Compliance assessment
1011 controls in 20 families. Read each control, mark it Met, Partially Met or Not Met, and keep evidence alongside. Your score is saved as you go, so you can pick up where you left off.
Access Control131
AC-01Policy and ProceduresAC-02Account ManagementAC-02 (01)Account Management | Automated System Account ManagementAC-02 (02)Account Management | Automated Temporary and Emergency Account ManagementAC-02 (03)Account Management | Disable AccountsAC-02 (04)Account Management | Automated Audit ActionsAC-02 (05)Account Management | Inactivity LogoutAC-02 (06)Account Management | Dynamic Privilege ManagementAC-02 (07)Account Management | Privileged User AccountsAC-02 (08)Account Management | Dynamic Account ManagementAC-02 (09)Account Management | Restrictions on Use of Shared and Group AccountsAC-02 (11)Account Management | Usage ConditionsAC-02 (12)Account Management | Account Monitoring for Atypical UsageAC-02 (13)Account Management | Disable Accounts for High-risk IndividualsAC-03Access EnforcementAC-03 (02)Access Enforcement | Dual AuthorizationAC-03 (03)Access Enforcement | Mandatory Access ControlAC-03 (04)Access Enforcement | Discretionary Access ControlAC-03 (05)Access Enforcement | Security-relevant InformationAC-03 (07)Access Enforcement | Role-based Access ControlAC-03 (08)Access Enforcement | Revocation of Access AuthorizationsAC-03 (09)Access Enforcement | Controlled ReleaseAC-03 (10)Access Enforcement | Audited Override of Access Control MechanismsAC-03 (11)Access Enforcement | Restrict Access to Specific Information TypesAC-03 (12)Access Enforcement | Assert and Enforce Application AccessAC-03 (13)Access Enforcement | Attribute-based Access ControlAC-03 (14)Access Enforcement | Individual AccessAC-03 (15)Access Enforcement | Discretionary and Mandatory Access ControlAC-04Information Flow EnforcementAC-04 (01)Information Flow Enforcement | Object Security and Privacy AttributesAC-04 (02)Information Flow Enforcement | Processing DomainsAC-04 (03)Information Flow Enforcement | Dynamic Information Flow ControlAC-04 (04)Information Flow Enforcement | Flow Control of Encrypted InformationAC-04 (05)Information Flow Enforcement | Embedded Data TypesAC-04 (06)Information Flow Enforcement | MetadataAC-04 (07)Information Flow Enforcement | One-way Flow MechanismsAC-04 (08)Information Flow Enforcement | Security and Privacy Policy FiltersAC-04 (09)Information Flow Enforcement | Human ReviewsAC-04 (10)Information Flow Enforcement | Enable and Disable Security or Privacy Policy FiltersAC-04 (11)Information Flow Enforcement | Configuration of Security or Privacy Policy FiltersAC-04 (12)Information Flow Enforcement | Data Type IdentifiersAC-04 (13)Information Flow Enforcement | Decomposition into Policy-relevant SubcomponentsAC-04 (14)Information Flow Enforcement | Security or Privacy Policy Filter ConstraintsAC-04 (15)Information Flow Enforcement | Detection of Unsanctioned InformationAC-04 (17)Information Flow Enforcement | Domain AuthenticationAC-04 (19)Information Flow Enforcement | Validation of MetadataAC-04 (20)Information Flow Enforcement | Approved SolutionsAC-04 (21)Information Flow Enforcement | Physical or Logical Separation of Information FlowsAC-04 (22)Information Flow Enforcement | Access OnlyAC-04 (23)Information Flow Enforcement | Modify Non-releasable InformationAC-04 (24)Information Flow Enforcement | Internal Normalized FormatAC-04 (25)Information Flow Enforcement | Data SanitizationAC-04 (26)Information Flow Enforcement | Audit Filtering ActionsAC-04 (27)Information Flow Enforcement | Redundant/independent Filtering MechanismsAC-04 (28)Information Flow Enforcement | Linear Filter PipelinesAC-04 (29)Information Flow Enforcement | Filter Orchestration EnginesAC-04 (30)Information Flow Enforcement | Filter Mechanisms Using Multiple ProcessesAC-04 (31)Information Flow Enforcement | Failed Content Transfer PreventionAC-04 (32)Information Flow Enforcement | Process Requirements for Information TransferAC-05Separation of DutiesAC-06Least PrivilegeAC-06 (01)Least Privilege | Authorize Access to Security FunctionsAC-06 (02)Least Privilege | Non-privileged Access for Nonsecurity FunctionsAC-06 (03)Least Privilege | Network Access to Privileged CommandsAC-06 (04)Least Privilege | Separate Processing DomainsAC-06 (05)Least Privilege | Privileged AccountsAC-06 (06)Least Privilege | Privileged Access by Non-organizational UsersAC-06 (07)Least Privilege | Review of User PrivilegesAC-06 (08)Least Privilege | Privilege Levels for Code ExecutionAC-06 (09)Least Privilege | Log Use of Privileged FunctionsAC-06 (10)Least Privilege | Prohibit Non-privileged Users from Executing Privileged FunctionsAC-07Unsuccessful Logon AttemptsAC-07 (02)Unsuccessful Logon Attempts | Purge or Wipe Mobile DeviceAC-07 (03)Unsuccessful Logon Attempts | Biometric Attempt LimitingAC-07 (04)Unsuccessful Logon Attempts | Use of Alternate Authentication FactorAC-08System Use NotificationAC-09Previous Logon NotificationAC-09 (01)Previous Logon Notification | Unsuccessful LogonsAC-09 (02)Previous Logon Notification | Successful and Unsuccessful LogonsAC-09 (03)Previous Logon Notification | Notification of Account ChangesAC-09 (04)Previous Logon Notification | Additional Logon InformationAC-10Concurrent Session ControlAC-11Device LockAC-11 (01)Device Lock | Pattern-hiding DisplaysAC-12Session TerminationAC-12 (01)Session Termination | User-initiated LogoutsAC-12 (02)Session Termination | Termination MessageAC-12 (03)Session Termination | Timeout Warning MessageAC-14Permitted Actions Without Identification or AuthenticationAC-16Security and Privacy AttributesAC-16 (01)Security and Privacy Attributes | Dynamic Attribute AssociationAC-16 (02)Security and Privacy Attributes | Attribute Value Changes by Authorized IndividualsAC-16 (03)Security and Privacy Attributes | Maintenance of Attribute Associations by SystemAC-16 (04)Security and Privacy Attributes | Association of Attributes by Authorized IndividualsAC-16 (05)Security and Privacy Attributes | Attribute Displays on Objects to Be OutputAC-16 (06)Security and Privacy Attributes | Maintenance of Attribute AssociationAC-16 (07)Security and Privacy Attributes | Consistent Attribute InterpretationAC-16 (08)Security and Privacy Attributes | Association Techniques and TechnologiesAC-16 (09)Security and Privacy Attributes | Attribute Reassignment — Regrading MechanismsAC-16 (10)Security and Privacy Attributes | Attribute Configuration by Authorized IndividualsAC-17Remote AccessAC-17 (01)Remote Access | Monitoring and ControlAC-17 (02)Remote Access | Protection of Confidentiality and Integrity Using EncryptionAC-17 (03)Remote Access | Managed Access Control PointsAC-17 (04)Remote Access | Privileged Commands and AccessAC-17 (06)Remote Access | Protection of Mechanism InformationAC-17 (09)Remote Access | Disconnect or Disable AccessAC-17 (10)Remote Access | Authenticate Remote CommandsAC-18Wireless AccessAC-18 (01)Wireless Access | Authentication and EncryptionAC-18 (03)Wireless Access | Disable Wireless NetworkingAC-18 (04)Wireless Access | Restrict Configurations by UsersAC-18 (05)Wireless Access | Antennas and Transmission Power LevelsAC-19Access Control for Mobile DevicesAC-19 (04)Access Control for Mobile Devices | Restrictions for Classified InformationAC-19 (05)Access Control for Mobile Devices | Full Device or Container-based EncryptionAC-20Use of External SystemsAC-20 (01)Use of External Systems | Limits on Authorized UseAC-20 (02)Use of External Systems | Portable Storage Devices — Restricted UseAC-20 (03)Use of External Systems | Non-organizationally Owned Systems — Restricted UseAC-20 (04)Use of External Systems | Network Accessible Storage Devices — Prohibited UseAC-20 (05)Use of External Systems | Portable Storage Devices — Prohibited UseAC-21Information SharingAC-21 (01)Information Sharing | Automated Decision SupportAC-21 (02)Information Sharing | Information Search and RetrievalAC-22Publicly Accessible ContentAC-23Data Mining ProtectionAC-24Access Control DecisionsAC-24 (01)Access Control Decisions | Transmit Access Authorization InformationAC-24 (02)Access Control Decisions | No User or Process IdentityAC-25Reference Monitor
