From 851c296c7bf92853bb77ba77b36a9c9f5364e005 Mon Sep 17 00:00:00 2001 From: Wendell Piez Date: Mon, 17 Oct 2022 14:55:29 -0400 Subject: [PATCH] Correcting validation error --- .../rev5/xml/NIST_SP-800-53_rev5_catalog.xml | 7338 ++++++++--------- .../rev5/xml/oscal-objectives-enhance.xsl | 38 +- 2 files changed, 3696 insertions(+), 3680 deletions(-) diff --git a/src/nist.gov/SP800-53/rev5/xml/NIST_SP-800-53_rev5_catalog.xml b/src/nist.gov/SP800-53/rev5/xml/NIST_SP-800-53_rev5_catalog.xml index ac3cdbc4..664c6259 100644 --- a/src/nist.gov/SP800-53/rev5/xml/NIST_SP-800-53_rev5_catalog.xml +++ b/src/nist.gov/SP800-53/rev5/xml/NIST_SP-800-53_rev5_catalog.xml @@ -1,8 +1,8 @@ - + Electronic Version of NIST SP 800-53 Rev 5 Controls and SP 800-53A Rev 5 Assessment Procedures - 2022-10-17T14:09:23.7475009-04:00 + 2022-10-17T14:53:10.1520111-04:00 5.2.3 1.0.0 @@ -165,116 +165,116 @@ - - -

an access control policy is developed and documented;

+ -

the access control policy is disseminated to ;

+ -

access control procedures to facilitate the implementation of the access control policy and associated controls are developed and documented;

+ -

the access control procedures are disseminated to ;

+ - - -

the access control policy addresses purpose;

+ -

the access control policy addresses scope;

+ -

the access control policy addresses roles;

+ -

the access control policy addresses responsibilities;

+ -

the access control policy addresses management commitment;

+ -

the access control policy addresses coordination among organizational entities;

+ -

the access control policy addresses compliance;

+ + -

the access control policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines;

+ + + -

the is designated to manage the development, documentation, and dissemination of the access control policy and procedures;

+ - - -

the current access control policy is reviewed and updated ;

+ -

the current access control policy is reviewed and updated following ;

+ + - -

the current access control procedures are reviewed and updated ;

+ -

the current access control procedures are reviewed and updated following .

+ + + + @@ -505,169 +505,169 @@ - - -

account types allowed for use within the system are defined and documented;

+ -

account types specifically prohibited for use within the system are defined and documented;

+ + -

account managers are assigned;

+ -

for group and role membership are required;

+ - -

authorized users of the system are specified;

+ -

group and role membership are specified;

+ - -

access authorizations (i.e., privileges) are specified for each account;

+ -

are specified for each account;

+ + + -

approvals are required by for requests to create accounts;

+ - -

accounts are created in accordance with ;

+ -

accounts are enabled in accordance with ;

+ -

accounts are modified in accordance with ;

+ -

accounts are disabled in accordance with ;

+ -

accounts are removed in accordance with ;

+ + -

the use of accounts is monitored;

+ - -

account managers and are notified within when accounts are no longer required;

+ -

account managers and are notified within when users are terminated or transferred;

+ -

account managers and are notified within when system usage or the need to know changes for an individual;

+ + - -

access to the system is authorized based on a valid access authorization;

+ -

access to the system is authorized based on intended system usage;

+ -

access to the system is authorized based on ;

+ + -

accounts are reviewed for compliance with account management requirements ;

+ - -

a process is established for changing shared or group account authenticators (if deployed) when individuals are removed from the group;

+ -

a process is implemented for changing shared or group account authenticators (if deployed) when individuals are removed from the group;

+ + - -

account management processes are aligned with personnel termination processes;

+ -

account management processes are aligned with personnel transfer processes.

+ + + @@ -732,8 +732,8 @@ -

the management of system accounts is supported using .

+ @@ -798,8 +798,8 @@ -

temporary and emergency accounts are automatically after .

+ @@ -881,27 +881,27 @@ - -

accounts are disabled within when the accounts have expired;

+ -

accounts are disabled within when the accounts are no longer associated with a user or individual;

+ -

accounts are disabled within when the accounts are in violation of organizational policy;

+ -

accounts are disabled within when the accounts have been inactive for .

+ + @@ -954,32 +954,32 @@ - -

account creation is automatically audited;

+ -

account modification is automatically audited;

+ -

account enabling is automatically audited;

+ -

account disabling is automatically audited;

+ -

account removal actions are automatically audited.

+ + @@ -1037,8 +1037,8 @@ -

users are required to log out when .

+ @@ -1089,8 +1089,8 @@ -

are implemented.

+ @@ -1162,27 +1162,27 @@ - -

privileged user accounts are established and administered in accordance with ;

+ -

privileged role or attribute assignments are monitored;

+ -

changes to roles or attributes are monitored;

+ -

access is revoked when privileged role or attribute assignments are no longer appropriate.

+ + @@ -1243,27 +1243,27 @@ - -

are created dynamically;

+ -

are activated dynamically;

+ -

are managed dynamically;

+ -

are deactivated dynamically.

+ + @@ -1321,8 +1321,8 @@ -

the use of shared and group accounts is only permitted if are met.

+ @@ -1394,8 +1394,8 @@ -

for are enforced.

+ @@ -1473,17 +1473,17 @@ - -

system accounts are monitored for ;

+ -

atypical usage of system accounts is reported to .

+ + @@ -1552,8 +1552,8 @@ -

accounts of individuals are disabled within of discovery of .

+ @@ -1653,8 +1653,8 @@ -

approved authorizations for logical access to information and system resources are enforced in accordance with applicable access control policies.

+ @@ -1722,8 +1722,8 @@ -

dual authorization is enforced for .

+ @@ -1842,65 +1842,65 @@ - -

is enforced over the set of covered subjects specified in the policy;

+ -

is enforced over the set of covered objects specified in the policy;

+ - -

is uniformly enforced across the covered subjects within the system;

+ -

is uniformly enforced across the covered objects within the system;

+ + - -

and specifying that a subject that has been granted access to information is constrained from passing the information to unauthorized subjects or objects are enforced;

+ -

and specifying that a subject that has been granted access to information is constrained from granting its privileges to other subjects are enforced;

+ -

and specifying that a subject that has been granted access to information is constrained from changing one of more security attributes (specified by the policy) on subjects, objects, the system, or system components are enforced;

+ -

and specifying that a subject that has been granted access to information is constrained from choosing the security attributes and attribute values (specified by the policy) to be associated with newly created or modified objects are enforced;

+ -

and specifying that a subject that has been granted access to information is constrained from changing the rules governing access control are enforced;

+ + -

and specifying that may explicitly be granted such that they are not limited by any defined subset (or all) of the above constraints are enforced.

+ + @@ -1989,42 +1989,42 @@ - -

is enforced over the set of covered subjects specified in the policy;

+ -

is enforced over the set of covered objects specified in the policy;

+ -

and are enforced where the policy specifies that a subject that has been granted access to information can pass the information to any other subjects or objects;

+ -

and are enforced where the policy specifies that a subject that has been granted access to information can grant its privileges to other subjects;

+ -

and are enforced where the policy specifies that a subject that has been granted access to information can change security attributes on subjects, objects, the system, or the system’s components;

+ -

and are enforced where the policy specifies that a subject that has been granted access to information can choose the security attributes to be associated with newly created or revised objects;

+ -

and are enforced where the policy specifies that a subject that has been granted access to information can change the rules governing access control.

+ + @@ -2084,8 +2084,8 @@ -

access to is prevented except during secure, non-operable system states.

+ @@ -2162,22 +2162,22 @@ - -

a role-based access control policy is enforced over defined subjects;

+ -

a role-based access control policy is enforced over defined objects;

+ -

access is controlled based on and .

+ + @@ -2238,17 +2238,17 @@ - -

revocation of access authorizations is enforced, resulting from changes to the security attributes of subjects based on ;

+ -

revocation of access authorizations is enforced resulting from changes to the security attributes of objects based on .

+ + @@ -2335,17 +2335,17 @@ - -

information is released outside of the system only if the receiving provides ;

+ -

information is released outside of the system only if are used to validate the appropriateness of the information designated for release.

+ + @@ -2423,8 +2423,8 @@ -

an audited override of automated access control mechanisms is employed under by .

+ @@ -2484,8 +2484,8 @@ -

access to data repositories containing is restricted.

+ @@ -2553,22 +2553,22 @@ - -

as part of the installation process, applications are required to assert the access needed to the following system applications and functions: ;

+ -

an enforcement mechanism to prevent unauthorized access is provided;

+ -

access changes after initial installation of the application are approved.

+ + @@ -2624,22 +2624,22 @@ - -

the attribute-based access control policy is enforced over defined subjects;

+ -

the attribute-based access control policy is enforced over defined objects;

+ -

access is controlled based on .

+ + @@ -2708,8 +2708,8 @@ -

are provided to enable individuals to have access to of their personally identifiable information.

+ @@ -2811,35 +2811,35 @@ - - -

is enforced over the set of covered subjects specified in the policy;

+ -

is enforced over the set of covered objects specified in the policy;

+ + - -

is enforced over the set of covered subjects specified in the policy;

+ -

is enforced over the set of covered objects specified in the policy.

+ + + @@ -2919,8 +2919,8 @@ -

approved authorizations are enforced for controlling the flow of information within the system and between connected systems based on .

+ @@ -3051,17 +3051,17 @@ - -

associated with , , and are used to enforce as a basis for flow control decisions;

+ -

associated with , , and are used to enforce as a basis for flow control decisions.

+ + @@ -3121,8 +3121,8 @@ -

protected processing domains are used to enforce as a basis for flow control decisions.

+ @@ -3179,8 +3179,8 @@ -

are enforced.

+ @@ -3257,8 +3257,8 @@ -

encrypted information is prevented from bypassing by .

+ @@ -3314,8 +3314,8 @@ -

are enforced on embedding data types within other data types.

+ @@ -3373,8 +3373,8 @@ -

information flow control enforcement is based on .

+ @@ -3423,8 +3423,8 @@ -

one-way information flows are enforced through hardware-based flow control mechanisms.

+ @@ -3547,27 +3547,27 @@ - - -

information flow control is enforced using as a basis for flow control decisions for ;

+ -

information flow control is enforced using as a basis for flow control decisions for ;

+ + -

data after a filter processing failure in accordance with ;

data after a filter processing failure in accordance with .

+ + @@ -3636,8 +3636,8 @@ -

human reviews are used for under .

+ @@ -3728,17 +3728,17 @@ - -

capability is provided for privileged administrators to enable and disable under ;

+ -

capability is provided for privileged administrators to enable and disable under .

+ + @@ -3811,17 +3811,17 @@ - -

capability is provided for privileged administrators to configure to support different security or privacy policies;

+ -

capability is provided for privileged administrators to configure to support different security or privacy policies.

+ + @@ -3882,8 +3882,8 @@ -

when transferring information between different security domains, are used to validate data essential for information flow decisions.

+ @@ -3940,8 +3940,8 @@ -

when transferring information between different security domains, information is decomposed into for submission to policy enforcement mechanisms.

+ @@ -4008,17 +4008,17 @@ - -

when transferring information between different security domains, implemented require fully enumerated formats that restrict data structure and content;

+ -

when transferring information between different security domains, implemented require fully enumerated formats that restrict data structure and content.

+ + @@ -4099,22 +4099,22 @@ - -

when transferring information between different security domains, information is examined for the presence of ;

+ -

when transferring information between different security domains, transfer of is prohibited in accordance with the ;

+ -

when transferring information between different security domains, transfer of is prohibited in accordance with the .

+ + @@ -4182,8 +4182,8 @@ -

source and destination points are uniquely identified and authenticated by for information transfer.

+ @@ -4261,17 +4261,17 @@ - -

when transferring information between different security domains, are implemented on metadata;

+ -

when transferring information between different security domains, are implemented on metadata.

+ + @@ -4340,8 +4340,8 @@ -

are employed to control the flow of across security domains.

+ @@ -4421,17 +4421,17 @@ - -

information flows are separated logically using to accomplish ;

+ -

information flows are separated physically using to accomplish .

+ + @@ -4482,8 +4482,8 @@ -

access is provided from a single device to computing platforms, applications, or data that reside in multiple different security domains while preventing information flow between the different security domains.

+ @@ -4539,8 +4539,8 @@ -

when transferring information between security domains, non-releasable information is modified by implementing .

+ @@ -4587,17 +4587,17 @@ - -

when transferring information between different security domains, incoming data is parsed into an internal, normalized format;

+ -

when transferring information between different security domains, the data is regenerated to be consistent with its intended specification.

+ + @@ -4661,8 +4661,8 @@ -

when transferring information between different security domains, data is sanitized to minimize in accordance with .

+ @@ -4713,17 +4713,17 @@ - -

when transferring information between different security domains, content-filtering actions are recorded and audited;

+ -

when transferring information between different security domains, results for the information being filtered are recorded and audited.

+ + @@ -4772,8 +4772,8 @@ -

when transferring information between security domains, implemented content filtering solutions provide redundant and independent filtering mechanisms for each data type.

+ @@ -4820,8 +4820,8 @@ -

when transferring information between security domains, a linear content filter pipeline is implemented that is enforced with discretionary and mandatory access controls.

+ @@ -4886,26 +4886,26 @@ - -

when transferring information between security domains, content filter orchestration engines are employed to ensure that content-filtering mechanisms successfully complete execution without errors;

+ - -

when transferring information between security domains, content filter orchestration engines are employed to ensure that content-filtering actions occur in the correct order;

+ -

when transferring information between security domains, content filter orchestration engines are employed to ensure that content-filtering actions comply with .

+ + + @@ -4953,8 +4953,8 @@ -

when transferring information between security domains, content-filtering mechanisms using multiple processes are implemented.

+ @@ -5002,8 +5002,8 @@ -

when transferring information between different security domains, the transfer of failed content to the receiving domain is prevented.

+ @@ -5066,27 +5066,27 @@ - -

when transferring information between different security domains, the process that transfers information between filter pipelines does not filter message content;

+ -

when transferring information between different security domains, the process that transfers information between filter pipelines validates filtering metadata;

+ -

when transferring information between different security domains, the process that transfers information between filter pipelines ensures that the content with the filtering metadata has successfully completed filtering;

+ -

when transferring information between different security domains, the process that transfers information between filter pipelines transfers the content to the destination filter pipeline.

+ + @@ -5166,17 +5166,17 @@ - -

are identified and documented;

+ -

system access authorizations to support separation of duties are defined.

+ + @@ -5235,8 +5235,8 @@ -

the principle of least privilege is employed, allowing only authorized accesses for users (or processes acting on behalf of users) that are necessary to accomplish assigned organizational tasks.

+ @@ -5339,31 +5339,31 @@ - - -

access is authorized for to ;

+ -

access is authorized for to ;

+ -

access is authorized for to ;

+ + -

access is authorized for to .

+ + @@ -5422,8 +5422,8 @@ -

users of system accounts (or roles) with access to are required to use non-privileged accounts or roles when accessing non-security functions.

+ @@ -5489,17 +5489,17 @@ - -

network access to is authorized only for ;

+ -

the rationale for authorizing network access to privileged commands is documented in the security plan for the system.

+ + @@ -5552,8 +5552,8 @@ -

separate processing domains are provided to enable finer-grain allocation of user privileges.

+ @@ -5611,8 +5611,8 @@ -

privileged accounts on the system are restricted to .

+ @@ -5664,8 +5664,8 @@ -

privileged access to the system by non-organizational users is prohibited.

+ @@ -5738,17 +5738,17 @@ - -

privileges assigned to are reviewed to validate the need for such privileges;

+ -

privileges are reassigned or removed, if necessary, to correctly reflect organizational mission and business needs.

+ + @@ -5806,8 +5806,8 @@ -

is prevented from executing at higher privilege levels than users executing the software.

+ @@ -5859,8 +5859,8 @@ -

the execution of privileged functions is logged.

+ @@ -5910,8 +5910,8 @@ -

non-privileged users are prevented from executing privileged functions.

+ @@ -6024,17 +6024,17 @@ - -

a limit of consecutive invalid logon attempts by a user during is enforced;

+ -

automatically when the maximum number of unsuccessful attempts is exceeded.

+ + @@ -6116,8 +6116,8 @@ -

information is purged or wiped from based on after consecutive, unsuccessful device logon attempts.

+ @@ -6174,8 +6174,8 @@ -

unsuccessful biometric logon attempts are limited to .

+ @@ -6254,17 +6254,17 @@ - -

that are different from the primary authentication factors are allowed to be used after the number of organization-defined consecutive invalid logon attempts have been exceeded;

+ -

a limit of consecutive invalid logon attempts through the use of the alternative factors by the user during a is enforced.

+ + @@ -6370,56 +6370,56 @@ - -

is displayed to users before granting access to the system that provides privacy and security notices consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines;

-

the system use notification states that users are accessing a U.S. Government system;

+ -

the system use notification states that system usage may be monitored, recorded, and subject to audit;

+ -

the system use notification states that unauthorized use of the system is prohibited and subject to criminal and civil penalties; and

+ -

the system use notification states that use of the system indicates consent to monitoring and recording;

+ + -

the notification message or banner is retained on the screen until users acknowledge the usage conditions and take explicit actions to log on to or further access the system;

+ - -

for publicly accessible systems, system use information is displayed before granting further access to the publicly accessible system;

+ -

for publicly accessible systems, any references to monitoring, recording, or auditing that are consistent with privacy accommodations for such systems that generally prohibit those activities are displayed;

+ -

for publicly accessible systems, a description of the authorized uses of the system is included.

+ + + @@ -6474,8 +6474,8 @@ -

the user is notified, upon successful logon to the system, of the date and time of the last logon.

+ @@ -6521,8 +6521,8 @@ -

the user is notified, upon successful logon, of the number of unsuccessful logon attempts since the last successful logon.

+ @@ -6586,8 +6586,8 @@ -

the user is notified, upon successful logon, of the number of during .

+ @@ -6651,8 +6651,8 @@ -

the user is notified, upon successful logon, of changes to during .

+ @@ -6707,8 +6707,8 @@ -

the user is notified, upon successful logon, of .

+ @@ -6773,8 +6773,8 @@ -

the number of concurrent sessions for each is limited to .

+ @@ -6847,17 +6847,17 @@ - -

further access to the system is prevented by ;

+ -

device lock is retained until the user re-establishes access using established identification and authentication procedures.

+ + @@ -6904,8 +6904,8 @@ -

information previously visible on the display is concealed, via device lock, with a publicly viewable image.

+ @@ -6964,8 +6964,8 @@ -

a user session is automatically terminated after .

+ @@ -7021,8 +7021,8 @@ -

a logout capability is provided for user-initiated communications sessions whenever authentication is used to gain access to .

+ @@ -7071,8 +7071,8 @@ -

an explicit logout message is displayed to users indicating the termination of authenticated communication sessions.

+ @@ -7130,8 +7130,8 @@ -

an explicit message to users is displayed indicating that the session will end in .

+ @@ -7207,26 +7207,26 @@ - -

that can be performed on the system without identification or authentication consistent with organizational mission and business functions are identified;

+ - -

user actions not requiring identification or authentication are documented in the security plan for the system;

+ -

a rationale for user actions not requiring identification or authentication is provided in the security plan for the system.

+ + + @@ -7436,73 +7436,73 @@ - - -

the means to associate with for information in storage, in process, and/or in transmission are provided;

+ -

the means to associate with for information in storage, in process, and/or in transmission are provided;

+ + - -

attribute associations are made;

+ -

attribute associations are retained with the information;

+ + - -

the following permitted security attributes are established from the attributes defined in AC-16_ODP[01] for : ;

+ -

the following permitted privacy attributes are established from the attributes defined in AC-16_ODP[02] for : ;

+ + -

the following permitted attribute values or ranges for each of the established attributes are determined: ;

+ -

changes to attributes are audited;

+ - -

are reviewed for applicability ;

+ -

are reviewed for applicability .

+ + + @@ -7603,27 +7603,27 @@ - -

security attributes are dynamically associated with in accordance with the following security policies as information is created and combined: ;

+ -

security attributes are dynamically associated with in accordance with the following security policies as information is created and combined: ;

+ -

privacy attributes are dynamically associated with in accordance with the following privacy policies as information is created and combined: ;

+ -

privacy attributes are dynamically associated with in accordance with the following privacy policies as information is created and combined: .

+ + @@ -7671,17 +7671,17 @@ - -

authorized individuals (or processes acting on behalf of individuals) are provided with the capability to define or change the value of associated security attributes;

+ -

authorized individuals (or processes acting on behalf of individuals) are provided with the capability to define or change the value of associated privacy attributes.

+ + @@ -7784,27 +7784,27 @@ - -

the association and integrity of to is maintained;

+ -

the association and integrity of to is maintained.

+ -

the association and integrity of to is maintained;

+ -

the association and integrity of to is maintained.

+ + @@ -7921,27 +7921,27 @@ - -

authorized individuals (or processes acting on behalf of individuals) are provided with the capability to associate with ;

+ -

authorized individuals (or processes acting on behalf of individuals) are provided with the capability to associate with ;

+ -

authorized individuals (or processes acting on behalf of individuals) are provided with the capability to associate with ;

+ -

authorized individuals (or processes acting on behalf of individuals) are provided with the capability to associate with .

+ + @@ -8009,17 +8009,17 @@ - -

security attributes are displayed in human-readable form on each object that the system transmits to output devices to identify using ;

+ -

privacy attributes are displayed in human-readable form on each object that the system transmits to output devices to identify using .

+ + @@ -8157,27 +8157,27 @@ - -

personnel are required to associate and maintain the association of with in accordance with ;

+ -

personnel are required to associate and maintain the association of with in accordance with ;

+ -

personnel are required to associate and maintain the association of with in accordance with ;

+ -

personnel are required to associate and maintain the association of with in accordance with .

+ + @@ -8222,17 +8222,17 @@ - -

a consistent interpretation of security attributes transmitted between distributed system components is provided;

+ -

a consistent interpretation of privacy attributes transmitted between distributed system components is provided.

+ + @@ -8303,17 +8303,17 @@ - -

are implemented in associating security attributes to information;

+ -

are implemented in associating privacy attributes to information.

+ + @@ -8380,17 +8380,17 @@ - -

security attributes associated with information are changed only via regrading mechanisms validated using ;

+ -

privacy attributes associated with information are changed only via regrading mechanisms validated using .

+ + @@ -8438,17 +8438,17 @@ - -

authorized individuals are provided with the capability to define or change the type and value of security attributes available for association with subjects and objects;

+ -

authorized individuals are provided with the capability to define or change the type and value of privacy attributes available for association with subjects and objects.

+ + @@ -8528,31 +8528,31 @@ - - -

usage restrictions are established and documented for each type of remote access allowed;

+ -

configuration/connection requirements are established and documented for each type of remote access allowed;

+ -

implementation guidance is established and documented for each type of remote access allowed;

+ + -

each type of remote access to the system is authorized prior to allowing such connections.

+ + @@ -8604,17 +8604,17 @@ - -

automated mechanisms are employed to monitor remote access methods;

+ -

automated mechanisms are employed to control remote access methods.

+ + @@ -8665,8 +8665,8 @@ -

cryptographic mechanisms are implemented to protect the confidentiality and integrity of remote access sessions.

+ @@ -8715,8 +8715,8 @@ -

remote accesses are routed through authorized and managed network access control points.

+ @@ -8792,36 +8792,36 @@ - - -

the execution of privileged commands via remote access is authorized only in a format that provides assessable evidence;

+ -

access to security-relevant information via remote access is authorized only in a format that provides assessable evidence;

+ -

the execution of privileged commands via remote access is authorized only for the following needs: ;

+ -

access to security-relevant information via remote access is authorized only for the following needs: ;

+ + -

the rationale for remote access is documented in the security plan for the system.

+ + @@ -8878,8 +8878,8 @@ -

information about remote access mechanisms is protected from unauthorized use and disclosure.

+ @@ -8940,8 +8940,8 @@ -

the capability to disconnect or disable remote access to the system within is provided.

+ @@ -9007,8 +9007,8 @@ -

are implemented to authenticate .

+ @@ -9077,31 +9077,31 @@ - - -

configuration requirements are established for each type of wireless access;

+ -

connection requirements are established for each type of wireless access;

+ -

implementation guidance is established for each type of wireless access;

+ + -

each type of wireless access to the system is authorized prior to allowing such connections.

+ + @@ -9159,17 +9159,17 @@ - -

wireless access to the system is protected using authentication of ;

+ -

wireless access to the system is protected using encryption.

+ + @@ -9225,8 +9225,8 @@ -

when not intended for use, wireless networking capabilities embedded within system components are disabled prior to issuance and deployment.

+ @@ -9274,17 +9274,17 @@ - -

users allowed to independently configure wireless networking capabilities are identified;

+ -

users allowed to independently configure wireless networking capabilities are explicitly authorized.

+ + @@ -9331,17 +9331,17 @@ - -

radio antennas are selected to reduce the probability that signals from wireless access points can be received outside of organization-controlled boundaries;

+ -

transmission power levels are calibrated to reduce the probability that signals from wireless access points can be received outside of organization-controlled boundaries.

+ + @@ -9422,31 +9422,31 @@ - - -

configuration requirements are established for organization-controlled mobile devices, including when such devices are outside of the controlled area;

+ -

connection requirements are established for organization-controlled mobile devices, including when such devices are outside of the controlled area;

+ -

implementation guidance is established for organization-controlled mobile devices, including when such devices are outside of the controlled area;

+ + -

the connection of mobile devices to organizational systems is authorized.

+ + @@ -9564,50 +9564,50 @@ - -

the use of unclassified mobile devices in facilities containing systems processing, storing, or transmitting classified information is prohibited unless specifically permitted by the authorizing official;

+ - -

prohibition of the connection of unclassified mobile devices to classified systems is enforced on individuals permitted by an authorizing official to use unclassified mobile devices in facilities containing systems processing, storing, or transmitting classified information;

+ -

approval by the authorizing official for the connection of unclassified mobile devices to unclassified systems is enforced on individuals permitted to use unclassified mobile devices in facilities containing systems processing, storing, or transmitting classified information;

+ -

prohibition of the use of internal or external modems or wireless interfaces within unclassified mobile devices is enforced on individuals permitted by an authorizing official to use unclassified mobile devices in facilities containing systems processing, storing, or transmitting classified information;

+ - -

random review and inspection of unclassified mobile devices and the information stored on those devices by are enforced;

+ -

following of the incident handling policy is enforced if classified information is found during a random review and inspection of unclassified mobile devices;

+ + + -

the connection of classified mobile devices to classified systems is restricted in accordance with .

+ + @@ -9677,8 +9677,8 @@ -

is employed to protect the confidentiality and integrity of information on .

+ @@ -9789,26 +9789,26 @@ - - -

is/are consistent with the trust relationships established with other organizations owning, operating, and/or maintaining external systems, allowing authorized individuals to access the system from external systems (if applicable);

+ -

is/are consistent with the trust relationships established with other organizations owning, operating, and/or maintaining external systems, allowing authorized individuals to process, store, or transmit organization-controlled information using external systems (if applicable);

+ + -

the use of is prohibited (if applicable).

+ + @@ -9864,17 +9864,17 @@ - -

authorized individuals are permitted to use an external system to access the system or to process, store, or transmit organization-controlled information only after verification of the implementation of controls on the external system as specified in the organization’s security and privacy policies and security and privacy plans (if applicable);

+ -

authorized individuals are permitted to use an external system to access the system or to process, store, or transmit organization-controlled information only after retention of approved system connection or processing agreements with the organizational entity hosting the external system (if applicable).

+ + @@ -9929,8 +9929,8 @@ -

the use of organization-controlled portable storage devices by authorized individuals is restricted on external systems using .

+ @@ -9985,8 +9985,8 @@ -

the use of non-organizationally owned systems or system components to process, store, or transmit organizational information is restricted using .

+ @@ -10042,8 +10042,8 @@ -

the use of is prohibited in external systems.

+ @@ -10096,8 +10096,8 @@ -

the use of organization-controlled portable storage devices by authorized individuals is prohibited on external systems.

+ @@ -10173,17 +10173,17 @@ - -

authorized users are enabled to determine whether access authorizations assigned to a sharing partner match the information’s access and use restrictions for ;

+ -

are employed to assist users in making information-sharing and collaboration decisions.

+ + @@ -10244,8 +10244,8 @@ -

are employed to enforce information-sharing decisions by authorized users based on access authorizations of sharing partners and access restrictions on information to be shared.

+ @@ -10303,8 +10303,8 @@ -

information search and retrieval services that enforce are implemented.

+ @@ -10382,36 +10382,36 @@ - -

designated individuals are authorized to make information publicly accessible;

+ -

authorized individuals are trained to ensure that publicly accessible information does not contain non-public information;

+ -

the proposed content of information is reviewed prior to posting onto the publicly accessible system to ensure that non-public information is not included;

+ - -

the content on the publicly accessible system is reviewed for non-public information ;

+ -

non-public information is removed from the publicly accessible system, if discovered.

+ + + @@ -10481,8 +10481,8 @@ -

are employed for to detect and protect against unauthorized data mining.

+ @@ -10556,8 +10556,8 @@ -

are taken to ensure that are applied to each access request prior to access enforcement.

+ @@ -10627,8 +10627,8 @@ -

is transmitted using to that enforce access control decisions.

+ @@ -10695,17 +10695,17 @@ - -

access control decisions are enforced based on that do not include the identity of the user or process acting on behalf of the user (if selected);

+ -

access control decisions are enforced based on that do not include the identity of the user or process acting on behalf of the user (if selected).

+ + @@ -10771,8 +10771,8 @@ -

a reference monitor is implemented for that is tamper-proof, always invoked, and small enough to be subject to analysis and testing, the completeness of which can be assured.

+ @@ -10935,116 +10935,116 @@ - - -

an awareness and training policy is developed and documented;

+ -

the awareness and training policy is disseminated to ;

+ -

awareness and training procedures to facilitate the implementation of the awareness and training policy and associated access controls are developed and documented;

+ -

the awareness and training procedures are disseminated to .

+ - - -

the awareness and training policy addresses purpose;

+ -

the awareness and training policy addresses scope;

+ -

the awareness and training policy addresses roles;

+ -

the awareness and training policy addresses responsibilities;

+ -

the awareness and training policy addresses management commitment;

+ -

the awareness and training policy addresses coordination among organizational entities;

+ -

the awareness and training policy addresses compliance; and

+ + -

the awareness and training policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines; and

+ + + -

the is designated to manage the development, documentation, and dissemination of the awareness and training policy and procedures;

+ - - -

the current awareness and training policy is reviewed and updated ;

+ -

the current awareness and training policy is reviewed and updated following ;

+ + - -

the current awareness and training procedures are reviewed and updated ;

+ -

the current awareness and training procedures are reviewed and updated following .

