenticators by having devices implement specific security safeguards to protect authenticators. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IA-5 i | ||
| CCI: | CCI-002367 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-06-26 |
| Definition: | The organization ensures unencrypted static authenticators are not embedded in applications. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IA-5 (7) | ||
| CCI: | CCI-002377 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | The organization documents the system and communications protection policy. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-1 a 1 | ||
| CCI: | CCI-002379 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | The organization documents procedures to facilitate the implementation of the system and communications protection policy and associated system and communications protection controls. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-1 a 2 | ||
| CCI: | CCI-002386 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | The organization defines the security safeguards to be employed to protect the information system against, or limit the effects of, denial of service attacks. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-5 | ||
| CCI: | CCI-002412 | Status: | deprecated |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | The organization defines the information system components supporting organization-defined missions and/or business functions that are to be separated using boundary protection mechanisms. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-7 (21) | ||
| CCI: | CCI-002419 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | The organization defines the alternative physical safeguards to be employed when cryptographic mechanisms are not implemented to protect information during transmission. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-8 (1) | ||
| CCI: | CCI-002491 | Status: | deprecated |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | The organization changes the location of organization-defined processing and/or storage at an organization-defined time frequency or at random time intervals. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-30 (3) | ||
| CCI: | CCI-002558 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-02 |
| Definition: | The organization prohibits the use of devices possessing organization-defined environmental sensing capabilities in organization-defined facilities, areas, or systems. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-42 (3) | ||
| CCI: | CCI-002588 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-09 |
| Definition: | The organization employs organization-defined tests of downgrading equipment in accordance with organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): MP-8 (2) | ||
| CCI: | CCI-002589 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-09 |
| Definition: | The organization employs procedures to verify correct performance of organization-defined tests of downgrading equipment in accordance with organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): MP-8 (2) | ||
| CCI: | CCI-002590 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-09 |
| Definition: | The organization defines tests to employ for downgrading equipment. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): MP-8 (2) | ||
| CCI: | CCI-002592 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-09 |
| Definition: | The organization defines Controlled Unclassified Information (CUI). | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): MP-8 (3) | ||
| CCI: | CCI-002595 | Status: | deprecated |
| Contributor: | DISA FSO | Published Date: | 2013-07-09 |
| Definition: | The organization establishes an organization-defined information system media downgrading process that includes employing downgrading mechanisms with organization-defined strength and integrity. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): MP-8 a | ||
| CCI: | CCI-002596 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-09 |
| Definition: | The organization establishes and defines an information system media downgrading process that includes employing downgrading mechanisms with organization-defined strength and integrity. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): MP-8 a | ||
| CCI: | CCI-002597 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-09 |
| Definition: | The organization defines strength and integrity for downgrading mechanisms to establish an organization-defined information system media downgrading process. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): MP-8 a | ||
| CCI: | CCI-002598 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-09 |
| Definition: | The organization ensures that the information system media downgrading process is commensurate with the security category and/or classification level of the information to be removed and the access authorizations of the potential recipients of the downgraded information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): MP-8 b | ||
| CCI: | CCI-002599 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-09 |
| Definition: | The organization defines and identifies the information system media requiring downgrading. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): MP-8 c | ||
| CCI: | CCI-002619 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | The organization employs malicious code protection mechanisms at information system entry points to detect malicious code. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-3 a | ||
| CCI: | CCI-002620 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | The organization employs malicious code protection mechanisms at information system exit points to detect malicious code. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-3 a | ||
| CCI: | CCI-002621 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | The organization employs malicious code protection mechanisms at information system entry points to eradicate malicious code. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-3 a | ||
| CCI: | CCI-002622 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | The organization employs malicious code protection mechanisms at information system exit points to eradicate malicious code. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-3 a | ||
| CCI: | CCI-002627 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | The information system implements nonsignature-based malicious code detection mechanisms. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-3 (7) | ||
| CCI: | CCI-002632 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | The organization defines the remote commands that are to be authenticated using organization-defined safeguards for malicious code protection. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-3 (9) | ||
| CCI: | CCI-002633 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | The organization defines the security safeguards to be implemented to authenticate organization-defined remote commands for malicious code protection. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-3 (9) | ||
| CCI: | CCI-002637 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | The information system implements organization-defined security safeguards to authenticate organization-defined remote commands for malicious code protection. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-3 (9) | ||
| CCI: | CCI-002647 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | The organization protects information obtained from intrusion-monitoring tools from unauthorized access. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-4 d | ||
| CCI: | CCI-002648 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | The organization protects information obtained from intrusion-monitoring tools from unauthorized modification. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-4 d | ||
| CCI: | CCI-002649 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | The organization protects information obtained from intrusion-monitoring tools from unauthorized deletion. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-4 d | ||
| CCI: | CCI-002653 | Status: | deprecated |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | The organization provides organization-defined information system monitoring information to organization-defined personnel or roles as needed or per organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-4 | ||
| CCI: | CCI-002691 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | The information system uses indicators of compromise. | ||
| Type: | technical | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-4 (24) | ||
| CCI: | CCI-002730 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | The organization defines the user-installed software that is to be executed in a confined physical or virtual machine environment with limited privileges. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-7 (11) | ||
| CCI: | CCI-002731 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | The organization requires that organization-defined user-installed software execute in a confined physical or virtual machine environment with limited privileges. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-7 (11) | ||
| CCI: | CCI-002735 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | The organization allows execution of binary or machine-executable code obtained from sources with limited or no warranty and without the provision of source code only in confined physical or virtual machine environments. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-7 (13) | ||
| CCI: | CCI-002736 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | The organization allows execution of binary or machine-executable code obtained from sources with limited or no warranty and without the provision of source code only with the explicit approval of organization-defined personnel or roles. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-7 (13) | ||
| CCI: | CCI-002737 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | The organization prohibits the use of binary or machine-executable code from sources with limited or no warranty and without the provision of source code. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-7 (14) (a) | ||
| CCI: | CCI-002738 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | The organization provides exceptions to the source code requirement only for compelling mission/operational requirements and with the approval of the authorizing official. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-7 (14) (b) | ||
| CCI: | CCI-002772 | Status: | deprecated |
| Contributor: | DISA FSO | Published Date: | 2013-07-11 |
| Definition: | The organization defines the security safeguards to be implemented to protect the information system's memory from unauthorized code execution. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SI-15 | ||
| CCI: | CCI-002783 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-12 |
| Definition: | The organization coordinates an incident handling capability for insider threats across organization-defined components or elements of the organization. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IR-4 (7) | ||
| CCI: | CCI-002784 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-12 |
| Definition: | The organization defines components or elements of the organization across which an incident handling capability for insider threats will be coordinated. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IR-4 (7) | ||
| CCI: | CCI-002813 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-12 |
| Definition: | The organization assigns organization-defined personnel or roles with responsibility for responding to information spills. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IR-9 (1) | ||
| CCI: | CCI-002814 | Status: | deprecated |
| Contributor: | DISA FSO | Published Date: | 2013-07-12 |
| Definition: | The organization assigns organization-defined personnel or roles with responsibility for responding to information spills. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IR-9 (1) | ||
| CCI: | CCI-002815 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-12 |
| Definition: | The organization defines personnel or roles to whom responsibility for responding to information spills will be assigned. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IR-9 (1) | ||
| CCI: | CCI-002822 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-12 |
| Definition: | The organization establishes an integrated team of forensic/malicious code analysts, tool developers, and real-time operations personnel. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IR-10 | ||
| CCI: | CCI-002863 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-22 |
| Definition: | The organization employs automated mechanisms to schedule, conduct, and document repairs. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): MA-2 (2) (a) | ||
| CCI: | CCI-002867 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-22 |
| Definition: | The organization performs maintenance on information system components in accordance with manufacturer or vendor specifications and/or organizational requirements. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): MA-2 a | ||
| CCI: | CCI-002871 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-22 |
| Definition: | The organization performs repairs on information system components in accordance with manufacturer or vendor specifications and/or organizational requirements. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): MA-2 a | ||
| CCI: | CCI-002877 | Status: | deprecated |
| Contributor: | DISA FSO | Published Date: | 2013-07-22 |
| Definition: | The organization prevents the unauthorized removal of maintenance equipment containing organizational information by verifying that there is no organizational information contained on the equipment. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): MA-3 (3) (a) | ||
| CCI: | CCI-002878 | Status: | deprecated |
| Contributor: | DISA FSO | Published Date: | 2013-07-22 |
| Definition: | The organization prevents the unauthorized removal of maintenance equipment containing organizational information by sanitizing or destroying the equipment. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): MA-3 (3) (b) | ||
| CCI: | CCI-002879 | Status: | deprecated |
| Contributor: | DISA FSO | Published Date: | 2013-07-22 |
| Definition: | The organization prevents the unauthorized removal of maintenance equipment containing organizational information by retaining the equipment within the facility. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): MA-3 (3) (c) | ||
| CCI: | CCI-002880 | Status: | deprecated |
| Contributor: | DISA FSO | Published Date: | 2013-07-22 |
| Definition: | The organization prevents the unauthorized removal of maintenance equipment containing organizational information by retaining the equipment within the facility. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): MA-3 (3) (c) | ||
| CCI: | CCI-002881 | Status: | deprecated |
| Contributor: | DISA FSO | Published Date: | 2013-07-22 |