Awareness and Training15
AT-01Policy and ProceduresAT-02Literacy Training and AwarenessAT-02 (01)Literacy Training and Awareness | Practical ExercisesAT-02 (02)Literacy Training and Awareness | Insider ThreatAT-02 (03)Literacy Training and Awareness | Social Engineering and MiningAT-02 (04)Literacy Training and Awareness | Suspicious Communications and Anomalous System BehaviorAT-02 (05)Literacy Training and Awareness | Advanced Persistent ThreatAT-02 (06)Literacy Training and Awareness | Cyber Threat EnvironmentAT-03Role-based TrainingAT-03 (01)Role-based Training | Environmental ControlsAT-03 (02)Role-based Training | Physical Security ControlsAT-03 (03)Role-based Training | Practical ExercisesAT-03 (05)Role-based Training | Processing Personally Identifiable InformationAT-04Training RecordsAT-06Training Feedback
Audit and Accountability56
AU-01Policy and ProceduresAU-02Event LoggingAU-03Content of Audit RecordsAU-03 (01)Content of Audit Records | Additional Audit InformationAU-03 (03)Content of Audit Records | Limit Personally Identifiable Information ElementsAU-04Audit Log Storage CapacityAU-04 (01)Audit Log Storage Capacity | Transfer to Alternate StorageAU-05Response to Audit Logging Process FailuresAU-05 (01)Response to Audit Logging Process Failures | Storage Capacity WarningAU-05 (02)Response to Audit Logging Process Failures | Real-time AlertsAU-05 (03)Response to Audit Logging Process Failures | Configurable Traffic Volume ThresholdsAU-05 (04)Response to Audit Logging Process Failures | Shutdown on FailureAU-05 (05)Response to Audit Logging Process Failures | Alternate Audit Logging CapabilityAU-06Audit Record Review, Analysis, and ReportingAU-06 (01)Audit Record Review, Analysis, and Reporting | Automated Process IntegrationAU-06 (03)Audit Record Review, Analysis, and Reporting | Correlate Audit Record RepositoriesAU-06 (04)Audit Record Review, Analysis, and Reporting | Central Review and AnalysisAU-06 (05)Audit Record Review, Analysis, and Reporting | Integrated Analysis of Audit RecordsAU-06 (06)Audit Record Review, Analysis, and Reporting | Correlation with Physical MonitoringAU-06 (07)Audit Record Review, Analysis, and Reporting | Permitted ActionsAU-06 (08)Audit Record Review, Analysis, and Reporting | Full Text Analysis of Privileged CommandsAU-06 (09)Audit Record Review, Analysis, and Reporting | Correlation with Information from Nontechnical SourcesAU-07Audit Record Reduction and Report GenerationAU-07 (01)Audit Record Reduction and Report Generation | Automatic ProcessingAU-08Time StampsAU-09Protection of Audit InformationAU-09 (01)Protection of Audit Information | Hardware Write-once MediaAU-09 (02)Protection of Audit Information | Store on Separate Physical Systems or ComponentsAU-09 (03)Protection of Audit Information | Cryptographic ProtectionAU-09 (04)Protection of Audit Information | Access by Subset of Privileged UsersAU-09 (05)Protection of Audit Information | Dual AuthorizationAU-09 (06)Protection of Audit Information | Read-only AccessAU-09 (07)Protection of Audit Information | Store on Component with Different Operating SystemAU-10Non-repudiationAU-10 (01)Non-repudiation | Association of IdentitiesAU-10 (02)Non-repudiation | Validate Binding of Information Producer IdentityAU-10 (03)Non-repudiation | Chain of CustodyAU-10 (04)Non-repudiation | Validate Binding of Information Reviewer IdentityAU-11Audit Record RetentionAU-11 (01)Audit Record Retention | Long-term Retrieval CapabilityAU-12Audit Record GenerationAU-12 (01)Audit Record Generation | System-wide and Time-correlated Audit TrailAU-12 (02)Audit Record Generation | Standardized FormatsAU-12 (03)Audit Record Generation | Changes by Authorized IndividualsAU-12 (04)Audit Record Generation | Query Parameter Audits of Personally Identifiable InformationAU-13Monitoring for Information DisclosureAU-13 (01)Monitoring for Information Disclosure | Use of Automated ToolsAU-13 (02)Monitoring for Information Disclosure | Review of Monitored SitesAU-13 (03)Monitoring for Information Disclosure | Unauthorized Replication of InformationAU-14Session AuditAU-14 (01)Session Audit | System Start-upAU-14 (03)Session Audit | Remote Viewing and ListeningAU-16Cross-organizational Audit LoggingAU-16 (01)Cross-organizational Audit Logging | Identity PreservationAU-16 (02)Cross-organizational Audit Logging | Sharing of Audit InformationAU-16 (03)Cross-organizational Audit Logging | Disassociability
Assessment, Authorization, and Monitoring25
CA-01Policy and ProceduresCA-02Control AssessmentsCA-02 (01)Control Assessments | Independent AssessorsCA-02 (02)Control Assessments | Specialized AssessmentsCA-02 (03)Control Assessments | Leveraging Results from External OrganizationsCA-03Information ExchangeCA-03 (06)Information Exchange | Transfer AuthorizationsCA-03 (07)Information Exchange | Transitive Information ExchangesCA-05Plan of Action and MilestonesCA-05 (01)Plan of Action and Milestones | Automation Support for Accuracy and CurrencyCA-06AuthorizationCA-06 (01)Authorization | Joint Authorization — Intra-organizationCA-06 (02)Authorization | Joint Authorization — Inter-organizationCA-07Continuous MonitoringCA-07 (01)Continuous Monitoring | Independent AssessmentCA-07 (03)Continuous Monitoring | Trend AnalysesCA-07 (04)Continuous Monitoring | Risk MonitoringCA-07 (05)Continuous Monitoring | Consistency AnalysisCA-07 (06)Continuous Monitoring | Automation Support for MonitoringCA-08Penetration TestingCA-08 (01)Penetration Testing | Independent Penetration Testing Agent or TeamCA-08 (02)Penetration Testing | Red Team ExercisesCA-08 (03)Penetration Testing | Facility Penetration TestingCA-09Internal System ConnectionsCA-09 (01)Internal System Connections | Compliance Checks
Configuration Management56