+ + + + @@ -11188,73 +11188,73 @@ - - - -

security literacy training is provided to system users (including managers, senior executives, and contractors) as part of initial training for new users;

+ -

privacy literacy training is provided to system users (including managers, senior executives, and contractors) as part of initial training for new users;

+ -

security literacy training is provided to system users (including managers, senior executives, and contractors) thereafter;

+ -

privacy literacy training is provided to system users (including managers, senior executives, and contractors) thereafter;

+ + - -

security literacy training is provided to system users (including managers, senior executives, and contractors) when required by system changes or following ;

+ -

privacy literacy training is provided to system users (including managers, senior executives, and contractors) when required by system changes or following ;

+ + + -

are employed to increase the security and privacy awareness of system users;

+ - -

literacy training and awareness content is updated ;

+ -

literacy training and awareness content is updated following ;

+ + -

lessons learned from internal or external security incidents or breaches are incorporated into literacy training and awareness techniques.

+ + @@ -11307,8 +11307,8 @@ -

practical exercises in literacy training that simulate events and incidents are provided.

+ @@ -11357,17 +11357,17 @@ - -

literacy training on recognizing potential indicators of insider threat is provided;

+ -

literacy training on reporting potential indicators of insider threat is provided.

+ + @@ -11408,27 +11408,27 @@ - -

literacy training on recognizing potential and actual instances of social engineering is provided;

+ -

literacy training on reporting potential and actual instances of social engineering is provided;

+ -

literacy training on recognizing potential and actual instances of social mining is provided;

+ -

literacy training on reporting potential and actual instances of social mining is provided.

+ + @@ -11477,8 +11477,8 @@ -

literacy training on recognizing suspicious communications and anomalous behavior in organizational systems using is provided.

+ @@ -11519,8 +11519,8 @@ -

literacy training on the advanced persistent threat is provided.

+ @@ -11569,17 +11569,17 @@ - -

literacy training on the cyber threat environment is provided;

+ -

system operations reflects current cyber threat information.

+ + @@ -11708,68 +11708,68 @@ - - - -

role-based security training is provided to before authorizing access to the system, information, or performing assigned duties;

+ -

role-based privacy training is provided to before authorizing access to the system, information, or performing assigned duties;

+ -

role-based security training is provided to thereafter;

+ -

role-based privacy training is provided to thereafter;

+ + - -

role-based security training is provided to personnel with assigned security roles and responsibilities when required by system changes;

+ -

role-based privacy training is provided to personnel with assigned security roles and responsibilities when required by system changes;

+ + + - -

role-based training content is updated ;

+ -

role-based training content is updated following ;

+ + -

lessons learned from internal or external security incidents or breaches are incorporated into role-based training.

+ + @@ -11838,8 +11838,8 @@ -

are provided with initial and refresher training in the employment and operation of environmental controls.

+ @@ -11899,8 +11899,8 @@ -

is/are provided with initial and refresher training in the employment and operation of physical security controls.

+ @@ -11941,17 +11941,17 @@ - -

practical exercises in security training that reinforce training objectives are provided;

+ -

practical exercises in privacy training that reinforce training objectives are provided.

+ + @@ -12020,8 +12020,8 @@ -

are provided with initial and refresher training in the employment and operation of personally identifiable information processing and transparency controls.

+ @@ -12090,26 +12090,26 @@ - - -

information security and privacy training activities, including security and privacy awareness training and specific role-based security and privacy training, are documented;

+ -

information security and privacy training activities, including security and privacy awareness training and specific role-based security and privacy training, are monitored;

+ + -

individual training records are retained for .

+ + @@ -12177,8 +12177,8 @@ -

feedback on organizational training results is provided to .

+ @@ -12334,116 +12334,116 @@ - - -

an audit and accountability policy is developed and documented;

+ -

the audit and accountability policy is disseminated to ;

+ -

audit and accountability procedures to facilitate the implementation of the audit and accountability policy and associated audit and accountability controls are developed and documented;

+ -

the audit and accountability procedures are disseminated to ;

+ - - -

the of the audit and accountability policy addresses purpose;

+ -

the of the audit and accountability policy addresses scope;

+ -

the of the audit and accountability policy addresses roles;

+ -

the of the audit and accountability policy addresses responsibilities;

+ -

the of the audit and accountability policy addresses management commitment;

+ -

the of the audit and accountability policy addresses coordination among organizational entities;

+ -

the of the audit and accountability policy addresses compliance;

+ + -

the of the audit and accountability policy is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines;

+ + + -

the is designated to manage the development, documentation, and dissemination of the audit and accountability policy and procedures;

+ - - -

the current audit and accountability policy is reviewed and updated ;

+ -

the current audit and accountability policy is reviewed and updated following ;

+ + - -

the current audit and accountability procedures are reviewed and updated ;

+ -

the current audit and accountability procedures are reviewed and updated following .

+ + + + @@ -12571,41 +12571,41 @@ - -

that the system is capable of logging are identified in support of the audit logging function;

+ -

the event logging function is coordinated with other organizational entities requiring audit-related information to guide and inform the selection criteria for events to be logged;

+ - -

are specified for logging within the system;

+ -

the specified event types are logged within the system ;

+ + -

a rationale is provided for why the event types selected for logging are deemed to be adequate to support after-the-fact investigations of incidents;

+ -

the event types selected for logging are reviewed and updated .

+ + @@ -12720,37 +12720,37 @@ - -

audit records contain information that establishes what type of event occurred;

+ -

audit records contain information that establishes when the event occurred;

+ -

audit records contain information that establishes where the event occurred;

+ -

audit records contain information that establishes the source of the event;

+ -

audit records contain information that establishes the outcome of the event;

+ -

audit records contain information that establishes the identity of any individuals, subjects, or objects/entities associated with the event.

+ + @@ -12807,8 +12807,8 @@ -

generated audit records contain the following .

+ @@ -12875,8 +12875,8 @@ -

personally identifiable information contained in audit records is limited to identified in the privacy risk assessment.

+ @@ -12947,8 +12947,8 @@ -

audit log storage capacity is allocated to accommodate .

+ @@ -13007,8 +13007,8 @@ -

audit logs are transferred to a different system, system component, or media other than the system or system component conducting the logging.

+ @@ -13098,17 +13098,17 @@ - -

are alerted in the event of an audit logging process failure within ;

+ -

are taken in the event of an audit logging process failure.

+ + @@ -13181,8 +13181,8 @@ -

a warning is provided to within when allocated audit log storage volume reaches of repository maximum audit log storage capacity.

+ @@ -13254,8 +13254,8 @@ -

an alert is provided within to when occur.

+ @@ -13305,17 +13305,17 @@ - -

configurable network communications traffic volume thresholds reflecting limits on audit log storage capacity are enforced;

+ -

network traffic is if network traffic volume is above configured thresholds.

+ + @@ -13375,8 +13375,8 @@ -

is/are invoked in the event of , unless an alternate audit logging capability exists.

+ @@ -13434,8 +13434,8 @@ -

an alternate audit logging capability is provided in the event of a failure in primary audit logging capability that implements .

+ @@ -13552,22 +13552,22 @@ - -

system audit records are reviewed and analyzed for indications of and the potential impact of the inappropriate or unusual activity;

+ -

findings are reported to ;

+ -

the level of audit record review, analysis, and reporting within the system is adjusted when there is a change in risk based on law enforcement information, intelligence information, or other credible sources of information.

+ + @@ -13615,8 +13615,8 @@ -

audit record review, analysis, and reporting processes are integrated using .

+ @@ -13675,8 +13675,8 @@ -

audit records across different repositories are analyzed and correlated to gain organization-wide situational awareness.

+ @@ -13726,17 +13726,17 @@ - -

the capability to centrally review and analyze audit records from multiple components within the system is provided;

+ -

the capability to centrally review and analyze audit records from multiple components within the system is implemented.

+ + @@ -13805,8 +13805,8 @@ -

analysis of audit records is integrated with analysis of to further enhance the ability to identify inappropriate or unusual activity.

+ @@ -13854,8 +13854,8 @@ -

information from audit records is correlated with information obtained from monitoring physical access to further enhance the ability to identify suspicious, inappropriate, unusual, or malevolent activity.

+ @@ -13914,8 +13914,8 @@ -

the permitted actions for each associated with the review, analysis, and reporting of audit record information are specified.

+ @@ -13964,8 +13964,8 @@ -

a full text analysis of logged privileged commands in a physically distinct component or subsystem of the system or other system that is dedicated to that analysis is performed.

+ @@ -14015,8 +14015,8 @@ -

information from non-technical sources is correlated with audit record information to enhance organization-wide situational awareness.

+ @@ -14094,35 +14094,35 @@ - - -

an audit record reduction and report generation capability is provided that supports on-demand audit record review, analysis, and reporting requirements and after-the-fact investigations of incidents;

+ -

an audit record reduction and report generation capability is implemented that supports on-demand audit record review, analysis, and reporting requirements and after-the-fact investigations of incidents;

+ + - -

an audit record reduction and report generation capability is provided that does not alter the original content or time ordering of audit records;

+ -

an audit record reduction and report generation capability is implemented that does not alter the original content or time ordering of audit records.

+ + + @@ -14178,17 +14178,17 @@ - -

the capability to process, sort, and search audit records for events of interest based on are provided;

+ -

the capability to process, sort, and search audit records for events of interest based on are implemented.

+ + @@ -14265,17 +14265,17 @@ - -

internal system clocks are used to generate timestamps for audit records;

+ -

timestamps are recorded for audit records that meet and that use Coordinated Universal Time, have a fixed local time offset from Coordinated Universal Time, or include the local time offset as part of the timestamp.

+ + @@ -14370,17 +14370,17 @@ - -

audit information and audit logging tools are protected from unauthorized access, modification, and deletion;

+ -

are alerted upon detection of unauthorized access, modification, or deletion of audit information.

+ + @@ -14432,8 +14432,8 @@ -

audit trails are written to hardware-enforced, write-once media.

+ @@ -14495,8 +14495,8 @@ -

audit records are stored in a repository that is part of a physically different system or system component than the system or component being audited.

+ @@ -14549,8 +14549,8 @@ -

cryptographic mechanisms to protect the integrity of audit information and audit tools are implemented.

+ @@ -14610,8 +14610,8 @@ -

access to management of audit logging functionality is authorized only to .

+ @@ -14681,8 +14681,8 @@ -

dual authorization is enforced for the of .

+ @@ -14741,8 +14741,8 @@ -

read-only access to audit information is authorized to .

+ @@ -14798,8 +14798,8 @@ -

audit information is stored on a component running a different operating system than the system or component being audited.

+ @@ -14873,8 +14873,8 @@ -

irrefutable evidence is provided that an individual (or process acting on behalf of an individual) has performed .

+ @@ -14939,17 +14939,17 @@ - -

the identity of the information producer is bound with the information to ;

+ -

the means for authorized individuals to determine the identity of the producer of the information is provided.

+ + @@ -15024,17 +15024,17 @@ - -

the binding of the information producer identity to the information is validated at ;

+ -

in the event of a validation error are performed.

+ + @@ -15087,8 +15087,8 @@ -

reviewer or releaser credentials are maintained within the established chain of custody for information reviewed or released.

+ @@ -15163,17 +15163,17 @@ - -

the binding of the information reviewer identity to the information at the transfer or release points prior to release or transfer between is validated;

+ -

are performed in the event of a validation error.

+ + @@ -15249,8 +15249,8 @@ -

audit records are retained for to provide support for after-the-fact investigations of incidents and to meet regulatory and organizational information retention requirements.

+ @@ -15301,8 +15301,8 @@ -

are employed to ensure that long-term audit records generated by the system can be retrieved.

+ @@ -15398,22 +15398,22 @@ - -

audit record generation capability for the event types the system is capable of auditing (defined in AU-02_ODP[01]) is provided by ;

+ -

is/are allowed to select the event types that are to be logged by specific components of the system;

+ -

audit records for the event types defined in AU-02_ODP[02] that include the audit record content defined in AU-03 are generated.

+ + @@ -15481,8 +15481,8 @@ -

audit records from are compiled into a system-wide (logical or physical) audit trail that is time-correlated to within .

+ @@ -15532,8 +15532,8 @@ -

a system-wide (logical or physical) audit trail composed of audit records is produced in a standardized format.

+ @@ -15616,17 +15616,17 @@ - -

the capability for to change the logging to be performed on based on within is provided;

+ -

the capability for to change the logging to be performed on based on within is implemented.

+ + @@ -15676,17 +15676,17 @@ - -

the capability to audit the parameters of user query events for data sets containing personally identifiable information is provided;

+ -

the capability to audit the parameters of user query events for data sets containing personally identifiable information is implemented.

+ + @@ -15791,26 +15791,26 @@ - -

is/are monitored for evidence of unauthorized disclosure of organizational information;

+ - -

are notified if an information disclosure is discovered;

+ -

are taken if an information disclosure is discovered.

+ + + @@ -15867,8 +15867,8 @@ -

open-source information and information sites are monitored using .

+ @@ -15925,8 +15925,8 @@ -

the list of open-source information sites being monitored is reviewed .

+ @@ -15976,8 +15976,8 @@ -

discovery techniques, processes, and tools are employed to determine if external entities are replicating organizational information in an unauthorized manner.

+ @@ -16070,40 +16070,40 @@ - - -

are provided with the capability to the content of a user session under ;

+ -

the capability for to the content of a user session under is implemented;

+ + - -

session auditing activities are developed in consultation with legal counsel and in accordance with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines;

+ -

session auditing activities are integrated in consultation with legal counsel and in accordance with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines;

+ -

session auditing activities are used in consultation with legal counsel and in accordance with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines;

+ + + @@ -16153,8 +16153,8 @@ -

session audits are initiated automatically at system start-up.

+ @@ -16212,17 +16212,17 @@ - -

the capability for authorized users to remotely view and hear content related to an established user session in real time is provided;

+ -

the capability for authorized users to remotely view and hear content related to an established user session in real time is implemented.

+ + @@ -16301,8 +16301,8 @@ -

for coordinating among external organizations when audit information is transmitted across organizational boundaries are employed.

+ @@ -16352,8 +16352,8 @@ -

the identity of individuals in cross-organizational audit trails is preserved.

+ @@ -16418,8 +16418,8 @@ -

cross-organizational audit information is provided to based on .

+ @@ -16465,8 +16465,8 @@ -

are implemented to disassociate individuals from audit information transmitted across organizational boundaries.

+ @@ -16634,116 +16634,116 @@ - - -

an assessment, authorization, and monitoring policy is developed and documented;

+ -

the assessment, authorization, and monitoring policy is disseminated to ;

+ -

assessment, authorization, and monitoring procedures to facilitate the implementation of the assessment, authorization, and monitoring policy and associated assessment, authorization, and monitoring controls are developed and documented;

+ -

the assessment, authorization, and monitoring procedures are disseminated to ;

+ - - -

the assessment, authorization, and monitoring policy addresses purpose;

+ -

the assessment, authorization, and monitoring policy addresses scope;

+ -

the assessment, authorization, and monitoring policy addresses roles;

+ -

the assessment, authorization, and monitoring policy addresses responsibilities;

+ -

the assessment, authorization, and monitoring policy addresses management commitment;

+ -

the assessment, authorization, and monitoring policy addresses coordination among organizational entities;

+ -

the assessment, authorization, and monitoring policy addresses compliance;

+ + -

the assessment, authorization, and monitoring policy is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines;

+ + + -

the is designated to manage the development, documentation, and dissemination of the assessment, authorization, and monitoring policy and procedures;

+ - - -

the current assessment, authorization, and monitoring policy is reviewed and updated ;

+ -

the current assessment, authorization, and monitoring policy is reviewed and updated following ;

+ + - -

the current assessment, authorization, and monitoring procedures are reviewed and updated ;

+ -

the current assessment, authorization, and monitoring procedures are reviewed and updated following .

+ + + + @@ -16858,74 +16858,74 @@ - -

an appropriate assessor or assessment team is selected for the type of assessment to be conducted;

+ - -

a control assessment plan is developed that describes the scope of the assessment, including controls and control enhancements under assessment;

+ -

a control assessment plan is developed that describes the scope of the assessment, including assessment procedures to be used to determine control effectiveness;

+ - -

a control assessment plan is developed that describes the scope of the assessment, including the assessment environment;

+ -

a control assessment plan is developed that describes the scope of the assessment, including the assessment team;

+ -

a control assessment plan is developed that describes the scope of the assessment, including assessment roles and responsibilities;

+ + + -

the control assessment plan is reviewed and approved by the authorizing official or designated representative prior to conducting the assessment;

+ - -

controls are assessed in the system and its environment of operation to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting established security requirements;

+ -

controls are assessed in the system and its environment of operation to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting established privacy requirements;

+ + -

a control assessment report is produced that documents the results of the assessment;

+ -

the results of the control assessment are provided to .

+ + @@ -16974,8 +16974,8 @@ -

independent assessors or assessment teams are employed to conduct control assessments.

+ @@ -17059,8 +17059,8 @@ -

are included as part of control assessments.

+ @@ -17134,8 +17134,8 @@ -

the results of control assessments performed by on are leveraged when the assessment meets .

+ @@ -17235,51 +17235,51 @@ - -

the exchange of information between the system and other systems is approved and managed using ;

+ - -

the interface characteristics are documented as part of each exchange agreement;

+ -

security requirements are documented as part of each exchange agreement;

+ -

privacy requirements are documented as part of each exchange agreement;

+ -

controls are documented as part of each exchange agreement;

+ -

responsibilities for each system are documented as part of each exchange agreement;

+ -

the impact level of the information communicated is documented as part of each exchange agreement;

+ + -

agreements are reviewed and updated .

+ + @@ -17371,8 +17371,8 @@ -

individuals or systems transferring data between interconnecting systems have the requisite authorizations (i.e., write permissions or privileges) prior to accepting such data.

+ @@ -17437,17 +17437,17 @@ - -

transitive (downstream) information exchanges with other systems through the systems identified in CA-03a are identified;

+ -

measures are taken to ensure that transitive (downstream) information exchanges cease when the controls on identified transitive (downstream) systems cannot be verified or validated.

+ + @@ -17535,17 +17535,17 @@ - -

a plan of action and milestones for the system is developed to document the planned remediation actions of the organization to correct weaknesses or deficiencies noted during the assessment of the controls and to reduce or eliminate known vulnerabilities in the system;

+ -

existing plan of action and milestones are updated based on the findings from control assessments, independent audits or reviews, and continuous monitoring activities.

+ + @@ -17601,8 +17601,8 @@ -

are used to ensure the accuracy, currency, and availability of the plan of action and milestones for the system.

+ @@ -17698,41 +17698,41 @@ - -

a senior official is assigned as the authorizing official for the system;

+ -

a senior official is assigned as the authorizing official for common controls available for inheritance by organizational systems;

+ - -

before commencing operations, the authorizing official for the system accepts the use of common controls inherited by the system;

+ -

before commencing operations, the authorizing official for the system authorizes the system to operate;

+ + -

the authorizing official for common controls authorizes the use of those controls for inheritance by organizational systems;

+ -

the authorizations are updated .

+ + @@ -17777,17 +17777,17 @@ - -

a joint authorization process is employed for the system;

+ -

the joint authorization process employed for the system includes multiple authorizing officials from the same organization conducting the authorization.

+ + @@ -17836,17 +17836,17 @@ - -

a joint authorization process is employed for the system;

+ -

the joint authorization process employed for the system includes multiple authorizing officials with at least one authorizing official from an organization external to the organization conducting the authorization.

+ + @@ -18044,70 +18044,70 @@ - -

a system-level continuous monitoring strategy is developed;

+ -

system-level continuous monitoring is implemented in accordance with the organization-level continuous monitoring strategy;

+ -

system-level continuous monitoring includes establishment of the following system-level metrics to be monitored: ;

+ - -

system-level continuous monitoring includes established for monitoring;

+ -

system-level continuous monitoring includes established for assessment of control effectiveness;

+ + -

system-level continuous monitoring includes ongoing control assessments in accordance with the continuous monitoring strategy;

+ -

system-level continuous monitoring includes ongoing monitoring of system and organization-defined metrics in accordance with the continuous monitoring strategy;

+ -

system-level continuous monitoring includes correlation and analysis of information generated by control assessments and monitoring;

+ -

system-level continuous monitoring includes response actions to address the results of the analysis of control assessment and monitoring information;

+ - -

system-level continuous monitoring includes reporting the security status of the system to ;

+ -

system-level continuous monitoring includes reporting the privacy status of the system to .

+ + + @@ -18163,8 +18163,8 @@ -

independent assessors or assessment teams are employed to monitor the controls in the system on an ongoing basis.

+ @@ -18217,22 +18217,22 @@ - -

trend analysis is employed to determine if control implementations used in the continuous monitoring process need to be modified based on empirical data;

+ -

trend analysis is employed to determine if the frequency of continuous monitoring activities used in the continuous monitoring process needs to be modified based on empirical data;

+ -

trend analysis is employed to determine if the types of activities used in the continuous monitoring process need to be modified based on empirical data.

+ + @@ -18298,23 +18298,23 @@ -

risk monitoring is an integral part of the continuous monitoring strategy;

-

effectiveness monitoring is included in risk monitoring;

+ -

compliance monitoring is included in risk monitoring;

+ -

change monitoring is included in risk monitoring.

+ + @@ -18385,17 +18385,17 @@ - -

are employed to validate that policies are established;

+ -

are employed to validate that implemented controls are operating in a consistent manner.

+ + @@ -18455,8 +18455,8 @@ -

are used to ensure the accuracy, currency, and availability of monitoring results for the system.

+ @@ -18531,8 +18531,8 @@ -

penetration testing is conducted on .

+ @@ -18582,8 +18582,8 @@ -

an independent penetration testing agent or team is employed to perform penetration testing on the system or system components.

+ @@ -18633,8 +18633,8 @@ -

are employed to simulate attempts by adversaries to compromise organizational systems in accordance with applicable rules of engagement.

+ @@ -18705,8 +18705,8 @@ -

the penetration testing process includes attempts to bypass or circumvent controls associated with physical access points to facility.

+ @@ -18809,46 +18809,46 @@ - -

internal connections of to the system are authorized;

+ - -

for each internal connection, the interface characteristics are documented;

+ -

for each internal connection, the security requirements are documented;

+ -

for each internal connection, the privacy requirements are documented;

+ -

for each internal connection, the nature of the information communicated is documented;

+ + -

internal system connections are terminated after ;

+ -

the continued need for each internal connection is reviewed .

+ + @@ -18901,17 +18901,17 @@ - -

security compliance checks are performed on constituent system components prior to the establishment of the internal connection;

+ -

privacy compliance checks are performed on constituent system components prior to the establishment of the internal connection.

+ + @@ -19078,116 +19078,116 @@ - - -

a configuration management policy is developed and documented;

+ -

the configuration management policy is disseminated to ;

+ -

configuration management procedures to facilitate the implementation of the configuration management policy and associated configuration management controls are developed and documented;

+ -

the configuration management procedures are disseminated to ;

+ - - -

the of the configuration management policy addresses purpose;

+ -

the of the configuration management policy addresses scope;

+ -

the of the configuration management policy addresses roles;

+ -

the of the configuration management policy addresses responsibilities;

+ -

the of the configuration management policy addresses management commitment;

+ -

the of the configuration management policy addresses coordination among organizational entities;

+ -

the of the configuration management policy addresses compliance;

+ + -

the configuration management policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines;

+ + + -

the is designated to manage the development, documentation, and dissemination of the configuration management policy and procedures;

+ - - -

the current configuration management policy is reviewed and updated ;

+ -

the current configuration management policy is reviewed and updated following ;

+ + - -

the current configuration management procedures are reviewed and updated ;

+ -

the current configuration management procedures are reviewed and updated following .

+ + + + @@ -19283,40 +19283,40 @@ - - -

a current baseline configuration of the system is developed and documented;

+ -

a current baseline configuration of the system is maintained under configuration control;

+ + - -

the baseline configuration of the system is reviewed and updated ;

+ -

the baseline configuration of the system is reviewed and updated when required due to ;

+ -

the baseline configuration of the system is reviewed and updated when system components are installed or upgraded.

+ + + @@ -19388,27 +19388,27 @@ - -

the currency of the baseline configuration of the system is maintained using ;

+ -

the completeness of the baseline configuration of the system is maintained using ;

+ -

the accuracy of the baseline configuration of the system is maintained using ;

+ -

the availability of the baseline configuration of the system is maintained using .

+ + @@ -19468,8 +19468,8 @@ -

of previous baseline configuration version(s) of the system is/are retained to support rollback.

+ @@ -19537,17 +19537,17 @@ - -

a baseline configuration for system development environments that is managed separately from the operational baseline configuration is maintained;

+ -

a baseline configuration for test environments that is managed separately from the operational baseline configuration is maintained.

+ + @@ -19630,17 +19630,17 @@ - -

with are issued to individuals traveling to locations that the organization deems to be of significant risk;

+ -

are applied to the systems or system components when the individuals return from travel.

+ + @@ -19786,69 +19786,69 @@ - -

the types of changes to the system that are configuration-controlled are determined and documented;

+ - -

proposed configuration-controlled changes to the system are reviewed;

+ -

proposed configuration-controlled changes to the system are approved or disapproved with explicit consideration for security and privacy impact analyses;

+ + -

configuration change decisions associated with the system are documented;

+ -

approved configuration-controlled changes to the system are implemented;

+ -

records of configuration-controlled changes to the system are retained for ;

+ - -

activities associated with configuration-controlled changes to the system are monitored;

+ -

activities associated with configuration-controlled changes to the system are reviewed;

+ + - -

configuration change control activities are coordinated and overseen by ;

+ -

the configuration control element convenes .

+ + + @@ -19959,37 +19959,37 @@ - -

are used to document proposed changes to the system;

+ -

are used to notify of proposed changes to the system and request change approval;

+ -

are used to highlight proposed changes to the system that have not been approved or disapproved within ;

+ -

are used to prohibit changes to the system until designated approvals are received;

+ -

are used to document all changes to the system;

+ -

are used to notify when approved changes to the system are completed.

+ + @@ -20046,22 +20046,22 @@ - -

changes to the system are tested before finalizing the implementation of the changes;

+ -

changes to the system are validated before finalizing the implementation of the changes;

+ -

changes to the system are documented before finalizing the implementation of the changes.

+ + @@ -20124,17 +20124,17 @@ - -

changes to the current system baseline are implemented using ;

+ -

the updated baseline is deployed across the installed base using .

+ + @@ -20215,17 +20215,17 @@ - -

are required to be members of the ;

+ -

are required to be members of the .

+ + @@ -20279,8 +20279,8 @@ -

are automatically implemented if baseline configurations are changed in an unauthorized manner.

+ @@ -20342,8 +20342,8 @@ -

cryptographic mechanisms used to provide are under configuration management.

+ @@ -20413,8 +20413,8 @@ -

changes to the system are reviewed or when to determine whether unauthorized changes have occurred.

+ @@ -20474,8 +20474,8 @@ -

changes to the configuration of the system are prevented or restricted under .

+ @@ -20523,17 +20523,17 @@ - -

changes to the system are analyzed to determine potential security impacts prior to change implementation;

+ -

changes to the system are analyzed to determine potential privacy impacts prior to change implementation.

+ + @@ -20593,52 +20593,52 @@ - -

changes to the system are analyzed in a separate test environment before implementation in an operational environment;

+ -

changes to the system are analyzed for security impacts due to flaws;

+ -

changes to the system are analyzed for privacy impacts due to flaws;

+ -

changes to the system are analyzed for security impacts due to weaknesses;

+ -

changes to the system are analyzed for privacy impacts due to weaknesses;

+ -

changes to the system are analyzed for security impacts due to incompatibility;

+ -

changes to the system are analyzed for privacy impacts due to incompatibility;

+ -

changes to the system are analyzed for security impacts due to intentional malice;

+ -

changes to the system are analyzed for privacy impacts due to intentional malice.

+ + @@ -20701,37 +20701,37 @@ - -

the impacted controls are implemented correctly with regard to meeting the security requirements for the system after system changes;

+ -

the impacted controls are implemented correctly with regard to meeting the privacy requirements for the system after system changes;

+ -

the impacted controls are operating as intended with regard to meeting the security requirements for the system after system changes;

+ -

the impacted controls are operating as intended with regard to meeting the privacy requirements for the system after system changes;

+ -

the impacted controls are producing the desired outcome with regard to meeting the security requirements for the system after system changes;

+ -

the impacted controls are producing the desired outcome with regard to meeting the privacy requirements for the system after system changes.

+ + @@ -20800,37 +20800,37 @@ - -

physical access restrictions associated with changes to the system are defined and documented;

+ -

physical access restrictions associated with changes to the system are approved;

+ -

physical access restrictions associated with changes to the system are enforced;

+ -

logical access restrictions associated with changes to the system are defined and documented;

+ -

logical access restrictions associated with changes to the system are approved;

+ -

logical access restrictions associated with changes to the system are enforced.

+ + @@ -20906,17 +20906,17 @@ - -

access restrictions for change are enforced using ;

+ -

audit records of enforcement actions are automatically generated.

+ + @@ -21007,17 +21007,17 @@ - -

dual authorization for implementing changes to is enforced;

+ -

dual authorization for implementing changes to is enforced.

+ + @@ -21097,35 +21097,35 @@ - - -

privileges to change system components within a production or operational environment are limited;

+ -

privileges to change system-related information within a production or operational environment are limited;

+ + - -

privileges are reviewed ;

+ -

privileges are reevaluated .

+ + + @@ -21180,8 +21180,8 @@ -

privileges to change software resident within software libraries are limited.

+ @@ -21316,45 +21316,45 @@ - -

configuration settings that reflect the most restrictive mode consistent with operational requirements are established and documented for components employed within the system using ;

+ -

the configuration settings documented in CM-06a are implemented;

+ - -

any deviations from established configuration settings for are identified and documented based on ;

+ -

any deviations from established configuration settings for are approved;

+ + - -

changes to the configuration settings are monitored in accordance with organizational policies and procedures;

+ -

changes to the configuration settings are controlled in accordance with organizational policies and procedures.

+ + + @@ -21446,22 +21446,22 @@ - -

configuration settings for are managed using ;

+ -

configuration settings for are applied using ;

+ -

configuration settings for are verified using .

+ + @@ -21534,8 +21534,8 @@ -

are taken in response to unauthorized changes to .