| Definition: | The organization prevents the unauthorized removal of maintenance equipment containing organizational information by obtaining an exemption from organization-defined personnel or roles explicitly authorizing removal of the equipment from the facility. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): MA-3 (3) (d) | ||
| CCI: | CCI-002892 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-07-22 |
| Definition: | The organization develops and implements alternate security safeguards in the event an information system component cannot be sanitized, removed, or disconnected from the system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): MA-5 (1) (b) | ||
| CCI: | CCI-002905 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-08-12 |
| Definition: | The organization employs automated mechanisms to schedule, conduct, and document maintenance. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): MA-2 (2) (a) | ||
| CCI: | CCI-002932 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-08-27 |
| Definition: | The organization controls physical access to output from organization-defined output devices. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PE-5 (1) (a) | ||
| CCI: | CCI-002933 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-08-27 |
| Definition: | The organization defines output devices for which physical access to output is controlled. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PE-5 (1) (a) | ||
| CCI: | CCI-002934 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-08-27 |
| Definition: | The organization ensures that only authorized individuals receive output from organization-defined output devices. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PE-5 (1) (b) | ||
| CCI: | CCI-002935 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-08-27 |
| Definition: | The information system controls physical access to output from organization-defined output devices. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PE-5 (2) (a) | ||
| CCI: | CCI-002936 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-08-27 |
| Definition: | The information system links individual identity to receipt of output from organization-defined output devices. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PE-5 (2) (b) | ||
| CCI: | CCI-002937 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-08-27 |
| Definition: | The organization marks organization-defined information system output devices indicating the appropriate security marking of the information permitted to be output from the device. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PE-5 (3) | ||
| CCI: | CCI-002938 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-08-27 |
| Definition: | The organization defines the information system output devices marked indicating the appropriate security marking of the information permitted to be output from the device. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PE-5 (3) | ||
| CCI: | CCI-002972 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-08-29 |
| Definition: | The organization employs automated mechanisms to detect the presence of water in the vicinity of the information system and alerts organization-defined personnel or roles. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PE-15 (1) | ||
| CCI: | CCI-002977 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-08-29 |
| Definition: | The organization plans the location or site of the facility where the information system resides with regard to physical and environmental hazards. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PE-18 (1) | ||
| CCI: | CCI-002978 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-08-29 |
| Definition: | The organization considers the physical and environmental hazards in its risk mitigation strategy for existing facilities. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PE-18 (1) | ||
| CCI: | CCI-002983 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-08-29 |
| Definition: | The organization ensures that asset location technologies are employed in accordance with applicable federal laws, Executive Orders, directives, regulations, policies, standards, and guidance. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PE-20 b | ||
| CCI: | CCI-002992 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-08-29 |
| Definition: | The organization implements a process for ensuring that plans of action and milestones for the security program and associated organizational information systems are reported in accordance with OMB FISMA reporting requirements. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PM-4 a 3 | ||
| CCI: | CCI-003016 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-12 |
| Definition: | The organization, upon termination of individual employment, notifies organization-defined personnel or roles within an organization-defined time period. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PS-4 f | ||
| CCI: | CCI-003025 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-12 |
| Definition: | The organization defines personnel or roles to notify upon termination of individual employment. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PS-4 f | ||
| CCI: | CCI-003026 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-12 |
| Definition: | The organization defines the time period within which to notify organization-defined personnel or roles upon termination of individual employment. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PS-4 f | ||
| CCI: | CCI-003036 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-12 |
| Definition: | The organization ensures that individuals requiring access to organizational information and information systems re-sign access agreements to maintain access to organizational information systems when access agreements have been updated or in accordance with organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PS-6 c 2 | ||
| CCI: | CCI-003037 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-12 |
| Definition: | The organization defines the frequency for individuals requiring access to organization information and information systems to re-sign access agreements. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PS-6 c 2 | ||
| CCI: | CCI-003040 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-12 |
| Definition: | The organization requires third-party providers to comply with personnel security policies and procedures established by the organization. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PS-7 b | ||
| CCI: | CCI-003058 | Status: | deprecated |
| Contributor: | DISA FSO | Published Date: | 2013-09-23 |
| Definition: | The organization distributes copies of the security plan to organization-defined personnel or roles. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PL-2 b | ||
| CCI: | CCI-003065 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-23 |
| Definition: | The organization plans and coordinates security-related activities affecting the information system with organization-defined individuals or groups before conducting such activities in order to reduce the impact on other organizational entities. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PL-2 (3) | ||
| CCI: | CCI-003066 | Status: | deprecated |
| Contributor: | DISA FSO | Published Date: | 2013-09-23 |
| Definition: | The organization defines the individuals or groups with whom security-related activities are planned and coordinated. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PL-2 (3) | ||
| CCI: | CCI-003067 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-23 |
| Definition: | The organization defines the individuals or groups with whom security-related activities are planned and coordinated. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): PL-2 (3) | ||
| CCI: | CCI-003107 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-23 |
| Definition: | The organization requires the developer of the information system, system component, or information system service to demonstrate the use of a system development life cycle that includes organization-defined state-of-the-practice system/security engineering methods, software development methods, testing/evaluation/validation techniques, and quality control processes. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-4 (3) | ||
| CCI: | CCI-003108 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-23 |
| Definition: | The organization defines the state-of-the-practice system/security engineering methods, software development methods, testing/evaluation/validation techniques, and quality control processes that the developer of the information system, system component, or information system service is required to include when demonstrating the use of a system development life cycle. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-4 (3) | ||
| CCI: | CCI-003113 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-23 |
| Definition: | The organization defines the level of detail to be contained in the plan for the continuous monitoring of security control effectiveness that the developer of the information system, system component, or information system services is required to produce. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-4 (8) | ||
| CCI: | CCI-003115 | Status: | deprecated |
| Contributor: | DISA FSO | Published Date: | 2013-09-23 |
| Definition: | The organization requires the developer of the information system, system component, or information system service to identify early in the system development life cycle, the functions, ports, protocols, and services intended for organizational use. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-4 (9) | ||
| CCI: | CCI-003134 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | The organization protects information system, system component, or information system service documentation as required, in accordance with the risk management strategy. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-5 d | ||
| CCI: | CCI-003137 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | The organization defines security controls that providers of external information system services employ in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-9 a | ||
| CCI: | CCI-003190 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | The organization requires the developer of the information system, system component, or information system service to perform penetration testing at an organization-defined breadth/depth and with organization-defined constraints. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-11 (5) | ||
| CCI: | CCI-003198 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | The organization employs organization-defined tailored acquisition strategies, contract tools, and procurement methods for the purchase of the information system, system component, or information system service from suppliers. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-12 (1) | ||
| CCI: | CCI-003199 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | The organization defines tailored acquisition strategies, contract tools, and procurement methods to employ for the purchase of the information system, system component, or information system service from suppliers. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-12 (1) | ||
| CCI: | CCI-003200 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | The organization conducts a supplier review prior to entering into a contractual agreement to acquire the information system, system component, or information system service. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-12 (2) | ||
| CCI: | CCI-003201 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | The organization employs organization-defined security safeguards to limit harm from potential adversaries identifying and targeting the organizational supply chain. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-12 (5) | ||
| CCI: | CCI-003202 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | The organization defines security safeguards to employ to limit harm from potential adversaries identifying and targeting the organizational supply chain. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-12 (5) | ||
| CCI: | CCI-003203 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | The organization conducts an assessment of the information system, system component, or information system service prior to selection, acceptance, or update. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-12 (7) | ||
| CCI: | CCI-003204 | Status: | deprecated |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | The organization conducts an assessment of the information system, system component, or information system service prior to selection, acceptance, or update. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-12 (7) | ||
| CCI: | CCI-003205 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | The organization uses all-source intelligence analysis of suppliers and potential suppliers of the information system, system component, or information system service. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-12 (8) | ||
| CCI: | CCI-003206 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | The organization employs organization-defined Operations Security (OPSEC) safeguards in accordance with classification guides to protect supply chain-related information for the information system, system component, or information system service. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-12 (9) | ||
| CCI: | CCI-003207 | Status: | deprecated |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | The organization employs organization-defined tailored acquisition strategies, contract tools, and procurement methods for the purchase of the information system, system component, or information system service from suppliers. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-12 (1) | ||
| CCI: | CCI-003208 | Status: | deprecated |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | The organization employs organization-defined tailored acquisition strategies, contract tools, and procurement methods for the purchase of the information system, system component, or information system service from suppliers. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-12 (1) | ||
| CCI: | CCI-003209 | Status: | deprecated |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | The organization employs organization-defined tailored acquisition strategies, contract tools, and procurement methods for the purchase of the information system, system component, or information system service from suppliers. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-12 (1) | ||
| CCI: | CCI-003210 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | The organization defines the Operations Security (OPSEC) safeguards to be employed in accordance with classification guides to protect supply chain-related information for the information system, system component, or information system service. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-12 (9) | ||
| CCI: | CCI-003211 | Status: | deprecated |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | The organization defines the Operations Security (OPSEC) safeguards to be employed in accordance with classification guides to protect supply chain-related information for the information system, system component, or information system service. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-12 (9) | ||