CM-01Policy and ProceduresCM-02Baseline ConfigurationCM-02 (02)Baseline Configuration | Automation Support for Accuracy and CurrencyCM-02 (03)Baseline Configuration | Retention of Previous ConfigurationsCM-02 (06)Baseline Configuration | Development and Test EnvironmentsCM-02 (07)Baseline Configuration | Configure Systems and Components for High-risk AreasCM-03Configuration Change ControlCM-03 (01)Configuration Change Control | Automated Documentation, Notification, and Prohibition of ChangesCM-03 (02)Configuration Change Control | Testing, Validation, and Documentation of ChangesCM-03 (03)Configuration Change Control | Automated Change ImplementationCM-03 (04)Configuration Change Control | Security and Privacy RepresentativesCM-03 (05)Configuration Change Control | Automated Security ResponseCM-03 (06)Configuration Change Control | Cryptography ManagementCM-03 (07)Configuration Change Control | Review System ChangesCM-03 (08)Configuration Change Control | Prevent or Restrict Configuration ChangesCM-04Impact AnalysesCM-04 (01)Impact Analyses | Separate Test EnvironmentsCM-04 (02)Impact Analyses | Verification of ControlsCM-05Access Restrictions for ChangeCM-05 (01)Access Restrictions for Change | Automated Access Enforcement and Audit RecordsCM-05 (04)Access Restrictions for Change | Dual AuthorizationCM-05 (05)Access Restrictions for Change | Privilege Limitation for Production and OperationCM-05 (06)Access Restrictions for Change | Limit Library PrivilegesCM-06Configuration SettingsCM-06 (01)Configuration Settings | Automated Management, Application, and VerificationCM-06 (02)Configuration Settings | Respond to Unauthorized ChangesCM-07Least FunctionalityCM-07 (01)Least Functionality | Periodic ReviewCM-07 (02)Least Functionality | Prevent Program ExecutionCM-07 (03)Least Functionality | Registration ComplianceCM-07 (04)Least Functionality | Unauthorized Software — Deny-by-exceptionCM-07 (05)Least Functionality | Authorized Software — Allow-by-exceptionCM-07 (06)Least Functionality | Confined Environments with Limited PrivilegesCM-07 (07)Least Functionality | Code Execution in Protected EnvironmentsCM-07 (08)Least Functionality | Binary or Machine Executable CodeCM-07 (09)Least Functionality | Prohibiting The Use of Unauthorized HardwareCM-08System Component InventoryCM-08 (01)System Component Inventory | Updates During Installation and RemovalCM-08 (02)System Component Inventory | Automated MaintenanceCM-08 (03)System Component Inventory | Automated Unauthorized Component DetectionCM-08 (04)System Component Inventory | Accountability InformationCM-08 (06)System Component Inventory | Assessed Configurations and Approved DeviationsCM-08 (07)System Component Inventory | Centralized RepositoryCM-08 (08)System Component Inventory | Automated Location TrackingCM-08 (09)System Component Inventory | Assignment of Components to SystemsCM-09Configuration Management PlanCM-09 (01)Configuration Management Plan | Assignment of ResponsibilityCM-10Software Usage RestrictionsCM-10 (01)Software Usage Restrictions | Open-source SoftwareCM-11User-installed SoftwareCM-11 (02)User-installed Software | Software Installation with Privileged StatusCM-11 (03)User-installed Software | Automated Enforcement and MonitoringCM-12Information LocationCM-12 (01)Information Location | Automated Tools to Support Information LocationCM-13Data Action MappingCM-14Signed Components
Contingency Planning49
CP-01Policy and ProceduresCP-02Contingency PlanCP-02 (01)Contingency Plan | Coordinate with Related PlansCP-02 (02)Contingency Plan | Capacity PlanningCP-02 (03)Contingency Plan | Resume Mission and Business FunctionsCP-02 (05)Contingency Plan | Continue Mission and Business FunctionsCP-02 (06)Contingency Plan | Alternate Processing and Storage SitesCP-02 (07)Contingency Plan | Coordinate with External Service ProvidersCP-02 (08)Contingency Plan | Identify Critical AssetsCP-03Contingency TrainingCP-03 (01)Contingency Training | Simulated EventsCP-03 (02)Contingency Training | Mechanisms Used in Training EnvironmentsCP-04Contingency Plan TestingCP-04 (01)Contingency Plan Testing | Coordinate with Related PlansCP-04 (02)Contingency Plan Testing | Alternate Processing SiteCP-04 (03)Contingency Plan Testing | Automated TestingCP-04 (04)Contingency Plan Testing | Full Recovery and ReconstitutionCP-04 (05)Contingency Plan Testing | Self-challengeCP-06Alternate Storage SiteCP-06 (01)Alternate Storage Site | Separation from Primary SiteCP-06 (02)Alternate Storage Site | Recovery Time and Recovery Point ObjectivesCP-06 (03)Alternate Storage Site | AccessibilityCP-07Alternate Processing SiteCP-07 (01)Alternate Processing Site | Separation from Primary SiteCP-07 (02)Alternate Processing Site | AccessibilityCP-07 (03)Alternate Processing Site | Priority of ServiceCP-07 (04)Alternate Processing Site | Preparation for UseCP-07 (06)Alternate Processing Site | Inability to Return to Primary SiteCP-08Telecommunications ServicesCP-08 (01)Telecommunications Services | Priority of Service ProvisionsCP-08 (02)Telecommunications Services | Single Points of FailureCP-08 (03)Telecommunications Services | Separation of Primary and Alternate ProvidersCP-08 (04)Telecommunications Services | Provider Contingency PlanCP-08 (05)Telecommunications Services | Alternate Telecommunication Service TestingCP-09System BackupCP-09 (01)System Backup | Testing for Reliability and IntegrityCP-09 (02)System Backup | Test Restoration Using SamplingCP-09 (03)System Backup | Separate Storage for Critical InformationCP-09 (05)System Backup | Transfer to Alternate Storage SiteCP-09 (06)System Backup | Redundant Secondary SystemCP-09 (07)System Backup | Dual Authorization for Deletion or DestructionCP-09 (08)System Backup | Cryptographic ProtectionCP-10System Recovery and ReconstitutionCP-10 (02)System Recovery and Reconstitution | Transaction RecoveryCP-10 (04)System Recovery and Reconstitution | Restore Within Time PeriodCP-10 (06)System Recovery and Reconstitution | Component ProtectionCP-11Alternate Communications ProtocolsCP-12Safe ModeCP-13Alternative Security Mechanisms
Identification and Authentication59
IA-01Policy and ProceduresIA-02Identification and Authentication (organizational Users)IA-02 (01)Identification and Authentication (organizational Users) | Multi-factor Authentication to Privileged AccountsIA-02 (02)Identification and Authentication (organizational Users) | Multi-factor Authentication to Non-privileged AccountsIA-02 (05)Identification and Authentication (organizational Users) | Individual Authentication with Group AuthenticationIA-02 (06)Identification and Authentication (organizational Users) | Access to Accounts —separate DeviceIA-02 (08)Identification and Authentication (organizational Users) | Access to Accounts — Replay ResistantIA-02 (10)Identification and Authentication (organizational Users) | Single Sign-onIA-02 (12)Identification and Authentication (organizational Users) | Acceptance of PIV CredentialsIA-02 (13)Identification and Authentication (organizational Users) | Out-of-band AuthenticationIA-03Device Identification and AuthenticationIA-03 (01)Device Identification and Authentication | Cryptographic Bidirectional AuthenticationIA-03 (03)Device Identification and Authentication | Dynamic Address AllocationIA-03 (04)Device Identification and Authentication | Device AttestationIA-04Identifier ManagementIA-04 (01)Identifier Management | Prohibit Account Identifiers as Public IdentifiersIA-04 (04)Identifier Management | Identify User StatusIA-04 (05)Identifier Management | Dynamic ManagementIA-04 (06)Identifier Management | Cross-organization ManagementIA-04 (08)Identifier Management | Pairwise Pseudonymous IdentifiersIA-04 (09)Identifier Management | Attribute Maintenance and ProtectionIA-05Authenticator ManagementIA-05 (01)Authenticator Management | Password-based AuthenticationIA-05 (02)Authenticator Management | Public Key-based AuthenticationIA-05 (05)Authenticator Management | Change Authenticators Prior to DeliveryIA-05 (06)Authenticator Management | Protection of AuthenticatorsIA-05 (07)Authenticator Management | No Embedded Unencrypted Static AuthenticatorsIA-05 (08)Authenticator Management | Multiple System AccountsIA-05 (09)Authenticator Management | Federated Credential ManagementIA-05 (10)Authenticator Management | Dynamic Credential BindingIA-05 (12)Authenticator Management | Biometric Authentication PerformanceIA-05 (13)Authenticator Management | Expiration of Cached AuthenticatorsIA-05 (14)Authenticator Management | Managing Content of PKI Trust StoresIA-05 (15)Authenticator Management | GSA-approved Products and