+ @@ -21687,41 +21687,41 @@ - -

the system is configured to provide only ;

+ - -

the use of is prohibited or restricted;

+ -

the use of is prohibited or restricted;

+ -

the use of is prohibited or restricted;

+ -

the use of is prohibited or restricted;

+ -

the use of is prohibited or restricted.

+ + + @@ -21831,41 +21831,41 @@ - -

the system is reviewed to identify unnecessary and/or non-secure functions, ports, protocols, software, and services:

+ - -

deemed to be unnecessary and/or non-secure are disabled or removed;

+ -

deemed to be unnecessary and/or non-secure are disabled or removed;

+ -

deemed to be unnecessary and/or non-secure are disabled or removed;

+ -

deemed to be unnecessary and/or non-secure is disabled or removed;

+ -

deemed to be unnecessary and/or non-secure are disabled or removed.

+ + + @@ -21939,8 +21939,8 @@ -

program execution is prevented in accordance with .

+ @@ -22004,8 +22004,8 @@ -

are complied with.

+ @@ -22089,22 +22089,22 @@ - -

are identified;

+ -

an allow-all, deny-by-exception policy is employed to prohibit the execution of unauthorized software programs on the system;

+ -

the list of unauthorized software programs is reviewed and updated .

+ + @@ -22197,22 +22197,22 @@ - -

are identified;

+ -

a deny-all, permit-by-exception policy to allow the execution of authorized software programs on the system is employed;

+ -

the list of authorized software programs is reviewed and updated .

+ + @@ -22278,8 +22278,8 @@ -

is required to be executed in a confined physical or virtual machine environment with limited privileges.

+ @@ -22352,18 +22352,18 @@ -

the execution of binary or machine-executable code is only allowed in confined physical or virtual machine environments;

-

the execution of binary or machine-executable code obtained from sources with limited or no warranty is only allowed with the explicit approval of ;

+ -

the execution of binary or machine-executable code without the provision of source code is only allowed with the explicit approval of .

+ + @@ -22429,26 +22429,26 @@ - -

the use of binary or machine-executable code is prohibited when it originates from sources with limited or no warranty or without the provision of source code;

+ - -

exceptions to the prohibition of binary or machine-executable code from sources with limited or no warranty or without the provision of source code are allowed only for compelling mission or operational requirements;

+ -

exceptions to the prohibition of binary or machine-executable code from sources with limited or no warranty or without the provision of source code are allowed only with the approval of the authorizing official.

+ + + @@ -22533,22 +22533,22 @@ - -

are identified;

+ -

the use or connection of unauthorized hardware components is prohibited;

+ -

the list of authorized hardware components is reviewed and updated .

+ + @@ -22668,41 +22668,41 @@ - - -

an inventory of system components that accurately reflects the system is developed and documented;

+ -

an inventory of system components that includes all components within the system is developed and documented;

+ -

an inventory of system components that does not include duplicate accounting of components or components assigned to any other system is developed and documented;

+ -

an inventory of system components that is at the level of granularity deemed necessary for tracking and reporting is developed and documented;

+ -

an inventory of system components that includes is developed and documented;

+ + -

the system component inventory is reviewed and updated .

+ + @@ -22753,22 +22753,22 @@ - -

the inventory of system components is updated as part of component installations;

+ -

the inventory of system components is updated as part of component removals;

+ -

the inventory of system components is updated as part of system updates.

+ + @@ -22856,27 +22856,27 @@ - -

are used to maintain the currency of the system component inventory;

+ -

are used to maintain the completeness of the system component inventory;

+ -

are used to maintain the accuracy of the system component inventory;

+ -

are used to maintain the availability of the system component inventory.

+ + @@ -22998,45 +22998,45 @@ - - -

the presence of unauthorized hardware within the system is detected using ;

+ -

the presence of unauthorized software within the system is detected using ;

+ -

the presence of unauthorized firmware within the system is detected using ;

+ + - -

are taken when unauthorized hardware is detected;

+ -

are taken when unauthorized software is detected;

+ -

are taken when unauthorized firmware is detected.

+ + + @@ -23105,8 +23105,8 @@ -

individuals responsible and accountable for administering system components are identified by in the system component inventory.

+ @@ -23163,17 +23163,17 @@ - -

assessed component configurations are included in the system component inventory;

+ -

any approved deviations to current deployed configurations are included in the system component inventory.

+ + @@ -23226,8 +23226,8 @@ -

a centralized repository for the system component inventory is provided.

+ @@ -23287,8 +23287,8 @@ -

are used to support the tracking of system components by geographic location.

+ @@ -23357,17 +23357,17 @@ - -

system components are assigned to a system;

+ -

an acknowledgement of the component assignment is received from .

+ + @@ -23461,83 +23461,83 @@ - -

a configuration management plan for the system is developed and documented;

+ -

a configuration management plan for the system is implemented;

+ - -

the configuration management plan addresses roles;

+ -

the configuration management plan addresses responsibilities;

+ -

the configuration management plan addresses configuration management processes and procedures;

+ + - -

the configuration management plan establishes a process for identifying configuration items throughout the system development life cycle;

+ -

the configuration management plan establishes a process for managing the configuration of the configuration items;

+ + - -

the configuration management plan defines the configuration items for the system;

+ -

the configuration management plan places the configuration items under configuration management;

+ + -

the configuration management plan is reviewed and approved by ;

+ - -

the configuration management plan is protected from unauthorized disclosure;

+ -

the configuration management plan is protected from unauthorized modification.

+ + + @@ -23590,8 +23590,8 @@ -

the responsibility for developing the configuration management process is assigned to organizational personnel who are not directly involved in system development.

+ @@ -23646,22 +23646,22 @@ - -

software and associated documentation are used in accordance with contract agreements and copyright laws;

+ -

the use of software and associated documentation protected by quantity licenses is tracked to control copying and distribution;

+ -

the use of peer-to-peer file sharing technology is controlled and documented to ensure that peer-to-peer file sharing is not used for the unauthorized distribution, display, performance, or reproduction of copyrighted work.

+ + @@ -23723,8 +23723,8 @@ -

are established for the use of open-source software.

+ @@ -23824,22 +23824,22 @@ - -

governing the installation of software by users are established;

+ -

software installation policies are enforced through ;

+ -

compliance with is monitored .

+ + @@ -23904,8 +23904,8 @@ -

user installation of software is allowed only with explicit privileged status.

+ @@ -23978,17 +23978,17 @@ - -

compliance with software installation policies is enforced using ;

+ -

compliance with software installation policies is monitored using .

+ + @@ -24083,54 +24083,54 @@ - - -

the location of is identified and documented;

+ -

the specific system components on which is processed are identified and documented;

+ -

the specific system components on which is stored are identified and documented;

+ + - -

the users who have access to the system and system components where is processed are identified and documented;

+ -

the users who have access to the system and system components where is stored are identified and documented;

+ + - -

changes to the location (i.e., system or system components) where is processed are documented;

+ -

changes to the location (i.e., system or system components) where is stored are documented.

+ + + @@ -24203,8 +24203,8 @@ -

automated tools are used to identify on to ensure that controls are in place to protect organizational information and individual privacy.

+ @@ -24267,8 +24267,8 @@ -

a map of system data actions is developed and documented.

+ @@ -24348,17 +24348,17 @@ - -

the installation of is prevented unless it is verified that the software has been digitally signed using a certificate recognized and approved by the organization;

+ -

the installation of is prevented unless it is verified that the firmware has been digitally signed using a certificate recognized and approved by the organization.

+ + @@ -24526,116 +24526,116 @@ - - -

a contingency planning policy is developed and documented;

+ -

the contingency planning policy is disseminated to ;

+ -

contingency planning procedures to facilitate the implementation of the contingency planning policy and associated contingency planning controls are developed and documented;

+ -

the contingency planning procedures are disseminated to ;

+ - - -

the contingency planning policy addresses purpose;

+ -

the contingency planning policy addresses scope;

+ -

the contingency planning policy addresses roles;

+ -

the contingency planning policy addresses responsibilities;

+ -

the contingency planning policy addresses management commitment;

+ -

the contingency planning policy addresses coordination among organizational entities;

+ -

the contingency planning policy addresses compliance;

+ + -

the contingency planning policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines;

+ + + -

the is designated to manage the development, documentation, and dissemination of the contingency planning policy and procedures;

+ - - -

the current contingency planning policy is reviewed and updated ;

+ -

the current contingency planning policy is reviewed and updated following ;

+ + - -

the current contingency planning procedures are reviewed and updated ;

+ -

the current contingency planning procedures are reviewed and updated following .

+ + + + @@ -24822,163 +24822,163 @@ - - -

a contingency plan for the system is developed that identifies essential mission and business functions and associated contingency requirements;

+ - -

a contingency plan for the system is developed that provides recovery objectives;

+ -

a contingency plan for the system is developed that provides restoration priorities;

+ -

a contingency plan for the system is developed that provides metrics;

+ + - -

a contingency plan for the system is developed that addresses contingency roles;

+ -

a contingency plan for the system is developed that addresses contingency responsibilities;

+ -

a contingency plan for the system is developed that addresses assigned individuals with contact information;

+ + -

a contingency plan for the system is developed that addresses maintaining essential mission and business functions despite a system disruption, compromise, or failure;

+ -

a contingency plan for the system is developed that addresses eventual, full-system restoration without deterioration of the controls originally planned and implemented;

+ -

a contingency plan for the system is developed that addresses the sharing of contingency information;

+ - -

a contingency plan for the system is developed that is reviewed by ;

+ -

a contingency plan for the system is developed that is approved by ;

+ + + - -

copies of the contingency plan are distributed to ;

+ -

copies of the contingency plan are distributed to ;

+ + -

contingency planning activities are coordinated with incident handling activities;

+ -

the contingency plan for the system is reviewed ;

+ - -

the contingency plan is updated to address changes to the organization, system, or environment of operation;

+ -

the contingency plan is updated to address problems encountered during contingency plan implementation, execution, or testing;

+ + - -

contingency plan changes are communicated to ;

+ -

contingency plan changes are communicated to ;

+ + - -

lessons learned from contingency plan testing or actual contingency activities are incorporated into contingency testing;

+ -

lessons learned from contingency plan training or actual contingency activities are incorporated into contingency testing and training;

+ + - -

the contingency plan is protected from unauthorized disclosure;

+ -

the contingency plan is protected from unauthorized modification.

+ + + @@ -25025,8 +25025,8 @@ -

contingency plan development is coordinated with organizational elements responsible for related plans.

+ @@ -25078,22 +25078,22 @@ - -

capacity planning is conducted so that the necessary capacity exists during contingency operations for information processing;

+ -

capacity planning is conducted so that the necessary capacity exists during contingency operations for telecommunications;

+ -

capacity planning is conducted so that the necessary capacity exists during contingency operations for environmental support.

+ + @@ -25148,8 +25148,8 @@ -

the resumption of mission and business functions are planned for within of contingency plan activation.

+ @@ -25214,17 +25214,17 @@ - -

the continuance of mission and business functions with minimal or no loss of operational continuity is planned for;

+ -

continuity is sustained until full system restoration at primary processing and/or storage sites.

+ + @@ -25284,17 +25284,17 @@ - -

the transfer of mission and business functions to alternate processing and/or storage sites with minimal or no loss of operational continuity is planned for;

+ -

operational continuity is sustained until full system restoration at primary processing and/or storage sites.

+ + @@ -25345,8 +25345,8 @@ -

the contingency plan is coordinated with the contingency plans of external service providers to ensure that contingency requirements can be satisfied.

+ @@ -25398,8 +25398,8 @@ -

critical system assets supporting mission and business functions are identified.

+ @@ -25500,40 +25500,40 @@ - - -

contingency training is provided to system users consistent with assigned roles and responsibilities within of assuming a contingency role or responsibility;

+ -

contingency training is provided to system users consistent with assigned roles and responsibilities when required by system changes;

+ -

contingency training is provided to system users consistent with assigned roles and responsibilities thereafter;

+ + - -

the contingency plan training content is reviewed and updated ;

+ -

the contingency plan training content is reviewed and updated following .

+ + + @@ -25580,8 +25580,8 @@ -

simulated events are incorporated into contingency training to facilitate effective response by personnel in crisis situations.

+ @@ -25629,8 +25629,8 @@ -

mechanisms used in operations are employed to provide a more thorough and realistic contingency training environment.

+ @@ -25730,36 +25730,36 @@ - - -

the contingency plan for the system is tested ;

+ -

are used to determine the effectiveness of the plan;

+ -

are used to determine the readiness to execute the plan;

+ + -

the contingency plan test results are reviewed;

+ -

corrective actions are initiated, if needed.

+ + @@ -25808,8 +25808,8 @@ -

contingency plan testing is coordinated with organizational elements responsible for related plans.

+ @@ -25866,17 +25866,17 @@ - -

the contingency plan is tested at the alternate processing site to familiarize contingency personnel with the facility and available resources;

+ -

the contingency plan is tested at the alternate processing site to evaluate the capabilities of the alternate processing site to support contingency operations.

+ + @@ -25934,8 +25934,8 @@ -

the contingency plan is tested using .

+ @@ -25986,17 +25986,17 @@ - -

a full recovery of the system to a known state is included as part of contingency plan testing;

+ -

a full reconstitution of the system to a known state is included as part of contingency plan testing.

+ + @@ -26063,8 +26063,8 @@ -

are employed to disrupt and adversely affect the .

+ @@ -26138,26 +26138,26 @@ - - -

an alternate storage site is established;

+ -

establishment of the alternate storage site includes necessary agreements to permit the storage and retrieval of system backup information;

+ + -

the alternate storage site provides controls equivalent to that of the primary site.

+ + @@ -26205,8 +26205,8 @@ -

an alternate storage site that is sufficiently separated from the primary storage site is identified to reduce susceptibility to the same threats.

+ @@ -26247,17 +26247,17 @@ - -

the alternate storage site is configured to facilitate recovery operations in accordance with recovery time objectives;

+ -

the alternate storage site is configured to facilitate recovery operations in accordance with recovery point objectives.

+ + @@ -26307,17 +26307,17 @@ - -

potential accessibility problems to the alternate storage site in the event of an area-wide disruption or disaster are identified;

+ -

explicit mitigation actions to address identified accessibility problems are outlined.

+ + @@ -26400,31 +26400,31 @@ - -

an alternate processing site, including necessary agreements to permit the transfer and resumption of for essential mission and business functions, is established within when the primary processing capabilities are unavailable;

+ - -

the equipment and supplies required to transfer operations are made available at the alternate processing site or if contracts are in place to support delivery to the site within for transfer;

+ -

the equipment and supplies required to resume operations are made available at the alternate processing site or if contracts are in place to support delivery to the site within for resumption;

+ + -

controls provided at the alternate processing site are equivalent to those at the primary site.

+ + @@ -26474,8 +26474,8 @@ -

an alternate processing site that is sufficiently separated from the primary processing site to reduce susceptibility to the same threats is identified.

+ @@ -26517,17 +26517,17 @@ - -

potential accessibility problems to alternate processing sites in the event of an area-wide disruption or disaster are identified;

+ -

explicit mitigation actions to address identified accessibility problems are outlined.

+ + @@ -26568,8 +26568,8 @@ -

alternate processing site agreements that contain priority-of-service provisions in accordance with availability requirements (including recovery time objectives) are developed.

+ @@ -26613,8 +26613,8 @@ -

the alternate processing site is prepared so that the site can serve as the operational site supporting essential mission and business functions.

+ @@ -26670,17 +26670,17 @@ - -

circumstances that preclude returning to the primary processing site are planned for;

+ -

circumstances that preclude returning to the primary processing site are prepared for.

+ + @@ -26742,8 +26742,8 @@ -

alternate telecommunications services, including necessary agreements to permit the resumption of , are established for essential mission and business functions within when the primary telecommunications capabilities are unavailable at either the primary or alternate processing or storage sites.

+ @@ -26797,26 +26797,26 @@ - - -

primary telecommunications service agreements that contain priority-of-service provisions in accordance with availability requirements (including recovery time objectives) are developed;

+ -

alternate telecommunications service agreements that contain priority-of-service provisions in accordance with availability requirements (including recovery time objectives) are developed;

+ + -

Telecommunications Service Priority is requested for all telecommunications services used for national security emergency preparedness if the primary and/or alternate telecommunications services are provided by a common carrier.

+ + @@ -26864,8 +26864,8 @@ -

alternate telecommunications services to reduce the likelihood of sharing a single point of failure with primary telecommunications services are obtained.

+ @@ -26905,8 +26905,8 @@ -

alternate telecommunications services from providers that are separated from primary service providers are obtained to reduce susceptibility to the same threats.

+ @@ -26979,40 +26979,40 @@ - - -

primary telecommunications service providers are required to have contingency plans;

+ -

alternate telecommunications service providers are required to have contingency plans;

+ + -

provider contingency plans are reviewed to ensure that the plans meet organizational contingency requirements;

+ - -

evidence of contingency testing by providers is obtained .

+ -

evidence of contingency training by providers is obtained .

+ + + @@ -27063,8 +27063,8 @@ -

alternate telecommunications services are tested .

+ @@ -27176,41 +27176,41 @@ - -

backups of user-level information contained in are conducted ;

+ -

backups of system-level information contained in the system are conducted ;

+ -

backups of system documentation, including security- and privacy-related documentation are conducted ;

+ - -

the confidentiality of backup information is protected;

+ -

the integrity of backup information is protected;

+ -

the availability of backup information is protected.

+ + + @@ -27277,17 +27277,17 @@ - -

backup information is tested to verify media reliability;

+ -

backup information is tested to verify information integrity.

+ + @@ -27336,8 +27336,8 @@ -

a sample of backup information in the restoration of selected system functions is used as part of contingency plan testing.

+ @@ -27397,8 +27397,8 @@ -

backup copies of are stored in a separate facility or in a fire rated container that is not collocated with the operational system.

+ @@ -27470,17 +27470,17 @@ - -

system backup information is transferred to the alternate storage site for ;

+ -

system backup information is transferred to the alternate storage site .

+ + @@ -27530,17 +27530,17 @@ - -

system backup is conducted by maintaining a redundant secondary system that is not collocated with the primary system;

+ -

system backup is conducted by maintaining a redundant secondary system that can be activated without loss of information or disruption to operations.

+ + @@ -27603,8 +27603,8 @@ -

dual authorization for the deletion or destruction of is enforced.

+ @@ -27664,8 +27664,8 @@ -

cryptographic mechanisms are implemented to prevent unauthorized disclosure and modification of .

+ @@ -27740,17 +27740,17 @@ - -

the recovery of the system to a known state is provided within after a disruption, compromise, or failure;

+ -

a reconstitution of the system to a known state is provided within after a disruption, compromise, or failure.

+ + @@ -27807,8 +27807,8 @@ -

transaction recovery is implemented for systems that are transaction-based.

+ @@ -27878,8 +27878,8 @@ -

the capability to restore system components within from configuration-controlled and integrity-protected information representing a known, operational state for the components is provided.

+ @@ -27942,8 +27942,8 @@ -

system components used for recovery and reconstitution are protected.

+ @@ -28005,8 +28005,8 @@ -

the capability to employ are provided in support of maintaining continuity of operations.

+ @@ -28079,8 +28079,8 @@ -

a safe mode of operation is entered with when are detected.

+ @@ -28153,8 +28153,8 @@ -

are employed for satisfying when the primary means of implementing the security function is unavailable or compromised.

+ @@ -28324,116 +28324,116 @@ - - -

an identification and authentication policy is developed and documented;

+ -

the identification and authentication policy is disseminated to ;

+ -

identification and authentication procedures to facilitate the implementation of the identification and authentication policy and associated identification and authentication controls are developed and documented;

+ -

the identification and authentication procedures are disseminated to ;

+ - - -

the identification and authentication policy addresses purpose;

+ -

the identification and authentication policy addresses scope;

+ -

the identification and authentication policy addresses roles;

+ -

the identification and authentication policy addresses responsibilities;

+ -

the identification and authentication policy addresses management commitment;

+ -

the identification and authentication policy addresses coordination among organizational entities;

+ -

the identification and authentication policy addresses compliance;

+ + -

the identification and authentication policy is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines;

+ + + -

the is designated to manage the development, documentation, and dissemination of the identification and authentication policy and procedures;

+ - - -

the current identification and authentication policy is reviewed and updated ;

+ -

the current identification and authentication policy is reviewed and updated following ;

+ + - -

the current identification and authentication procedures are reviewed and updated ;

+ -

the current identification and authentication procedures are reviewed and updated following .

+ + + + @@ -28507,17 +28507,17 @@ - -

organizational users are uniquely identified and authenticated;

+ -

the unique identification of authenticated organizational users is associated with processes acting on behalf of those users.

+ + @@ -28568,8 +28568,8 @@ -

multi-factor authentication is implemented for access to privileged accounts.

+ @@ -28620,8 +28620,8 @@ -

multi-factor authentication for access to non-privileged accounts is implemented.

+ @@ -28688,8 +28688,8 @@ -

users are required to be individually authenticated before granting access to the shared accounts or resources when shared accounts or authenticators are employed.

+ @@ -28773,17 +28773,17 @@ - -

multi-factor authentication is implemented for access to such that one of the factors is provided by a device separate from the system gaining access;

+ -

multi-factor authentication is implemented for access to such that the device meets .

+ + @@ -28849,8 +28849,8 @@ -

replay-resistant authentication mechanisms for access to are implemented.

+ @@ -28917,8 +28917,8 @@ -

a single sign-on capability is provided for .

+ @@ -28978,8 +28978,8 @@ -

Personal Identity Verification-compliant credentials are accepted and electronically verified.

+ @@ -29050,8 +29050,8 @@ -

mechanisms are implemented under .

+ @@ -29129,8 +29129,8 @@ -

are uniquely identified and authenticated before establishing a connection.

+ @@ -29198,8 +29198,8 @@ -

are authenticated before establishing connection using bidirectional authentication that is cryptographically based.

+ @@ -29284,26 +29284,26 @@ - - -

dynamic address allocation lease information assigned to devices where addresses are allocated dynamically are standardized in accordance with ;

+ -

dynamic address allocation lease duration assigned to devices where addresses are allocated dynamically are standardized in accordance with ;

+ + -

lease information is audited when assigned to a device.

+ + @@ -29366,8 +29366,8 @@ -

device identification and authentication are handled based on attestation by .

+ @@ -29473,27 +29473,27 @@ - -

system identifiers are managed by receiving authorization from to assign to an individual, group, role, or device identifier;

+ -

system identifiers are managed by selecting an identifier that identifies an individual, group, role, service, or device;

+ -

system identifiers are managed by assigning the identifier to the intended individual, group, role, service, or device;

+ -

system identifiers are managed by preventing reuse of identifiers for .

+ + @@ -29544,8 +29544,8 @@ -

the use of system account identifiers that are the same as public identifiers is prohibited for individual accounts.

+ @@ -29618,8 +29618,8 @@ -

individual identifiers are managed by uniquely identifying each individual as .

+ @@ -29674,8 +29674,8 @@ -

individual identifiers are dynamically managed in accordance with .

+ @@ -29735,8 +29735,8 @@ -

cross-organization management of identifiers is coordinated with .

+ @@ -29789,8 +29789,8 @@ -

pairwise pseudonymous identifiers are generated.

+ @@ -29846,8 +29846,8 @@ -

the attributes for each uniquely identified individual, device, or service are maintained in .

+ @@ -29974,61 +29974,61 @@ - -

system authenticators are managed through the verification of the identity of the individual, group, role, service, or device receiving the authenticator as part of the initial authenticator distribution;

+ -

system authenticators are managed through the establishment of initial authenticator content for any authenticators issued by the organization;

+ -

system authenticators are managed to ensure that authenticators have sufficient strength of mechanism for their intended use;

+ -

system authenticators are managed through the establishment and implementation of administrative procedures for initial authenticator distribution; lost, compromised, or damaged authenticators; and the revocation of authenticators;

+ -

system authenticators are managed through the change of default authenticators prior to first use;

+ -

system authenticators are managed through the change or refreshment of authenticators or when occur;

+ -

system authenticators are managed through the protection of authenticator content from unauthorized disclosure and modification;

+ - -

system authenticators are managed through the requirement for individuals to take specific controls to protect authenticators;

+ -

system authenticators are managed through the requirement for devices to implement specific controls to protect authenticators;

+ + -

system authenticators are managed through the change of authenticators for group or role accounts when membership to those accounts changes.

+ + @@ -30126,47 +30126,47 @@ - -

for password-based authentication, a list of commonly used, expected, or compromised passwords is maintained and updated and when organizational passwords are suspected to have been compromised directly or indirectly;

+ -

for password-based authentication when passwords are created or updated by users, the passwords are verified not to be found on the list of commonly used, expected, or compromised passwords in IA-05(01)(a);

+ -

for password-based authentication, passwords are only transmitted over cryptographically protected channels;

+ -

for password-based authentication, passwords are stored using an approved salted key derivation function, preferably using a keyed hash;

+ -

for password-based authentication, immediate selection of a new password is required upon account recovery;

+ -

for password-based authentication, user selection of long passwords and passphrases is allowed, including spaces and all printable characters;

+ -

for password-based authentication, automated tools are employed to assist the user in selecting strong password authenticators;

+ -

for password-based authentication, are enforced.

+ + @@ -30240,35 +30240,35 @@ - - -

authorized access to the corresponding private key is enforced for public key-based authentication;

+ -

the authenticated identity is mapped to the account of the individual or group for public key-based authentication;

+ + - -

when public key infrastructure (PKI) is used, certificates are validated by constructing and verifying a certification path to an accepted trust anchor, including checking certificate status information;

+ -

when public key infrastructure (PKI) is used, a local cache of revocation data is implemented to support path discovery and validation.

+ + + @@ -30333,8 +30333,8 @@ -

developers and installers of system components are required to provide unique authenticators or change default authenticators prior to delivery and installation.

+ @@ -30383,8 +30383,8 @@ -

authenticators are protected commensurate with the security category of the information to which use of the authenticator permits access.

+ @@ -30433,8 +30433,8 @@ -

unencrypted static authenticators are not embedded in applications or other forms of static storage.

+ @@ -30493,8 +30493,8 @@ -

are implemented to manage the risk of compromise due to individuals having accounts on multiple systems.

+ @@ -30550,8 +30550,8 @@ -

are used to federate credentials.

+ @@ -30607,8 +30607,8 @@ -

identities and authenticators are dynamically bound using .

+ @@ -30675,8 +30675,8 @@ -

mechanisms that satisfy are employed for biometric-based authentication.

+ @@ -30734,8 +30734,8 @@ -

the use of cached authenticators is prohibited after .

+ @@ -30783,8 +30783,8 @@ -

an organization-wide methodology for managing the content of PKI trust stores is employed across all platforms, including networks, operating systems, browsers, and applications for PKI-based authentication.

+ @@ -30835,8 +30835,8 @@ -

only General Services Administration-approved products and services are used for identity, credential, and access management.

+ @@ -30918,8 +30918,8 @@ -

the issuance of is required to be conducted before with authorization by .

+ @@ -30969,8 +30969,8 @@ -

presentation attack detection mechanisms are employed for biometric-based authentication.

+ @@ -31042,17 +31042,17 @@ - -

are employed to generate and manage passwords;

+ -

the passwords are protected using .

+ + @@ -31102,8 +31102,8 @@ -

the feedback of authentication information is obscured during the authentication process to protect the information from possible exploitation and use by unauthorized individuals.

+ @@ -31155,8 +31155,8 @@ -

mechanisms for authentication to a cryptographic module are implemented that meet the requirements of applicable laws, executive orders, directives, policies, regulations, standards, and guidelines for such authentication.

+ @@ -31225,8 +31225,8 @@ -

non-organizational users or processes acting on behalf of non-organizational users are uniquely identified and authenticated.

+ @@ -31276,17 +31276,17 @@ - -

Personal Identity Verification-compliant credentials from other federal agencies are accepted;

+ -

Personal Identity Verification-compliant credentials from other federal agencies are electronically verified.

+ + @@ -31346,26 +31346,26 @@ - -

only external authenticators that are NIST-compliant are accepted;

+ - -

a list of accepted external authenticators is documented;

+ -

a list of accepted external authenticators is maintained.

+ + + @@ -31435,8 +31435,8 @@ -

there is conformance with for identity management.

+ @@ -31493,17 +31493,17 @@ - -

federated or PKI credentials that meet are accepted;

+ -

federated or PKI credentials that meet are verified.

+ + @@ -31564,8 +31564,8 @@ -

to disassociate user attributes or identifier assertion relationships among individuals, credential service providers, and relying parties are implemented.

+ @@ -31628,8 +31628,8 @@ -

are uniquely identified and authenticated before establishing communications with devices, users, or other services or applications.

+ @@ -31713,8 +31713,8 @@ -

individuals accessing the system are required to employ under specific .

+ @@ -31779,8 +31779,8 @@ -

users are required to re-authenticate when .

+ @@ -31852,36 +31852,36 @@ - -

users who require accounts for logical access to systems based on appropriate identity assurance level requirements as specified in applicable standards and guidelines are identity proofed;

+ -

user identities are resolved to a unique individual;

+ - -

identity evidence is collected;

+ -

identity evidence is validated;

+ -

identity evidence is verified.

+ + + @@ -31928,8 +31928,8 @@ -

the registration process to receive an account for logical access includes supervisor or sponsor authorization.

+ @@ -31975,8 +31975,8 @@ -

evidence of individual identification is presented to the registration authority.

+ @@ -32031,8 +32031,8 @@ -

the presented identity evidence is validated and verified through .

+ @@ -32078,8 +32078,8 @@ -

the validation and verification of identity evidence is conducted in person before a designated registration authority.

+ @@ -32134,8 +32134,8 @@ -

a is delivered through an out-of-band channel to verify the user’s address (physical or digital) of record.

+ @@ -32193,8 +32193,8 @@ -

externally proofed identities are accepted .

+ @@ -32358,116 +32358,116 @@ - - -

an incident response policy is developed and documented;

+ -

the incident response policy is disseminated to ;

+ -

incident response procedures to facilitate the implementation of the incident response policy and associated incident response controls are developed and documented;

+ -

the incident response procedures are disseminated to ;

+ - - -

the incident response policy addresses purpose;

+ -

the incident response policy addresses scope;

+ -

the incident response policy addresses roles;

+ -

the incident response policy addresses responsibilities;

+ -

the incident response policy addresses management commitment;

+ -

the incident response policy addresses coordination among organizational entities;

+ -

the incident response policy addresses compliance;

+ + -

the incident response policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines;

+ + + -

the is designated to manage the development, documentation, and dissemination of the incident response policy and procedures;

+ - - -

the current incident response policy is reviewed and updated ;

+ -

the current incident response policy is reviewed and updated following ;

+ + - -

the current incident response procedures are reviewed and updated ;

+ -

the current incident response procedures are reviewed and updated following .