| CCI: | CCI-003212 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | The organization employs organization-defined security safeguards to validate that the information system or system component received is genuine and has not been altered. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-12 (10) | ||
| CCI: | CCI-003213 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | The organization defines the security safeguards to be employed to validate that the information system or system component received is genuine and has not been altered. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-12 (10) | ||
| CCI: | CCI-003214 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | The organization employs organizational analysis, independent third-party analysis, organizational penetration testing and/or independent third-party penetration testing of organization-defined supply chain elements, processes, and actors associated with the information system, system component, or information system service. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-12 (11) | ||
| CCI: | CCI-003215 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | The organization defines the supply chain elements, processes, and actors associated with the information system, system component, or information system service for organizational analysis, independent third-party analysis, organizational penetration testing and/or independent third-party penetration testing. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-12 (11) | ||
| CCI: | CCI-003216 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | The organization establishes inter-organizational agreements with entities involved in the supply chain for the information system, system component, or information system service. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-12 (12) | ||
| CCI: | CCI-003217 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | The organization establishes inter-organizational procedures with entities involved in the supply chain for the information system, system component, or information system service. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-12 (12) | ||
| CCI: | CCI-003218 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | The organization employs organization-defined security safeguards to ensure an adequate supply of organization-defined critical information system components. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-12 (13) | ||
| CCI: | CCI-003219 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | The organization defines the security safeguards to be employed to ensure an adequate supply of organization-defined critical information system components. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-12 (13) | ||
| CCI: | CCI-003220 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | The organization defines the critical information system components for which organization-defined security safeguards are employed to ensure adequate supply. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-12 (13) | ||
| CCI: | CCI-003221 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | The organization establishes unique identification of organization-defined supply chain elements, processes, and actors for the information system, system component, or information system service. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-12 (14) | ||
| CCI: | CCI-003222 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | The organization retains unique identification of organization-defined supply chain elements, processes, and actors for the information system, system component, or information system service. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-12 (14) | ||
| CCI: | CCI-003223 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | The organization defines the supply chain elements, processes, and actors for the information system, system component, or information system service to establish and retain unique identification. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-12 (14) | ||
| CCI: | CCI-003224 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | The organization establishes a process to address weaknesses or deficiencies in supply chain elements identified during independent or organizational assessments of such elements. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-12 (15) | ||
| CCI: | CCI-003225 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | The organization describes the trustworthiness required in the organization-defined information system, information system component, or information system service supporting its critical missions/business functions. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-13 a | ||
| CCI: | CCI-003226 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | The organization defines the information system, information system component, or information system service supporting its critical missions/business functions in which the trustworthiness must be described. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-13 a | ||
| CCI: | CCI-003227 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | The organization implements an organization-defined assurance overlay to achieve trustworthiness required to support its critical missions/business functions. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-13 b | ||
| CCI: | CCI-003228 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | The organization defines an assurance overlay to be implemented to achieve trustworthiness required to support its critical missions/business functions. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-13 b | ||
| CCI: | CCI-003229 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | The organization identifies critical information system components by performing a criticality analysis for organization-defined information systems, information system components, or information system services at organization-defined decision points in the system development life cycle. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-14 | ||
| CCI: | CCI-003230 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | The organization identifies critical information system functions by performing a criticality analysis for organization-defined information systems, information system components, or information system services at organization-defined decision points in the system development life cycle. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-14 | ||
| CCI: | CCI-003231 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | The organization defines the information systems, information system components, or information system services for which the organization identifies critical information system components and functions for criticality analysis. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-14 | ||
| CCI: | CCI-003232 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | The organization defines the decision points in the system development life cycle at which to perform a criticality analysis to identify critical information system components and functions for organization-defined information systems, information system components, or information system services. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-14 | ||
| CCI: | CCI-003253 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | The organization requires the developer of the information system, system component, or information system service to perform a criticality analysis at an organization-defined breadth/depth and at organization-defined decision points in the system development life cycle. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-15 (3) | ||
| CCI: | CCI-003256 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | The organization requires that developers perform threat modeling for the information system at an organization-defined breadth/depth. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-15 (4) | ||
| CCI: | CCI-003257 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | The organization requires that developers perform a vulnerability analysis for the information system at an organization-defined breadth/depth. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-15 (4) | ||
| CCI: | CCI-003258 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | The organization defines the breadth/depth at which threat modeling for the information system must be performed by developers. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-15 (4) | ||
| CCI: | CCI-003259 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | The organization defines the breadth/depth at which vulnerability analysis for the information system must be performed by developers. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-15 (4) | ||
| CCI: | CCI-003260 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | Threat modeling performed by the developer for the information system uses organization-defined information concerning impact, environment of operations, known or assumed threats, and acceptable risk levels. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-15 (4) (a) | ||
| CCI: | CCI-003261 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | Vulnerability analysis performed by the developer for the information system uses organization-defined information concerning impact, environment of operations, known or assumed threats, and acceptable risk levels. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-15 (4) (a) | ||
| CCI: | CCI-003262 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | The organization defines information concerning impact, environment of operations, known or assumed threats, and acceptable risk levels to be used to perform threat modeling for the information system by the developer. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-15 (4) (a) | ||
| CCI: | CCI-003263 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | The organization defines information concerning impact, environment of operations, known or assumed threats, and acceptable risk levels to be used to perform a vulnerability analysis for the information system by the developer. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-15 (4) (a) | ||
| CCI: | CCI-003264 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | The organization requires the threat modeling performed by the developers employ organization-defined tools and methods. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-15 (4) (b) | ||
| CCI: | CCI-003265 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | The organization requires the vulnerability analysis performed by the developers employ organization-defined tools and methods. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-15 (4) (b) | ||
| CCI: | CCI-003266 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | The organization defines tools and methods to be employed to perform threat modeling for the information system by the developer. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-15 (4) (b) | ||
| CCI: | CCI-003267 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | The organization defines tools and methods to be employed to perform a vulnerability analysis for the information system by the developer. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-15 (4) (b) | ||
| CCI: | CCI-003268 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | The organization requires that developers performing threat modeling for the information system produce evidence that meets organization-defined acceptance criteria. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-15 (4) (c) | ||
| CCI: | CCI-003269 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | The organization requires that developers performing vulnerability analysis for the information system produce evidence that meets organization-defined acceptance criteria. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-15 (4) (c) | ||
| CCI: | CCI-003270 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-09-30 |
| Definition: | The organization defines the acceptance criteria that must be met when threat modeling of the information system is performed by the developer. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-15 (4) (c) | ||
| CCI: | CCI-003271 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | The organization defines the acceptance criteria that must be met when vulnerability analysis of the information system is performed by the developer. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-15 (4) (c) | ||
| CCI: | CCI-003283 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | The organization approves the use of live data in development environments for the information system, system component, or information system service. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-15 (9) | ||
| CCI: | CCI-003284 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | The organization approves the use of live data in test environments for the information system, system component, or information system service. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-15 (9) | ||
| CCI: | CCI-003285 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | The organization documents the use of live data in development environments for the information system, system component, or information system service. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-15 (9) | ||
| CCI: | CCI-003286 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | The organization documents the use of live data in test environments for the information system, system component, or information system service. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-15 (9) | ||
| CCI: | CCI-003287 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | The organization controls the use of live data in development environments for the information system, system component, or information system service. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-15 (9) | ||
| CCI: | CCI-003288 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | The organization controls the use of live data in test environments for the information system, system component, or information system service. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-15 (9) | ||
| CCI: | CCI-003302 | Status: | deprecated |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | The organization requires the developer of the information system, system component, or information system service to define security-relevant hardware. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-17 (2) (a) | ||
| CCI: | CCI-003346 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | The organization implements a tamper protection program for the information system, system component, or information system service. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-18 | ||
| CCI: | CCI-003347 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | The organization employs anti-tamper technologies and techniques during multiple phases in the system development life cycle including design. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-18 (1) | ||