ServicesIA-05 (16)Authenticator Management | In-person or Trusted External Party Authenticator IssuanceIA-05 (17)Authenticator Management | Presentation Attack Detection for Biometric AuthenticatorsIA-05 (18)Authenticator Management | Password ManagersIA-06Authentication FeedbackIA-07Cryptographic Module AuthenticationIA-08Identification and Authentication (non-organizational Users)IA-08 (01)Identification and Authentication (non-organizational Users) | Acceptance of PIV Credentials from Other AgenciesIA-08 (02)Identification and Authentication (non-organizational Users) | Acceptance of External AuthenticatorsIA-08 (04)Identification and Authentication (non-organizational Users) | Use of Defined ProfilesIA-08 (05)Identification and Authentication (non-organizational Users) | Acceptance of PVI-I CredentialsIA-08 (06)Identification and Authentication (non-organizational Users) | DisassociabilityIA-09Service Identification and AuthenticationIA-10Adaptive AuthenticationIA-11Re-authenticationIA-12Identity ProofingIA-12 (01)Identity Proofing | Supervisor AuthorizationIA-12 (02)Identity Proofing | Identity EvidenceIA-12 (03)Identity Proofing | Identity Evidence Validation and VerificationIA-12 (04)Identity Proofing | In-person Validation and VerificationIA-12 (05)Identity Proofing | Address ConfirmationIA-12 (06)Identity Proofing | Accept Externally-proofed IdentitiesIA-13Identity Providers And Authorization ServersIA-13(01)Identity Providers And Authorization Servers | Protection Of Cryptographic KeysIA-13(02)Identity Providers And Authorization Servers | Verification Of Identity Assertions And Access TokensIA-13(03)Identity Providers And Authorization Servers | Token Management
Incident Response40
IR-01Policy and ProceduresIR-02Incident Response TrainingIR-02 (01)Incident Response Training | Simulated EventsIR-02 (02)Incident Response Training | Automated Training EnvironmentsIR-02 (03)Incident Response Training | BreachIR-03Incident Response TestingIR-03 (01)Incident Response Testing | Automated TestingIR-03 (02)Incident Response Testing | Coordination with Related PlansIR-03 (03)Incident Response Testing | Continuous ImprovementIR-04Incident HandlingIR-04 (01)Incident Handling | Automated Incident Handling ProcessesIR-04 (02)Incident Handling | Dynamic ReconfigurationIR-04 (03)Incident Handling | Continuity of OperationsIR-04 (04)Incident Handling | Information CorrelationIR-04 (05)Incident Handling | Automatic Disabling of SystemIR-04 (06)Incident Handling | Insider ThreatsIR-04 (07)Incident Handling | Insider Threats — Intra-organization CoordinationIR-04 (08)Incident Handling | Correlation with External OrganizationsIR-04 (09)Incident Handling | Dynamic Response CapabilityIR-04 (10)Incident Handling | Supply Chain CoordinationIR-04 (11)Incident Handling | Integrated Incident Response TeamIR-04 (12)Incident Handling | Malicious Code and Forensic AnalysisIR-04 (13)Incident Handling | Behavior AnalysisIR-04 (14)Incident Handling | Security Operations CenterIR-04 (15)Incident Handling | Public Relations and Reputation RepairIR-05Incident MonitoringIR-05 (01)Incident Monitoring | Automated Tracking, Data Collection, and AnalysisIR-06Incident ReportingIR-06 (01)Incident Reporting | Automated ReportingIR-06 (02)Incident Reporting | Vulnerabilities Related to IncidentsIR-06 (03)Incident Reporting | Supply Chain CoordinationIR-07Incident Response AssistanceIR-07 (01)Incident Response Assistance | Automation Support for Availability of Information and SupportIR-07 (02)Incident Response Assistance | Coordination with External ProvidersIR-08Incident Response PlanIR-08 (01)Incident Response Plan | BreachesIR-09Information Spillage ResponseIR-09 (02)Information Spillage Response | TrainingIR-09 (03)Information Spillage Response | Post-spill OperationsIR-09 (04)Information Spillage Response | Exposure to Unauthorized Personnel
Maintenance28
MA-01Policy and ProceduresMA-02Controlled MaintenanceMA-02 (02)Controlled Maintenance | Automated Maintenance ActivitiesMA-03Maintenance ToolsMA-03 (01)Maintenance Tools | Inspect ToolsMA-03 (02)Maintenance Tools | Inspect MediaMA-03 (03)Maintenance Tools | Prevent Unauthorized RemovalMA-03 (04)Maintenance Tools | Restricted Tool UseMA-03 (05)Maintenance Tools | Execution with PrivilegeMA-03 (06)Maintenance Tools | Software Updates and PatchesMA-04Nonlocal MaintenanceMA-04 (01)Nonlocal Maintenance | Logging and ReviewMA-04 (03)Nonlocal Maintenance | Comparable Security and SanitizationMA-04 (04)Nonlocal Maintenance | Authentication and Separation of Maintenance SessionsMA-04 (05)Nonlocal Maintenance | Approvals and NotificationsMA-04 (06)Nonlocal Maintenance | Cryptographic ProtectionMA-04 (07)Nonlocal Maintenance | Disconnect VerificationMA-05Maintenance PersonnelMA-05 (01)Maintenance Personnel | Individuals Without Appropriate AccessMA-05 (02)Maintenance Personnel | Security Clearances for Classified SystemsMA-05 (03)Maintenance Personnel | Citizenship Requirements for Classified SystemsMA-05 (04)Maintenance Personnel | Foreign NationalsMA-05 (05)Maintenance Personnel | Non-system MaintenanceMA-06Timely MaintenanceMA-06 (01)Timely Maintenance | Preventive MaintenanceMA-06 (02)Timely Maintenance | Predictive MaintenanceMA-06 (03)Timely Maintenance | Automated Support for Predictive MaintenanceMA-07Field Maintenance
Media Protection20
MP-01Policy and ProceduresMP-02Media AccessMP-03Media MarkingMP-04Media StorageMP-04 (02)Media Storage | Automated Restricted AccessMP-05Media TransportMP-05 (03)Media Transport | CustodiansMP-06Media SanitizationMP-06 (01)Media Sanitization | Review, Approve, Track, Document, and VerifyMP-06 (02)Media Sanitization | Equipment TestingMP-06 (03)Media Sanitization | Nondestructive TechniquesMP-06 (07)Media Sanitization | Dual AuthorizationMP-06 (08)Media Sanitization | Remote Purging or Wiping of InformationMP-07Media UseMP-07 (02)Media Use | Prohibit Use of Sanitization-resistant MediaMP-08Media DowngradingMP-08 (01)Media Downgrading | Documentation of ProcessMP-08 (02)Media Downgrading | Equipment TestingMP-08 (03)Media Downgrading | Controlled Unclassified InformationMP-08 (04)Media Downgrading | Classified Information
Physical and Environmental Protection51
PE-01Policy and ProceduresPE-02Physical Access AuthorizationsPE-02 (01)Physical Access Authorizations | Access by Position or RolePE-02 (02)Physical Access Authorizations | Two Forms of IdentificationPE-02 (03)Physical Access Authorizations | Restrict Unescorted AccessPE-03Physical Access ControlPE-03 (01)Physical Access Control | System AccessPE-03 (02)Physical Access Control | Facility and SystemsPE-03 (03)Physical Access Control | Continuous GuardsPE-03 (04)Physical Access Control | Lockable CasingsPE-03 (05)Physical Access Control | Tamper ProtectionPE-03 (07)Physical Access Control | Physical BarriersPE-03 (08)Physical Access Control | Access Control VestibulesPE-04Access Control for TransmissionPE-05Access Control for Output DevicesPE-05 (02)Access Control for Output Devices | Link to Individual IdentityPE-06Monitoring Physical AccessPE-06 (01)Monitoring Physical Access | Intrusion Alarms and Surveillance EquipmentPE-06 (02)Monitoring Physical Access | Automated Intrusion Recognition and ResponsesPE-06 (03)Monitoring Physical Access | Video SurveillancePE-06 (04)Monitoring Physical Access | Monitoring Physical Access to SystemsPE-08Visitor Access RecordsPE-08 (01)Visitor Access Records | Automated Records Maintenance and ReviewPE-08 (03)Visitor Access Records | Limit Personally Identifiable Information