+ + + + @@ -32564,40 +32564,40 @@ - - -

incident response training is provided to system users consistent with assigned roles and responsibilities within of assuming an incident response role or responsibility or acquiring system access;

+ -

incident response training is provided to system users consistent with assigned roles and responsibilities when required by system changes;

+ -

incident response training is provided to system users consistent with assigned roles and responsibilities thereafter;

+ + - -

incident response training content is reviewed and updated ;

+ -

incident response training content is reviewed and updated following .

+ + + @@ -32639,8 +32639,8 @@ -

simulated events are incorporated into incident response training to facilitate the required response by personnel in crisis situations.

+ @@ -32696,8 +32696,8 @@ -

an incident response training environment is provided using .

+ @@ -32746,17 +32746,17 @@ - -

incident response training on how to identify and respond to a breach is provided;

+ -

incident response training on the organization’s process for reporting a breach is provided.

+ + @@ -32826,8 +32826,8 @@ -

the effectiveness of the incident response capability for the system is tested using .

+ @@ -32879,8 +32879,8 @@ -

the incident response capability is tested using .

+ @@ -32932,8 +32932,8 @@ -

incident response testing is coordinated with organizational elements responsible for related plans.

+ @@ -32994,69 +32994,69 @@ - - -

qualitative data from testing are used to determine the effectiveness of incident response processes;

+ -

quantitative data from testing are used to determine the effectiveness of incident response processes;

+ + - -

qualitative data from testing are used to continuously improve incident response processes;

+ -

quantitative data from testing are used to continuously improve incident response processes;

+ + - -

qualitative data from testing are used to provide incident response measures and metrics that are accurate;

+ -

quantitative data from testing are used to provide incident response measures and metrics that are accurate;

+ -

qualitative data from testing are used to provide incident response measures and metrics that are consistent;

+ -

quantitative data from testing are used to provide incident response measures and metrics that are consistent;

+ -

qualitative data from testing are used to provide incident response measures and metrics in a reproducible format;

+ -

quantitative data from testing are used to provide incident response measures and metrics in a reproducible format.

+ + + @@ -33150,84 +33150,84 @@ - - -

an incident handling capability for incidents is implemented that is consistent with the incident response plan;

+ -

the incident handling capability for incidents includes preparation;

+ -

the incident handling capability for incidents includes detection and analysis;

+ -

the incident handling capability for incidents includes containment;

+ -

the incident handling capability for incidents includes eradication;

+ -

the incident handling capability for incidents includes recovery;

+ + -

incident handling activities are coordinated with contingency planning activities;

+ - -

lessons learned from ongoing incident handling activities are incorporated into incident response procedures, training, and testing;

+ -

the changes resulting from the incorporated lessons learned are implemented accordingly;

+ + - -

the rigor of incident handling activities is comparable and predictable across the organization;

+ -

the intensity of incident handling activities is comparable and predictable across the organization;

+ -

the scope of incident handling activities is comparable and predictable across the organization;

+ -

the results of incident handling activities are comparable and predictable across the organization.

+ + + @@ -33282,8 +33282,8 @@ -

the incident handling process is supported using .

+ @@ -33350,8 +33350,8 @@ -

for are included as part of the incident response capability.

+ @@ -33417,17 +33417,17 @@ - -

are identified;

+ -

are taken in response to those incidents (defined in IR-04(03)_ODP[01]) to ensure the continuation of organizational mission and business functions.

+ + @@ -33474,8 +33474,8 @@ -

incident information and individual incident responses are correlated to achieve an organization-wide perspective on incident awareness and response.

+ @@ -33542,8 +33542,8 @@ -

a configurable capability is implemented to automatically disable the system if are detected.

+ @@ -33593,8 +33593,8 @@ -

an incident handling capability is implemented for incidents involving insider threats.

+ @@ -33650,17 +33650,17 @@ - -

an incident handling capability is coordinated for insider threats;

+ -

the coordinated incident handling capability includes .

+ + @@ -33726,8 +33726,8 @@ -

there is coordination with to correlate and share to achieve a cross-organization perspective on incident awareness and more effective incident responses.

+ @@ -33783,8 +33783,8 @@ -

are employed to respond to incidents.

+ @@ -33837,8 +33837,8 @@ -

incident handling activities involving supply chain events are coordinated with other organizations involved in the supply chain.

+ @@ -33893,17 +33893,17 @@ - -

an integrated incident response team is established and maintained;

+ -

the integrated incident response team can be deployed to any location identified by the organization in .

+ + @@ -33943,17 +33943,17 @@ - -

malicious code remaining in the system is analyzed after the incident;

+ -

other residual artifacts remaining in the system (if any) are analyzed after the incident.

+ + @@ -34016,8 +34016,8 @@ -

anomalous or suspected adversarial behavior in or related to are analyzed.

+ @@ -34070,17 +34070,17 @@ - -

a security operations center is established;

+ -

a security operations center is maintained.

+ + @@ -34138,17 +34138,17 @@ - -

public relations associated with an incident are managed;

+ -

measures are employed to repair the reputation of the organization.

+ + @@ -34201,17 +34201,17 @@ - -

incidents are tracked;

+ -

incidents are documented.

+ + @@ -34285,22 +34285,22 @@ - -

incidents are tracked using ;

+ -

incident information is collected using ;

+ -

incident information is analyzed using .

+ + @@ -34379,17 +34379,17 @@ - -

personnel is/are required to report suspected incidents to the organizational incident response capability within ;

+ -

incident information is reported to .

+ + @@ -34447,8 +34447,8 @@ -

incidents are reported using .

+ @@ -34504,8 +34504,8 @@ -

system vulnerabilities associated with reported incidents are reported to .

+ @@ -34555,8 +34555,8 @@ -

incident information is provided to the provider of the product or service and other organizations involved in the supply chain or supply chain governance for systems or system components related to the incident.

+ @@ -34620,17 +34620,17 @@ - -

an incident response support resource, integral to the organizational incident response capability, is provided;

+ -

the incident response support resource offers advice and assistance to users of the system for the response and reporting of incidents.

+ + @@ -34684,8 +34684,8 @@ -

the availability of incident response information and support is increased using .

+ @@ -34741,17 +34741,17 @@ - -

a direct, cooperative relationship is established between its incident response capability and external providers of the system protection capability;

+ -

organizational incident response team members are identified to the external providers.

+ + @@ -34923,108 +34923,108 @@ - - -

an incident response plan is developed that provides the organization with a roadmap for implementing its incident response capability;

+ -

an incident response plan is developed that describes the structure and organization of the incident response capability;

+ -

an incident response plan is developed that provides a high-level approach for how the incident response capability fits into the overall organization;

+ -

an incident response plan is developed that meets the unique requirements of the organization with regard to mission, size, structure, and functions;

+ -

an incident response plan is developed that defines reportable incidents;

+ -

an incident response plan is developed that provides metrics for measuring the incident response capability within the organization;

+ -

an incident response plan is developed that defines the resources and management support needed to effectively maintain and mature an incident response capability;

+ -

an incident response plan is developed that addresses the sharing of incident information;

+ -

an incident response plan is developed that is reviewed and approved by ;

+ -

an incident response plan is developed that explicitly designates responsibility for incident response to .

+ + - -

copies of the incident response plan are distributed to ;

+ -

copies of the incident response plan are distributed to ;

+ + -

the incident response plan is updated to address system and organizational changes or problems encountered during plan implementation, execution, or testing;

+ - -

incident response plan changes are communicated to ;

+ -

incident response plan changes are communicated to ;

+ + - -

the incident response plan is protected from unauthorized disclosure;

+ -

the incident response plan is protected from unauthorized modification.

+ + + @@ -35087,22 +35087,22 @@ - -

the incident response plan for breaches involving personally identifiable information includes a process to determine if notice to individuals or other organizations, including oversight organizations, is needed;

+ -

the incident response plan for breaches involving personally identifiable information includes an assessment process to determine the extent of the harm, embarrassment, inconvenience, or unfairness to affected individuals and any mechanisms to mitigate such harms;

+ -

the incident response plan for breaches involving personally identifiable information includes the identification of applicable privacy requirements.

+ + @@ -35208,42 +35208,42 @@ - -

is/are assigned the responsibility to respond to information spills;

+ -

the specific information involved in the system contamination is identified in response to information spills;

+ -

is/are alerted of the information spill using a method of communication not associated with the spill;

+ -

the contaminated system or system component is isolated in response to information spills;

+ -

the information is eradicated from the contaminated system or component in response to information spills;

+ -

other systems or system components that may have been subsequently contaminated are identified in response to information spills;

+ -

are performed in response to information spills.

+ + @@ -35310,8 +35310,8 @@ -

information spillage response training is provided .

+ @@ -35359,8 +35359,8 @@ -

are implemented to ensure that organizational personnel impacted by information spills can continue to carry out assigned tasks while contaminated systems are undergoing corrective actions.

+ @@ -35413,8 +35413,8 @@ -

are employed for personnel exposed to information not within assigned access authorizations.

+ @@ -35584,116 +35584,116 @@ - - -

a maintenance policy is developed and documented;

+ -

the maintenance policy is disseminated to ;

+ -

maintenance procedures to facilitate the implementation of the maintenance policy and associated maintenance controls are developed and documented;

+ -

the maintenance procedures are disseminated to ;

+ - - -

the maintenance policy addresses purpose;

+ -

the maintenance policy addresses scope;

+ -

the maintenance policy addresses roles;

+ -

the maintenance policy addresses responsibilities;

+ -

the maintenance policy addresses management commitment;

+ -

the maintenance policy addresses coordination among organizational entities;

+ -

the maintenance policy addresses compliance;

+ + -

the maintenance policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines;

+ + + -

the is designated to manage the development, documentation, and dissemination of the maintenance policy and procedures;

+ - - -

the current maintenance policy is reviewed and updated ;

+ -

the current maintenance policy is reviewed and updated following ;

+ + - -

the current maintenance procedures are reviewed and updated ;

+ -

the current maintenance procedures are reviewed and updated following .

+ + + + @@ -35790,60 +35790,60 @@ - - -

maintenance, repair, and replacement of system components are scheduled in accordance with manufacturer or vendor specifications and/or organizational requirements;

+ -

maintenance, repair, and replacement of system components are documented in accordance with manufacturer or vendor specifications and/or organizational requirements;

+ -

records of maintenance, repair, and replacement of system components are reviewed in accordance with manufacturer or vendor specifications and/or organizational requirements;

+ + - -

all maintenance activities, whether performed on site or remotely and whether the system or system components are serviced on site or removed to another location, are approved;

+ -

all maintenance activities, whether performed on site or remotely and whether the system or system components are serviced on site or removed to another location, are monitored;

+ + -

is/are required to explicitly approve the removal of the system or system components from organizational facilities for off-site maintenance, repair, or replacement;

+ -

equipment is sanitized to remove from associated media prior to removal from organizational facilities for off-site maintenance, repair, or replacement;

+ -

all potentially impacted controls are checked to verify that the controls are still functioning properly following maintenance, repair, or replacement actions;

+ -

is included in organizational maintenance records.

+ + @@ -35937,45 +35937,45 @@ - - -

are used to schedule maintenance, repair, and replacement actions for the system;

+ -

are used to conduct maintenance, repair, and replacement actions for the system;

+ -

are used to document maintenance, repair, and replacement actions for the system;

+ + - -

up-to date, accurate, and complete records of all maintenance actions requested, scheduled, in process, and completed are produced.

+ -

up-to date, accurate, and complete records of all repair actions requested, scheduled, in process, and completed are produced.

+ -

up-to date, accurate, and complete records of all replacement actions requested, scheduled, in process, and completed are produced.

+ + + @@ -36041,31 +36041,31 @@ - - -

the use of system maintenance tools is approved;

+ -

the use of system maintenance tools is controlled;

+ -

the use of system maintenance tools is monitored;

+ + -

previously approved system maintenance tools are reviewed .

+ + @@ -36111,8 +36111,8 @@ -

maintenance tools used by maintenance personnel are inspected for improper or unauthorized modifications.

+ @@ -36160,8 +36160,8 @@ -

media containing diagnostic and test programs are checked for malicious code before the media are used in the system.

+ @@ -36232,27 +36232,27 @@ - -

the removal of maintenance equipment containing organizational information is prevented by verifying that there is no organizational information contained on the equipment; or

+ -

the removal of maintenance equipment containing organizational information is prevented by sanitizing or destroying the equipment; or

+ -

the removal of maintenance equipment containing organizational information is prevented by retaining the equipment within the facility; or

+ -

the removal of maintenance equipment containing organizational information is prevented by obtaining an exemption from explicitly authorizing removal of the equipment from the facility.

+ + @@ -36307,8 +36307,8 @@ -

the use of maintenance tools is restricted to authorized personnel only.

+ @@ -36359,8 +36359,8 @@ -

the use of maintenance tools that execute with increased privilege is monitored.

+ @@ -36412,8 +36412,8 @@ -

maintenance tools are inspected to ensure that the latest software updates and patches are installed.

+ @@ -36502,59 +36502,59 @@ - - -

nonlocal maintenance and diagnostic activities are approved;

+ -

nonlocal maintenance and diagnostic activities are monitored;

+ + - -

the use of nonlocal maintenance and diagnostic tools are allowed only as consistent with organizational policy;

+ -

the use of nonlocal maintenance and diagnostic tools are documented in the security plan for the system;

+ + -

strong authentication is employed in the establishment of nonlocal maintenance and diagnostic sessions;

+ -

records for nonlocal maintenance and diagnostic activities are maintained;

+ - -

session connections are terminated when nonlocal maintenance is completed;

+ -

network connections are terminated when nonlocal maintenance is completed.

+ + + @@ -36635,35 +36635,35 @@ - - -

are logged for nonlocal maintenance sessions;

+ -

are logged for nonlocal diagnostic sessions;

+ + - -

the audit records of the maintenance sessions are reviewed to detect anomalous behavior;

+ -

the audit records of the diagnostic sessions are reviewed to detect anomalous behavior.

+ + + @@ -36734,40 +36734,40 @@ - - -

nonlocal maintenance services are required to be performed from a system that implements a security capability comparable to the capability implemented on the system being serviced;

+ -

nonlocal diagnostic services are required to be performed from a system that implements a security capability comparable to the capability implemented on the system being serviced; or

+ + - -

the component to be serviced is removed from the system prior to nonlocal maintenance or diagnostic services;

+ -

the component to be serviced is sanitized (for organizational information);

+ -

the component is inspected and sanitized (for potentially malicious software) after the service is performed and before reconnecting the component to the system.

+ + + @@ -36845,26 +36845,26 @@ - -

nonlocal maintenance sessions are protected by employing ;

+ - -

nonlocal maintenance sessions are protected by separating maintenance sessions from other network sessions with the system by physically separated communication paths; or

+ -

nonlocal maintenance sessions are protected by logically separated communication paths.

+ + + @@ -36939,17 +36939,17 @@ - -

the approval of each nonlocal maintenance session is required by ;

+ -

is/are notified of the date and time of planned nonlocal maintenance.

+ + @@ -37010,17 +37010,17 @@ - -

are implemented to protect the integrity of nonlocal maintenance and diagnostic communications;

+ -

are implemented to protect the confidentiality of nonlocal maintenance and diagnostic communications.

+ + @@ -37072,17 +37072,17 @@ - -

session connection termination is verified after the completion of nonlocal maintenance and diagnostic sessions;

+ -

network connection termination is verified after the completion of nonlocal maintenance and diagnostic sessions.

+ + @@ -37157,31 +37157,31 @@ - - -

a process for maintenance personnel authorization is established;

+ -

a list of authorized maintenance organizations or personnel is maintained;

+ + -

non-escorted personnel performing maintenance on the system possess the required access authorizations;

+ -

organizational personnel with required access authorizations and technical competence is/are designated to supervise the maintenance activities of personnel who do not possess the required access authorizations.

+ + @@ -37254,26 +37254,26 @@ - - -

procedures for the use of maintenance personnel who lack appropriate security clearances or are not U.S. citizens are implemented and include approved organizational personnel who are fully cleared, have appropriate access authorizations, and are technically qualified escorting and supervising maintenance personnel without the needed access authorization during the performance of maintenance and diagnostic activities;

+ -

procedures for the use of maintenance personnel who lack appropriate security clearances or are not U.S. citizens are implemented and include all volatile information storage components within the system being sanitized and all non-volatile storage media being removed or physically disconnected from the system and secured prior to initiating maintenance or diagnostic activities;

+ + -

are developed and implemented in the event that a system cannot be sanitized, removed, or disconnected from the system.

+ + @@ -37328,17 +37328,17 @@ - -

personnel performing maintenance and diagnostic activities on a system processing, storing, or transmitting classified information possess security clearances for at least the highest classification level and for compartments of information on the system;

+ -

personnel performing maintenance and diagnostic activities on a system processing, storing, or transmitting classified information possess formal access approvals for at least the highest classification level and for compartments of information on the system.

+ + @@ -37389,8 +37389,8 @@ -

personnel performing maintenance and diagnostic activities on a system processing, storing, or transmitting classified information are U.S. citizens.

+ @@ -37441,31 +37441,31 @@ - -

foreign nationals with appropriate security clearances are used to conduct maintenance and diagnostic activities on classified systems only when the systems are jointly owned and operated by the United States and foreign allied governments or owned and operated solely by foreign allied governments;

+ - -

approvals regarding the use of foreign nationals to conduct maintenance and diagnostic activities on classified systems are fully documented within Memoranda of Agreements;

+ -

consents regarding the use of foreign nationals to conduct maintenance and diagnostic activities on classified systems are fully documented within Memoranda of Agreements;

+ -

detailed operational conditions regarding the use of foreign nationals to conduct maintenance and diagnostic activities on classified systems are fully documented within Memoranda of Agreements.

+ + + @@ -37517,8 +37517,8 @@ -

non-escorted personnel performing maintenance activities not directly associated with the system but in the physical proximity of the system have required access authorizations.

+ @@ -37587,8 +37587,8 @@ -

maintenance support and/or spare parts are obtained for within of failure.

+ @@ -37651,8 +37651,8 @@ -

preventive maintenance is performed on at .

+ @@ -37717,8 +37717,8 @@ -

predictive maintenance is performed on at .

+ @@ -37775,8 +37775,8 @@ -

predictive maintenance data is transferred to a maintenance management system using .

+ @@ -37844,8 +37844,8 @@ -

field maintenance on are restricted or prohibited to .

+ @@ -38010,116 +38010,116 @@ - - -

a media protection policy is developed and documented;

+ -

the media protection policy is disseminated to ;

+ -

media protection procedures to facilitate the implementation of the media protection policy and associated media protection controls are developed and documented;

+ -

the media protection procedures are disseminated to ;

+ - - -

the media protection policy addresses purpose;

+ -

the media protection policy addresses scope;

+ -

the media protection policy addresses roles;

+ -

the media protection policy addresses responsibilities;

+ -

the media protection policy addresses management commitment;

+ -

the media protection policy addresses coordination among organizational entities;

+ -

the media protection policy compliance;

+ + -

the media protection policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines;

+ + + -

the is designated to manage the development, documentation, and dissemination of the media protection policy and procedures.

+ - - -

the current media protection policy is reviewed and updated ;

+ -

the current media protection policy is reviewed and updated following ;

+ + - -

the current media protection procedures are reviewed and updated ;

+ -

the current media protection procedures are reviewed and updated following .

+ + + + @@ -38210,17 +38210,17 @@ - -

access to is restricted to ;

+ -

access to is restricted to .

+ + @@ -38316,17 +38316,17 @@ - -

system media is marked to indicate distribution limitations, handling caveats, and applicable security markings (if any) of the information;

+ -

remain within .

+ + @@ -38455,36 +38455,36 @@ - - -

are physically controlled;

+ -

are physically controlled;

+ -

are securely stored within ;

+ -

are securely stored within ;

+ + -

system media types (defined in MP-04_ODP[01], MP-04_ODP[02], MP-04_ODP[03], MP-04_ODP[04]) are protected until the media are destroyed or sanitized using approved equipment, techniques, and procedures.

+ + @@ -38572,22 +38572,22 @@ - -

access to media storage areas is restricted using ;

+ -

access attempts to media storage areas are logged using ;

+ -

access granted to media storage areas is logged using .

+ + @@ -38697,45 +38697,45 @@ - - -

are protected during transport outside of controlled areas using ;

+ -

are controlled during transport outside of controlled areas using ;

+ + -

accountability for system media is maintained during transport outside of controlled areas;

+ -

activities associated with the transport of system media are documented;

+ - -

personnel authorized to conduct media transport activities is/are identified;

+ -

activities associated with the transport of system media are restricted to identified authorized personnel.

+ + + @@ -38800,17 +38800,17 @@ - -

a custodian to transport system media outside of controlled areas is identified;

+ -

the identified custodian is employed during the transport of system media outside of controlled areas.

+ + @@ -38947,31 +38947,31 @@ - - -

is sanitized using prior to disposal;

+ -

is sanitized using prior to release from organizational control;

+ -

is sanitized using prior to release for reuse;

+ + -

sanitization mechanisms with strength and integrity commensurate with the security category or classification of the information are employed.

+ + @@ -39024,32 +39024,32 @@ - -

media sanitization and disposal actions are reviewed;

+ -

media sanitization and disposal actions are approved;

+ -

media sanitization and disposal actions are tracked;

+ -

media sanitization and disposal actions are documented;

+ -

media sanitization and disposal actions are verified.

+ + @@ -39124,17 +39124,17 @@ - -

sanitization equipment is tested to ensure that the intended sanitization is being achieved;

+ -

sanitization procedures are tested to ensure that the intended sanitization is being achieved.

+ + @@ -39196,8 +39196,8 @@ -

non-destructive sanitization techniques are applied to portable storage devices prior to connecting such devices to the system under .

+ @@ -39279,8 +39279,8 @@ -

dual authorization for sanitization of is enforced.

+ @@ -39355,8 +39355,8 @@ -

the capability to purge or wipe information from is provided.

+ @@ -39453,17 +39453,17 @@ - -

the use of is on using ;

+ -

the use of portable storage devices in organizational systems is prohibited when such devices have no identifiable owner.

+ + @@ -39521,17 +39521,17 @@ - -

sanitization-resistant media is identified;

+ -

the use of sanitization-resistant media in organizational systems is prohibited.

+ + @@ -39612,45 +39612,45 @@ - - -

a is established;

+ -

the includes employing downgrading mechanisms with strength and integrity commensurate with the security category or classification of the information;

+ + - -

there is verification that the system media downgrading process is commensurate with the security category and/or classification level of the information to be removed;

+ -

there is verification that the system media downgrading process is commensurate with the access authorizations of the potential recipients of the downgraded information;

+ + -

is identified;

+ -

the identified system media is downgraded using the .

+ + @@ -39698,8 +39698,8 @@ -

system media downgrading actions are documented.

+ @@ -39767,17 +39767,17 @@ - -

downgrading equipment is tested to ensure that downgrading actions are being achieved;

+ -

downgrading procedures are tested to ensure that downgrading actions are being achieved.

+ + @@ -39825,17 +39825,17 @@ - -

system media containing controlled unclassified information is identified;

+ -

system media containing controlled unclassified information is downgraded prior to public release.

+ + @@ -39882,17 +39882,17 @@ - -

system media containing classified information is identified;

+ -

system media containing classified information is downgraded prior to release to individuals without required access authorizations.

+ + @@ -40055,116 +40055,116 @@ - - -

a physical and environmental protection policy is developed and documented;

+ -

the physical and environmental protection policy is disseminated to ;

+ -

physical and environmental protection procedures to facilitate the implementation of the physical and environmental protection policy and associated physical and environmental protection controls are developed and documented;

+ -

the physical and environmental protection procedures are disseminated to ;

+ - - -

the physical and environmental protection policy addresses purpose;

+ -

the physical and environmental protection policy addresses scope;

+ -

the physical and environmental protection policy addresses roles;

+ -

the physical and environmental protection policy addresses responsibilities;

+ -

the physical and environmental protection policy addresses management commitment;

+ -

the physical and environmental protection policy addresses coordination among organizational entities;

+ -

the physical and environmental protection policy addresses compliance;

+ + -

the physical and environmental protection policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines;

+ + + -

the is designated to manage the development, documentation, and dissemination of the physical and environmental protection policy and procedures;

+ - - -

the current physical and environmental protection policy is reviewed and updated ;

+ -

the current physical and environmental protection policy is reviewed and updated following ;

+ + - -

the current physical and environmental protection procedures are reviewed and updated ;

+ -

the current physical and environmental protection procedures are reviewed and updated following .

+ + + + @@ -40241,41 +40241,41 @@ - - -

a list of individuals with authorized access to the facility where the system resides has been developed;

+ -

the list of individuals with authorized access to the facility where the system resides has been approved;

+ -

the list of individuals with authorized access to the facility where the system resides has been maintained;

+ + -

authorization credentials are issued for facility access;

+ -

the access list detailing authorized facility access by individuals is reviewed ;

+ -

individuals are removed from the facility access list when access is no longer required.

+ + @@ -40326,8 +40326,8 @@ -

physical access to the facility where the system resides is authorized based on position or role.

+ @@ -40386,8 +40386,8 @@ -

two forms of identification are required from for visitor access to the facility where the system resides.

+ @@ -40456,8 +40456,8 @@ -

unescorted access to the facility where the system resides is restricted to personnel with .

+ @@ -40656,83 +40656,83 @@ - - -

physical access authorizations are enforced at by verifying individual access authorizations before granting access to the facility;

+ -

physical access authorizations are enforced at by controlling ingress and egress to the facility using ;

+ + -

physical access audit logs are maintained for ;

+ -

access to areas within the facility designated as publicly accessible are maintained by implementing ;

+ - -

visitors are escorted;

+ -

visitor activity is controlled ;

+ + - -

keys are secured;

+ -

combinations are secured;

+ -

other physical access devices are secured;

+ + -

are inventoried ;

+ - -

combinations are changed , when combinations are compromised, or when individuals possessing the combinations are transferred or terminated;

+ -

keys are changed , when keys are lost, or when individuals possessing the keys are transferred or terminated.

+ + + @@ -40792,17 +40792,17 @@ - -

physical access authorizations to the system are enforced;

+ -

physical access controls are enforced for the facility at .

+ + @@ -40862,8 +40862,8 @@ -

security checks are performed at the physical perimeter of the facility or system for exfiltration of information or removal of system components.

+ @@ -40925,8 +40925,8 @@ -

guards are employed to control to the facility where the system resides 24 hours per day, 7 days per week.

+ @@ -40983,8 +40983,8 @@ -

lockable physical casings are used to protect from unauthorized access.

+ @@ -41056,8 +41056,8 @@ -

are employed to physical tampering or alteration of within the system.

+ @@ -41110,8 +41110,8 @@ -

physical barriers are used to limit access.

+ @@ -41157,8 +41157,8 @@ -

access control vestibules are employed at .

+ @@ -41228,8 +41228,8 @@ -

physical access to within organizational facilities is controlled using .

+ @@ -41288,8 +41288,8 @@ -

physical access to output from is controlled to prevent unauthorized individuals from obtaining the output.

+ @@ -41344,8 +41344,8 @@ -

individual identity is linked to the receipt of output from output devices.

+ @@ -41444,40 +41444,40 @@ - -

physical access to the facility where the system resides is monitored to detect and respond to physical security incidents;

+ - -

physical access logs are reviewed ;

+ -

physical access logs are reviewed upon occurrence of ;

+ + - -

results of reviews are coordinated with organizational incident response capabilities;

+ -

results of investigations are coordinated with organizational incident response capabilities.

+ + + @@ -41526,17 +41526,17 @@ - -

physical access to the facility where the system resides is monitored using physical intrusion alarms;

+ -

physical access to the facility where the system resides is monitored using physical surveillance equipment.

+ + @@ -41614,17 +41614,17 @@ - -

are recognized;

+ -

are initiated using .

+ + @@ -41710,22 +41710,22 @@ - -

video surveillance of is employed;

+ -

video recordings are reviewed ;

+ -

video recordings are retained for .

+ + @@ -41786,8 +41786,8 @@ -

physical access to the system is monitored in addition to the physical access monitoring of the facility at .

+ @@ -41887,22 +41887,22 @@ - -

visitor access records for the facility where the system resides are maintained for ;

+ -

visitor access records are reviewed ;

+ -

visitor access records anomalies are reported to .

+ + @@ -41969,17 +41969,17 @@ - -

visitor access records are maintained using ;

+ -

visitor access records are reviewed using .

+ + @@ -42044,8 +42044,8 @@ -

personally identifiable information contained in visitor access records is limited to identified in the privacy risk assessment.

+ @@ -42094,17 +42094,17 @@ - -

power equipment for the system is protected from damage and destruction;

+ -

power cabling for the system is protected from damage and destruction.

+ + @@ -42155,8 +42155,8 @@ -

redundant power cabling paths that are physically separated by are employed.

+ @@ -42208,8 +42208,8 @@ -

automatic voltage controls for are employed.

+ @@ -42284,22 +42284,22 @@ - -

the capability to shut off power to in emergency situations is provided;

+ -

emergency shutoff switches or devices are placed in to facilitate access for authorized personnel;

+ -

the emergency power shutoff capability is protected from unauthorized activation.

+ + @@ -42363,8 +42363,8 @@ -

an uninterruptible power supply is provided to facilitate in the event of a primary power source loss.

+ @@ -42418,17 +42418,17 @@ - -

an alternate power supply provided for the system is activated ;

+ -

the alternate power supply provided for the system can maintain minimally required operational capability in the event of an extended loss of the primary power source.

+ + @@ -42503,23 +42503,23 @@ -

an alternate power supply provided for the system is activated ;

-

the alternate power supply provided for the system is self-contained;

+ -

the alternate power supply provided for the system is not reliant on external power generation;

+ -

the alternate power supply provided for the system is capable of maintaining in the event of an extended loss of the primary power source.

+ + @@ -42568,27 +42568,27 @@ - -

automatic emergency lighting that activates in the event of a power outage or disruption is employed for the system;

+ -

automatic emergency lighting that activates in the event of a power outage or disruption is maintained for the system;

+ -

automatic emergency lighting for the system covers emergency exits within the facility;

+ -

automatic emergency lighting for the system covers evacuation routes within the facility.

+ + @@ -42633,8 +42633,8 @@ -

emergency lighting is provided for all areas within the facility supporting essential mission and business functions.

+ @@ -42682,37 +42682,37 @@ - -

fire detection systems are employed;

+ -

employed fire detection systems are supported by an independent energy source;

+ -

employed fire detection systems are maintained;

+ -

fire suppression systems are employed;

+ -

employed fire suppression systems are supported by an independent energy source;

+ -

employed fire suppression systems are maintained.