| CCI: | CCI-003348 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | The organization employs anti-tamper technologies and techniques during multiple phases in the system development life cycle including development. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-18 (1) | ||
| CCI: | CCI-003349 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | The organization employs anti-tamper technologies and techniques during multiple phases in the system development life cycle including integration. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-18 (1) | ||
| CCI: | CCI-003350 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | The organization employs anti-tamper technologies and techniques during multiple phases in the system development life cycle including operations. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-18 (1) | ||
| CCI: | CCI-003351 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | The organization employs anti-tamper technologies and techniques during multiple phases in the system development life cycle including maintenance. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-18 (1) | ||
| CCI: | CCI-003352 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | The organization inspects organization-defined information systems, system components, or devices at random, at an organization-defined frequency, and/or upon organization-defined indications of need for inspection to detect tampering. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-18 (2) | ||
| CCI: | CCI-003353 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | The organization defines the information systems, system components, or devices to inspect at random, at an organization-defined frequency, and/or upon organization-defined indications of need for inspection to detect tampering. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-18 (2) | ||
| CCI: | CCI-003354 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | The organization defines the frequency on which to inspect organization-defined information systems, system components, or devices to detect tampering. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-18 (2) | ||
| CCI: | CCI-003355 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | The organization defines indications of need for inspection to detect tampering during inspections of organization-defined information systems, system components, or devices. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-18 (2) | ||
| CCI: | CCI-003356 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | The organization develops an anti-counterfeit policy that includes the means to detect counterfeit components from entering the information system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-19 a | ||
| CCI: | CCI-003357 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | The organization develops an anti-counterfeit policy that includes the means to prevent counterfeit components from entering the information system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-19 a | ||
| CCI: | CCI-003358 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | The organization develops anti-counterfeit procedures that include the means to detect counterfeit components from entering the information system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-19 a | ||
| CCI: | CCI-003359 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | The organization develops anti-counterfeit procedures that include the means to prevent counterfeit components from entering the information system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-19 a | ||
| CCI: | CCI-003360 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | The organization implements an anti-counterfeit policy that includes the means to detect counterfeit components from entering the information system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-19 a | ||
| CCI: | CCI-003361 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | The organization implements an anti-counterfeit policy that includes the means to prevent counterfeit components from entering the information system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-19 a | ||
| CCI: | CCI-003362 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | The organization implements anti-counterfeit procedures that include the means to detect counterfeit components from entering the information system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-19 a | ||
| CCI: | CCI-003363 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | The organization implements anti-counterfeit procedures that include the means to prevent counterfeit components from entering the information system. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-19 a | ||
| CCI: | CCI-003364 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | The organization reports counterfeit information system components to the source of the counterfeit component, organization-defined external reporting organizations, and/or organization-defined personnel or roles. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-19 b | ||
| CCI: | CCI-003365 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | The organization defines the external reporting organizations to which counterfeit information system components are to be reported. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-19 b | ||
| CCI: | CCI-003366 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | The organization defines the personnel or roles to whom counterfeit information system components are to be reported. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-19 b | ||
| CCI: | CCI-003367 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | The organization trains organization-defined personnel or roles to detect counterfeit information system components (including hardware, software, and firmware). | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-19 (1) | ||
| CCI: | CCI-003368 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | The organization defines the personnel or roles to be trained to detect counterfeit information system components (including hardware, software, and firmware). | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-19 (1) | ||
| CCI: | CCI-003369 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | The organization maintains configuration control over organization-defined information system components awaiting service/repair. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-19 (2) | ||
| CCI: | CCI-003370 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | The organization defines the information system components awaiting service/repair over which configuration control must be maintained. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-19 (2) | ||
| CCI: | CCI-003371 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | The organization maintains configuration control over serviced/repaired components awaiting return to service. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-19 (2) | ||
| CCI: | CCI-003374 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | The organization documents approval for the continued use of unsupported system components required to satisfy mission/business needs. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-22 b | ||
| CCI: | CCI-003375 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | The organization provides justification for the continued use of unsupported system components required to satisfy mission/business needs. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-22 b | ||
| CCI: | CCI-003377 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | The organization defines the actions the developer of the information system, system component, or information system service must take to ensure the required screening criteria are satisfied. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-21 (1) | ||
| CCI: | CCI-003378 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | The organization defines the actions the developer of the information system, system component, or information system service must take to ensure the required access authorizations are satisfied. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-21 (1) | ||
| CCI: | CCI-003379 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | The organization requires the developer of the information system, system component, or information system service take organization-defined actions to ensure the required screening criteria are satisfied. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-21 (1) | ||
| CCI: | CCI-003380 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | The organization requires the developer of the information system, system component, or information system service take organization-defined actions to ensure the required access authorizations are satisfied. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-21 (1) | ||
| CCI: | CCI-003388 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | The organization defines the frequency on which to scan for counterfeit information system components. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-19 (4) | ||
| CCI: | CCI-003389 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | The organization scans for counterfeit information system components in accordance with organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-19 (4) | ||
| CCI: | CCI-003390 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | The organization defines the techniques and methods used to dispose of information system components. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-19 (3) | ||
| CCI: | CCI-003391 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-10-03 |
| Definition: | The organization disposes of information system components using organization-defined techniques and methods. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SA-19 (3) | ||
| CCI: | CCI-003392 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-07 |
| Definition: | The organization determines and documents the legal authority that permits the collection of personally identifiable information (PII), either generally or in support of a specific program or information system need. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AP-1 | ||
| CCI: | CCI-003393 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-07 |
| Definition: | The organization determines and documents the legal authority that permits the use of personally identifiable information (PII), either generally or in support of a specific program or information system need. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AP-1 | ||
| CCI: | CCI-003394 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-07 |
| Definition: | The organization determines and documents the legal authority that permits the maintenance of personally identifiable information (PII), either generally or in support of a specific program or information system need. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AP-1 | ||
| CCI: | CCI-003395 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-07 |
| Definition: | The organization determines and documents the legal authority that permits the sharing of personally identifiable information (PII), either generally or in support of a specific program or information system need. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AP-1 | ||
| CCI: | CCI-003396 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-07 |
| Definition: | The organization describes, in its privacy notices, the purpose(s) for which personally identifiable information (PII) is collected. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AP-2 | ||
| CCI: | CCI-003397 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-07 |
| Definition: | The organization appoints a Senior Agency Official for Privacy (SAOP)/Chief Privacy Officer (CPO) accountable for developing, implementing, and maintaining an organization-wide governance and privacy program to ensure compliance with all applicable laws and regulations regarding the collection, use, maintenance, sharing, and disposal of personally identifiable information (PII) by programs and information systems. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AR-1 a | ||
| CCI: | CCI-003398 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-07 |
| Definition: | The organization describes, in its privacy notices, the purpose(s) for which personally identifiable information (PII) is used. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AP-2 | ||
| CCI: | CCI-003399 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-07 |
| Definition: | The organization describes, in its privacy notices, the purpose(s) for which personally identifiable information (PII) is maintained. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AP-2 | ||
| CCI: | CCI-003400 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-07 |
| Definition: | The organization describes, in its privacy notices, the purpose(s) for which personally identifiable information (PII) is shared. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AP-2 | ||
| CCI: | CCI-003401 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-07 |
| Definition: | The organization monitors federal privacy laws and policy for changes that affect the privacy program. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AR-1 b | ||
| CCI: | CCI-003402 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-07 |
| Definition: | The organization defines the allocation of budget resources sufficient to implement and operate the organization-wide privacy program. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AR-1 c | ||
| CCI: | CCI-003403 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-07 |
| Definition: | The organization defines the allocation of staffing resources sufficient to implement and operate the organization-wide privacy program. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AR-1 c | ||
| CCI: | CCI-003404 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-07 |
| Definition: | The organization allocates sufficient organization-defined budget resources to implement and operate the organization-wide privacy program. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AR-1 c | ||
| CCI: | CCI-003405 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-07 |
| Definition: | The organization allocates sufficient organization-defined staffing resources to implement and operate the organization-wide privacy program. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AR-1 c | ||
| CCI: | CCI-003406 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-07 |
| Definition: | The organization develops a strategic organizational privacy plan for implementing applicable privacy controls, policies, and procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AR-1 d | ||
| CCI: | CCI-003407 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-07 |
| Definition: | The organization develops operational privacy policies which govern the appropriate privacy and security controls for programs, information systems, or technologies involving personally identifiable information (PII). | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AR-1 e | ||