ElementsPE-09Power Equipment and CablingPE-09 (01)Power Equipment and Cabling | Redundant CablingPE-09 (02)Power Equipment and Cabling | Automatic Voltage ControlsPE-10Emergency ShutoffPE-11Emergency PowerPE-11 (01)Emergency Power | Alternate Power Supply — Minimal Operational CapabilityPE-11 (02)Emergency Power | Alternate Power Supply — Self-containedPE-12Emergency LightingPE-12 (01)Emergency Lighting | Essential Mission and Business FunctionsPE-13Fire ProtectionPE-13 (01)Fire Protection | Detection Systems — Automatic Activation and NotificationPE-13 (02)Fire Protection | Suppression Systems — Automatic Activation and NotificationPE-13 (04)Fire Protection | InspectionsPE-14Environmental ControlsPE-14 (01)Environmental Controls | Automatic ControlsPE-14 (02)Environmental Controls | Monitoring with Alarms and NotificationsPE-15Water Damage ProtectionPE-15 (01)Water Damage Protection | Automation SupportPE-16Delivery and RemovalPE-17Alternate Work SitePE-18Location of System ComponentsPE-19Information LeakagePE-19 (01)Information Leakage | National Emissions Policies and ProceduresPE-20Asset Monitoring and TrackingPE-21Electromagnetic Pulse ProtectionPE-22Component MarkingPE-23Facility Location
Planning11
PL-01Policy and ProceduresPL-02System Security and Privacy PlansPL-04Rules of BehaviorPL-04 (01)Rules of Behavior | Social Media and External Site/application Usage RestrictionsPL-07Concept of OperationsPL-08Security and Privacy ArchitecturesPL-08 (01)Security and Privacy Architectures | Defense in DepthPL-08 (02)Security and Privacy Architectures | Supplier DiversityPL-09Central ManagementPL-10Baseline SelectionPL-11Baseline Tailoring
Program Management37
PM-01Information Security Program PlanPM-02Information Security Program Leadership RolePM-03Information Security and Privacy ResourcesPM-04Plan of Action and Milestones ProcessPM-05System InventoryPM-05 (01)System Inventory | Inventory of Personally Identifiable InformationPM-06Measures of PerformancePM-07Enterprise ArchitecturePM-07 (01)Enterprise Architecture | OffloadingPM-08Critical Infrastructure PlanPM-09Risk Management StrategyPM-10Authorization ProcessPM-11Mission and Business Process DefinitionPM-12Insider Threat ProgramPM-13Security and Privacy WorkforcePM-14Testing, Training, and MonitoringPM-15Security and Privacy Groups and AssociationsPM-16Threat Awareness ProgramPM-16 (01)Threat Awareness Program | Automated Means for Sharing Threat IntelligencePM-17Protecting Controlled Unclassified Information on External SystemsPM-18Privacy Program PlanPM-19Privacy Program Leadership RolePM-20Dissemination of Privacy Program InformationPM-20 (01)Dissemination of Privacy Program Information | Privacy Policies on Websites, Applications, and Digital ServicesPM-21Accounting of DisclosuresPM-22Personally Identifiable Information Quality ManagementPM-23Data Governance BodyPM-24Data Integrity BoardPM-25Minimization of Personally Identifiable Information Used in Testing, Training, and ResearchPM-26Complaint ManagementPM-27Privacy ReportingPM-28Risk FramingPM-29Risk Management Program Leadership RolesPM-30Supply Chain Risk Management StrategyPM-30 (01)Supply Chain Risk Management Strategy | Suppliers of Critical or Mission-essential ItemsPM-31Continuous Monitoring StrategyPM-32Purposing
Personnel Security17
PS-01Policy and ProceduresPS-02Position Risk DesignationPS-03Personnel ScreeningPS-03 (01)Personnel Screening | Classified InformationPS-03 (02)Personnel Screening | Formal IndoctrinationPS-03 (03)Personnel Screening | Information Requiring Special Protective MeasuresPS-03 (04)Personnel Screening | Citizenship RequirementsPS-04Personnel TerminationPS-04 (01)Personnel Termination | Post-employment RequirementsPS-04 (02)Personnel Termination | Automated ActionsPS-05Personnel TransferPS-06Access AgreementsPS-06 (02)Access Agreements | Classified Information Requiring Special ProtectionPS-06 (03)Access Agreements | Post-employment RequirementsPS-07External Personnel SecurityPS-08Personnel SanctionsPS-09Position Descriptions
Personally Identifiable Information Processing and Transparency21
PT-01Policy and ProceduresPT-02Authority to Process Personally Identifiable InformationPT-02 (01)Authority to Process Personally Identifiable Information | Data TaggingPT-02 (02)Authority to Process Personally Identifiable Information | AutomationPT-03Personally Identifiable Information Processing PurposesPT-03 (01)Personally Identifiable Information Processing Purposes | Data TaggingPT-03 (02)Personally Identifiable Information Processing Purposes | AutomationPT-04ConsentPT-04 (01)Consent | Tailored ConsentPT-04 (02)Consent | Just-in-time ConsentPT-04 (03)Consent | RevocationPT-05Privacy NoticePT-05 (01)Privacy Notice | Just-in-time NoticePT-05 (02)Privacy Notice | Privacy Act StatementsPT-06System of Records NoticePT-06 (01)System of Records Notice | Routine UsesPT-06 (02)System of Records Notice | Exemption RulesPT-07Specific Categories of Personally Identifiable InformationPT-07 (01)Specific Categories of Personally Identifiable Information | Social Security NumbersPT-07 (02)Specific Categories of Personally Identifiable Information | First Amendment InformationPT-08Computer Matching Requirements
Risk Assessment22
RA-01Policy and ProceduresRA-02Security CategorizationRA-02 (01)Security Categorization | Impact-level PrioritizationRA-03Risk AssessmentRA-03 (01)Risk Assessment | Supply Chain Risk AssessmentRA-03 (02)Risk Assessment | Use of All-source IntelligenceRA-03 (03)Risk Assessment | Dynamic Threat AwarenessRA-03 (04)Risk Assessment | Predictive Cyber AnalyticsRA-05Vulnerability Monitoring and ScanningRA-05 (02)Vulnerability Monitoring and Scanning | Update Vulnerabilities to Be ScannedRA-05 (03)Vulnerability Monitoring and Scanning | Breadth and Depth of CoverageRA-05 (04)Vulnerability Monitoring and Scanning | Discoverable InformationRA-05 (05)Vulnerability Monitoring and Scanning | Privileged AccessRA-05 (06)Vulnerability Monitoring and Scanning | Automated Trend AnalysesRA-05 (08)Vulnerability Monitoring and Scanning | Review Historic Audit LogsRA-05 (10)Vulnerability Monitoring and Scanning | Correlate Scanning InformationRA-05 (11)Vulnerability Monitoring and Scanning | Public Disclosure ProgramRA-06Technical Surveillance Countermeasures SurveyRA-07Risk ResponseRA-08Privacy Impact AssessmentsRA-09Criticality AnalysisRA-10Threat Hunting
System and Services Acquisition106