+ + @@ -42773,22 +42773,22 @@ - -

fire detection systems that activate automatically are employed in the event of a fire;

+ -

fire detection systems that notify automatically are employed in the event of a fire;

+ -

fire detection systems that notify automatically are employed in the event of a fire.

+ + @@ -42862,31 +42862,31 @@ - - -

fire suppression systems that activate automatically are employed;

+ -

fire suppression systems that notify automatically are employed;

+ -

fire suppression systems that notify automatically are employed;

+ + -

an automatic fire suppression capability is employed when the facility is not staffed on a continuous basis.

+ + @@ -42960,17 +42960,17 @@ - -

the facility undergoes fire protection inspections by authorized and qualified inspectors;

+ -

the identified deficiencies from fire protection inspections are resolved within .

+ + @@ -43055,17 +43055,17 @@ - -

levels are maintained at within the facility where the system resides;

+ -

environmental control levels are monitored .

+ + @@ -43119,8 +43119,8 @@ -

are employed in the facility to prevent fluctuations that are potentially harmful to the system.

+ @@ -43175,17 +43175,17 @@ - -

environmental control monitoring is employed;

+ -

the environmental control monitoring capability provides an alarm or notification to when changes are potentially harmful to personnel or equipment.

+ + @@ -43233,27 +43233,27 @@ - -

the system is protected from damage resulting from water leakage by providing master shutoff or isolation valves;

+ -

the master shutoff or isolation valves are accessible;

+ -

the master shutoff or isolation valves are working properly;

+ -

the master shutoff or isolation valves are known to key personnel.

+ + @@ -43316,17 +43316,17 @@ - -

the presence of water near the system can be detected automatically;

+ -

is/are alerted using .

+ + @@ -43409,36 +43409,36 @@ - - -

are authorized when entering the facility;

+ -

are controlled when entering the facility;

+ -

are authorized when exiting the facility;

+ -

are controlled when exiting the facility;

+ + -

records of the system components are maintained.

+ + @@ -43518,27 +43518,27 @@ - -

are determined and documented;

+ -

are employed at alternate work sites;

+ -

the effectiveness of controls at alternate work sites is assessed;

+ -

a means for employees to communicate with information security and privacy personnel in case of incidents is provided.

+ + @@ -43601,8 +43601,8 @@ -

system components are positioned within the facility to minimize potential damage from and to minimize the opportunity for unauthorized access.

+ @@ -43659,8 +43659,8 @@ -

the system is protected from information leakage due to electromagnetic signal emanations.

+ @@ -43705,22 +43705,22 @@ - -

system components are protected in accordance with national emissions security policies and procedures based on the security category or classification of the information;

+ -

associated data communications are protected in accordance with national emissions security policies and procedures based on the security category or classification of the information;

+ -

networks are protected in accordance with national emissions security policies and procedures based on the security category or classification of the information.

+ + @@ -43791,8 +43791,8 @@ -

are employed to track and monitor the location and movement of within .

+ @@ -43860,8 +43860,8 @@ -

are employed against electromagnetic pulse damage for .

+ @@ -43919,8 +43919,8 @@ -

are marked indicating the impact level or classification level of the information permitted to be processed, stored, or transmitted by the hardware component.

+ @@ -43981,17 +43981,17 @@ - -

the location or site of the facility where the system resides is planned considering physical and environmental hazards;

+ -

for existing facilities, physical and environmental hazards are considered in the organizational risk management strategy.

+ + @@ -44153,116 +44153,116 @@ - - -

a planning policy is developed and documented.

+ -

the planning policy is disseminated to ;

+ -

planning procedures to facilitate the implementation of the planning policy and associated planning controls are developed and documented;

+ -

the planning procedures are disseminated to ;

+ - - -

the planning policy addresses purpose;

+ -

the planning policy addresses scope;

+ -

the planning policy addresses roles;

+ -

the planning policy addresses responsibilities;

+ -

the planning policy addresses management commitment;

+ -

the planning policy addresses coordination among organizational entities;

+ -

the planning policy addresses compliance;

+ + -

the planning policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines;

+ + + -

the is designated to manage the development, documentation, and dissemination of the planning policy and procedures;

+ - - -

the current planning policy is reviewed and updated ;

+ -

the current planning policy is reviewed and updated following ;

+ + - -

the current planning procedures are reviewed and updated ;

+ -

the current planning procedures are reviewed and updated following .

+ + + + @@ -44446,273 +44446,273 @@ - - - -

a security plan for the system is developed that is consistent with the organization’s enterprise architecture;

+ -

a privacy plan for the system is developed that is consistent with the organization’s enterprise architecture;

+ + - -

a security plan for the system is developed that explicitly defines the constituent system components;

+ -

a privacy plan for the system is developed that explicitly defines the constituent system components;

+ + - -

a security plan for the system is developed that describes the operational context of the system in terms of mission and business processes;

+ -

a privacy plan for the system is developed that describes the operational context of the system in terms of mission and business processes;

+ + - -

a security plan for the system is developed that identifies the individuals that fulfill system roles and responsibilities;

+ -

a privacy plan for the system is developed that identifies the individuals that fulfill system roles and responsibilities;

+ + - -

a security plan for the system is developed that identifies the information types processed, stored, and transmitted by the system;

+ -

a privacy plan for the system is developed that identifies the information types processed, stored, and transmitted by the system;

+ + - -

a security plan for the system is developed that provides the security categorization of the system, including supporting rationale;

+ -

a privacy plan for the system is developed that provides the security categorization of the system, including supporting rationale;

+ + - -

a security plan for the system is developed that describes any specific threats to the system that are of concern to the organization;

+ -

a privacy plan for the system is developed that describes any specific threats to the system that are of concern to the organization;

+ + - -

a security plan for the system is developed that provides the results of a privacy risk assessment for systems processing personally identifiable information;

+ -

a privacy plan for the system is developed that provides the results of a privacy risk assessment for systems processing personally identifiable information;

+ + - -

a security plan for the system is developed that describes the operational environment for the system and any dependencies on or connections to other systems or system components;

+ -

a privacy plan for the system is developed that describes the operational environment for the system and any dependencies on or connections to other systems or system components;

+ + - -

a security plan for the system is developed that provides an overview of the security requirements for the system;

+ -

a privacy plan for the system is developed that provides an overview of the privacy requirements for the system;

+ + - -

a security plan for the system is developed that identifies any relevant control baselines or overlays, if applicable;

+ -

a privacy plan for the system is developed that identifies any relevant control baselines or overlays, if applicable;

+ + - -

a security plan for the system is developed that describes the controls in place or planned for meeting the security requirements, including rationale for any tailoring decisions;

+ -

a privacy plan for the system is developed that describes the controls in place or planned for meeting the privacy requirements, including rationale for any tailoring decisions;

+ + - -

a security plan for the system is developed that includes risk determinations for security architecture and design decisions;

+ -

a privacy plan for the system is developed that includes risk determinations for privacy architecture and design decisions;

+ + - -

a security plan for the system is developed that includes security-related activities affecting the system that require planning and coordination with ;

+ -

a privacy plan for the system is developed that includes privacy-related activities affecting the system that require planning and coordination with ;

+ + - -

a security plan for the system is developed that is reviewed and approved by the authorizing official or designated representative prior to plan implementation;

+ -

a privacy plan for the system is developed that is reviewed and approved by the authorizing official or designated representative prior to plan implementation.

+ + + - -

copies of the plans are distributed to ;

+ -

subsequent changes to the plans are communicated to ;

+ + -

plans are reviewed ;

+ - -

plans are updated to address changes to the system and environment of operations;

+ -

plans are updated to address problems identified during the plan implementation;

+ -

plans are updated to address problems identified during control assessments;

+ + - -

plans are protected from unauthorized disclosure;

+ -

plans are protected from unauthorized modification.

+ + + @@ -44857,36 +44857,36 @@ - - -

rules that describe responsibilities and expected behavior for information and system usage, security, and privacy are established for individuals requiring access to the system;

+ -

rules that describe responsibilities and expected behavior for information and system usage, security, and privacy are provided to individuals requiring access to the system;

+ + -

before authorizing access to information and the system, a documented acknowledgement from such individuals indicating that they have read, understand, and agree to abide by the rules of behavior is received;

+ -

rules of behavior are reviewed and updated ;

+ -

individuals who have acknowledged a previous version of the rules of behavior are required to read and reacknowledge .

+ + @@ -44948,22 +44948,22 @@ - -

the rules of behavior include restrictions on the use of social media, social networking sites, and external sites/applications;

+ -

the rules of behavior include restrictions on posting organizational information on public websites;

+ -

the rules of behavior include restrictions on the use of organization-provided identifiers (e.g., email addresses) and authentication secrets (e.g., passwords) for creating accounts on external sites/applications.

+ + @@ -45045,17 +45045,17 @@ - -

a CONOPS for the system describing how the organization intends to operate the system from the perspective of information security and privacy is developed;

+ -

the CONOPS is reviewed and updated .

+ + @@ -45157,88 +45157,88 @@ - - -

a security architecture for the system describes the requirements and approach to be taken for protecting the confidentiality, integrity, and availability of organizational information;

+ -

a privacy architecture describes the requirements and approach to be taken for processing personally identifiable information to minimize privacy risk to individuals;

+ - -

a security architecture for the system describes how the architecture is integrated into and supports the enterprise architecture;

+ -

a privacy architecture for the system describes how the architecture is integrated into and supports the enterprise architecture;

+ + - -

a security architecture for the system describes any assumptions about and dependencies on external systems and services;

+ -

a privacy architecture for the system describes any assumptions about and dependencies on external systems and services;

+ + + -

changes in the enterprise architecture are reviewed and updated to reflect changes in the enterprise architecture;

+ - -

planned architecture changes are reflected in the security plan;

+ -

planned architecture changes are reflected in the privacy plan;

+ -

planned architecture changes are reflected in the Concept of Operations (CONOPS);

+ -

planned architecture changes are reflected in criticality analysis;

+ -

planned architecture changes are reflected in organizational procedures;

+ -

planned architecture changes are reflected in procurements and acquisitions.

+ + + @@ -45317,35 +45317,35 @@ - - -

the security architecture for the system is designed using a defense-in-depth approach that allocates to ;

+ -

the privacy architecture for the system is designed using a defense-in-depth approach that allocates to ;

+ + - -

the security architecture for the system is designed using a defense-in-depth approach that ensures the allocated controls operate in a coordinated and mutually reinforcing manner;

+ -

the privacy architecture for the system is designed using a defense-in-depth approach that ensures the allocated controls operate in a coordinated and mutually reinforcing manner.

+ + + @@ -45413,8 +45413,8 @@ -

that are allocated to are required to be obtained from different suppliers.

+ @@ -45479,8 +45479,8 @@ -

are centrally managed.

+ @@ -45540,8 +45540,8 @@ -

a control baseline for the system is selected.

+ @@ -45607,8 +45607,8 @@ -

the selected control baseline is tailored by applying specified tailoring actions.

+ @@ -45723,107 +45723,107 @@ - - -

an organization-wide information security program plan is developed;

+ -

the information security program plan is disseminated;

+ - -

the information security program plan provides an overview of the requirements for the security program;

+ -

the information security program plan provides a description of the security program management controls in place or planned for meeting those requirements;

+ -

the information security program plan provides a description of the common controls in place or planned for meeting those requirements;

+ + - -

the information security program plan includes the identification and assignment of roles;

+ -

the information security program plan includes the identification and assignment of responsibilities;

+ -

the information security program plan addresses management commitment;

+ -

the information security program plan addresses coordination among organizational entities;

+ -

the information security program plan addresses compliance;

+ + -

the information security program plan reflects the coordination among the organizational entities responsible for information security;

+ -

the information security program plan is approved by a senior official with responsibility and accountability for the risk being incurred to organizational operations (including mission, functions, image, and reputation), organizational assets, individuals, other organizations, and the Nation;

+ + - -

the information security program plan is reviewed and updated ;

+ -

the information security program plan is reviewed and updated following ;

+ + - -

the information security program plan is protected from unauthorized disclosure;

+ -

the information security program plan is protected from unauthorized modification.

+ + + @@ -45873,32 +45873,32 @@ - -

a senior agency information security officer is appointed;

+ -

the senior agency information security officer is provided with the mission and resources to coordinate an organization-wide information security program;

+ -

the senior agency information security officer is provided with the mission and resources to develop an organization-wide information security program;

+ -

the senior agency information security officer is provided with the mission and resources to implement an organization-wide information security program;

+ -

the senior agency information security officer is provided with the mission and resources to maintain an organization-wide information security program.

+ + @@ -45949,49 +45949,49 @@ - - -

the resources needed to implement the information security program are included in capital planning and investment requests, and all exceptions are documented;

+ -

the resources needed to implement the privacy program are included in capital planning and investment requests, and all exceptions are documented;

+ + - -

the documentation required for addressing the information security program in capital planning and investment requests is prepared in accordance with applicable laws, executive orders, directives, policies, regulations, standards;

+ -

the documentation required for addressing the privacy program in capital planning and investment requests is prepared in accordance with applicable laws, executive orders, directives, policies, regulations, standards;

+ + - -

information security resources are made available for expenditure as planned;

+ -

privacy resources are made available for expenditure as planned.

+ + + @@ -46068,97 +46068,97 @@ - - - -

a process to ensure that plans of action and milestones for the information security program and associated organizational systems are developed;

+ -

a process to ensure that plans of action and milestones for the information security program and associated organizational systems are maintained;

+ -

a process to ensure that plans of action and milestones for the privacy program and associated organizational systems are developed;

+ -

a process to ensure that plans of action and milestones for the privacy program and associated organizational systems are maintained;

+ -

a process to ensure that plans of action and milestones for the supply chain risk management program and associated organizational systems are developed;

+ -

a process to ensure that plans of action and milestones for the supply chain risk management program and associated organizational systems are maintained;

+ + - -

a process to ensure that plans of action and milestones for the information security program and associated organizational systems document remedial information security risk management actions to adequately respond to risks to organizational operations and assets, individuals, other organizations, and the Nation;

+ -

a process to ensure that plans of action and milestones for the privacy program and associated organizational systems document remedial privacy risk management actions to adequately respond to risks to organizational operations and assets, individuals, other organizations, and the Nation;

+ -

a process to ensure that plans of action and milestones for the supply chain risk management program and associated organizational systems document remedial supply chain risk management actions to adequately respond to risks to organizational operations and assets, individuals, other organizations, and the Nation;

+ + - -

a process to ensure that plans of action and milestones for the information security risk management programs and associated organizational systems are reported in accordance with established reporting requirements;

+ -

a process to ensure that plans of action and milestones for the privacy risk management programs and associated organizational systems are reported in accordance with established reporting requirements;

+ -

a process to ensure that plans of action and milestones for the supply chain risk management programs and associated organizational systems are reported in accordance with established reporting requirements;

+ + + - -

plans of action and milestones are reviewed for consistency with the organizational risk management strategy;

+ -

plans of action and milestones are reviewed for consistency with organization-wide priorities for risk response actions.

+ + + @@ -46215,17 +46215,17 @@ - -

an inventory of organizational systems is developed;

+ -

the inventory of organizational systems is updated .

+ + @@ -46288,22 +46288,22 @@ - -

an inventory of all systems, applications, and projects that process personally identifiable information is established;

+ -

an inventory of all systems, applications, and projects that process personally identifiable information is maintained;

+ -

an inventory of all systems, applications, and projects that process personally identifiable information is updated .

+ + @@ -46361,37 +46361,37 @@ - -

information security measures of performance are developed;

+ -

information security measures of performance are monitored;

+ -

the results of information security measures of performance are reported;

+ -

privacy measures of performance are developed;

+ -

privacy measures of performance are monitored;

+ -

the results of privacy measures of performance are reported.

+ + @@ -46451,37 +46451,37 @@ - -

an enterprise architecture is developed with consideration for information security;

+ -

an enterprise architecture is maintained with consideration for information security;

+ -

an enterprise architecture is developed with consideration for privacy;

+ -

an enterprise architecture is maintained with consideration for privacy;

+ -

an enterprise architecture is developed with consideration for the resulting risk to organizational operations and assets, individuals, other organizations, and the Nation;

+ -

an enterprise architecture is maintained with consideration for the resulting risk to organizational operations and assets, individuals, other organizations, and the Nation.

+ + @@ -46537,8 +46537,8 @@ -

are offloaded to other systems, system components, or an external provider.

+ @@ -46601,37 +46601,37 @@ - -

information security issues are addressed in the development of a critical infrastructure and key resources protection plan;

+ -

information security issues are addressed in the documentation of a critical infrastructure and key resources protection plan;

+ -

information security issues are addressed in the update of a critical infrastructure and key resources protection plan;

+ -

privacy issues are addressed in the development of a critical infrastructure and key resources protection plan;

+ -

privacy issues are addressed in the documentation of a critical infrastructure and key resources protection plan;

+ -

privacy issues are addressed in the update of a critical infrastructure and key resources protection plan.

+ + @@ -46749,31 +46749,31 @@ - - -

a comprehensive strategy is developed to manage security risk to organizational operations and assets, individuals, other organizations, and the Nation associated with the operation and use of organizational systems;

+ -

a comprehensive strategy is developed to manage privacy risk to individuals resulting from the authorized processing of personally identifiable information;

+ + -

the risk management strategy is implemented consistently across the organization;

+ -

the risk management strategy is reviewed and updated or as required to address organizational changes.

+ + @@ -46838,31 +46838,31 @@ - - -

the security state of organizational systems and the environments in which those systems operate are managed through authorization processes;

+ -

the privacy state of organizational systems and the environments in which those systems operate are managed through authorization processes;

+ + -

individuals are designated to fulfill specific roles and responsibilities within the organizational risk management process;

+ -

the authorization processes are integrated into an organization-wide risk management program.

+ + @@ -46945,45 +46945,45 @@ - - -

organizational mission and business processes are defined with consideration for information security;

+ -

organizational mission and business processes are defined with consideration for privacy;

+ -

organizational mission and business processes are defined with consideration for the resulting risk to organizational operations, organizational assets, individuals, other organizations, and the Nation;

+ + - -

information protection needs arising from the defined mission and business processes are determined;

+ -

personally identifiable information processing needs arising from the defined mission and business processes are determined;

+ + -

the mission and business processes are reviewed and revised .

+ + @@ -47058,8 +47058,8 @@ -

an insider threat program that includes a cross-discipline insider threat incident handling team is implemented.

+ @@ -47099,17 +47099,17 @@ - -

a security workforce development and improvement program is established;

+ -

a privacy workforce development and improvement program is established.

+ + @@ -47184,83 +47184,83 @@ - - - -

a process is implemented for ensuring that organizational plans for conducting security testing, training, and monitoring activities associated with organizational systems are developed;

+ -

a process is implemented for ensuring that organizational plans for conducting security testing, training, and monitoring activities associated with organizational systems are maintained;

+ -

a process is implemented for ensuring that organizational plans for conducting privacy testing, training, and monitoring activities associated with organizational systems are developed;

+ -

a process is implemented for ensuring that organizational plans for conducting privacy testing, training, and monitoring activities associated with organizational systems are maintained;

+ + - -

a process is implemented for ensuring that organizational plans for conducting security testing, training, and monitoring activities associated with organizational systems continue to be executed;

+ -

a process is implemented for ensuring that organizational plans for conducting privacy testing, training, and monitoring activities associated with organizational systems continue to be executed;

+ + + - -

testing plans are reviewed for consistency with the organizational risk management strategy;

+ -

training plans are reviewed for consistency with the organizational risk management strategy;

+ -

monitoring plans are reviewed for consistency with the organizational risk management strategy;

+ -

testing plans are reviewed for consistency with organization-wide priorities for risk response actions;

+ -

training plans are reviewed for consistency with organization-wide priorities for risk response actions;

+ -

monitoring plans are reviewed for consistency with organization-wide priorities for risk response actions.

+ + + @@ -47323,49 +47323,49 @@ - - -

contact is established and institutionalized with selected groups and associations within the security community to facilitate ongoing security education and training for organizational personnel;

+ -

contact is established and institutionalized with selected groups and associations within the privacy community to facilitate ongoing privacy education and training for organizational personnel;

+ + - -

contact is established and institutionalized with selected groups and associations within the security community to maintain currency with recommended security practices, techniques, and technologies;

+ -

contact is established and institutionalized with selected groups and associations within the privacy community to maintain currency with recommended privacy practices, techniques, and technologies;

+ + - -

contact is established and institutionalized with selected groups and associations within the security community to share current security information, including threats, vulnerabilities, and incidents;

+ -

contact is established and institutionalized with selected groups and associations within the privacy community to share current privacy information, including threats, vulnerabilities, and incidents.

+ + + @@ -47415,8 +47415,8 @@ -

a threat awareness program that includes a cross-organization information-sharing capability for threat intelligence is implemented.

+ @@ -47468,8 +47468,8 @@ -

automated mechanisms are employed to maximize the effectiveness of sharing threat intelligence information.

+ @@ -47554,35 +47554,35 @@ - - -

policy is established to ensure that requirements for the protection of controlled unclassified information that is processed, stored, or transmitted on external systems are implemented in accordance with applicable laws, executive orders, directives, policies, regulations, and standards;

+ -

procedures are established to ensure that requirements for the protection of controlled unclassified information that is processed, stored, or transmitted on external systems are implemented in accordance with applicable laws, executive orders, directives, policies, regulations, and standards;

+ + - -

policy is reviewed and updated ;

+ -

procedures are reviewed and updated

+ + + @@ -47663,121 +47663,121 @@ - - -

an organization-wide privacy program plan that provides an overview of the agency’s privacy program is developed;

+ - -

the privacy program plan includes a description of the structure of the privacy program;

+ -

the privacy program plan includes a description of the resources dedicated to the privacy program;

+ + - -

the privacy program plan provides an overview of the requirements for the privacy program;

+ -

the privacy program plan provides a description of the privacy program management controls in place or planned for meeting the requirements of the privacy program;

+ -

the privacy program plan provides a description of common controls in place or planned for meeting the requirements of the privacy program;

+ + - -

the privacy program plan includes the role of the senior agency official for privacy;

+ -

the privacy program plan includes the identification and assignment of the roles of other privacy officials and staff and their responsibilities;

+ + - -

the privacy program plan describes management commitment;

+ -

the privacy program plan describes compliance;

+ -

the privacy program plan describes the strategic goals and objectives of the privacy program;

+ + -

the privacy program plan reflects coordination among organizational entities responsible for the different aspects of privacy;

+ -

the privacy program plan is approved by a senior official with responsibility and accountability for the privacy risk being incurred by organizational operations (including, mission, functions, image, and reputation), organizational assets, individuals, other organizations, and the Nation;

+ -

the privacy program plan is disseminated;

+ + - -

the privacy program plan is updated ;

+ -

the privacy program plan is updated to address changes in federal privacy laws and policies;

+ -

the privacy program plan is updated to address organizational changes;

+ -

the privacy program plan is updated to address problems identified during plan implementation or privacy control assessments.

+ + + @@ -47820,32 +47820,32 @@ - -

a senior agency official for privacy with authority, mission, accountability, and resources is appointed;

+ -

the senior agency official for privacy coordinates applicable privacy requirements;

+ -

the senior agency official for privacy develops applicable privacy requirements;

+ -

the senior agency official for privacy implements applicable privacy requirements;

+ -

the senior agency official for privacy manages privacy risks through the organization-wide privacy program.

+ + @@ -47909,50 +47909,50 @@ - -

a central resource webpage is maintained on the organization’s principal public website;

+ -

the webpage serves as a central source of information about the organization’s privacy program;

+ - -

the webpage ensures that the public has access to information about organizational privacy activities;

+ -

the webpage ensures that the public can communicate with its senior agency official for privacy;

+ + - -

the webpage ensures that organizational privacy practices are publicly available;

+ -

the webpage ensures that organizational privacy reports are publicly available;

+ + -

the webpage employs publicly facing email addresses and/or phone numbers to enable the public to provide feedback and/or direct questions to privacy offices regarding privacy practices.

+ + @@ -48012,64 +48012,64 @@ - -

privacy policies are developed and posted on all external-facing websites;

+ -

privacy policies are developed and posted on all mobile applications;

+ -

privacy policies are developed and posted on all other digital services;

+ - -

the privacy policies are written in plain language;

+ -

the privacy policies are organized in a way that is easy to understand and navigate;

+ + - -

the privacy policies provide the information needed by the public to make an informed decision about whether to interact with the organization;

+ -

the privacy policies provide the information needed by the public to make an informed decision about how to interact with the organization;

+ + - -

the privacy policies are updated whenever the organization makes a substantive change to the practices it describes;

+ -

the privacy policies include a time/date stamp to inform the public of the date of the most recent changes.

+ + + @@ -48137,55 +48137,55 @@ - -

an accurate accounting of disclosures of personally identifiable information is developed and maintained;

- -

the accounting includes the date of each disclosure;

+ -

the accounting includes the nature of each disclosure;

+ -

the accounting includes the purpose of each disclosure;

+ + - -

the accounting includes the name of the individual or organization to whom the disclosure was made;

+ -

the accounting includes the address or other contact information of the individual or organization to whom the disclosure was made;

+ + + -

the accounting of disclosures is retained for the length of time that the personally identifiable information is maintained or five years after the disclosure is made, whichever is longer;

+ -

the accounting of disclosures is made available to the individual to whom the personally identifiable information relates upon request.

+ + @@ -48255,103 +48255,103 @@ - -

organization-wide policies for personally identifiable information quality management are developed and documented;

+ -

organization-wide procedures for personally identifiable information quality management are developed and documented;

+ - -

the policies address reviewing the accuracy of personally identifiable information across the information life cycle;

+ -

the policies address reviewing the relevance of personally identifiable information across the information life cycle;

+ -

the policies address reviewing the timeliness of personally identifiable information across the information life cycle;

+ -

the policies address reviewing the completeness of personally identifiable information across the information life cycle;

+ -

the procedures address reviewing the accuracy of personally identifiable information across the information life cycle;

+ -

the procedures address reviewing the relevance of personally identifiable information across the information life cycle;

+ -

the procedures address reviewing the timeliness of personally identifiable information across the information life cycle;

+ -

the procedures address reviewing the completeness of personally identifiable information across the information life cycle;

+ + - -

the policies address correcting or deleting inaccurate or outdated personally identifiable information;

+ -

the procedures address correcting or deleting inaccurate or outdated personally identifiable information;

+ + - -

the policies address disseminating notice of corrected or deleted personally identifiable information to individuals or other appropriate entities;

+ -

the procedures address disseminating notice of corrected or deleted personally identifiable information to individuals or other appropriate entities;

+ + - -

the policies address appeals of adverse decisions on correction or deletion requests;

+ -

the procedures address appeals of adverse decisions on correction or deletion requests.

+ + + @@ -48423,8 +48423,8 @@ -

a Data Governance Body consisting of with is established.

+ @@ -48476,18 +48476,18 @@ -

a Data Integrity Board is established;

-

the Data Integrity Board reviews proposals to conduct or participate in a matching program;

+ -

the Data Integrity Board conducts an annual review of all matching programs in which the agency has participated.

+ + @@ -48580,133 +48580,133 @@ - - -

policies that address the use of personally identifiable information for internal testing are developed and documented;

+ -

policies that address the use of personally identifiable information for internal training are developed and documented;

+ -

policies that address the use of personally identifiable information for internal research are developed and documented;

+ -

procedures that address the use of personally identifiable information for internal testing are developed and documented;

+ -

procedures that address the use of personally identifiable information for internal training are developed and documented;

+ -

procedures that address the use of personally identifiable information for internal research are developed and documented;

+ -

policies that address the use of personally identifiable information for internal testing, are implemented;

+ -

policies that address the use of personally identifiable information for training are implemented;

+ -

policies that address the use of personally identifiable information for research are implemented;

+ -

procedures that address the use of personally identifiable information for internal testing are implemented;

+ -

procedures that address the use of personally identifiable information for training are implemented;

+ -

procedures that address the use of personally identifiable information for research are implemented;

+ + - -

the amount of personally identifiable information used for internal testing purposes is limited or minimized;

+ -

the amount of personally identifiable information used for internal training purposes is limited or minimized;

+ -

the amount of personally identifiable information used for internal research purposes is limited or minimized;

+ + - -

the required use of personally identifiable information for internal testing is authorized;

+ -

the required use of personally identifiable information for internal training is authorized;

+ -

the required use of personally identifiable information for internal research is authorized;

+ + - -

policies are reviewed ;

+ -

policies are updated ;

+ -

procedures are reviewed ;

+ -

procedures are updated .

+ + + @@ -48813,60 +48813,60 @@ - -

a process for receiving complaints, concerns, or questions from individuals about organizational security and privacy practices is implemented;

+ -

a process for responding to complaints, concerns, or questions from individuals about organizational security and privacy practices is implemented;

+ - -

the complaint management process includes mechanisms that are easy to use by the public;

+ -

the complaint management process includes mechanisms that are readily accessible by the public;

+ + -

the complaint management process includes all information necessary for successfully filing complaints;

+ - -

the complaint management process includes tracking mechanisms to ensure that all complaints are reviewed within ;

+ -

the complaint management process includes tracking mechanisms to ensure that all complaints are addressed within ;

+ + -

the complaint management process includes acknowledging the receipt of complaints, concerns, or questions from individuals within ;

+ -

the complaint management process includes responding to complaints, concerns, or questions from individuals within .

+ + @@ -48963,36 +48963,36 @@ - -

are developed;

-

the privacy reports are disseminated to to demonstrate accountability with statutory, regulatory, and policy privacy mandates;

+ - -

the privacy reports are disseminated to ;

+ -

the privacy reports are disseminated to other personnel responsible for monitoring privacy program compliance;

+ + + -

the privacy reports are reviewed and updated .

+ + @@ -49081,78 +49081,78 @@ - - - -

assumptions affecting risk assessments are identified and documented;

+ -

assumptions affecting risk responses are identified and documented;

+ -

assumptions affecting risk monitoring are identified and documented;

+ + - -

constraints affecting risk assessments are identified and documented;

+ -

constraints affecting risk responses are identified and documented;

+ -

constraints affecting risk monitoring are identified and documented;

+ + - -

priorities considered by the organization for managing risk are identified and documented;

+ -

trade-offs considered by the organization for managing risk are identified and documented;

+ + -

organizational risk tolerance is identified and documented;

+ + -

the results of risk framing activities are distributed to ;

+ -

risk framing considerations are reviewed and updated .