| CCI: | CCI-003408 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-07 |
| Definition: | The organization disseminates operational privacy policies which govern the appropriate privacy and security controls for programs, information systems, or technologies involving personally identifiable information (PII). | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AR-1 e | ||
| CCI: | CCI-003409 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-07 |
| Definition: | The organization implements operational privacy policies which govern the appropriate privacy and security controls for programs, information systems, or technologies involving personally identifiable information (PII). | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AR-1 e | ||
| CCI: | CCI-003410 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-07 |
| Definition: | The organization develops operational privacy procedures which govern the appropriate privacy and security controls for programs, information systems, or technologies involving personally identifiable information (PII). | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AR-1 e | ||
| CCI: | CCI-003411 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-07 |
| Definition: | The organization disseminates operational privacy procedures which govern the appropriate privacy and security controls for programs, information systems, or technologies involving personally identifiable information (PII). | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AR-1 e | ||
| CCI: | CCI-003412 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-07 |
| Definition: | The organization implements operational privacy procedures which govern the appropriate privacy and security controls for programs, information systems, or technologies involving personally identifiable information (PII). | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AR-1 e | ||
| CCI: | CCI-003413 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-07 |
| Definition: | The organization defines the frequency, minimally biennially, on which the privacy plan, policies, and procedures are to be updated. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AR-1 f | ||
| CCI: | CCI-003414 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-07 |
| Definition: | The organization updates the privacy plan per organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AR-1 f | ||
| CCI: | CCI-003415 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-07 |
| Definition: | The organization updates the privacy policies per organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AR-1 f | ||
| CCI: | CCI-003416 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-07 |
| Definition: | The organization updates the privacy procedures per organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AR-1 f | ||
| CCI: | CCI-003417 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-07 |
| Definition: | The organization documents a privacy risk management process which assesses the privacy risk to individuals. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AR-2 a | ||
| CCI: | CCI-003418 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-07 |
| Definition: | The organization implements a privacy risk management process which assesses the privacy risk to individuals. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AR-2 a | ||
| CCI: | CCI-003419 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-07 |
| Definition: | The organization's privacy risk management process assesses the privacy risk to individuals resulting from the collection of personally identifiable information (PII). | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AR-2 a | ||
| CCI: | CCI-003420 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-07 |
| Definition: | The organization's privacy risk management process assesses the privacy risk to individuals resulting from the sharing of personally identifiable information (PII). | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AR-2 a | ||
| CCI: | CCI-003421 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-07 |
| Definition: | The organization's privacy risk management process assesses the privacy risk to individuals resulting from the storing of personally identifiable information (PII). | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AR-2 a | ||
| CCI: | CCI-003422 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-07 |
| Definition: | The organization's privacy risk management process assesses the privacy risk to individuals resulting from the transmitting of personally identifiable information (PII). | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AR-2 a | ||
| CCI: | CCI-003423 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-07 |
| Definition: | The organization's privacy risk management process assesses the privacy risk to individuals resulting from the use of personally identifiable information (PII). | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AR-2 a | ||
| CCI: | CCI-003424 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-07 |
| Definition: | The organization's privacy risk management process assesses the privacy risk to individuals resulting from the disposal of personally identifiable information (PII). | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AR-2 a | ||
| CCI: | CCI-003425 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-07 |
| Definition: | The organization conducts Privacy Impact Assessments (PIAs) for information systems, programs, or other activities that pose a privacy risk in accordance with applicable law, OMB policy, or any existing organizational policies and procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AR-2 b | ||
| CCI: | CCI-003426 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-07 |
| Definition: | The organization establishes privacy roles for contractors. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AR-3 a | ||
| CCI: | CCI-003427 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-07 |
| Definition: | The organization establishes privacy responsibilities for contractors. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AR-3 a | ||
| CCI: | CCI-003428 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-07 |
| Definition: | The organization establishes access requirements for contractors. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AR-3 a | ||
| CCI: | CCI-003429 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-07 |
| Definition: | The organization establishes privacy roles for service providers. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AR-3 a | ||
| CCI: | CCI-003430 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-07 |
| Definition: | The organization establishes privacy responsibilities for service providers. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AR-3 a | ||
| CCI: | CCI-003431 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-07 |
| Definition: | The organization establishes access requirements for service providers. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AR-3 a | ||
| CCI: | CCI-003432 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-07 |
| Definition: | The organization includes privacy requirements in contracts. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AR-3 b | ||
| CCI: | CCI-003433 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-07 |
| Definition: | The organization includes privacy requirements in other acquisition-related documents. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AR-3 b | ||
| CCI: | CCI-003434 | Status: | deprecated |
| Contributor: | DISA FSO | Published Date: | 2013-11-07 |
| Definition: | The organization defines the frequency for monitoring privacy controls and internal privacy policy to ensure effective implementation. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AR-4 | ||
| CCI: | CCI-003435 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-07 |
| Definition: | The organization defines the frequency for auditing privacy controls and internal privacy policy to ensure effective implementation. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AR-4 | ||
| CCI: | CCI-003436 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-07 |
| Definition: | The organization monitors privacy controls, per organization-defined frequency, to ensure effective implementation. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AR-4 | ||
| CCI: | CCI-003437 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-07 |
| Definition: | The organization monitors internal privacy policy to ensure effective implementation. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AR-4 | ||
| CCI: | CCI-003438 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-07 |
| Definition: | The organization audits privacy controls, per organization-defined frequency, to ensure effective implementation. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AR-4 | ||
| CCI: | CCI-003439 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-07 |
| Definition: | The organization audits internal privacy policy, per organization-defined frequency, to ensure effective implementation. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AR-4 | ||
| CCI: | CCI-003440 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-07 |
| Definition: | The organization develops a comprehensive training and awareness strategy aimed at ensuring that personnel understand privacy responsibilities and procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AR-5 a | ||
| CCI: | CCI-003441 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-07 |
| Definition: | The organization implements a comprehensive training and awareness strategy aimed at ensuring that personnel understand privacy responsibilities and procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AR-5 a | ||
| CCI: | CCI-003442 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-07 |
| Definition: | The organization updates a comprehensive training and awareness strategy aimed at ensuring that personnel understand privacy responsibilities and procedures. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AR-5 a | ||
| CCI: | CCI-003443 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-07 |
| Definition: | The organization defines the frequency, minimally annually, for administering its basic privacy training. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AR-5 b | ||
| CCI: | CCI-003444 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-07 |
| Definition: | The organization defines the frequency, minimally annually, for administering the targeted, role-based privacy training for personnel having responsibility for personally identifiable information (PII) or for activities that involve PII. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AR-5 b | ||
| CCI: | CCI-003445 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-07 |
| Definition: | The organization administers basic privacy training per the organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AR-5 b | ||
| CCI: | CCI-003446 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-07 |
| Definition: | The organization administers, per organization-defined frequency, targeted, role-based privacy training for personnel having responsibility for personally identifiable information (PII) or for activities that involve PII. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AR-5 b | ||
| CCI: | CCI-003447 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-07 |
| Definition: | The organization defines the frequency, minimally annually, on which personnel certify acceptance of responsibilities for privacy requirements. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AR-5 c | ||
| CCI: | CCI-003448 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-07 |
| Definition: | The organization ensures personnel certify (manually or electronically) acceptance of responsibilities for privacy requirements per organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AR-5 c | ||
| CCI: | CCI-003449 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-07 |
| Definition: | The organization develops reports for the Office of Management and Budget (OMB), Congress, and other oversight bodies, as appropriate, to demonstrate accountability with specific statutory and regulatory privacy program mandates. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AR-6 | ||
| CCI: | CCI-003450 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-07 |
| Definition: | The organization disseminates reports to the Office of Management and Budget (OMB), Congress, and other oversight bodies, as appropriate, to demonstrate accountability with specific statutory and regulatory privacy program mandates. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AR-6 | ||
| CCI: | CCI-003451 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-07 |
| Definition: | The organization updates reports for the Office of Management and Budget (OMB), Congress, and other oversight bodies, as appropriate, to demonstrate accountability with specific statutory and regulatory privacy program mandates. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AR-6 | ||
| CCI: | CCI-003452 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-07 |
| Definition: | The organization develops reports for senior management and other personnel with responsibility for monitoring privacy program progress and compliance. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AR-6 | ||
| CCI: | CCI-003453 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-07 |
| Definition: | The organization disseminates reports to senior management and other personnel with responsibility for monitoring privacy program progress and compliance. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AR-6 | ||
| CCI: | CCI-003454 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-07 |
| Definition: | The organization updates reports for senior management and other personnel with responsibility for monitoring privacy program progress and compliance. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AR-6 | ||
| CCI: | CCI-003455 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-07 |
| Definition: | The organization designs information systems to support privacy by automating privacy controls. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AR-7 | ||
| CCI: | CCI-003456 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-07 |
| Definition: | The organization, as part of the accurate accounting of disclosures of Privacy Act information held in each system of records under its control, includes the date of each disclosure of a record. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AR-8 a (1) | ||
| CCI: | CCI-003457 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-07 |
| Definition: | The organization, as part of the accurate accounting of disclosures of Privacy Act information held in each system of records under its control, includes the nature of each disclosure of a record. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AR-8 a (1) | ||
| CCI: | CCI-003458 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-07 |