SA-01Policy and ProceduresSA-02Allocation of ResourcesSA-03System Development Life CycleSA-03 (01)System Development Life Cycle | Manage Preproduction EnvironmentSA-03 (02)System Development Life Cycle | Use of Live or Operational DataSA-03 (03)System Development Life Cycle | Technology RefreshSA-04Acquisition ProcessSA-04 (01)Acquisition Process | Functional Properties of ControlsSA-04 (02)Acquisition Process | Design and Implementation Information for ControlsSA-04 (03)Acquisition Process | Development Methods, Techniques, and PracticesSA-04 (05)Acquisition Process | System, Component, and Service ConfigurationsSA-04 (06)Acquisition Process | Use of Information Assurance ProductsSA-04 (07)Acquisition Process | NIAP-approved Protection ProfilesSA-04 (08)Acquisition Process | Continuous Monitoring Plan for ControlsSA-04 (09)Acquisition Process | Functions, Ports, Protocols, and Services in UseSA-04 (10)Acquisition Process | Use of Approved PIV ProductsSA-04 (11)Acquisition Process | System of RecordsSA-04 (12)Acquisition Process | Data OwnershipSA-05System DocumentationSA-08Security and Privacy Engineering PrinciplesSA-08 (01)Security and Privacy Engineering Principles | Clear AbstractionsSA-08 (02)Security and Privacy Engineering Principles | Least Common MechanismSA-08 (03)Security and Privacy Engineering Principles | Modularity and LayeringSA-08 (04)Security and Privacy Engineering Principles | Partially Ordered DependenciesSA-08 (05)Security and Privacy Engineering Principles | Efficiently Mediated AccessSA-08 (06)Security and Privacy Engineering Principles | Minimized SharingSA-08 (07)Security and Privacy Engineering Principles | Reduced ComplexitySA-08 (08)Security and Privacy Engineering Principles | Secure EvolvabilitySA-08 (09)Security and Privacy Engineering Principles | Trusted ComponentsSA-08 (10)Security and Privacy Engineering Principles | Hierarchical TrustSA-08 (11)Security and Privacy Engineering Principles | Inverse Modification ThresholdSA-08 (12)Security and Privacy Engineering Principles | Hierarchical ProtectionSA-08 (13)Security and Privacy Engineering Principles | Minimized Security ElementsSA-08 (14)Security and Privacy Engineering Principles | Least PrivilegeSA-08 (15)Security and Privacy Engineering Principles | Predicate PermissionSA-08 (16)Security and Privacy Engineering Principles | Self-reliant TrustworthinessSA-08 (17)Security and Privacy Engineering Principles | Secure Distributed CompositionSA-08 (18)Security and Privacy Engineering Principles | Trusted Communications ChannelsSA-08 (19)Security and Privacy Engineering Principles | Continuous ProtectionSA-08 (20)Security and Privacy Engineering Principles | Secure Metadata ManagementSA-08 (21)Security and Privacy Engineering Principles | Self-analysisSA-08 (22)Security and Privacy Engineering Principles | Accountability and TraceabilitySA-08 (23)Security and Privacy Engineering Principles | Secure DefaultsSA-08 (24)Security and Privacy Engineering Principles | Secure Failure and RecoverySA-08 (25)Security and Privacy Engineering Principles | Economic SecuritySA-08 (26)Security and Privacy Engineering Principles | Performance SecuritySA-08 (27)Security and Privacy Engineering Principles | Human Factored SecuritySA-08 (28)Security and Privacy Engineering Principles | Acceptable SecuritySA-08 (29)Security and Privacy Engineering Principles | Repeatable and Documented ProceduresSA-08 (30)Security and Privacy Engineering Principles | Procedural RigorSA-08 (31)Security and Privacy Engineering Principles | Secure System ModificationSA-08 (32)Security and Privacy Engineering Principles | Sufficient DocumentationSA-08 (33)Security and Privacy Engineering Principles | MinimizationSA-09External System ServicesSA-09 (01)External System Services | Risk Assessments and Organizational ApprovalsSA-09 (02)External System Services | Identification of Functions, Ports, Protocols, and ServicesSA-09 (03)External System Services | Establish and Maintain Trust Relationship with ProvidersSA-09 (04)External System Services | Consistent Interests of Consumers and ProvidersSA-09 (05)External System Services | Processing, Storage, and Service LocationSA-09 (06)External System Services | Organization-controlled Cryptographic KeysSA-09 (07)External System Services | Organization-controlled Integrity CheckingSA-09 (08)External System Services | Processing and Storage Location — U.S. JurisdictionSA-10Developer Configuration ManagementSA-10 (01)Developer Configuration Management | Software and Firmware Integrity VerificationSA-10 (02)Developer Configuration Management | Alternative Configuration Management ProcessesSA-10 (03)Developer Configuration Management | Hardware Integrity VerificationSA-10 (04)Developer Configuration Management | Trusted GenerationSA-10 (05)Developer Configuration Management | Mapping Integrity for Version ControlSA-10 (06)Developer Configuration Management | Trusted DistributionSA-10 (07)Developer Configuration Management | Security and Privacy RepresentativesSA-11Developer Testing and EvaluationSA-11 (01)Developer Testing and Evaluation | Static Code AnalysisSA-11 (02)Developer Testing and Evaluation | Threat Modeling and Vulnerability AnalysesSA-11 (03)Developer Testing and Evaluation | Independent Verification of Assessment Plans and EvidenceSA-11 (04)Developer Testing and Evaluation | Manual Code ReviewsSA-11 (05)Developer Testing and Evaluation | Penetration TestingSA-11 (06)Developer Testing and Evaluation | Attack Surface ReviewsSA-11 (07)Developer Testing and Evaluation | Verify Scope of Testing and EvaluationSA-11 (08)Developer Testing and Evaluation | Dynamic Code AnalysisSA-11 (09)Developer Testing and Evaluation | Interactive Application Security TestingSA-15Development Process, Standards, and ToolsSA-15 (01)Development Process, Standards, and Tools | Quality MetricsSA-15 (02)Development Process, Standards, and Tools | Security and Privacy Tracking ToolsSA-15 (03)Development Process, Standards, and Tools | Criticality AnalysisSA-15 (05)Development Process, Standards, and Tools | Attack Surface ReductionSA-15 (06)Development Process, Standards, and Tools | Continuous ImprovementSA-15 (07)Development Process, Standards, and Tools | Automated Vulnerability AnalysisSA-15 (08)Development Process, Standards, and Tools | Reuse of Threat and Vulnerability InformationSA-15 (10)Development Process, Standards, and Tools | Incident Response PlanSA-15 (11)Development Process, Standards, and Tools | Archive System or ComponentSA-15 (12)Development Process, Standards, and Tools | Minimize Personally Identifiable InformationSA-16Developer-provided TrainingSA-17Developer Security and Privacy Architecture and DesignSA-17 (01)Developer Security and Privacy Architecture and Design | Formal Policy ModelSA-17 (02)Developer Security and Privacy Architecture and Design | Security-relevant ComponentsSA-17 (03)Developer Security and Privacy Architecture and Design | Formal CorrespondenceSA-17 (04)Developer Security and Privacy Architecture and Design | Informal CorrespondenceSA-17 (05)Developer Security and Privacy Architecture and Design | Conceptually Simple DesignSA-17 (06)Developer Security and Privacy Architecture and Design | Structure for TestingSA-17 (07)Developer Security and Privacy Architecture and Design | Structure for Least PrivilegeSA-17 (08)Developer Security and Privacy Architecture and Design | OrchestrationSA-17 (09)Developer Security and Privacy Architecture and Design | Design DiversitySA-20Customized Development of Critical ComponentsSA-21Developer ScreeningSA-22Unsupported System ComponentsSA-23Specialization
System and Communications Protection139