+ + @@ -49212,40 +49212,40 @@ - - -

a Senior Accountable Official for Risk Management is appointed;

+ -

a Senior Accountable Official for Risk Management aligns information security and privacy management processes with strategic, operational, and budgetary planning processes;

+ + - -

a Risk Executive (function) is established;

+ -

a Risk Executive (function) views and analyzes risk from an organization-wide perspective;

+ -

a Risk Executive (function) ensures that the management of risk is consistent across the organization.

+ + + @@ -49329,86 +49329,86 @@ - - -

an organization-wide strategy for managing supply chain risks is developed;

+ -

the supply chain risk management strategy addresses risks associated with the development of systems;

+ -

the supply chain risk management strategy addresses risks associated with the development of system components;

+ -

the supply chain risk management strategy addresses risks associated with the development of system services;

+ -

the supply chain risk management strategy addresses risks associated with the acquisition of systems;

+ -

the supply chain risk management strategy addresses risks associated with the acquisition of system components;

+ -

the supply chain risk management strategy addresses risks associated with the acquisition of system services;

+ -

the supply chain risk management strategy addresses risks associated with the maintenance of systems;

+ -

the supply chain risk management strategy addresses risks associated with the maintenance of system components;

+ -

the supply chain risk management strategy addresses risks associated with the maintenance of system services;

+ -

the supply chain risk management strategy addresses risks associated with the disposal of systems;

+ -

the supply chain risk management strategy addresses risks associated with the disposal of system components;

+ -

the supply chain risk management strategy addresses risks associated with the disposal of system services;

+ + -

the supply chain risk management strategy is implemented consistently across the organization;

+ -

the supply chain risk management strategy is reviewed and updated or as required to address organizational changes.

+ + @@ -49448,22 +49448,22 @@ - -

suppliers of critical or mission-essential technologies, products, and services are identified;

+ -

suppliers of critical or mission-essential technologies, products, and services are prioritized;

+ -

suppliers of critical or mission-essential technologies, products, and services are assessed.

+ + @@ -49655,74 +49655,74 @@ -

an organization-wide continuous monitoring strategy is developed;

-

continuous monitoring programs are implemented that include establishing to be monitored;

+ - -

continuous monitoring programs are implemented that establish for monitoring;

+ -

continuous monitoring programs are implemented that establish for assessment of control effectiveness;

+ + -

continuous monitoring programs are implemented that include monitoring on an ongoing basis in accordance with the continuous monitoring strategy;

+ - -

continuous monitoring programs are implemented that include correlating information generated by control assessments and monitoring;

+ -

continuous monitoring programs are implemented that include analyzing information generated by control assessments and monitoring;

+ + - -

continuous monitoring programs are implemented that include response actions to address the analysis of control assessment information;

+ -

continuous monitoring programs are implemented that include response actions to address the analysis of monitoring information;

+ + - -

continuous monitoring programs are implemented that include reporting the security status of organizational systems to ;

+ -

continuous monitoring programs are implemented that include reporting the privacy status of organizational systems to .

+ + + @@ -49793,8 +49793,8 @@ -

supporting mission-essential services or functions are analyzed to ensure that the information resources are being used in a manner that is consistent with their intended purpose.

+ @@ -49944,116 +49944,116 @@ - - -

a personnel security policy is developed and documented;

+ -

the personnel security policy is disseminated to ;

+ -

personnel security procedures to facilitate the implementation of the personnel security policy and associated personnel security controls are developed and documented;

+ -

the personnel security procedures are disseminated to ;

+ - - -

the personnel security policy addresses purpose;

+ -

the personnel security policy addresses scope;

+ -

the personnel security policy addresses roles;

+ -

the personnel security policy addresses responsibilities;

+ -

the personnel security policy addresses management commitment;

+ -

the personnel security policy addresses coordination among organizational entities;

+ -

the personnel security policy addresses compliance;

+ + -

the personnel security policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines;

+ + + -

the is designated to manage the development, documentation, and dissemination of the personnel security policy and procedures;

+ - - -

the current personnel security policy is reviewed and updated ;

+ -

the current personnel security policy is reviewed and updated following ;

+ + - -

the current personnel security procedures are reviewed and updated ;

+ -

the current personnel security procedures are reviewed and updated following .

+ + + + @@ -50122,22 +50122,22 @@ - -

a risk designation is assigned to all organizational positions;

+ -

screening criteria are established for individuals filling organizational positions;

+ -

position risk designations are reviewed and updated .

+ + @@ -50227,26 +50227,26 @@ - -

individuals are screened prior to authorizing access to the system;

+ - -

individuals are rescreened in accordance with ;

+ -

where rescreening is so indicated, individuals are rescreened .

+ + + @@ -50291,17 +50291,17 @@ - -

individuals accessing a system processing, storing, or transmitting classified information are cleared;

+ -

individuals accessing a system processing, storing, or transmitting classified information are indoctrinated to the highest classification level of the information to which they have access on the system.

+ + @@ -50347,8 +50347,8 @@ -

individuals accessing a system processing, storing, or transmitting types of classified information that require formal indoctrination are formally indoctrinated for all of the relevant types of information to which they have access on the system.

+ @@ -50409,17 +50409,17 @@ - -

individuals accessing a system processing, storing, or transmitting information requiring special protection have valid access authorizations that are demonstrated by assigned official government duties;

+ -

individuals accessing a system processing, storing, or transmitting information requiring special protection satisfy .

+ + @@ -50482,8 +50482,8 @@ -

individuals accessing a system processing, storing, or transmitting meet .

+ @@ -50572,32 +50572,32 @@ - -

upon termination of individual employment, system access is disabled within ;

+ -

upon termination of individual employment, any authenticators and credentials are terminated or revoked;

+ -

upon termination of individual employment, exit interviews that include a discussion of are conducted;

+ -

upon termination of individual employment, all security-related organizational system-related property is retrieved;

+ -

upon termination of individual employment, access to organizational information and systems formerly controlled by the terminated individual are retained.

+ + @@ -50654,17 +50654,17 @@ - -

terminated individuals are notified of applicable, legally binding post-employment requirements for the protection of organizational information;

+ -

terminated individuals are required to sign an acknowledgement of post-employment requirements as part of the organizational termination process.

+ + @@ -50733,8 +50733,8 @@ -

are used to .

+ @@ -50835,27 +50835,27 @@ - -

the ongoing operational need for current logical and physical access authorizations to systems and facilities are reviewed and confirmed when individuals are reassigned or transferred to other positions within the organization;

+ -

are initiated within ;

+ -

access authorization is modified as needed to correspond with any changes in operational need due to reassignment or transfer;

+ -

are notified within .

+ + @@ -50949,31 +50949,31 @@ - -

access agreements are developed and documented for organizational systems;

+ -

the access agreements are reviewed and updated ;

+ - -

individuals requiring access to organizational information and systems sign appropriate access agreements prior to being granted access;

+ -

individuals requiring access to organizational information and systems re-sign access agreements to maintain access to organizational systems when access agreements have been updated or .

+ + + @@ -51044,22 +51044,22 @@ - -

access to classified information requiring special protection is granted only to individuals who have a valid access authorization that is demonstrated by assigned official government duties;

+ -

access to classified information requiring special protection is granted only to individuals who satisfy associated personnel security criteria;

+ -

access to classified information requiring special protection is granted only to individuals who have read, understood, and signed a non-disclosure agreement.

+ + @@ -51116,17 +51116,17 @@ - -

individuals are notified of applicable, legally binding post-employment requirements for the protection of organizational information;

+ -

individuals are required to sign an acknowledgement of applicable, legally binding post-employment requirements as part of being granted initial access to covered information.

+ + @@ -51224,32 +51224,32 @@ - -

personnel security requirements are established, including security roles and responsibilities for external providers;

+ -

external providers are required to comply with personnel security policies and procedures established by the organization;

+ -

personnel security requirements are documented;

+ -

external providers are required to notify of any personnel transfers or terminations of external personnel who possess organizational credentials and/or badges or who have system privileges within ;

+ -

provider compliance with personnel security requirements is monitored.

+ + @@ -51326,17 +51326,17 @@ - -

a formal sanctions process is employed for individuals failing to comply with established information security and privacy policies and procedures;

+ -

is/are notified within when a formal employee sanctions process is initiated, identifying the individual sanctioned and the reason for the sanction.

+ + @@ -51387,17 +51387,17 @@ - -

security roles and responsibilities are incorporated into organizational position descriptions;

+ -

privacy roles and responsibilities are incorporated into organizational position descriptions.

+ + @@ -51552,116 +51552,116 @@ - - -

a personally identifiable information processing and transparency policy is developed and documented;

+ -

the personally identifiable information processing and transparency policy is disseminated to ;

+ -

personally identifiable information processing and transparency procedures to facilitate the implementation of the personally identifiable information processing and transparency policy and associated personally identifiable information processing and transparency controls are developed and documented;

+ -

the personally identifiable information processing and transparency procedures are disseminated to ;

+ - - -

the personally identifiable information processing and transparency policy addresses purpose;

+ -

the personally identifiable information processing and transparency policy addresses scope;

+ -

the personally identifiable information processing and transparency policy addresses roles;

+ -

the personally identifiable information processing and transparency policy addresses responsibilities;

+ -

the personally identifiable information processing and transparency policy addresses management commitment;

+ -

the personally identifiable information processing and transparency policy addresses coordination among organizational entities;

+ -

the personally identifiable information processing and transparency policy addresses compliance;

+ + -

the personally identifiable information processing and transparency policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines;

+ + + -

the is designated to manage the development, documentation, and dissemination of the personally identifiable information processing and transparency policy and procedures;

+ - - -

the current personally identifiable information processing and transparency policy is reviewed and updated ;

+ -

the current personally identifiable information processing and transparency policy is reviewed and updated following ;

+ + - -

the current personally identifiable information processing and transparency procedures are reviewed and updated ;

+ -

the current personally identifiable information processing and transparency procedures are reviewed and updated following .

+ + + + @@ -51748,17 +51748,17 @@ - -

the that permits the of personally identifiable information is determined and documented;

+ -

the of personally identifiable information is restricted to only that which is authorized.

+ + @@ -51828,8 +51828,8 @@ -

data tags containing are attached to .

+ @@ -51896,8 +51896,8 @@ -

enforcement of the authorized processing of personally identifiable information is managed using .

+ @@ -52007,45 +52007,45 @@ - -

the for processing personally identifiable information is/are identified and documented;

+ - -

the purpose(s) is/are described in the public privacy notices of the organization;

+ -

the purpose(s) is/are described in the policies of the organization;

+ + -

the of personally identifiable information are restricted to only that which is compatible with the identified purpose(s);

+ - -

changes in the processing of personally identifiable information are monitored;

+ -

are implemented to ensure that any changes are made in accordance with .

+ + + @@ -52121,8 +52121,8 @@ -

data tags containing are attached to .

+ @@ -52187,8 +52187,8 @@ -

the processing purposes of personally identifiable information are tracked using .

+ @@ -52246,8 +52246,8 @@ -

the are implemented for individuals to consent to the processing of their personally identifiable information prior to its collection that facilitate individuals’ informed decision-making.

+ @@ -52303,8 +52303,8 @@ -

are provided to allow individuals to tailor processing permissions to selected elements of personally identifiable information.

+ @@ -52377,8 +52377,8 @@ -

are presented to individuals and in conjunction with .

+ @@ -52433,8 +52433,8 @@ -

the are implemented for individuals to revoke consent to the processing of their personally identifiable information.

+ @@ -52529,41 +52529,41 @@ - - -

a notice to individuals about the processing of personally identifiable information is provided such that the notice is available to individuals upon first interacting with an organization;

+ -

a notice to individuals about the processing of personally identifiable information is provided such that the notice is subsequently available to individuals ;

+ + -

a notice to individuals about the processing of personally identifiable information is provided that is clear, easy-to-understand, and expresses information about personally identifiable information processing in plain language;

+ -

a notice to individuals about the processing of personally identifiable information that identifies the authority that authorizes the processing of personally identifiable information is provided;

+ -

a notice to individuals about the processing of personally identifiable information that identifies the purpose for which personally identifiable information is to be processed is provided;

+ -

a notice to individuals about the processing of personally identifiable information which includes is provided.

+ + @@ -52616,8 +52616,8 @@ -

a notice of personally identifiable information processing is presented to individuals at a time and location where the individual provides personally identifiable information, in conjunction with a data action, or .

+ @@ -52663,8 +52663,8 @@ -

Privacy Act statements are included on forms that collect information that will be maintained in a Privacy Act system of records, or Privacy Act statements are provided on separate forms that can be retained by individuals.

+ @@ -52728,31 +52728,31 @@ - - -

system of records notices are drafted in accordance with OMB guidance for systems that process information that will be maintained in a Privacy Act system of records;

+ -

new and significantly modified system of records notices are submitted to the OMB and appropriate congressional committees for advance review for systems that process information that will be maintained in a Privacy Act system of records;

+ + -

system of records notices are published in the Federal Register for systems that process information that will be maintained in a Privacy Act system of records;

+ -

system of records notices are kept accurate, up-to-date, and scoped in accordance with policy for systems that process information that will be maintained in a Privacy Act system of records.

+ + @@ -52804,8 +52804,8 @@ -

all routine uses published in the system of records notice are reviewed to ensure continued accuracy, and to ensure that routine uses continue to be compatible with the purpose for which the information was collected.

+ @@ -52857,22 +52857,22 @@ - -

all Privacy Act exemptions claimed for the system of records are reviewed to ensure that they remain appropriate and necessary in accordance with law;

+ -

all Privacy Act exemptions claimed for the system of records are reviewed to ensure that they have been promulgated as regulations;

+ -

all Privacy Act exemptions claimed for the system of records are reviewed to ensure that they are accurately described in the system of records notice.

+ + @@ -52933,8 +52933,8 @@ -

are applied for specific categories of personally identifiable information.

+ @@ -52995,45 +52995,45 @@ - - -

when a system processes Social Security numbers, the unnecessary collection, maintenance, and use of Social Security numbers are eliminated;

+ -

when a system processes Social Security numbers, alternatives to the use of Social Security Numbers as a personal identifier are explored;

+ + -

when a system processes Social Security numbers, individual rights, benefits, or privileges provided by law are not denied because of an individual’s refusal to disclose their Social Security number;

+ - -

when a system processes Social Security numbers, any individual who is asked to disclose their Social Security number is informed whether that disclosure is mandatory or voluntary, by what statutory or other authority such number is solicited, and what uses will be made of it;

+ -

when a system processes Social Security numbers, any individual who is asked to disclose their Social Security number is informed by what statutory or other authority the number is solicited;

+ -

when a system processes Social Security numbers, any individual who is asked to disclose their Social Security number is informed what uses will be made of it.

+ + + @@ -53080,8 +53080,8 @@ -

the processing of information describing how any individual exercises rights guaranteed by the First Amendment is prohibited unless expressly authorized by statute or by the individual or unless pertinent to and within the scope of an authorized law enforcement activity.

+ @@ -53150,50 +53150,50 @@ - -

approval to conduct the matching program is obtained from the Data Integrity Board when a system or organization processes information for the purpose of conducting a matching program;

+ - -

a computer matching agreement is developed when a system or organization processes information for the purpose of conducting a matching program;

+ -

a computer matching agreement is entered into when a system or organization processes information for the purpose of conducting a matching program;

+ + -

a matching notice is published in the Federal Register when a system or organization processes information for the purpose of conducting a matching program;

+ -

the information produced by the matching program is independently verified before taking adverse action against an individual, if required, when a system or organization processes information for the purpose of conducting a matching program;

+ - -

individuals are provided with notice when a system or organization processes information for the purpose of conducting a matching program;

+ -

individuals are provided with an opportunity to contest the findings before adverse action is taken against them when a system or organization processes information for the purpose of conducting a matching program.

+ + + @@ -53358,116 +53358,116 @@ - - -

a risk assessment policy is developed and documented;

+ -

the risk assessment policy is disseminated to ;

+ -

risk assessment procedures to facilitate the implementation of the risk assessment policy and associated risk assessment controls are developed and documented;

+ -

the risk assessment procedures are disseminated to ;

+ - - -

the risk assessment policy addresses purpose;

+ -

the risk assessment policy addresses scope;

+ -

the risk assessment policy addresses roles;

+ -

the risk assessment policy addresses responsibilities;

+ -

the risk assessment policy addresses management commitment;

+ -

the risk assessment policy addresses coordination among organizational entities;

+ -

the risk assessment policy addresses compliance;

+ + -

the risk assessment policy is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines;

+ + + -

the is designated to manage the development, documentation, and dissemination of the risk assessment policy and procedures;

+ - - -

the current risk assessment policy is reviewed and updated ;

+ -

the current risk assessment policy is reviewed and updated following ;

+ + - -

the current risk assessment procedures are reviewed and updated ;

+ -

the current risk assessment procedures are reviewed and updated following .

+ + + + @@ -53539,22 +53539,22 @@ - -

the system and the information it processes, stores, and transmits are categorized;

+ -

the security categorization results, including supporting rationale, are documented in the security plan for the system;

+ -

the authorizing official or authorizing official designated representative reviews and approves the security categorization decision.

+ + @@ -53599,8 +53599,8 @@ -

an impact-level prioritization of organizational systems is conducted to obtain additional granularity on system impact levels.

+ @@ -53758,51 +53758,51 @@ - - -

a risk assessment is conducted to identify threats to and vulnerabilities in the system;

+ -

a risk assessment is conducted to determine the likelihood and magnitude of harm from unauthorized access, use, disclosure, disruption, modification, or destruction of the system; the information it processes, stores, or transmits; and any related information;

+ -

a risk assessment is conducted to determine the likelihood and impact of adverse effects on individuals arising from the processing of personally identifiable information;

+ + -

risk assessment results and risk management decisions from the organization and mission or business process perspectives are integrated with system-level risk assessments;

+ -

risk assessment results are documented in ;

+ -

risk assessment results are reviewed ;

+ -

risk assessment results are disseminated to ;

+ -

the risk assessment is updated or when there are significant changes to the system, its environment of operation, or other conditions that may impact the security or privacy state of the system.

+ + @@ -53881,17 +53881,17 @@ - -

supply chain risks associated with are assessed;

+ -

the supply chain risk assessment is updated , when there are significant changes to the relevant supply chain, or when changes to the system, environments of operation, or other conditions may necessitate a change in the supply chain.

+ + @@ -53946,8 +53946,8 @@ -

all-source intelligence is used to assist in the analysis of risk.

+ @@ -54007,8 +54007,8 @@ -

the current cyber threat environment is determined on an ongoing basis using .

+ @@ -54086,17 +54086,17 @@ - -

are employed to predict and identify risks to ;

+ -

are employed to predict and identify risks to .

+ + @@ -54254,61 +54254,61 @@ - - -

systems and hosted applications are monitored for vulnerabilities and when new vulnerabilities potentially affecting the system are identified and reported;

+ -

systems and hosted applications are scanned for vulnerabilities and when new vulnerabilities potentially affecting the system are identified and reported;

+ + -

vulnerability monitoring tools and techniques are employed to facilitate interoperability among tools;

-

vulnerability monitoring tools and techniques are employed to automate parts of the vulnerability management process by using standards for enumerating platforms, software flaws, and improper configurations;

+ -

vulnerability monitoring tools and techniques are employed to facilitate interoperability among tools and to automate parts of the vulnerability management process by using standards for formatting checklists and test procedures;

+ -

vulnerability monitoring tools and techniques are employed to facilitate interoperability among tools and to automate parts of the vulnerability management process by using standards for measuring vulnerability impact;

+ + -

vulnerability scan reports and results from vulnerability monitoring are analyzed;

+ -

legitimate vulnerabilities are remediated in accordance with an organizational assessment of risk;

+ -

information obtained from the vulnerability monitoring process and control assessments is shared with to help eliminate similar vulnerabilities in other systems;

+ -

vulnerability monitoring tools that include the capability to readily update the vulnerabilities to be scanned are employed.

+ + @@ -54386,8 +54386,8 @@ -

the system vulnerabilities to be scanned are updated .

+ @@ -54437,8 +54437,8 @@ -

the breadth and depth of vulnerability scanning coverage are defined.

+ @@ -54497,17 +54497,17 @@ - -

information about the system is discoverable;

+ -

are taken when information about the system is confirmed as discoverable.

+ + @@ -54581,8 +54581,8 @@ -

privileged access authorization is implemented to for .

+ @@ -54647,8 +54647,8 @@ -

the results of multiple vulnerability scans are compared using .

+ @@ -54724,8 +54724,8 @@ -

historic audit logs are reviewed to determine if a vulnerability identified in a has been previously exploited within .

+ @@ -54787,8 +54787,8 @@ -

the output from vulnerability scanning tools is correlated to determine the presence of multi-vulnerability and multi-hop attack vectors.

+ @@ -54841,8 +54841,8 @@ -

a public reporting channel is established for receiving reports of vulnerabilities in organizational systems and system components.

+ @@ -54927,8 +54927,8 @@ -

a technical surveillance countermeasures survey is employed at .

+ @@ -54987,27 +54987,27 @@ - -

findings from security assessments are responded to in accordance with organizational risk tolerance;

+ -

findings from privacy assessments are responded to in accordance with organizational risk tolerance;

+ -

findings from monitoring are responded to in accordance with organizational risk tolerance;

+ -

findings from audits are responded to in accordance with organizational risk tolerance.

+ + @@ -55085,26 +55085,26 @@ - -

privacy impact assessments are conducted for systems, programs, or other activities before developing or procuring information technology that processes personally identifiable information;

+ - -

privacy impact assessments are conducted for systems, programs, or other activities before initiating a collection of personally identifiable information that will be processed using information technology;

+ -

privacy impact assessments are conducted for systems, programs, or other activities before initiating a collection of personally identifiable information that includes personally identifiable information permitting the physical or virtual (online) contacting of a specific individual, if identical questions have been posed to, or identical reporting requirements imposed on, ten or more individuals, other than agencies, instrumentalities, or employees of the federal government.

+ + + @@ -55183,8 +55183,8 @@ -

critical system components and functions are identified by performing a criticality analysis for at .

+ @@ -55265,26 +55265,26 @@ - - -

a cyber threat capability is established and maintained to search for indicators of compromise in organizational systems;

+ -

a cyber threat capability is established and maintained to detect, track, and disrupt threats that evade existing controls;

+ + -

the threat hunting capability is employed .

+ + @@ -55447,116 +55447,116 @@ - - -

a system and services acquisition policy is developed and documented;

+ -

the system and services acquisition policy is disseminated to ;

+ -

system and services acquisition procedures to facilitate the implementation of the system and services acquisition policy and associated system and services acquisition controls are developed and documented;

+ -

the system and services acquisition procedures are disseminated to ;

+ - - -

the system and services acquisition policy addresses purpose;

+ -

the system and services acquisition policy addresses scope;

+ -

the system and services acquisition policy addresses roles;

+ -

the system and services acquisition policy addresses responsibilities;

+ -

the system and services acquisition policy addresses management commitment;

+ -

the system and services acquisition policy addresses coordination among organizational entities;

+ -

the system and services acquisition policy addresses compliance;

+ + -

the system and services acquisition policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines;

+ + + -

the is designated to manage the development, documentation, and dissemination of the system and services acquisition policy and procedures;

+ - - -

the system and services acquisition policy is reviewed and updated ;

+ -

the current system and services acquisition policy is reviewed and updated following ;

+ + - -

the current system and services acquisition procedures are reviewed and updated ;

+ -

the current system and services acquisition procedures are reviewed and updated following .

+ + + + @@ -55617,49 +55617,49 @@ - - -

the high-level information security requirements for the system or system service are determined in mission and business process planning;

+ -

the high-level privacy requirements for the system or system service are determined in mission and business process planning;

+ + - -

the resources required to protect the system or system service are determined and documented as part of the organizational capital planning and investment control process;

+ -

the resources required to protect the system or system service are allocated as part of the organizational capital planning and investment control process;

+ + - -

a discrete line item for information security is established in organizational programming and budgeting documentation;

+ -

a discrete line item for privacy is established in organizational programming and budgeting documentation.

+ + + @@ -55756,63 +55756,63 @@ - - -

the system is acquired, developed, and managed using that incorporates information security considerations;

+ -

the system is acquired, developed, and managed using that incorporates privacy considerations;

+ + - -

information security roles and responsibilities are defined and documented throughout the system development life cycle;

+ -

privacy roles and responsibilities are defined and documented throughout the system development life cycle;

+ + - -

individuals with information security roles and responsibilities are identified;

+ -

individuals with privacy roles and responsibilities are identified;

+ + - -

organizational information security risk management processes are integrated into system development life cycle activities;

+ -

organizational privacy risk management processes are integrated into system development life cycle activities.

+ + + @@ -55873,8 +55873,8 @@ -

system pre-production environments are protected commensurate with risk throughout the system development life cycle for the system, system component, or system service.

+ @@ -55935,31 +55935,31 @@ - - -

the use of live data in pre-production environments is approved for the system, system component, or system service;

+ -

the use of live data in pre-production environments is documented for the system, system component, or system service;

+ -

the use of live data in pre-production environments is controlled for the system, system component, or system service;

+ + -

pre-production environments for the system, system component, or system service are protected at the same impact or classification level as any live data in use within the pre-production environments.

+ + @@ -56015,17 +56015,17 @@ - -

a technology refresh schedule is planned for the system throughout the system development life cycle;

+ -

a technology refresh schedule is implemented for the system throughout the system development life cycle.

+ + @@ -56168,111 +56168,111 @@ - - -

security functional requirements, descriptions, and criteria are included explicitly or by reference using in the acquisition contract for the system, system component, or system service;

+ -

privacy functional requirements, descriptions, and criteria are included explicitly or by reference using in the acquisition contract for the system, system component, or system service;

+ + -

strength of mechanism requirements, descriptions, and criteria are included explicitly or by reference using in the acquisition contract for the system, system component, or system service;

+ - -

security assurance requirements, descriptions, and criteria are included explicitly or by reference using in the acquisition contract for the system, system component, or system service;

+ -

privacy assurance requirements, descriptions, and criteria are included explicitly or by reference using in the acquisition contract for the system, system component, or system service;

+ + - -

controls needed to satisfy the security requirements, descriptions, and criteria are included explicitly or by reference using in the acquisition contract for the system, system component, or system service;

+ -

controls needed to satisfy the privacy requirements, descriptions, and criteria are included explicitly or by reference using in the acquisition contract for the system, system component, or system service;

+ + - -

security documentation requirements, descriptions, and criteria are included explicitly or by reference using in the acquisition contract for the system, system component, or system service;

+ -

privacy documentation requirements, descriptions, and criteria are included explicitly or by reference using in the acquisition contract for the system, system component, or system service;

+ + - -

requirements for protecting security documentation, descriptions, and criteria are included explicitly or by reference using in the acquisition contract for the system, system component, or system service;

+ -

requirements for protecting privacy documentation, descriptions, and criteria are included explicitly or by reference using in the acquisition contract for the system, system component, or system service;

+ + -

the description of the system development environment and environment in which the system is intended to operate, requirements, and criteria are included explicitly or by reference using in the acquisition contract for the system, system component, or system service;

+ - -

the allocation of responsibility or identification of parties responsible for information security requirements, descriptions, and criteria are included explicitly or by reference using in the acquisition contract for the system, system component, or system service;

+ -

the allocation of responsibility or identification of parties responsible for privacy requirements, descriptions, and criteria are included explicitly or by reference using ;

+ -

the allocation of responsibility or identification of parties responsible for supply chain risk management requirements, descriptions, and criteria are included explicitly or by reference using ;

+ + -

acceptance criteria requirements and descriptions are included explicitly or by reference using in the acquisition contract for the system, system component, or system service.

+ + @@ -56325,8 +56325,8 @@ -

the developer of the system, system component, or system service is required to provide a description of the functional properties of the controls to be implemented.

+ @@ -56405,8 +56405,8 @@ -

the developer of the system, system component, or system service is required to provide design and implementation information for the controls that includes using at .

+ @@ -56533,22 +56533,22 @@ - -

the developer of the system, system component, or system service is required to demonstrate the use of a system development life cycle process that includes ;

+ -

the developer of the system, system component, or system service is required to demonstrate the use of a system development life cycle process that includes ;

+ -

the developer of the system, system component, or system service is required to demonstrate the use of a system development life cycle process that includes .

+ + @@ -56627,17 +56627,17 @@ - -

the developer of the system, system component, or system service is required to deliver the system, component, or service with implemented;

+ -

the configurations are used as the default for any subsequent system, component, or service reinstallation or upgrade.

+ + @@ -56698,17 +56698,17 @@ - -

only government off-the-shelf or commercial off-the-shelf information assurance and information assurance-enabled information technology products that compose an NSA-approved solution to protect classified information when the networks used to transmit the information are at a lower classification level than the information being transmitted are employed;

+ -

these products have been evaluated and/or validated by NSA or in accordance with NSA-approved procedures.

+ + @@ -56772,17 +56772,17 @@ - -

the use of commercially provided information assurance and information assurance-enabled information technology products is limited to those products that have been successfully evaluated against a National Information Assurance partnership (NIAP)-approved Protection Profile for a specific technology type, if such a profile exists;

+ -

if no NIAP-approved Protection Profile exists for a specific technology type but a commercially provided information technology product relies on cryptographic functionality to enforce its security policy, that cryptographic module is required to be FIPS-validated or NSA-approved.

+ + @@ -56836,8 +56836,8 @@ -

the developer of the system, system component, or system service is required to produce a plan for the continuous monitoring of control effectiveness that is consistent with the continuous monitoring program of the organization.

+ @@ -56893,27 +56893,27 @@ - -

the developer of the system, system component, or system service is required to identify the functions intended for organizational use;

+ -

the developer of the system, system component, or system service is required to identify the ports intended for organizational use;

+ -

the developer of the system, system component, or system service is required to identify the protocols intended for organizational use;

+ -

the developer of the system, system component, or system service is required to identify the services intended for organizational use.

+ + @@ -56964,8 +56964,8 @@ -

only information technology products on the FIPS 201-approved products list for the Personal Identity Verification (PIV) capability implemented within organizational systems are employed.

+ @@ -57026,8 +57026,8 @@ -

are defined in the acquisition contract for the operation of a system of records on behalf of an organization to accomplish an organizational mission or function.

+ @@ -57097,17 +57097,17 @@ - -

organizational data ownership requirements are included in the acquisition contract;

+ -

all data to be removed from the contractor’s system and returned to the organization is required within .