| Definition: | The organization, as part of the accurate accounting of disclosures of Privacy Act information held in each system of records under its control, includes the purpose of each disclosure of a record. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AR-8 a (1) | ||
| CCI: | CCI-003459 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-07 |
| Definition: | The organization keeps an accurate accounting of disclosures of Privacy Act information held in each system of records under its control. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AR-8 a (1) | ||
| CCI: | CCI-003460 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-07 |
| Definition: | The organization, as part of the accurate accounting of disclosures of Privacy Act information held in each system of records under its control, includes the name and address of the person or agency to which the disclosure was made. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AR-8 a (2) | ||
| CCI: | CCI-003461 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-07 |
| Definition: | The organization retains the accounting of disclosures for the life of the record or five years after the disclosure is made, whichever is longer. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AR-8 b | ||
| CCI: | CCI-003462 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-07 |
| Definition: | The organization makes the accounting of disclosures available to the person named in the record upon request. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): AR-8 c | ||
| CCI: | CCI-003463 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-07 |
| Definition: | The organization confirms to the greatest extent practicable upon collection or creation of personally identifiable information (PII), the accuracy of that information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): DI-1 a | ||
| CCI: | CCI-003464 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-07 |
| Definition: | The organization confirms to the greatest extent practicable upon collection or creation of personally identifiable information (PII), the relevancy of that information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): DI-1 a | ||
| CCI: | CCI-003465 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-07 |
| Definition: | The organization confirms to the greatest extent practicable upon collection or creation of personally identifiable information (PII), the timeliness of that information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): DI-1 a | ||
| CCI: | CCI-003466 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-07 |
| Definition: | The organization confirms to the greatest extent practicable upon collection or creation of personally identifiable information (PII), the completeness of that information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): DI-1 a | ||
| CCI: | CCI-003467 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-07 |
| Definition: | The organization collects personally identifiable information (PII) directly from the individual to the greatest extent practicable. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): DI-1 b | ||
| CCI: | CCI-003468 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-07 |
| Definition: | The organization defines the frequency on which it will check for, and correct as necessary, inaccurate or outdated personally identifiable information (PII) used by its programs or systems. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): DI-1 c | ||
| CCI: | CCI-003469 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-07 |
| Definition: | The organization checks for, and corrects as necessary, any inaccurate or outdated personally identifiable information (PII) used by its programs or systems on an organization-defined frequency. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): DI-1 c | ||
| CCI: | CCI-003470 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-07 |
| Definition: | The organization issues guidelines ensuring the quality of disseminated Privacy Act information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): DI-1 d | ||
| CCI: | CCI-003471 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-07 |
| Definition: | The organization issues guidelines ensuring the utility of disseminated Privacy Act information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): DI-1 d | ||
| CCI: | CCI-003472 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-07 |
| Definition: | The organization issues guidelines ensuring the objectivity of disseminated Privacy Act information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): DI-1 d | ||
| CCI: | CCI-003473 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-07 |
| Definition: | The organization issues guidelines ensuring the integrity of disseminated Privacy Act information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): DI-1 d | ||
| CCI: | CCI-003474 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-07 |
| Definition: | The organization issues guidelines maximizing the quality of disseminated Privacy Act information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): DI-1 d | ||
| CCI: | CCI-003475 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-07 |
| Definition: | The organization issues guidelines maximizing the utility of disseminated Privacy Act information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): DI-1 d | ||
| CCI: | CCI-003476 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-07 |
| Definition: | The organization issues guidelines maximizing the objectivity of disseminated Privacy Act information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): DI-1 d | ||
| CCI: | CCI-003477 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-07 |
| Definition: | The organization issues guidelines maximizing the integrity of disseminated Privacy Act information. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): DI-1 d | ||
| CCI: | CCI-003478 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-07 |
| Definition: | The organization requests the individual or individual's authorized representative validate personally identifiable information (PII) during the collection process. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): DI-1 (1) | ||
| CCI: | CCI-003479 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-07 |
| Definition: | The organization defines the frequency on which it will request the individual, or individual's authorized representative, revalidate that personally identifiable information (PII) collected is still accurate. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): DI-1 (2) | ||
| CCI: | CCI-003480 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-07 |
| Definition: | On an organization-defined frequency, the organization requests the individual, or individual's authorized representative, revalidate that personally identifiable information (PII) collected is still accurate. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): DI-1 (2) | ||
| CCI: | CCI-003481 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-07 |
| Definition: | The organization documents processes to ensure the integrity of personally identifiable information (PII) through existing security controls. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): DI-2 a | ||
| CCI: | CCI-003482 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-07 |
| Definition: | The organization, when appropriate, establishes a Data Integrity Board. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): DI-2 b | ||
| CCI: | CCI-003483 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-07 |
| Definition: | The organization's Data Integrity Board oversees the organizational Computer Matching Agreements. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): DI-2 b | ||
| CCI: | CCI-003484 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-07 |
| Definition: | The organization's Data Integrity Board ensures the Computer Matching Agreements comply with the computer matching provisions of the Privacy Act. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): DI-2 b | ||
| CCI: | CCI-003485 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-07 |
| Definition: | The organization publishes Computer Matching Agreements on its public website. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): DI-2 (1) | ||
| CCI: | CCI-003486 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-08 |
| Definition: | The organization identifies the minimum personally identifiable information (PII) elements that are relevant and necessary to accomplish the legally authorized purpose of collection. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): DM-1 a | ||
| CCI: | CCI-003487 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-08 |
| Definition: | The organization limits the collection and retention of personally identifiable information (PII) to the minimum elements identified for the purposes described in the published privacy notice. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): DM-1 b | ||
| CCI: | CCI-003488 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-08 |
| Definition: | The organization limits the collection and retention of personally identifiable information (PII) to the minimum elements identified for the purposes which the individual has provided consent. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): DM-1 b | ||
| CCI: | CCI-003489 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-08 |
| Definition: | The organization defines the frequency, minimally annually, for conducting reviews of its personally identifiable information (PII) holdings. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): DM-1 c | ||
| CCI: | CCI-003490 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-08 |
| Definition: | The organization conducts an initial evaluation of personally identifiable information (PII) holdings. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): DM-1 c | ||
| CCI: | CCI-003491 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-08 |
| Definition: | The organization establishes a schedule for regularly reviewing the personally identifiable information (PII) holdings on an organization-defined frequency to ensure that only PII identified in the notice is collected and retained. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): DM-1 c | ||
| CCI: | CCI-003492 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-08 |
| Definition: | The organization follows a schedule for regularly reviewing the personally identifiable information (PII) holdings on an organization-defined frequency to ensure that only PII identified in the notice is collected and retained. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): DM-1 c | ||
| CCI: | CCI-003493 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-08 |
| Definition: | The organization establishes a schedule for regularly reviewing the personally identifiable information (PII) holdings on an organization-defined frequency to ensure the PII continues to be necessary to accomplish the legally authorized purpose. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): DM-1 c | ||
| CCI: | CCI-003494 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-08 |
| Definition: | The organization follows a schedule for regularly reviewing the personally identifiable information (PII) holdings on an organization-defined frequency to ensure the PII continues to be necessary to accomplish the legally authorized purpose. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): DM-1 c | ||
| CCI: | CCI-003495 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-08 |
| Definition: | The organization, where feasible and within the limits of technology, locates and removes/redacts specified personally identifiable information (PII). | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): DM-1 (1) | ||
| CCI: | CCI-003496 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-08 |
| Definition: | The organization, where feasible and within the limits of technology, uses anonymization and de-identification techniques to permit use of the retained Privacy Act information while reducing its sensitivity and reducing the risk resulting from disclosure. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): DM-1 (1) | ||
| CCI: | CCI-003497 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-08 |
| Definition: | The organization defines the time period for retaining each collection of personally identifiable information (PII) that is required to fulfill the purpose(s) identified in the published privacy notice or required by law. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): DM-2 a | ||
| CCI: | CCI-003498 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-08 |
| Definition: | The organization retains each collection of personally identifiable information (PII) for the organization-defined time period to fulfill the purpose(s) identified in the published privacy notice or as required by law. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): DM-2 a | ||
| CCI: | CCI-003499 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-08 |
| Definition: | The organization disposes of, destroys, erases, and/or anonymizes the personally identifiable information (PII), regardless of the method of storage, in accordance with a NARA-approved record retention schedule. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): DM-2 b | ||
| CCI: | CCI-003500 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-08 |
| Definition: | The organization disposes of, destroys, erases, and/or anonymizes the personally identifiable information (PII), regardless of the method of storage, in a manner that prevents loss, theft, misuse, or unauthorized access. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): DM-2 b | ||
| CCI: | CCI-003501 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-08 |
| Definition: | The organization defines the techniques or methods to be employed to ensure the secure deletion or destruction of personally identifiable information (PII) (including originals, copies, and archived records). | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): DM-2 c | ||
| CCI: | CCI-003502 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-08 |
| Definition: | The organization uses organization-defined techniques or methods to ensure secure deletion or destruction of personally identifiable information (PII) (including originals, copies, and archived records). | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): DM-2 c | ||
| CCI: | CCI-003503 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-08 |
| Definition: | The organization, where feasible, configures its information systems to record the date personally identifiable information (PII) is collected, created, or updated. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): DM-2 (1) | ||
| CCI: | CCI-003504 | Status: | deprecated |
| Contributor: | DISA FSO | Published Date: | 2013-11-08 |
| Definition: | The organization, where feasible, configures its information systems to record the date personally identifiable information (PII) is created. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): DM-2 (1) | ||
| CCI: | CCI-003505 | Status: | deprecated |
| Contributor: | DISA FSO | Published Date: | 2013-11-08 |