SC-01Policy and ProceduresSC-02Separation of System and User FunctionalitySC-02 (01)Separation of System and User Functionality | Interfaces for Non-privileged UsersSC-02 (02)Separation of System and User Functionality | DisassociabilitySC-03Security Function IsolationSC-03 (01)Security Function Isolation | Hardware SeparationSC-03 (02)Security Function Isolation | Access and Flow Control FunctionsSC-03 (03)Security Function Isolation | Minimize Nonsecurity FunctionalitySC-03 (04)Security Function Isolation | Module Coupling and CohesivenessSC-03 (05)Security Function Isolation | Layered StructuresSC-04Information in Shared System ResourcesSC-04 (02)Information in Shared System Resources | Multilevel or Periods ProcessingSC-05Denial-of-service ProtectionSC-05 (01)Denial-of-service Protection | Restrict Ability to Attack Other SystemsSC-05 (02)Denial-of-service Protection | Capacity, Bandwidth, and RedundancySC-05 (03)Denial-of-service Protection | Detection and MonitoringSC-06Resource AvailabilitySC-07Boundary ProtectionSC-07 (03)Boundary Protection | Access PointsSC-07 (04)Boundary Protection | External Telecommunications ServicesSC-07 (05)Boundary Protection | Deny by Default — Allow by ExceptionSC-07 (07)Boundary Protection | Split Tunneling for Remote DevicesSC-07 (08)Boundary Protection | Route Traffic to Authenticated Proxy ServersSC-07 (09)Boundary Protection | Restrict Threatening Outgoing Communications TrafficSC-07 (10)Boundary Protection | Prevent ExfiltrationSC-07 (11)Boundary Protection | Restrict Incoming Communications TrafficSC-07 (12)Boundary Protection | Host-based ProtectionSC-07 (13)Boundary Protection | Isolation of Security Tools, Mechanisms, and Support ComponentsSC-07 (14)Boundary Protection | Protect Against Unauthorized Physical ConnectionsSC-07 (15)Boundary Protection | Networked Privileged AccessesSC-07 (16)Boundary Protection | Prevent Discovery of System ComponentsSC-07 (17)Boundary Protection | Automated Enforcement of Protocol FormatsSC-07 (18)Boundary Protection | Fail SecureSC-07 (19)Boundary Protection | Block Communication from Non-organizationally Configured HostsSC-07 (20)Boundary Protection | Dynamic Isolation and SegregationSC-07 (21)Boundary Protection | Isolation of System ComponentsSC-07 (22)Boundary Protection | Separate Subnets for Connecting to Different Security DomainsSC-07 (23)Boundary Protection | Disable Sender Feedback on Protocol Validation FailureSC-07 (24)Boundary Protection | Personally Identifiable InformationSC-07 (25)Boundary Protection | Unclassified National Security System ConnectionsSC-07 (26)Boundary Protection | Classified National Security System ConnectionsSC-07 (27)Boundary Protection | Unclassified Non-national Security System ConnectionsSC-07 (28)Boundary Protection | Connections to Public NetworksSC-07 (29)Boundary Protection | Separate Subnets to Isolate FunctionsSC-08Transmission Confidentiality and IntegritySC-08 (01)Transmission Confidentiality and Integrity | Cryptographic ProtectionSC-08 (02)Transmission Confidentiality and Integrity | Pre- and Post-transmission HandlingSC-08 (03)Transmission Confidentiality and Integrity | Cryptographic Protection for Message ExternalsSC-08 (04)Transmission Confidentiality and Integrity | Conceal or Randomize CommunicationsSC-08 (05)Transmission Confidentiality and Integrity | Protected Distribution SystemSC-10Network DisconnectSC-11Trusted PathSC-11 (01)Trusted Path | Irrefutable Communications PathSC-12Cryptographic Key Establishment and ManagementSC-12 (01)Cryptographic Key Establishment and Management | AvailabilitySC-12 (02)Cryptographic Key Establishment and Management | Symmetric KeysSC-12 (03)Cryptographic Key Establishment and Management | Asymmetric KeysSC-12 (06)Cryptographic Key Establishment and Management | Physical Control of KeysSC-13Cryptographic ProtectionSC-15Collaborative Computing Devices and ApplicationsSC-15 (01)Collaborative Computing Devices and Applications | Physical or Logical DisconnectSC-15 (03)Collaborative Computing Devices and Applications | Disabling and Removal in Secure Work AreasSC-15 (04)Collaborative Computing Devices and Applications | Explicitly Indicate Current ParticipantsSC-16Transmission of Security and Privacy AttributesSC-16 (01)Transmission of Security and Privacy Attributes | Integrity VerificationSC-16 (02)Transmission of Security and Privacy Attributes | Anti-spoofing MechanismsSC-16 (03)Transmission of Security and Privacy Attributes | Cryptographic BindingSC-17Public Key Infrastructure CertificatesSC-18Mobile CodeSC-18 (01)Mobile Code | Identify Unacceptable Code and Take Corrective ActionsSC-18 (02)Mobile Code | Acquisition, Development, and UseSC-18 (03)Mobile Code | Prevent Downloading and ExecutionSC-18 (04)Mobile Code | Prevent Automatic ExecutionSC-18 (05)Mobile Code | Allow Execution Only in Confined EnvironmentsSC-20Secure Name/address Resolution Service (authoritative Source)SC-20 (02)Secure Name/address Resolution Service (authoritative Source) | Data Origin and IntegritySC-21Secure Name/address Resolution Service (recursive or Caching Resolver)SC-22Architecture and Provisioning for Name/address Resolution ServiceSC-23Session AuthenticitySC-23 (01)Session Authenticity | Invalidate Session Identifiers at LogoutSC-23 (03)Session Authenticity | Unique System-generated Session IdentifiersSC-23 (05)Session Authenticity | Allowed Certificate AuthoritiesSC-24Fail in Known StateSC-25Thin NodesSC-26DecoysSC-27Platform-independent ApplicationsSC-28Protection of Information at RestSC-28 (01)Protection of Information at Rest | Cryptographic ProtectionSC-28 (02)Protection of Information at Rest | Offline StorageSC-28 (03)Protection of Information at Rest | Cryptographic KeysSC-29HeterogeneitySC-29 (01)Heterogeneity | Virtualization TechniquesSC-30Concealment and MisdirectionSC-30 (02)Concealment and Misdirection | RandomnessSC-30 (03)Concealment and Misdirection | Change Processing and Storage LocationsSC-30 (04)Concealment and Misdirection | Misleading InformationSC-30 (05)Concealment and Misdirection | Concealment of System ComponentsSC-31Covert Channel AnalysisSC-31 (01)Covert Channel Analysis | Test Covert Channels for ExploitabilitySC-31 (02)Covert Channel Analysis | Maximum BandwidthSC-31 (03)Covert Channel Analysis | Measure Bandwidth in Operational EnvironmentsSC-32System PartitioningSC-32 (01)System Partitioning | Separate Physical Domains for Privileged FunctionsSC-34Non-modifiable Executable ProgramsSC-34 (01)Non-modifiable Executable Programs | No Writable StorageSC-34 (02)Non-modifiable Executable Programs | Integrity Protection on Read-only MediaSC-35External Malicious Code IdentificationSC-36Distributed Processing and StorageSC-36 (01)Distributed Processing and Storage | Polling TechniquesSC-36 (02)Distributed Processing and Storage | SynchronizationSC-37Out-of-band ChannelsSC-37 (01)Out-of-band Channels | Ensure Delivery and TransmissionSC-38Operations SecuritySC-39Process IsolationSC-39 (01)Process Isolation | Hardware SeparationSC-39 (02)Process Isolation | Separate Execution Domain Per ThreadSC-40Wireless Link ProtectionSC-40 (01)Wireless Link Protection | Electromagnetic InterferenceSC-40 (02)Wireless Link Protection | Reduce Detection PotentialSC-40 (03)Wireless Link Protection | Imitative or Manipulative Communications DeceptionSC-40 (04)Wireless Link Protection | Signal Parameter IdentificationSC-41Port and I/O Device AccessSC-42Sensor Capability and DataSC-42 (01)Sensor Capability and Data | Reporting to Authorized Individuals or RolesSC-42 (02)Sensor Capability and Data | Authorized UseSC-42 (04)Sensor Capability and Data | Notice of CollectionSC-42 (05)Sensor Capability and Data | Collection MinimizationSC-43Usage RestrictionsSC-44Detonation ChambersSC-45System Time SynchronizationSC-45 (01)System Time Synchronization | Synchronization with Authoritative Time SourceSC-45 (02)System Time Synchronization | Secondary Authoritative Time SourceSC-46Cross Domain Policy EnforcementSC-47Alternate Communications PathsSC-48Sensor RelocationSC-48 (01)Sensor Relocation | Dynamic Relocation of Sensors or Monitoring CapabilitiesSC-49Hardware-enforced Separation and Policy EnforcementSC-50Software-enforced Separation and Policy EnforcementSC-51Hardware-based Protection
System and Information Integrity101