+ + @@ -57241,143 +57241,143 @@ - - - -

administrator documentation for the system, system component, or system service that describes the secure configuration of the system, component, or service is obtained or developed;

+ -

administrator documentation for the system, system component, or system service that describes the secure installation of the system, component, or service is obtained or developed;

+ -

administrator documentation for the system, system component, or system service that describes the secure operation of the system, component, or service is obtained or developed;

+ + - -

administrator documentation for the system, system component, or system service that describes the effective use of security functions and mechanisms is obtained or developed;

+ -

administrator documentation for the system, system component, or system service that describes the effective maintenance of security functions and mechanisms is obtained or developed;

+ -

administrator documentation for the system, system component, or system service that describes the effective use of privacy functions and mechanisms is obtained or developed;

+ -

administrator documentation for the system, system component, or system service that describes the effective maintenance of privacy functions and mechanisms is obtained or developed;

+ + - -

administrator documentation for the system, system component, or system service that describes known vulnerabilities regarding the configuration of administrative or privileged functions is obtained or developed;

+ -

administrator documentation for the system, system component, or system service that describes known vulnerabilities regarding the use of administrative or privileged functions is obtained or developed;

+ + + - - -

user documentation for the system, system component, or system service that describes user-accessible security functions and mechanisms is obtained or developed;

+ -

user documentation for the system, system component, or system service that describes how to effectively use those (user-accessible security) functions and mechanisms is obtained or developed;

+ -

user documentation for the system, system component, or system service that describes user-accessible privacy functions and mechanisms is obtained or developed;

+ -

user documentation for the system, system component, or system service that describes how to effectively use those (user-accessible privacy) functions and mechanisms is obtained or developed;

+ + - -

user documentation for the system, system component, or system service that describes methods for user interaction, which enable individuals to use the system, component, or service in a more secure manner is obtained or developed;

+ -

user documentation for the system, system component, or system service that describes methods for user interaction, which enable individuals to use the system, component, or service to protect individual privacy is obtained or developed;

+ + - -

user documentation for the system, system component, or system service that describes user responsibilities for maintaining the security of the system, component, or service is obtained or developed;

+ -

user documentation for the system, system component, or system service that describes user responsibilities for maintaining the privacy of individuals is obtained or developed;

+ + + - -

attempts to obtain system, system component, or system service documentation when such documentation is either unavailable or nonexistent is documented;

+ -

after attempts to obtain system, system component, or system service documentation when such documentation is either unavailable or nonexistent, are taken in response;

+ + -

documentation is distributed to .

+ + @@ -57539,57 +57539,57 @@ - -

are applied in the specification of the system and system components;

+ -

are applied in the design of the system and system components;

+ -

are applied in the development of the system and system components;

+ -

are applied in the implementation of the system and system components;

+ -

are applied in the modification of the system and system components;

+ -

are applied in the specification of the system and system components;

+ -

are applied in the design of the system and system components;

+ -

are applied in the development of the system and system components;

+ -

are applied in the implementation of the system and system components;

+ -

are applied in the modification of the system and system components.

+ + @@ -57643,8 +57643,8 @@ -

the security design principle of clear abstractions is implemented.

+ @@ -57703,8 +57703,8 @@ -

implement the security design principle of least common mechanism.

+ @@ -57776,17 +57776,17 @@ - -

implement the security design principle of modularity;

+ -

implement the security design principle of layering.

+ + @@ -57846,8 +57846,8 @@ -

implement the security design principle of partially ordered dependencies.

+ @@ -57907,8 +57907,8 @@ -

implement the security design principle of efficiently mediated access.

+ @@ -57969,8 +57969,8 @@ -

implement the security design principle of minimized sharing.

+ @@ -58029,8 +58029,8 @@ -

implement the security design principle of reduced complexity.

+ @@ -58090,8 +58090,8 @@ -

implement the security design principle of secure evolvability.

+ @@ -58151,8 +58151,8 @@ -

implement the security design principle of trusted components.

+ @@ -58214,8 +58214,8 @@ -

implement the security design principle of hierarchical trust.

+ @@ -58274,8 +58274,8 @@ -

implement the security design principle of inverse modification threshold.

+ @@ -58334,8 +58334,8 @@ -

implement the security design principle of hierarchical protection.

+ @@ -58394,8 +58394,8 @@ -

implement the security design principle of minimized security elements.

+ @@ -58457,8 +58457,8 @@ -

implement the security design principle of least privilege.

+ @@ -58518,8 +58518,8 @@ -

implement the security design principle of predicate permission.

+ @@ -58578,8 +58578,8 @@ -

implement the security design principle of self-reliant trustworthiness.

+ @@ -58638,8 +58638,8 @@ -

implement the security design principle of secure distributed composition.

+ @@ -58701,8 +58701,8 @@ -

implement the security design principle of trusted communications channels.

+ @@ -58763,8 +58763,8 @@ -

implement the security design principle of continuous protection.

+ @@ -58833,8 +58833,8 @@ -

implement the security design principle of secure metadata management.

+ @@ -58894,8 +58894,8 @@ -

implement the security design principle of self-analysis.

+ @@ -58974,17 +58974,17 @@ - -

implement the security design principle of accountability;

+ -

implement the security design principle of traceability.

+ + @@ -59060,8 +59060,8 @@ -

implement the security design principle of secure defaults.

+ @@ -59149,17 +59149,17 @@ - -

implement the security design principle of secure failure;

+ -

implement the security design principle of secure recovery.

+ + @@ -59235,8 +59235,8 @@ -

implement the security design principle of economic security.

+ @@ -59301,8 +59301,8 @@ -

implement the security design principle of performance security.

+ @@ -59362,8 +59362,8 @@ -

implement the security design principle of human factored security.

+ @@ -59425,8 +59425,8 @@ -

implement the security design principle of acceptable security.

+ @@ -59499,8 +59499,8 @@ -

implement the security design principle of repeatable and documented procedures.

+ @@ -59562,8 +59562,8 @@ -

implement the security design principle of procedural rigor.

+ @@ -59625,8 +59625,8 @@ -

implement the security design principle of secure system modification.

+ @@ -59694,8 +59694,8 @@ -

implement the security design principle of sufficient documentation.

+ @@ -59764,8 +59764,8 @@ -

the privacy principle of minimization is implemented using .

+ @@ -59868,45 +59868,45 @@ - - -

providers of external system services comply with organizational security requirements;

+ -

providers of external system services comply with organizational privacy requirements;

+ -

providers of external system services employ ;

+ + - -

organizational oversight with regard to external system services are defined and documented;

+ -

user roles and responsibilities with regard to external system services are defined and documented;

+ + -

are employed to monitor control compliance by external service providers on an ongoing basis.

+ + @@ -59980,17 +59980,17 @@ - -

an organizational assessment of risk is conducted prior to the acquisition or outsourcing of information security services;

+ -

approve the acquisition or outsourcing of dedicated information security services.

+ + @@ -60056,8 +60056,8 @@ -

providers of are required to identify the functions, ports, protocols, and other services required for the use of such services.

+ @@ -60123,27 +60123,27 @@ - -

trust relationships with external service provides based on are established and documented;

+ -

trust relationships with external service provides based on are maintained;

+ -

trust relationships with external service provides based on are established and documented;

+ -

trust relationships with external service provides based on are maintained.

+ + @@ -60208,8 +60208,8 @@ -

are taken to verify that the interests of are consistent with and reflect organizational interests.

+ @@ -60292,8 +60292,8 @@ -

based on , is/are restricted to .

+ @@ -60352,8 +60352,8 @@ -

exclusive control of cryptographic keys is maintained for encrypted material stored or transmitted through an external system.

+ @@ -60409,8 +60409,8 @@ -

the capability is provided to check the integrity of information while it resides in the external system.

+ @@ -60468,8 +60468,8 @@ -

the geographic location of information processing and data storage is restricted to facilities located within the legal jurisdictional boundary of the United States.

+ @@ -60592,74 +60592,74 @@ - -

the developer of the system, system component, or system service is required to perform configuration management during system, component, or service ;

+ - -

the developer of the system, system component, or system service is required to document the integrity of changes to ;

+ -

the developer of the system, system component, or system service is required to manage the integrity of changes to ;

+ -

the developer of the system, system component, or system service is required to control the integrity of changes to ;

+ + -

the developer of the system, system component, or system service is required to implement only organization-approved changes to the system, component, or service;

+ - -

the developer of the system, system component, or system service is required to document approved changes to the system, component, or service;

+ -

the developer of the system, system component, or system service is required to document the potential security impacts of approved changes;

+ -

the developer of the system, system component, or system service is required to document the potential privacy impacts of approved changes;

+ + - -

the developer of the system, system component, or system service is required to track security flaws within the system, component, or service;

+ -

the developer of the system, system component, or system service is required to track security flaw resolutions within the system, component, or service;

+ -

the developer of the system, system component, or system service is required to report findings to .

+ + + @@ -60716,8 +60716,8 @@ -

the developer of the system, system component, or system service is required to enable integrity verification of software and firmware components.

+ @@ -60775,8 +60775,8 @@ -

an alternate configuration management process has been provided using organizational personnel in the absence of a dedicated developer configuration management team.

+ @@ -60836,8 +60836,8 @@ -

the developer of the system, system component, or system service is required to enable integrity verification of hardware components.

+ @@ -60892,22 +60892,22 @@ - -

the developer of the system, system component, or system service is required to employ tools for comparing newly generated versions of security-relevant hardware descriptions with previous versions;

+ -

the developer of the system, system component, or system service is required to employ tools for comparing newly generated versions of source code with previous versions;

+ -

the developer of the system, system component, or system service is required to employ tools for comparing newly generated versions of object code with previous versions.

+ + @@ -60952,8 +60952,8 @@ -

the developer of the system, system component, or system service is required to maintain the integrity of the mapping between the master build data describing the current version of security-relevant hardware, software, and firmware and the on-site master copy of the data for the current version.

+ @@ -61009,8 +61009,8 @@ -

the developer of the system, system component, or system service is required to execute procedures for ensuring that security-relevant hardware, software, and firmware updates distributed to the organization are exactly as specified by the master copies.

+ @@ -61102,17 +61102,17 @@ - -

are required to be included in the ;

+ -

are required to be included in the .

+ + @@ -61226,60 +61226,60 @@ - - -

the developer of the system, system component, or system service is required at all post-design stages of the system development life cycle to develop a plan for ongoing security assessments;

+ -

the developer of the system, system component, or system service is required at all post-design stages of the system development life cycle to implement a plan for ongoing security assessments;

+ -

the developer of the system, system component, or system service is required at all post-design stages of the system development life cycle to develop a plan for privacy assessments;

+ -

the developer of the system, system component, or system service is required at all post-design stages of the system development life cycle to implement a plan for ongoing privacy assessments;

+ + -

the developer of the system, system component, or system service is required at all post-design stages of the system development life cycle to perform testing/evaluation at ;

+ - -

the developer of the system, system component, or system service is required at all post-design stages of the system development life cycle to produce evidence of the execution of the assessment plan;

+ -

the developer of the system, system component, or system service is required at all post-design stages of the system development life cycle to produce the results of the testing and evaluation;

+ + -

the developer of the system, system component, or system service is required at all post-design stages of the system development life cycle to implement a verifiable flaw remediation process;

+ -

the developer of the system, system component, or system service is required at all post-design stages of the system development life cycle to correct flaws identified during testing and evaluation.

+ + @@ -61339,17 +61339,17 @@ - -

the developer of the system, system component, or system service is required to employ static code analysis tools to identify common flaws;

+ -

the developer of the system, system component, or system service is required to employ static code analysis tools to document the results of the analysis.

+ + @@ -61486,93 +61486,93 @@ - - -

the developer of the system, system component, or system service is required to perform threat modeling during development of the system, component, or service that uses ;

+ -

the developer of the system, system component, or system service is required to perform vulnerability analyses during development of the system, component, or service that uses ;

+ -

the developer of the system, system component, or system service is required to perform threat modeling during the subsequent testing and evaluation of the system, component, or service that uses ;

+ -

the developer of the system, system component, or system service is required to perform vulnerability analyses during the subsequent testing and evaluation of the system, component, or service that uses ;

+ + - -

the developer of the system, system component, or system service is required to perform threat modeling during development of the system, component, or service that employs ;

+ -

the developer of the system, system component, or system service is required to perform threat modeling during the subsequent testing and evaluation of the system, component, or service that employs ;

+ -

the developer of the system, system component, or system service is required to perform vulnerability analyses during development of the system, component, or service that employs ;

+ -

the developer of the system, system component, or system service is required to perform vulnerability analyses during the subsequent testing and evaluation of the system, component, or service that employs ;

+ + - -

the developer of the system, system component, or system service is required to perform threat modeling at during development of the system, component, or service;

+ -

the developer of the system, system component, or system service is required to perform vulnerability analyses during the subsequent testing and evaluation of the system, component, or service that conducts modeling and analyses at ;

+ + - -

the developer of the system, system component, or system service is required to perform threat modeling during development of the system, component, or service that produces evidence that meets ;

+ -

the developer of the system, system component, or system service is required to perform threat modeling during the subsequent testing and evaluation of the system, component, or service that produces evidence that meets ;

+ -

the developer of the system, system component, or system service is required to perform vulnerability analyses during development of the system, component, or service that produces evidence that meets ;

+ -

the developer of the system, system component, or system service is required to perform vulnerability analyses during the subsequent testing and evaluation of the system, component, or service that produces evidence that meets .

+ + + @@ -61647,26 +61647,26 @@ - - -

an independent agent is required to satisfy to verify the correct implementation of the developer security assessment plan and the evidence produced during testing and evaluation;

+ -

an independent agent is required to satisfy to verify the correct implementation of the developer privacy assessment plan and the evidence produced during testing and evaluation;

+ + -

the independent agent is provided with sufficient information to complete the verification process or granted the authority to obtain such information.

+ + @@ -61740,8 +61740,8 @@ -

the developer of the system, system component, or system service is required to perform a manual code review of using .

+ @@ -61840,26 +61840,26 @@ - - -

the developer of the system, system component, or system service is required to perform penetration testing at the following level of rigor: ;

+ -

the developer of the system, system component, or system service is required to perform penetration testing at the following level of rigor: ;

+ + -

the developer of the system, system component, or system service is required to perform penetration testing under .

+ + @@ -61917,8 +61917,8 @@ -

the developer of the system, system component, or system service is required to perform attack surface reviews.

+ @@ -61993,17 +61993,17 @@ - -

the developer of the system, system component, or system service is required to verify that the scope of testing and evaluation provides complete coverage of the required controls at ;

+ -

the developer of the system, system component, or system service is required to verify that the scope of testing and evaluation provides complete coverage of the required controls at .

+ + @@ -62057,17 +62057,17 @@ - -

the developer of the system, system component, or system service is required to employ dynamic code analysis tools to identify common flaws;

+ -

the developer of the system, system component, or system service is required to document the results of the analysis.

+ + @@ -62123,17 +62123,17 @@ - -

the developer of the system, system component, or system service is required to employ interactive application security testing tools to identify flaws;

+ -

the developer of the system, system component, or system service is required to document the results of flaw identification.

+ + @@ -62406,72 +62406,72 @@ - - - -

the developer of the system, system component, or system service is required to follow a documented development process that explicitly addresses security requirements;

+ -

the developer of the system, system component, or system service is required to follow a documented development process that explicitly addresses privacy requirements;

+ + - -

the developer of the system, system component, or system service is required to follow a documented development process that identifies the standards used in the development process;

+ -

the developer of the system, system component, or system service is required to follow a documented development process that identifies the tools used in the development process;

+ + - -

the developer of the system, system component, or system service is required to follow a documented development process that documents the specific tool used in the development process;

+ -

the developer of the system, system component, or system service is required to follow a documented development process that documents the specific tool configurations used in the development process;

+ + -

the developer of the system, system component, or system service is required to follow a documented development process that documents, manages, and ensures the integrity of changes to the process and/or tools used in development;

+ + - -

the developer of the system, system component, or system service is required to follow a documented development process in which the development process, standards, tools, tool options, and tool configurations are reviewed to determine that the process, standards, tools, tool options, and tool configurations selected and employed satisfy ;

+ -

the developer of the system, system component, or system service is required to follow a documented development process in which the development process, standards, tools, tool options, and tool configurations are reviewed to determine that the process, standards, tools, tool options, and tool configurations selected and employed satisfy .

+ + + @@ -62559,17 +62559,17 @@ - -

the developer of the system, system component, or system service is required to define quality metrics at the beginning of the development process;

+ -

the developer of the system, system component, or system service is required to provide evidence of meeting the quality metrics .

+ + @@ -62615,17 +62615,17 @@ - -

the developer of the system, system component, or system service is required to select and employ security tracking tools for use during the development process;

+ -

the developer of the system, system component, or system service is required to select and employ privacy tracking tools for use during the development process.

+ + @@ -62712,26 +62712,26 @@ - -

the developer of the system, system component, or system service is required to perform a criticality analysis at in the system development life cycle;

+ - -

the developer of the system, system component, or system service is required to perform a criticality analysis at the following rigor level: ;

+ -

the developer of the system, system component, or system service is required to perform a criticality analysis at the following rigor level: .

+ + + @@ -62808,8 +62808,8 @@ -

the developer of the system, system component, or system service is required to reduce attack surfaces to .

+ @@ -62864,8 +62864,8 @@ -

the developer of the system, system component, or system service is required to implement an explicit process to continuously improve the development process.

+ @@ -62957,27 +62957,27 @@ - -

the developer of the system, system component, or system service is required to perform automated vulnerability analysis using ;

+ -

the developer of the system, system component, or system service is required to determine the exploitation potential for discovered vulnerabilities ;

+ -

the developer of the system, system component, or system service is required to determine potential risk mitigations for delivered vulnerabilities;

+ -

the developer of the system, system component, or system service is required to deliver the outputs of the tools and results of the analysis to .

+ + @@ -63033,17 +63033,17 @@ - -

the developer of the system, system component, or system service is required to use threat modeling from similar systems, components, or services to inform the current development process;

+ -

the developer of the system, system component, or system service is required to use vulnerability analyses from similar systems, components, or services to inform the current development process.

+ + @@ -63097,22 +63097,22 @@ - -

the developer of the system, system component, or system service is required to provide an incident response plan;

+ -

the developer of the system, system component, or system service is required to implement an incident response plan;

+ -

the developer of the system, system component, or system service is required to test an incident response plan.

+ + @@ -63162,8 +63162,8 @@ -

the developer of the system or system component is required to archive the system or component to be released or delivered together with the corresponding evidence supporting the final security and privacy review.

+ @@ -63211,8 +63211,8 @@ -

the developer of the system or system component is required to minimize the use of personally identifiable information in development and test environments.

+ @@ -63280,8 +63280,8 @@ -

the developer of the system, system component, or system service is required to provide on the correct use and operation of the implemented security and privacy functions, controls, and/or mechanisms.

+ @@ -63352,49 +63352,49 @@ - - -

the developer of the system, system component, or system service is required to produce a design specification and security architecture that are consistent with the organization’s security architecture, which is an integral part the organization’s enterprise architecture;

+ -

the developer of the system, system component, or system service is required to produce a design specification and privacy architecture that are consistent with the organization’s privacy architecture, which is an integral part the organization’s enterprise architecture;

+ + - -

the developer of the system, system component, or system service is required to produce a design specification and security architecture that accurately and completely describe the required security functionality and the allocation of controls among physical and logical components;

+ -

the developer of the system, system component, or system service is required to produce a design specification and privacy architecture that accurately and completely describe the required privacy functionality and the allocation of controls among physical and logical components;

+ + - -

the developer of the system, system component, or system service is required to produce a design specification and security architecture that express how individual security functions, mechanisms, and services work together to provide required security capabilities and a unified approach to protection;

+ -

the developer of the system, system component, or system service is required to produce a design specification and privacy architecture that express how individual privacy functions, mechanisms, and services work together to provide required privacy capabilities and a unified approach to protection.

+ + + @@ -63471,35 +63471,35 @@ - - -

as an integral part of the development process, the developer of the system, system component, or system service is required to produce a formal policy model describing the to be enforced;

+ -

as an integral part of the development process, the developer of the system, system component, or system service is required to produce a formal policy model describing the to be enforced;

+ + - -

the developer of the system, system component, or system service is required to prove that the formal policy model is internally consistent and sufficient to enforce the defined elements of the organizational security policy when implemented;

+ -

the developer of the system, system component, or system service is required to prove that the formal policy model is internally consistent and sufficient to enforce the defined elements of the organizational privacy policy when implemented.

+ + + @@ -63557,31 +63557,31 @@ - - -

the developer of the system, system component, or system service is required to define security-relevant hardware;

+ -

the developer of the system, system component, or system service is required to define security-relevant software;

+ -

the developer of the system, system component, or system service is required to define security-relevant firmware;

+ + -

the developer of the system, system component, or system service is required to provide a rationale that the definition for security-relevant hardware, software, and firmware is complete.

+ + @@ -63652,46 +63652,46 @@ - - -

as an integral part of the development process, the developer of the system, system component, or system service is required to produce a formal top-level specification that specifies the interfaces to security-relevant hardware, software, and firmware in terms of exceptions;

+ -

as an integral part of the development process, the developer of the system, system component, or system service is required to produce a formal top-level specification that specifies the interfaces to security-relevant hardware, software, and firmware in terms of error messages;

+ -

as an integral part of the development process, the developer of the system, system component, or system service is required to produce a formal top-level specification that specifies the interfaces to security-relevant hardware, software, and firmware in terms of effects;

+ + -

the developer of the system, system component, or system service is required to show proof that the formal top-level specification is consistent with the formal policy model to the extent feasible with additional informal demonstration as necessary;

+ -

the developer of the system, system component, or system service is required to show via informal demonstration that the formal top-level specification completely covers the interfaces to security-relevant hardware, software, and firmware;

+ -

the developer of the system, system component, or system service is required to show that the formal top-level specification is an accurate description of the implemented security-relevant hardware, software, and firmware;

+ -

the developer of the system, system component, or system service is required to describe the security-relevant hardware, software, and firmware mechanisms that are not addressed in the formal top-level specification but are strictly internal to the security-relevant hardware, software, and firmware.

+ + @@ -63773,46 +63773,46 @@ - - -

as an integral part of the development process, the developer of the system, system component, or system service is required to produce an informal, descriptive top-level specification that specifies the interfaces to security-relevant hardware, software, and firmware in terms of exceptions;

+ -

as an integral part of the development process, the developer of the system, system component, or system service is required to produce an informal, descriptive top-level specification that specifies the interfaces to security-relevant hardware, software, and firmware in terms of error messages;

+ -

as an integral part of the development process, the developer of the system, system component, or system service is required to produce an informal, descriptive top-level specification that specifies the interfaces to security-relevant hardware, software, and firmware in terms of effects;

+ + -

the developer of the system, system component, or system service is required to show via that the descriptive top-level specification is consistent with the formal policy model;

+ -

the developer of the system, system component, or system service is required to show via informal demonstration that the descriptive top-level specification completely covers the interfaces to security-relevant hardware, software, and firmware;

+ -

the developer of the system, system component, or system service is required to show that the descriptive top-level specification is an accurate description of the interfaces to security-relevant hardware, software, and firmware;

+ -

the developer of the system, system component, or system service is required to describe the security-relevant hardware, software, and firmware mechanisms that are not addressed in the descriptive top-level specification but are strictly internal to the security-relevant hardware, software, and firmware.

+ + @@ -63873,17 +63873,17 @@ - -

the developer of the system, system component, or system service is required to design and structure the security-relevant hardware, software, and firmware to use a complete, conceptually simple protection mechanism with precisely defined semantics;

+ -

the developer of the system, system component, or system service is required to internally structure the security-relevant hardware, software, and firmware with specific regard for this mechanism.

+ + @@ -63933,8 +63933,8 @@ -

the developer of the system, system component, or system service is required to structure security-relevant hardware, software, and firmware to facilitate testing.

+ @@ -63988,8 +63988,8 @@ -

the developer of the system, system component, or system service is required to structure security-relevant hardware, software, and firmware to facilitate controlling access with least privilege.

+ @@ -64055,8 +64055,8 @@ -

are designed with coordinated behavior to implement .

+ @@ -64115,8 +64115,8 @@ -

different designs are used for to satisfy a common set of requirements or to provide equivalent functionality.

+ @@ -64240,8 +64240,8 @@ -

are reimplemented or custom-developed.

+ @@ -64331,17 +64331,17 @@ - -

the developer of is required to have appropriate access authorizations as determined by assigned ;

+ -

the developer of is required to satisfy .

+ + @@ -64429,17 +64429,17 @@ - -

system components are replaced when support for the components is no longer available from the developer, vendor, or manufacturer;

+ -

provide options for alternative sources for continued support for unsupported components.

+ + @@ -64517,8 +64517,8 @@ -

is employed on supporting essential services or functions to increase the trustworthiness in those systems or components.

+ @@ -64679,116 +64679,116 @@ - - -

a system and communications protection policy is developed and documented;

+ -

the system and communications protection policy is disseminated to ;

+ -

system and communications protection procedures to facilitate the implementation of the system and communications protection policy and associated system and communications protection controls are developed and documented;

+ -

the system and communications protection procedures are disseminated to ;

+ - - -

the system and communications protection policy addresses purpose;

+ -

the system and communications protection policy addresses scope;

+ -

the system and communications protection policy addresses roles;

+ -

the system and communications protection policy addresses responsibilities;

+ -

the system and communications protection policy addresses management commitment;

+ -

the system and communications protection policy addresses coordination among organizational entities;

+ -

the system and communications protection policy addresses compliance;

+ + -

the system and communications protection policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines;

+ + + -

the is designated to manage the development, documentation, and dissemination of the system and communications protection policy and procedures;

+ - - -

the current system and communications protection policy is reviewed and updated ;

+ -

the current system and communications protection policy is reviewed and updated following ;

+ + - -

the current system and communications protection procedures are reviewed and updated ;

+ -

the current system and communications protection procedures are reviewed and updated following .

+ + + + @@ -64835,8 +64835,8 @@ -

user functionality, including user interface services, is separated from system management functionality.

+ @@ -64884,8 +64884,8 @@ -

the presentation of system management functionality is prevented at interfaces to non-privileged users.

+ @@ -64934,8 +64934,8 @@ -

state information is stored separately from applications and software.

+ @@ -64999,8 +64999,8 @@ -

security functions are isolated from non-security functions.

+ @@ -65048,8 +65048,8 @@ -

hardware separation mechanisms are employed to implement security function isolation.

+ @@ -65098,27 +65098,27 @@ - -

security functions enforcing access control are isolated from non-security functions;

+ -

security functions enforcing access control are isolated from other security functions;

+ -

security functions enforcing information flow control are isolated from non-security functions;

+ -

security functions enforcing information flow control are isolated from other security functions.

+ + @@ -65167,8 +65167,8 @@ -

the number of non-security functions included within the isolation boundary containing security functions is minimized.

+ @@ -65216,17 +65216,17 @@ - -

security functions are implemented as largely independent modules that maximize internal cohesiveness within modules;

+ -

security functions are implemented as largely independent modules that minimize coupling between modules.

+ + @@ -65275,8 +65275,8 @@ -

security functions are implemented as a layered structure, minimizing interactions between layers of the design and avoiding any dependence by lower layers on the functionality or correctness of higher layers.

+ @@ -65326,17 +65326,17 @@ - -

unauthorized information transfer via shared system resources is prevented;

+ -

unintended information transfer via shared system resources is prevented.

+ + @@ -65398,8 +65398,8 @@ -

unauthorized information transfer via shared resources is prevented in accordance with when system processing explicitly switches between different information classification levels or security categories.

+ @@ -65483,17 +65483,17 @@ - -

the effects of are ;

+ -

are employed to achieve the denial-of-service protection objective.

+ + @@ -65550,8 +65550,8 @@ -

the ability of individuals to launch against other systems is restricted.

+ @@ -65600,8 +65600,8 @@ -

capacity, bandwidth, or other redundancies to limit the effects of information flooding denial-of-service attacks are managed.

+ @@ -65674,17 +65674,17 @@ - -

are employed to detect indicators of denial-of-service attacks against or launched from the system;

+ -

are monitored to determine if sufficient resources exist to prevent effective denial-of-service attacks.

+ + @@ -65761,8 +65761,8 @@ -

the availability of resources is protected by allocating by .

+ @@ -65859,41 +65859,41 @@ - - -

communications at external managed interfaces to the system are monitored;

+ -

communications at external managed interfaces to the system are controlled;

+ -

communications at key internal managed interfaces within the system are monitored;

+ -

communications at key internal managed interfaces within the system are controlled;

+ + -

subnetworks for publicly accessible system components are separated from internal organizational networks;

+ -

external networks or systems are only connected to through managed interfaces consisting of boundary protection devices arranged in accordance with an organizational security and privacy architecture.

+ + @@ -65959,8 +65959,8 @@ -

the number of external network connections to the system is limited.

+ @@ -66055,65 +66055,65 @@ - -

a managed interface is implemented for each external telecommunication service;

+ -

a traffic flow policy is established for each managed interface;

+ - -

the confidentiality of the information being transmitted across each interface is protected;

+ -

the integrity of the information being transmitted across each interface is protected;

+ + -

each exception to the traffic flow policy is documented with a supporting mission or business need and duration of that need;

+ - -

exceptions to the traffic flow policy are reviewed ;

+ -

exceptions to the traffic flow policy that are no longer supported by an explicit mission or business need are removed;

+ + -

unauthorized exchanges of control plan traffic with external networks are prevented;

+ -

information is published to enable remote networks to detect unauthorized control plane traffic from internal networks;

+ -

unauthorized control plane traffic is filtered from external networks.

+ + @@ -66185,17 +66185,17 @@ - -

network communications traffic is denied by default ;

+ -

network communications traffic is allowed by exception .

+ + @@ -66259,8 +66259,8 @@ -

split tunneling is prevented for remote devices connecting to organizational systems unless the split tunnel is securely provisioned using .

+ @@ -66328,8 +66328,8 @@ -

is routed to through authenticated proxy servers at managed interfaces.

+ @@ -66393,26 +66393,26 @@ - - -

outgoing communications traffic posing a threat to external systems is detected;

+ -

outgoing communications traffic posing a threat to external systems is denied;

+ + -

the identity of internal users associated with denied communications is audited.

+ + @@ -66482,17 +66482,17 @@ - -

the exfiltration of information is prevented;

+ -

exfiltration tests are conducted .

+ + @@ -66556,8 +66556,8 @@ -

only incoming communications from are allowed to be routed to .

+ @@ -66621,8 +66621,8 @@ -

are implemented at .

+ @@ -66681,8 +66681,8 @@ -

are isolated from other internal system components by implementing physically separate subnetworks with managed interfaces to other components of the system.

+ @@ -66742,8 +66742,8 @@ -

are protected against unauthorized physical connections.

+ @@ -66795,17 +66795,17 @@ - -

networked, privileged accesses are routed through a dedicated, managed interface for purposes of access control;

+ -

networked, privileged accesses are routed through a dedicated, managed interface for purposes of auditing.