| Definition: | The organization, where feasible, configures its information systems to record the date personally identifiable information (PII) is updated. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): DM-2 (1) | ||
| CCI: | CCI-003506 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-08 |
| Definition: | The organization, where feasible, configures its information systems to record when personally identifiable information (PII) is to be deleted or archived under an approved record retention schedule. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): DM-2 (1) | ||
| CCI: | CCI-003507 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-08 |
| Definition: | The organization develops policies that minimize the use of personally identifiable information (PII) for testing. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): DM-3 a | ||
| CCI: | CCI-003508 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-08 |
| Definition: | The organization develops policies that minimize the use of personally identifiable information (PII) for training. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): DM-3 a | ||
| CCI: | CCI-003509 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-08 |
| Definition: | The organization develops policies that minimize the use of personally identifiable information (PII) for research. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): DM-3 a | ||
| CCI: | CCI-003510 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-08 |
| Definition: | The organization develops procedures that minimize the use of personally identifiable information (PII) for testing. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): DM-3 a | ||
| CCI: | CCI-003511 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-08 |
| Definition: | The organization develops procedures that minimize the use of personally identifiable information (PII) for training. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): DM-3 a | ||
| CCI: | CCI-003512 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-08 |
| Definition: | The organization develops procedures that minimize the use of personally identifiable information (PII) for research. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): DM-3 a | ||
| CCI: | CCI-003513 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-08 |
| Definition: | The organization implements controls to protect personally identifiable information (PII) used for testing. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): DM-3 b | ||
| CCI: | CCI-003514 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-08 |
| Definition: | The organization implements controls to protect personally identifiable information (PII) used for training. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): DM-3 b | ||
| CCI: | CCI-003515 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-08 |
| Definition: | The organization implements controls to protect personally identifiable information (PII) used for research. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): DM-3 b | ||
| CCI: | CCI-003516 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-08 |
| Definition: | The organization, where feasible, uses techniques to minimize the risk to privacy of using personally identifiable information (PII) for research. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): DM-3 (1) | ||
| CCI: | CCI-003517 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-08 |
| Definition: | The organization, where feasible, uses techniques to minimize the risk to privacy of using personally identifiable information (PII) for testing. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): DM-3 (1) | ||
| CCI: | CCI-003518 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-08 |
| Definition: | The organization, where feasible, uses techniques to minimize the risk to privacy of using personally identifiable information (PII) for training. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): DM-3 (1) | ||
| CCI: | CCI-003519 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-08 |
| Definition: | The organization provides means, where feasible and appropriate, for individuals to authorize the collection of personally identifiable information (PII) prior to its collection. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IP-1 a | ||
| CCI: | CCI-003520 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-08 |
| Definition: | The organization provides means, where feasible and appropriate, for individuals to authorize the use of personally identifiable information (PII) prior to its collection. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IP-1 a | ||
| CCI: | CCI-003521 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-08 |
| Definition: | The organization provides means, where feasible and appropriate, for individuals to authorize the maintaining of personally identifiable information (PII) prior to its collection. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IP-1 a | ||
| CCI: | CCI-003522 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-08 |
| Definition: | The organization provides means, where feasible and appropriate, for individuals to authorize sharing of personally identifiable information (PII) prior to its collection. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IP-1 a | ||
| CCI: | CCI-003523 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-08 |
| Definition: | The organization provides appropriate means for individuals to understand the consequences of decisions to approve or decline the authorization of the collection of personally identifiable information (PII). | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IP-1 b | ||
| CCI: | CCI-003524 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-08 |
| Definition: | The organization provides appropriate means for individuals to understand the consequences of decisions to approve or decline the authorization of the use of personally identifiable information (PII). | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IP-1 b | ||
| CCI: | CCI-003525 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-08 |
| Definition: | The organization provides appropriate means for individuals to understand the consequences of decisions to approve or decline the authorization of the dissemination of personally identifiable information (PII). | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IP-1 b | ||
| CCI: | CCI-003526 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-08 |
| Definition: | The organization provides appropriate means for individuals to understand the consequences of decisions to approve or decline the authorization of the retention of personally identifiable information (PII). | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IP-1 b | ||
| CCI: | CCI-003527 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-08 |
| Definition: | The organization obtains consent, where feasible and appropriate, from individuals prior to any new uses or disclosure of previously collected personally identifiable information (PII). | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IP-1 c | ||
| CCI: | CCI-003528 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-08 |
| Definition: | The organization ensures that individuals are aware of all uses of personally identifiable information (PII) not initially described in the public notice that was in effect at the time the organization collected the PII. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IP-1 d | ||
| CCI: | CCI-003529 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-08 |
| Definition: | The organization ensures that individuals, where feasible, consent to all uses of personally identifiable information (PII) not initially described in the public notice that was in effect at the time the organization collected the PII. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IP-1 d | ||
| CCI: | CCI-003530 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-08 |
| Definition: | The organization implements mechanisms to support itemized or tiered consent for specific uses of personally identifiable information (PII) data. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IP-1 (1) | ||
| CCI: | CCI-003531 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-08 |
| Definition: | The organization provides individuals the ability to have access to their personally identifiable information (PII) maintained in its system(s) of records. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IP-2 a | ||
| CCI: | CCI-003532 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-08 |
| Definition: | The organization publishes rules and regulations governing how individuals may request access to records maintained in a Privacy Act system of records. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IP-2 b | ||
| CCI: | CCI-003533 | Status: | deprecated |
| Contributor: | DISA FSO | Published Date: | 2013-11-08 |
| Definition: | The organization publishes regulations governing how individuals may request access to records maintained in a Privacy Act system of records. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IP-2 b | ||
| CCI: | CCI-003534 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-08 |
| Definition: | The organization publishes access procedures for Privacy Act systems of records in System of Records Notices (SORNs). | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IP-2 c | ||
| CCI: | CCI-003535 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-08 |
| Definition: | The organization adheres to Privacy Act requirements for the proper processing of Privacy Act requests. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IP-2 d | ||
| CCI: | CCI-003536 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-08 |
| Definition: | The organization adheres to OMB policies and guidance for the proper processing of Privacy Act requests. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IP-2 d | ||
| CCI: | CCI-003537 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-08 |
| Definition: | The organization provides a process for individuals to have inaccurate personally identifiable information (PII) maintained by the organization corrected or amended, as appropriate. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IP-3 a | ||
| CCI: | CCI-003538 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-08 |
| Definition: | The organization establishes a process for disseminating corrections or amendments of the personally identifiable information (PII) to other authorized users of the PII, such as external information-sharing partners. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IP-3 b | ||
| CCI: | CCI-003539 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-08 |
| Definition: | The organization establishes a process, where feasible and appropriate, to notify affected individuals that their personally identifiable information (PII) information has been corrected or amended. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IP-3 b | ||
| CCI: | CCI-003540 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-08 |
| Definition: | The organization implements a process for receiving complaints, concerns, or questions from individuals about the organizational privacy practices. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IP-4 | ||
| CCI: | CCI-003541 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-08 |
| Definition: | The organization implements a process for responding to complaints, concerns, or questions from individuals about the organizational privacy practices. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IP-4 | ||
| CCI: | CCI-003542 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-08 |
| Definition: | The organization defines the time period within which it must respond to complaints, concerns, or questions from individuals about the organizational privacy practices. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IP-4 (1) | ||
| CCI: | CCI-003543 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-08 |
| Definition: | The organization responds to complaints, concerns, or questions from individuals about the organizational privacy practices within the organization-defined time period. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): IP-4 (1) | ||
| CCI: | CCI-003544 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-08 |
| Definition: | The organization defines the frequency on which it will update the inventory that contains a listing of all programs and information systems identified as collecting, using, maintaining, or sharing personally identifiable information (PII). | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SE-1 a | ||
| CCI: | CCI-003545 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-08 |
| Definition: | The organization establishes an inventory that contains a listing of all programs identified as collecting, using, maintaining, or sharing personally identifiable information (PII). | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SE-1 a | ||
| CCI: | CCI-003546 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-08 |
| Definition: | The organization establishes an inventory that contains a listing of all information systems identified as collecting, using, maintaining, or sharing personally identifiable information (PII). | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SE-1 a | ||
| CCI: | CCI-003547 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-08 |
| Definition: | The organization maintains an inventory that contains a listing of all programs identified as collecting, using, maintaining, or sharing personally identifiable information (PII). | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SE-1 a | ||
| CCI: | CCI-003548 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-08 |
| Definition: | The organization maintains an inventory that contains a listing of all information systems identified as collecting, using, maintaining, or sharing personally identifiable information (PII). | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SE-1 a | ||
| CCI: | CCI-003549 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-08 |
| Definition: | The organization updates, per organization-defined frequency, an inventory that contains a listing of all programs identified as collecting, using, maintaining, or sharing personally identifiable information (PII). | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SE-1 a | ||
| CCI: | CCI-003550 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-08 |
| Definition: | The organization updates, per organization-defined frequency, an inventory that contains a listing of all information systems identified as collecting, using, maintaining, or sharing personally identifiable information (PII). | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SE-1 a | ||
| CCI: | CCI-003551 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-08 |
| Definition: | The organization defines the frequency for providing each update of the personally identifiable information (PII) inventory to the CIO or information security official. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SE-1 b | ||
| CCI: | CCI-003552 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-08 |