SI-01Policy and ProceduresSI-02Flaw RemediationSI-02 (02)Flaw Remediation | Automated Flaw Remediation StatusSI-02 (03)Flaw Remediation | Time to Remediate Flaws and Benchmarks for Corrective ActionsSI-02 (04)Flaw Remediation | Automated Patch Management ToolsSI-02 (05)Flaw Remediation | Automatic Software and Firmware UpdatesSI-02 (06)Flaw Remediation | Removal of Previous Versions of Software and FirmwareSI-03Malicious Code ProtectionSI-03 (04)Malicious Code Protection | Updates Only by Privileged UsersSI-03 (06)Malicious Code Protection | Testing and VerificationSI-03 (08)Malicious Code Protection | Detect Unauthorized CommandsSI-03 (10)Malicious Code Protection | Malicious Code AnalysisSI-04System MonitoringSI-04 (01)System Monitoring | System-wide Intrusion Detection SystemSI-04 (02)System Monitoring | Automated Tools and Mechanisms for Real-time AnalysisSI-04 (03)System Monitoring | Automated Tool and Mechanism IntegrationSI-04 (04)System Monitoring | Inbound and Outbound Communications TrafficSI-04 (05)System Monitoring | System-generated AlertsSI-04 (07)System Monitoring | Automated Response to Suspicious EventsSI-04 (09)System Monitoring | Testing of Monitoring Tools and MechanismsSI-04 (10)System Monitoring | Visibility of Encrypted CommunicationsSI-04 (11)System Monitoring | Analyze Communications Traffic AnomaliesSI-04 (12)System Monitoring | Automated Organization-generated AlertsSI-04 (13)System Monitoring | Analyze Traffic and Event PatternsSI-04 (14)System Monitoring | Wireless Intrusion DetectionSI-04 (15)System Monitoring | Wireless to Wireline CommunicationsSI-04 (16)System Monitoring | Correlate Monitoring InformationSI-04 (17)System Monitoring | Integrated Situational AwarenessSI-04 (18)System Monitoring | Analyze Traffic and Covert ExfiltrationSI-04 (19)System Monitoring | Risk for IndividualsSI-04 (20)System Monitoring | Privileged UsersSI-04 (21)System Monitoring | Probationary PeriodsSI-04 (22)System Monitoring | Unauthorized Network ServicesSI-04 (23)System Monitoring | Host-based DevicesSI-04 (24)System Monitoring | Indicators of CompromiseSI-04 (25)System Monitoring | Optimize Network Traffic AnalysisSI-05Security Alerts, Advisories, and DirectivesSI-05 (01)Security Alerts, Advisories, and Directives | Automated Alerts and AdvisoriesSI-06Security and Privacy Function VerificationSI-06 (02)Security and Privacy Function Verification | Automation Support for Distributed TestingSI-06 (03)Security and Privacy Function Verification | Report Verification ResultsSI-07Software, Firmware, and Information IntegritySI-07 (01)Software, Firmware, and Information Integrity | Integrity ChecksSI-07 (02)Software, Firmware, and Information Integrity | Automated Notifications of Integrity ViolationsSI-07 (03)Software, Firmware, and Information Integrity | Centrally Managed Integrity ToolsSI-07 (05)Software, Firmware, and Information Integrity | Automated Response to Integrity ViolationsSI-07 (06)Software, Firmware, and Information Integrity | Cryptographic ProtectionSI-07 (07)Software, Firmware, and Information Integrity | Integration of Detection and ResponseSI-07 (08)Software, Firmware, and Information Integrity | Auditing Capability for Significant EventsSI-07 (09)Software, Firmware, and Information Integrity | Verify Boot ProcessSI-07 (10)Software, Firmware, and Information Integrity | Protection of Boot FirmwareSI-07 (12)Software, Firmware, and Information Integrity | Integrity VerificationSI-07 (15)Software, Firmware, and Information Integrity | Code AuthenticationSI-07 (16)Software, Firmware, and Information Integrity | Time Limit on Process Execution Without SupervisionSI-07 (17)Software, Firmware, and Information Integrity | Runtime Application Self-protectionSI-08Spam ProtectionSI-08 (02)Spam Protection | Automatic UpdatesSI-08 (03)Spam Protection | Continuous Learning CapabilitySI-10Information Input ValidationSI-10 (01)Information Input Validation | Manual Override CapabilitySI-10 (02)Information Input Validation | Review and Resolve ErrorsSI-10 (03)Information Input Validation | Predictable BehaviorSI-10 (04)Information Input Validation | Timing InteractionsSI-10 (05)Information Input Validation | Restrict Inputs to Trusted Sources and Approved FormatsSI-10 (06)Information Input Validation | Injection PreventionSI-11Error HandlingSI-12Information Management and RetentionSI-12 (01)Information Management and Retention | Limit Personally Identifiable Information ElementsSI-12 (02)Information Management and Retention | Minimize Personally Identifiable Information in Testing, Training, and ResearchSI-12 (03)Information Management and Retention | Information DisposalSI-13Predictable Failure PreventionSI-13 (01)Predictable Failure Prevention | Transferring Component ResponsibilitiesSI-13 (03)Predictable Failure Prevention | Manual Transfer Between ComponentsSI-13 (04)Predictable Failure Prevention | Standby Component Installation and NotificationSI-13 (05)Predictable Failure Prevention | Failover CapabilitySI-14Non-persistenceSI-14 (01)Non-persistence | Refresh from Trusted SourcesSI-14 (02)Non-persistence | Non-persistent InformationSI-14 (03)Non-persistence | Non-persistent ConnectivitySI-15Information Output FilteringSI-16Memory ProtectionSI-17Fail-safe ProceduresSI-18Personally Identifiable Information Quality OperationsSI-18 (01)Personally Identifiable Information Quality Operations | Automation SupportSI-18 (02)Personally Identifiable Information Quality Operations | Data TagsSI-18 (03)Personally Identifiable Information Quality Operations | CollectionSI-18 (04)Personally Identifiable Information Quality Operations | Individual RequestsSI-18 (05)Personally Identifiable Information Quality Operations | Notice of Correction or DeletionSI-19De-identificationSI-19 (01)De-identification | CollectionSI-19 (02)De-identification | ArchivingSI-19 (03)De-identification | ReleaseSI-19 (04)De-identification | Removal, Masking, Encryption, Hashing, or Replacement of Direct IdentifiersSI-19 (05)De-identification | Statistical Disclosure ControlSI-19 (06)De-identification | Differential PrivacySI-19 (07)De-identification | Validated Algorithms and SoftwareSI-19 (08)De-identification | Motivated IntruderSI-20TaintingSI-21Information RefreshSI-22Information DiversitySI-23Information Fragmentation
Supply Chain Risk Management27
SR-01Policy and ProceduresSR-02Supply Chain Risk Management PlanSR-02 (01)Supply Chain Risk Management Plan | Establish SCRM TeamSR-03Supply Chain Controls and ProcessesSR-03 (01)Supply Chain Controls and Processes | Diverse Supply BaseSR-03 (02)Supply Chain Controls and Processes | Limitation of HarmSR-03 (03)Supply Chain Controls and Processes | Sub-tier Flow DownSR-04ProvenanceSR-04 (01)Provenance | IdentitySR-04 (02)Provenance | Track and TraceSR-04 (03)Provenance | Validate as Genuine and Not AlteredSR-04 (04)Provenance | Supply Chain Integrity — PedigreeSR-05Acquisition Strategies, Tools, and MethodsSR-05 (01)Acquisition Strategies, Tools, and Methods | Adequate SupplySR-05 (02)Acquisition Strategies, Tools, and Methods | Assessments Prior to Selection, Acceptance, Modification, or UpdateSR-06Supplier Assessments and ReviewsSR-06 (01)Supplier Assessments and Reviews | Testing and AnalysisSR-07Supply Chain Operations SecuritySR-08Notification AgreementsSR-09Tamper Resistance and DetectionSR-09 (01)Tamper Resistance and Detection | Multiple Stages of System Development Life CycleSR-10Inspection of Systems or ComponentsSR-11Component AuthenticitySR-11 (01)Component Authenticity | Anti-counterfeit TrainingSR-11 (02)Component Authenticity | Configuration Control for Component Service and RepairSR-11 (03)Component Authenticity | Anti-counterfeit ScanningSR-12Component Disposal