| Definition: | The organization provides each update of the personally identifiable information (PII) inventory to the CIO or information security official, per organization-defined frequency, to support the establishment of information security requirements for all new or modified information systems containing PII. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SE-1 b | ||
| CCI: | CCI-003553 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-08 |
| Definition: | The organization develops a Privacy Incident Response Plan. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SE-2 a | ||
| CCI: | CCI-003554 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-08 |
| Definition: | The organization implements a Privacy Incident Response Plan. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SE-2 a | ||
| CCI: | CCI-003555 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-08 |
| Definition: | The organization provides an organized and effective response to privacy incidents in accordance with the organizational Privacy Incident Response Plan. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SE-2 b | ||
| CCI: | CCI-003556 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-08 |
| Definition: | The organization provides effective notice to the public regarding its activities that impact privacy, including its collection, use, sharing, safeguarding, maintenance, and disposal of personally identifiable information (PII). | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): TR-1 a | ||
| CCI: | CCI-003557 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-08 |
| Definition: | The organization provides effective notice to individuals regarding its activities that impact privacy, including its collection, use, sharing, safeguarding, maintenance, and disposal of personally identifiable information (PII). | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): TR-1 a | ||
| CCI: | CCI-003558 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-08 |
| Definition: | The organization provides effective notice to the public regarding its authority for collecting personally identifiable information (PII). | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): TR-1 a | ||
| CCI: | CCI-003559 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-08 |
| Definition: | The organization provides effective notice to individuals regarding its authority for collecting personally identifiable information (PII). | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): TR-1 a | ||
| CCI: | CCI-003560 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-08 |
| Definition: | The organization provides effective notice to the public regarding the choices, if any, individuals may have regarding how the organization uses personally identifiable information (PII). | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): TR-1 a | ||
| CCI: | CCI-003561 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-08 |
| Definition: | The organization provides effective notice to individuals regarding the choices, if any, individuals may have regarding how the organization uses personally identifiable information (PII). | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): TR-1 a | ||
| CCI: | CCI-003562 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-08 |
| Definition: | The organization provides effective notice to the public regarding the consequences of exercising or not exercising the choices regarding how the organization uses personally identifiable information (PII). | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): TR-1 a | ||
| CCI: | CCI-003563 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-08 |
| Definition: | The organization provides effective notice to individuals regarding the consequences of exercising or not exercising the choices regarding how the organization uses personally identifiable information (PII). | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): TR-1 a | ||
| CCI: | CCI-003564 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-08 |
| Definition: | The organization provides effective notice to the public regarding the ability of individuals to access personally identifiable information (PII). | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): TR-1 a | ||
| CCI: | CCI-003565 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-08 |
| Definition: | The organization provides effective notice to individuals regarding the ability to access personally identifiable information (PII). | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): TR-1 a | ||
| CCI: | CCI-003566 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-08 |
| Definition: | The organization provides effective notice to the public regarding the ability to have personally identifiable information (PII) amended or corrected if necessary. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): TR-1 a | ||
| CCI: | CCI-003567 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-08 |
| Definition: | The organization provides effective notice to individuals regarding the ability to have personally identifiable information (PII) amended or corrected if necessary. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): TR-1 a | ||
| CCI: | CCI-003568 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-08 |
| Definition: | The organization describes the personally identifiable information (PII) the organization collects. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): TR-1 b | ||
| CCI: | CCI-003569 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-08 |
| Definition: | The organization describes the purpose(s) for which it collects the personally identifiable information (PII). | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): TR-1 b | ||
| CCI: | CCI-003570 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-08 |
| Definition: | The organization describes how the organization uses personally identifiable information (PII) internally. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): TR-1 b | ||
| CCI: | CCI-003571 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-08 |
| Definition: | The organization describes whether the organization shares personally identifiable information (PII) with external entities. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): TR-1 b | ||
| CCI: | CCI-003572 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-08 |
| Definition: | The organization describes the categories of those external entities with whom personally identifiable information (PII) is shared. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): TR-1 b | ||
| CCI: | CCI-003573 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-08 |
| Definition: | The organization describes the purposes for sharing personally identifiable information (PII) with external entities. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): TR-1 b | ||
| CCI: | CCI-003574 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-08 |
| Definition: | The organization describes whether individuals have the ability to consent to specific uses or sharing of personally identifiable information (PII). | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): TR-1 b | ||
| CCI: | CCI-003575 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-08 |
| Definition: | The organization describes how individuals may exercise their consent regarding specific uses or sharing of personally identifiable information (PII). | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): TR-1 b | ||
| CCI: | CCI-003576 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-08 |
| Definition: | The organization describes how individuals may obtain access to personally identifiable information (PII). | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): TR-1 b | ||
| CCI: | CCI-003577 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-08 |
| Definition: | The organization describes how the personally identifiable information (PII) will be protected. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): TR-1 b | ||
| CCI: | CCI-003578 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-08 |
| Definition: | The organization revises its public notices to reflect changes in practice or policy that affect personally identifiable information (PII), before or as soon as practicable after the change. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): TR-1 c | ||
| CCI: | CCI-003579 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-08 |
| Definition: | The organization revises its public notices to reflect changes in practice or policy that impact privacy, before or as soon as practicable after the change. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): TR-1 c | ||
| CCI: | CCI-003580 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-08 |
| Definition: | The organization provides real-time notice and/or layered notice when it collects personally identifiable information (PII). | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): TR-1 (1) | ||
| CCI: | CCI-003581 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-08 |
| Definition: | The organization publishes System of Records Notices (SORNs) in the Federal Register, subject to required oversight processes, for systems containing personally identifiable information (PII). | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): TR-2 a | ||
| CCI: | CCI-003582 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-08 |
| Definition: | The organization keeps System of Records Notices (SORNs) current. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): TR-2 b | ||
| CCI: | CCI-003583 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-08 |
| Definition: | The organization includes Privacy Act Statements on its forms that collect personally identifiable information (PII), or on separate forms that can be retained by individuals, to provide additional formal notice to individuals from whom the information is being collected. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): TR-2 c | ||
| CCI: | CCI-003584 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-08 |
| Definition: | The organization publishes System of Records Notices (SORNs) on its public website. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): TR-2 (1) | ||
| CCI: | CCI-003585 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-08 |
| Definition: | The organization ensures the public has access to information about its privacy activities. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): TR-3 a | ||
| CCI: | CCI-003586 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-08 |
| Definition: | The organization ensures the public is able to communicate with its Senior Agency Official for Privacy (SAOP)/Chief Privacy Officer (CPO). | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): TR-3 a | ||
| CCI: | CCI-003587 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-08 |
| Definition: | The organization ensures its privacy practices are publicly available through organizational websites or otherwise. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): TR-3 b | ||
| CCI: | CCI-003588 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-08 |
| Definition: | The organization uses personally identifiable information (PII) internally only for the authorized purpose(s) identified in the Privacy Act and/or in public notices. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): UL-1 | ||
| CCI: | CCI-003589 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-08 |
| Definition: | The organization shares personally identifiable information (PII) externally, only for the authorized purposes identified in the Privacy Act and/or described in its notice(s) or for a purpose that is compatible with those purposes. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): UL-2 a | ||
| CCI: | CCI-003590 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-08 |
| Definition: | The organization, where appropriate, enters into Memoranda of Understanding, Memoranda of Agreement, Letters of Intent, Computer Matching Agreements, or similar agreements, with third parties that specifically describe the personally identifiable information (PII) covered. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): UL-2 b | ||
| CCI: | CCI-003591 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-08 |
| Definition: | The organization, where appropriate, enters into Memoranda of Understanding, Memoranda of Agreement, Letters of Intent, Computer Matching Agreements, or similar agreements, with third parties that specifically enumerate the purposes for which the personally identifiable information (PII) may be used. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): UL-2 b | ||
| CCI: | CCI-003592 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-08 |
| Definition: | The organization monitors its staff on the authorized sharing of personally identifiable information (PII) with third parties. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): UL-2 c | ||
| CCI: | CCI-003593 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-08 |
| Definition: | The organization audits its staff on the authorized sharing of personally identifiable information (PII) with third parties. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): UL-2 c | ||
| CCI: | CCI-003594 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-08 |
| Definition: | The organization trains its staff on the authorized sharing of personally identifiable information (PII) with third parties. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): UL-2 c | ||
| CCI: | CCI-003595 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-08 |
| Definition: | The organization trains its staff on the consequences of unauthorized use or sharing of personally identifiable information (PII). | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): UL-2 c | ||
| CCI: | CCI-003596 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-08 |
| Definition: | The organization evaluates any proposed new instances of sharing personally identifiable information (PII) with third parties to assess whether the sharing is authorized. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): UL-2 d | ||
| CCI: | CCI-003597 | Status: | draft |
| Contributor: | DISA FSO | Published Date: | 2013-11-08 |
| Definition: | The organization evaluates any proposed new instances of sharing personally identifiable information (PII) with third parties to assess whether additional or new public notice is required. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): UL-2 d | ||
| CCI: | CCI-003598 | Status: | deprecated |
| Contributor: | DISA FSO | Published Date: | 2016-06-07 |
| Definition: | The organization defines the individuals or information systems to be the only recipients of organization-defined information, information system components, or devices, by employing organization-defined security safeguards. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): TR-1 b | ||
| CCI: | CCI-003599 | Status: | draft |
| Contributor: | ManTech | Published Date: | 2016-06-07 |
| Definition: | The organization defines the individuals or information systems to be the only recipients of organization-defined information, information system components, or devices, by employing organization-defined security safeguards. | ||
| Type: | policy | ||
| References: | NIST: NIST SP 800-53 Revision 4 (v4): SC-37 | ||