+ + @@ -66855,8 +66855,8 @@ -

the discovery of specific system components that represent a managed interface is prevented.

+ @@ -66907,8 +66907,8 @@ -

adherence to protocol formats is enforced.

+ @@ -66961,8 +66961,8 @@ -

systems are prevented from entering unsecure states in the event of an operational failure of a boundary protection device.

+ @@ -67019,17 +67019,17 @@ - -

inbound communications traffic is blocked between that are independently configured by end users and external service providers;

+ -

outbound communications traffic is blocked between that are independently configured by end users and external service providers.

+ + @@ -67087,8 +67087,8 @@ -

the capability to dynamically isolate from other system components is provided.

+ @@ -67158,8 +67158,8 @@ -

boundary protection mechanisms are employed to isolate supporting .

+ @@ -67210,8 +67210,8 @@ -

separate network addresses are implemented to connect to systems in different security domains.

+ @@ -67261,8 +67261,8 @@ -

feedback to senders is disabled on protocol format validation failure.

+ @@ -67339,45 +67339,45 @@ - -

are applied to data elements of personally identifiable information on systems that process personally identifiable information;

+ - -

permitted processing is monitored at the external interfaces to the systems that process personally identifiable information;

+ -

permitted processing is monitored at key internal boundaries within the systems that process personally identifiable information;

+ + -

each processing exception is documented for systems that process personally identifiable information;

+ - -

exceptions for systems that process personally identifiable information are reviewed;

+ -

exceptions for systems that process personally identifiable information that are no longer supported are removed.

+ + + @@ -67447,8 +67447,8 @@ -

the direct connection of to an external network without the use of is prohibited.

+ @@ -67506,8 +67506,8 @@ -

the direct connection of classified national security system to an external network without the use of a is prohibited.

+ @@ -67574,8 +67574,8 @@ -

the direct connection of to an external network without the use of a is prohibited.

+ @@ -67633,8 +67633,8 @@ -

the direct connection of the to a public network is prohibited.

+ @@ -67700,8 +67700,8 @@ -

subnetworks are separated to isolate .

+ @@ -67784,8 +67784,8 @@ -

the of transmitted information is/are protected.

+ @@ -67841,8 +67841,8 @@ -

cryptographic mechanisms are implemented to during transmission.

+ @@ -67899,17 +67899,17 @@ - -

information is/are maintained during preparation for transmission;

+ -

information is/are maintained during reception.

+ + @@ -67966,8 +67966,8 @@ -

cryptographic mechanisms are implemented to protect message externals unless otherwise protected by .

+ @@ -68026,8 +68026,8 @@ -

cryptographic mechanisms are implemented to conceal or randomize communication patterns unless otherwise protected by .

+ @@ -68092,8 +68092,8 @@ -

the is implemented to during transmission.

+ @@ -68159,8 +68159,8 @@ -

the network connection associated with a communication session is terminated at the end of the session or after of inactivity.

+ @@ -68236,17 +68236,17 @@ - -

a isolated trusted communication path is provided for communications between the user and the trusted components of the system;

+ -

users are permitted to invoke the trusted communication path for communications between the user and the of the system, including authentication and re-authentication, at a minimum.

+ + @@ -68310,17 +68310,17 @@ - -

a trusted communication path that is irrefutably distinguishable from other communication paths is provided;

+ -

the trusted communication path for communications between the of the system and the user is initiated.

+ + @@ -68408,17 +68408,17 @@ - -

cryptographic keys are established when cryptography is employed within the system in accordance with ;

+ -

cryptographic keys are managed when cryptography is employed within the system in accordance with .

+ + @@ -68466,8 +68466,8 @@ -

information availability is maintained in the event of the loss of cryptographic keys by users.

+ @@ -68523,22 +68523,22 @@ - -

symmetric cryptographic keys are produced using key management technology and processes;

+ -

symmetric cryptographic keys are controlled using key management technology and processes;

+ -

symmetric cryptographic keys are distributed using key management technology and processes.

+ + @@ -68600,22 +68600,22 @@ - -

asymmetric cryptographic keys are produced using ;

+ -

asymmetric cryptographic keys are controlled using ;

+ -

asymmetric cryptographic keys are distributed using .

+ + @@ -68683,8 +68683,8 @@ -

physical control of cryptographic keys is maintained when stored information is encrypted by external service providers.

+ @@ -68784,17 +68784,17 @@ - -

are identified;

+ -

for each specified cryptographic use (defined in SC-13_ODP[01]) are implemented.

+ + @@ -68908,17 +68908,17 @@ - -

remote activation of collaborative computing devices and applications is prohibited except ;

+ -

an explicit indication of use is provided to users physically present at the devices.

+ + @@ -68975,8 +68975,8 @@ -

the disconnect of collaborative computing devices is/are provided in a manner that supports ease of use.

+ @@ -69049,8 +69049,8 @@ -

collaborative computing devices and applications are disabled or removed from in .

+ @@ -69108,8 +69108,8 @@ -

an explicit indication of current participants in is provided.

+ @@ -69181,27 +69181,27 @@ - -

are associated with information exchanged between systems;

+ -

are associated with information exchanged between system components;

+ -

are associated with information exchanged between systems;

+ -

are associated with information exchanged between system components.

+ + @@ -69251,17 +69251,17 @@ - -

the integrity of transmitted security attributes is verified;

+ -

the integrity of transmitted privacy attributes is verified.

+ + @@ -69312,8 +69312,8 @@ -

anti-spoofing mechanisms are implemented to prevent adversaries from falsifying the security attributes indicating the successful application of the security process.

+ @@ -69371,8 +69371,8 @@ -

are implemented to bind security and privacy attributes to transmitted information.

+ @@ -69443,17 +69443,17 @@ - -

public key certificates are issued under , or public key certificates are obtained from an approved service provider;

+ -

only approved trust anchors are included in trust stores or certificate stores managed by the organization.

+ + @@ -69512,50 +69512,50 @@ - - -

acceptable mobile code is defined;

+ -

unacceptable mobile code is defined;

+ -

acceptable mobile code technologies are defined;

+ -

unacceptable mobile code technologies are defined;

+ + - -

the use of mobile code is authorized within the system;

+ -

the use of mobile code is monitored within the system;

+ -

the use of mobile code is controlled within the system.

+ + + @@ -69622,17 +69622,17 @@ - -

is identified;

+ -

are taken if unacceptable mobile code is identified.

+ + @@ -69693,22 +69693,22 @@ - -

the acquisition of mobile code to be deployed in the system meets ;

+ -

the development of mobile code to be deployed in the system meets ;

+ -

the use of mobile code to be deployed in the system meets .

+ + @@ -69767,17 +69767,17 @@ - -

the download of is prevented;

+ -

the execution of is prevented.

+ + @@ -69843,17 +69843,17 @@ - -

the automatic execution of mobile code in is prevented;

+ -

are enforced prior to executing mobile code.

+ + @@ -69907,8 +69907,8 @@ -

execution of permitted mobile code is allowed only in confined virtual machine environments.

+ @@ -69985,35 +69985,35 @@ - - -

additional data origin authentication is provided along with the authoritative name resolution data that the system returns in response to external name/address resolution queries;

+ -

integrity verification artifacts are provided along with the authoritative name resolution data that the system returns in response to external name/address resolution queries;

+ + - -

the means to indicate the security status of child zones (and if the child supports secure resolution services) is provided when operating as part of a distributed, hierarchical namespace;

+ -

the means to enable verification of a chain of trust among parent and child domains when operating as part of a distributed, hierarchical namespace is provided.

+ + + @@ -70066,17 +70066,17 @@ - -

data origin artifacts are provided for internal name/address resolution queries;

+ -

integrity protection artifacts are provided for internal name/address resolution queries.

+ + @@ -70126,27 +70126,27 @@ - -

data origin authentication is requested for the name/address resolution responses that the system receives from authoritative sources;

+ -

data origin authentication is performed on the name/address resolution responses that the system receives from authoritative sources;

+ -

data integrity verification is requested for the name/address resolution responses that the system receives from authoritative sources;

+ -

data integrity verification is performed on the name/address resolution responses that the system receives from authoritative sources.

+ + @@ -70205,22 +70205,22 @@ - -

the systems that collectively provide name/address resolution services for an organization are fault-tolerant;

+ -

the systems that collectively provide name/address resolution services for an organization implement internal role separation;

+ -

the systems that collectively provide name/address resolution services for an organization implement external role separation.

+ + @@ -70276,8 +70276,8 @@ -

the authenticity of communication sessions is protected.

+ @@ -70322,8 +70322,8 @@ -

session identifiers are invalidated upon user logout or other session termination.

+ @@ -70388,17 +70388,17 @@ - -

a unique session identifier is generated for each session with ;

+ -

only system-generated session identifiers are recognized.

+ + @@ -70464,8 +70464,8 @@ -

only the use of for verification of the establishment of protected sessions is allowed.

+ @@ -70546,8 +70546,8 @@ -

fail to a while preserving in failure.

+ @@ -70606,17 +70606,17 @@ - -

minimal functionality for is employed;

+ -

minimal information storage on is allocated.

+ + @@ -70668,22 +70668,22 @@ - -

components within organizational systems specifically designed to be the target of malicious attacks are included to detect such attacks;

+ -

components within organizational systems specifically designed to be the target of malicious attacks are included to deflect such attacks;

+ -

components within organizational systems specifically designed to be the target of malicious attacks are included to analyze such attacks.

+ + @@ -70746,8 +70746,8 @@ -

are included within organizational systems.

+ @@ -70838,8 +70838,8 @@ -

the of is/are protected.

+ @@ -70905,17 +70905,17 @@ - -

cryptographic mechanisms are implemented to prevent unauthorized disclosure of at rest on ;

+ -

cryptographic mechanisms are implemented to prevent unauthorized modification of at rest on .

+ + @@ -70971,17 +70971,17 @@ - -

is removed from online storage;

+ -

is stored offline in a secure location.

+ + @@ -71049,8 +71049,8 @@ -

protected storage for cryptographic keys is provided using .

+ @@ -71111,8 +71111,8 @@ -

a diverse set of information technologies is employed for in the implementation of the system.

+ @@ -71168,8 +71168,8 @@ -

virtualization techniques are employed to support the deployment of a diverse range of operating systems and applications that are changed .

+ @@ -71252,8 +71252,8 @@ -

are employed for for to confuse and mislead adversaries.

+ @@ -71318,8 +71318,8 @@ -

are employed to introduce randomness into organizational operations and assets.

+ @@ -71393,8 +71393,8 @@ -

the location of is changed .

+ @@ -71452,8 +71452,8 @@ -

realistic but misleading information about the security state or posture of is employed.

+ @@ -71518,8 +71518,8 @@ -

are employed to hide or conceal .

+ @@ -71588,17 +71588,17 @@ - -

a covert channel analysis is performed to identify those aspects of communications within the system that are potential avenues for covert channels;

+ -

the maximum bandwidth of those channels is estimated.

+ + @@ -71649,8 +71649,8 @@ -

a subset of the identified covert channels is tested to determine the channels that are exploitable.

+ @@ -71717,8 +71717,8 @@ -

the maximum bandwidth for identified covert channels is reduced to .

+ @@ -71780,8 +71780,8 @@ -

the bandwidth of is measured in the operational environment of the system.

+ @@ -71868,8 +71868,8 @@ -

the system is partitioned into residing in separate domains or environments based on .

+ @@ -71921,8 +71921,8 @@ -

privileged functions are partitioned into separate physical domains.

+ @@ -72009,17 +72009,17 @@ - -

the operating environment for is loaded and executed from hardware-enforced, read-only media;

+ -

for are loaded and executed from hardware-enforced, read-only media.

+ + @@ -72084,8 +72084,8 @@ -

are employed with no writeable storage that is persistent across component restart or power on/off.

+ @@ -72145,17 +72145,17 @@ - -

the integrity of information is protected prior to storage on read-only media;

+ -

the media is controlled after such information has been recorded onto the media;

+ + @@ -72217,8 +72217,8 @@ -

system components that proactively seek to identify network-based malicious code or malicious websites are included.

+ @@ -72313,17 +72313,17 @@ - -

are distributed across ;

+ -

are distributed across .

+ + @@ -72402,17 +72402,17 @@ - -

polling techniques are employed to identify potential faults, errors, or compromises to ;

+ -

are taken in response to identified faults, errors, or compromise.

+ + @@ -72472,8 +72472,8 @@ -

are synchronized.

+ @@ -72563,8 +72563,8 @@ -

are employed for the physical delivery or electronic transmission of to .

+ @@ -72645,8 +72645,8 @@ -

are employed to ensure that only receive .

+ @@ -72723,8 +72723,8 @@ -

are employed to protect key organizational information throughout the system development life cycle.

+ @@ -72786,8 +72786,8 @@ -

a separate execution domain is maintained for each executing system process.

+ @@ -72831,8 +72831,8 @@ -

hardware separation is implemented to facilitate process isolation.

+ @@ -72891,8 +72891,8 @@ -

a separate execution domain is maintained for each thread in .

+ @@ -72984,17 +72984,17 @@ - -

external are protected from .

+ -

internal are protected from .

+ + @@ -73058,8 +73058,8 @@ -

cryptographic mechanisms that achieve against the effects of intentional electromagnetic interference are implemented.

+ @@ -73123,8 +73123,8 @@ -

cryptographic mechanisms to reduce the detection potential of wireless links to are implemented.

+ @@ -73181,8 +73181,8 @@ -

cryptographic mechanisms are implemented to identify and reject wireless transmissions that are deliberate attempts to achieve imitative or manipulative communications deception based on signal parameters.

+ @@ -73244,8 +73244,8 @@ -

cryptographic mechanisms are implemented to prevent the identification of by using the transmitter signal parameters.

+ @@ -73324,8 +73324,8 @@ -

are disabled or removed on .

+ @@ -73424,17 +73424,17 @@ - -

is/are prohibited;

+ -

an explicit indication of sensor use is provided to .

+ + @@ -73494,8 +73494,8 @@ -

the system is configured so that data or information collected by the is only reported to authorized individuals or roles.

+ @@ -73559,8 +73559,8 @@ -

are employed so that data or information collected by is only used for authorized purposes.

+ @@ -73641,8 +73641,8 @@ -

are employed to facilitate an individual’s awareness that personally identifiable information is being collected by

+ @@ -73709,8 +73709,8 @@ -

the configured to minimize the collection of information about individuals that is not needed are employed.

+ @@ -73791,31 +73791,31 @@ - -

usage restrictions and implementation guidelines are established for ;

+ - -

the use of is authorized within the system;

+ -

the use of is monitored within the system;

+ -

the use of is controlled within the system.

+ + + @@ -73882,8 +73882,8 @@ -

a detonation chamber capability is employed within the .

+ @@ -73934,8 +73934,8 @@ -

system clocks are synchronized within and between systems and system components.

+ @@ -74012,17 +74012,17 @@ - -

the internal system clocks are compared with ;

+ -

the internal system clocks are synchronized with the authoritative time source when the time difference is greater than .

+ + @@ -74076,17 +74076,17 @@ - -

a secondary authoritative time source is identified that is in a different geographic region than the primary authoritative time source;

+ -

the internal system clocks are synchronized to the secondary authoritative time source if the primary authoritative time source is unavailable.

+ + @@ -74144,8 +74144,8 @@ -

a policy enforcement mechanism is implemented between the physical and/or network interfaces for the connecting security domains.

+ @@ -74206,8 +74206,8 @@ -

are established for system operations and operational command and control.

+ @@ -74282,8 +74282,8 @@ -

are relocated to under .

+ @@ -74357,8 +74357,8 @@ -

are dynamically relocated to under .

+ @@ -74422,8 +74422,8 @@ -

hardware-enforced separation and policy enforcement mechanisms are implemented between .

+ @@ -74486,8 +74486,8 @@ -

software-enforced separation and policy enforcement mechanisms are implemented between .

+ @@ -74558,26 +74558,26 @@ - -

hardware-based write-protect for is employed;

+ - -

specific procedures are implemented for to manually disable hardware write-protect for firmware modifications;

+ -

specific procedures are implemented for to re-enable the write-protect prior to returning to operational mode.

+ + + @@ -74740,116 +74740,116 @@ - - -

a system and information integrity policy is developed and documented;

+ -

the system and information integrity policy is disseminated to ;

+ -

system and information integrity procedures to facilitate the implementation of the system and information integrity policy and associated system and information integrity controls are developed and documented;

+ -

the system and information integrity procedures are disseminated to ;

+ - - -

the system and information integrity policy addresses purpose;

+ -

the system and information integrity policy addresses scope;

+ -

the system and information integrity policy addresses roles;

+ -

the system and information integrity policy addresses responsibilities;

+ -

the system and information integrity policy addresses management commitment;

+ -

the system and information integrity policy addresses coordination among organizational entities;

+ -

the system and information integrity policy addresses compliance;

+ + -

the system and information integrity policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines;

+ + + -

the is designated to manage the development, documentation, and dissemination of the system and information integrity policy and procedures;

+ - - -

the current system and information integrity policy is reviewed and updated ;

+ -

the current system and information integrity policy is reviewed and updated following ;

+ + - -

the current system and information integrity procedures are reviewed and updated ;

+ -

the current system and information integrity procedures are reviewed and updated following .

+ + + + @@ -74931,69 +74931,69 @@ - - -

system flaws are identified;

+ -

system flaws are reported;

+ -

system flaws are corrected;

+ + - -

software updates related to flaw remediation are tested for effectiveness before installation;

+ -

software updates related to flaw remediation are tested for potential side effects before installation;

+ -

firmware updates related to flaw remediation are tested for effectiveness before installation;

+ -

firmware updates related to flaw remediation are tested for potential side effects before installation;

+ + - -

security-relevant software updates are installed within of the release of the updates;

+ -

security-relevant firmware updates are installed within of the release of the updates;

+ + -

flaw remediation is incorporated into the organizational configuration management process.

+ + @@ -75074,8 +75074,8 @@ -

system components have applicable security-relevant software and firmware updates installed using .

+ @@ -75140,17 +75140,17 @@ - -

the time between flaw identification and flaw remediation is measured;

+ -

for taking corrective actions have been established.

+ + @@ -75211,8 +75211,8 @@ -

automated patch management tools are employed to facilitate flaw remediation to .

+ @@ -75283,8 +75283,8 @@ -

are installed automatically to .

+ @@ -75344,8 +75344,8 @@ -

previous versions of are removed after updated versions have been installed.

+ @@ -75493,63 +75493,63 @@ - - -

malicious code protection mechanisms are implemented at system entry and exit points to detect malicious code;

+ -

malicious code protection mechanisms are implemented at system entry and exit points to eradicate malicious code;

+ + -

malicious code protection mechanisms are updated automatically as new releases are available in accordance with organizational configuration management policy and procedures;

+ - - -

malicious code protection mechanisms are configured to perform periodic scans of the system ;

+ -

malicious code protection mechanisms are configured to perform real-time scans of files from external sources at as the files are downloaded, opened, or executed in accordance with organizational policy;

+ + - -

malicious code protection mechanisms are configured to in response to malicious code detection;

+ -

malicious code protection mechanisms are configured to send alerts to in response to malicious code detection;

+ + + -

the receipt of false positives during malicious code detection and eradication and the resulting potential impact on the availability of the system are addressed.

+ + @@ -75632,8 +75632,8 @@ -

malicious code protection mechanisms are updated only when directed by a privileged user.

+ @@ -75712,26 +75712,26 @@ - -

malicious code protection mechanisms are tested by introducing known benign code into the system;

+ - -

the detection of (benign test) code occurs;

+ -

the associated incident reporting occurs.

+ + + @@ -75825,17 +75825,17 @@ - -

are detected through the kernel application programming interface on ;

+ -

is/are performed.

+ + @@ -75911,26 +75911,26 @@ - -

are employed to analyze the characteristics and behavior of malicious code;

+ - -

the results from malicious code analysis are incorporated into organizational incident response processes;

+ -

the results from malicious code analysis are incorporated into organizational flaw remediation processes.

+ + + @@ -76129,83 +76129,83 @@ - - -

the system is monitored to detect attacks and indicators of potential attacks in accordance with ;

+ - -

the system is monitored to detect unauthorized local connections;

+ -

the system is monitored to detect unauthorized network connections;

+ -

the system is monitored to detect unauthorized remote connections;

+ + + -

unauthorized use of the system is identified through ;

+ - -

internal monitoring capabilities are invoked or monitoring devices are deployed strategically within the system to collect organization-determined essential information;

+ -

internal monitoring capabilities are invoked or monitoring devices are deployed at ad hoc locations within the system to track specific types of transactions of interest to the organization;

+ + - -

detected events are analyzed;

+ -

detected anomalies are analyzed;

+ + -

the level of system monitoring activity is adjusted when there is a change in risk to organizational operations and assets, individuals, other organizations, or the Nation;

+ -

a legal opinion regarding system monitoring activities is obtained;

+ -

is provided to .

+ + @@ -76259,17 +76259,17 @@ - -

individual intrusion detection tools are connected to a system-wide intrusion detection system;

+ -

individual intrusion detection tools are configured into a system-wide intrusion detection system.

+ + @@ -76324,8 +76324,8 @@ -

automated tools and mechanisms are employed to support a near real-time analysis of events.

+ @@ -76386,17 +76386,17 @@ - -

automated tools and mechanisms are employed to integrate intrusion detection tools and mechanisms into access control mechanisms;

+ -

automated tools and mechanisms are employed to integrate intrusion detection tools and mechanisms into flow control mechanisms.

+ + @@ -76497,35 +76497,35 @@ - - -

criteria for unusual or unauthorized activities or conditions for inbound communications traffic are defined;

+ -

criteria for unusual or unauthorized activities or conditions for outbound communications traffic are defined;

+ + - -

inbound communications traffic is monitored for ;

+ -

outbound communications traffic is monitored for .

+ + + @@ -76599,8 +76599,8 @@ -

are alerted when system-generated occur.

+ @@ -76691,17 +76691,17 @@ - -

are notified of detected suspicious events;

+ -

are taken upon the detection of suspicious events.

+ + @@ -76775,8 +76775,8 @@ -

intrusion-monitoring tools and mechanisms are tested .

+ @@ -76843,8 +76843,8 @@ -

provisions are made so that is visible to .

+ @@ -76908,17 +76908,17 @@ - -

outbound communications traffic at the external interfaces to the system is analyzed to discover anomalies;

+ -

outbound communications traffic at is analyzed to discover anomalies.

+ + @@ -76999,8 +76999,8 @@ -

is/are alerted using when indicate inappropriate or unusual activities with security or privacy implications.

+ @@ -77072,49 +77072,49 @@ - - -

communications traffic for the system is analyzed;

+ -

event patterns for the system are analyzed;

+ + - -

profiles representing common traffic are developed;

+ -

profiles representing event patterns are developed;

+ + - -

traffic profiles are used in tuning system-monitoring devices;

+ -

event profiles are used in tuning system-monitoring devices.

+ + + @@ -77172,22 +77172,22 @@ - -

a wireless intrusion detection system is employed to identify rogue wireless devices;

+ -

a wireless intrusion detection system is employed to detect attack attempts on the system;

+ -

a wireless intrusion detection system is employed to detect potential compromises or breaches to the system.

+ + @@ -77242,8 +77242,8 @@ -

an intrusion detection system is employed to monitor wireless communications traffic as the traffic passes from wireless to wireline networks.

+ @@ -77300,8 +77300,8 @@ -

information from monitoring tools and mechanisms employed throughout the system is correlated.

+ @@ -77361,8 +77361,8 @@ -

information from monitoring physical, cyber, and supply chain activities are correlated to achieve integrated, organization-wide situational awareness.

+ @@ -77428,17 +77428,17 @@ - -

outbound communications traffic is analyzed at interfaces external to the system to detect covert exfiltration of information;

+ -

outbound communications traffic is analyzed at to detect covert exfiltration of information.

+ + @@ -77510,8 +77510,8 @@ -

is implemented on individuals who have been identified by as posing an increased level of risk.

+ @@ -77576,8 +77576,8 @@ -

of privileged users is implemented.

+ @@ -77647,8 +77647,8 @@ -

of individuals is implemented during .

+ @@ -77733,17 +77733,17 @@ - -

network services that have not been authorized or approved by are detected;

+ -

is/are initiated when network services that have not been authorized or approved by authorization or approval processes are detected.

+ + @@ -77819,8 +77819,8 @@ -

are implemented on .

+ @@ -77892,22 +77892,22 @@ - -

indicators of compromise provided by are discovered;

+ -

indicators of compromise provided by are collected;

+ -

indicators of compromise provided by are distributed to .

+ + @@ -77963,17 +77963,17 @@ - -

visibility into network traffic at external system interfaces is provided to optimize the effectiveness of monitoring devices;

+ -

visibility into network traffic at key internal system interfaces is provided to optimize the effectiveness of monitoring devices.

+ + @@ -78092,27 +78092,27 @@ - -

system security alerts, advisories, and directives are received from on an ongoing basis;

+ -

internal security alerts, advisories, and directives are generated as deemed necessary;

+ -

security alerts, advisories, and directives are disseminated to ;

+ -

security directives are implemented in accordance with established time frames or if the issuing organization is notified of the degree of noncompliance.

+ + @@ -78170,8 +78170,8 @@ -

are used to broadcast security alert and advisory information throughout the organization.

+ @@ -78314,54 +78314,54 @@ - - -

are verified to be operating correctly;

+ -

are verified to be operating correctly;

+ + - -

are verified ;

+ -

are verified ;

+ + - -

is/are alerted to failed security verification tests;

+ -

is/are alerted to failed privacy verification tests;

+ + -

is/are initiated when anomalies are discovered.

+ + @@ -78423,17 +78423,17 @@ - -

automated mechanisms are implemented to support the management of distributed security function testing;

+ -

automated mechanisms are implemented to support the management of distributed privacy function testing.

+ + @@ -78495,17 +78495,17 @@ - -

the results of security function verification are reported to ;

+ -

the results of privacy function verification are reported to .

+ + @@ -78649,45 +78649,45 @@ - - -

integrity verification tools are employed to detect unauthorized changes to ;

+ -

integrity verification tools are employed to detect unauthorized changes to ;

+ -

integrity verification tools are employed to detect unauthorized changes to ;

+ + - -

are taken when unauthorized changes to the software, are detected;

+ -

are taken when unauthorized changes to the firmware are detected;

+ -

are taken when unauthorized changes to the information are detected.

+ + + @@ -78854,22 +78854,22 @@ - -

an integrity check of is performed ;

+ -

an integrity check of is performed ;

+ -

an integrity check of is performed .

+ + @@ -78928,8 +78928,8 @@ -

automated tools that provide notification to upon discovering discrepancies during integrity verification are employed.

+ @@ -78989,8 +78989,8 @@ -

centrally managed integrity verification tools are employed.

+ @@ -79064,8 +79064,8 @@ -

are automatically performed when integrity violations are discovered.

+ @@ -79122,22 +79122,22 @@ - -

cryptographic mechanisms are implemented to detect unauthorized changes to software;

+ -

cryptographic mechanisms are implemented to detect unauthorized changes to firmware;

+ -

cryptographic mechanisms are implemented to detect unauthorized changes to information.

+ + @@ -79204,8 +79204,8 @@ -

the detection of are incorporated into the organizational incident response capability.

+ @@ -79287,17 +79287,17 @@ - -

the capability to audit an event upon the detection of a potential integrity violation is provided;

+ -

is/are initiated upon the detection of a potential integrity violation.

+ + @@ -79363,8 +79363,8 @@ -

the integrity of the boot process of is verified.

+ @@ -79434,8 +79434,8 @@ -

are implemented to protect the integrity of boot firmware in .

+ @@ -79507,8 +79507,8 @@ -

the integrity of is verified prior to execution.

+ @@ -79585,8 +79585,8 @@ -

cryptographic mechanisms are implemented to authenticate prior to installation.

+ @@ -79645,8 +79645,8 @@ -

processes are prohibited from executing without supervision for more than .

+ @@ -79707,8 +79707,8 @@ -

are implemented for application self-protection at runtime.

+ @@ -79773,36 +79773,36 @@ - - -

spam protection mechanisms are employed at system entry points to detect unsolicited messages;

+ -

spam protection mechanisms are employed at system exit points to detect unsolicited messages;

+ -

spam protection mechanisms are employed at system entry points to act on unsolicited messages;

+ -

spam protection mechanisms are employed at system exit points to act on unsolicited messages;

+ + -

spam protection mechanisms are updated when new releases are available in accordance with organizational configuration management policies and procedures.

+ + @@ -79870,8 +79870,8 @@ -

spam protection mechanisms are automatically updated .

+ @@ -79923,8 +79923,8 @@ -

spam protection mechanisms with a learning capability are implemented to more effectively identify legitimate communications traffic.

+ @@ -79998,8 +79998,8 @@ -

the validity of the is checked.

+ @@ -80075,22 +80075,22 @@ - -

a manual override capability for the validation of is provided;

+ -

the use of the manual override capability is restricted to only ;

+ -

the use of the manual override capability is audited.

+ + @@ -80163,17 +80163,17 @@ - -

input validation errors are reviewed within ;

+ -

input validation errors are resolved within .

+ + @@ -80226,17 +80226,17 @@ - -

the system behaves in a predictable manner when invalid inputs are received;

+ -

the system behaves in a documented manner when invalid inputs are received.

+ + @@ -80286,8 +80286,8 @@ -

timing interactions among system components are accounted for in determining appropriate responses for invalid inputs.

+ @@ -80356,8 +80356,8 @@ -

the use of information inputs is restricted to and/or .

+ @@ -80412,8 +80412,8 @@ -

untrusted data injections are prevented.

+ @@ -80485,17 +80485,17 @@ - -

error messages that provide the information necessary for corrective actions are generated without revealing information that could be exploited;

+ -

error messages are revealed only to .

+ + @@ -80579,27 +80579,27 @@ - -

information within the system is managed in accordance with applicable laws, Executive Orders, directives, regulations, policies, standards, guidelines, and operational requirements;

+ -

information within the system is retained in accordance with applicable laws, Executive Orders, directives, regulations, policies, standards, guidelines, and operational requirements;

+ -

information output from the system is managed in accordance with applicable laws, Executive Orders, directives, regulations, policies, standards, guidelines, and operational requirements;

+ -

information output from the system is retained in accordance with applicable laws, Executive Orders, directives, regulations, policies, standards, guidelines, and operational requirements.

+ + @@ -80664,8 +80664,8 @@ -

personally identifiable information being processed in the information life cycle is limited to .

+ @@ -80753,22 +80753,22 @@ - -

are used to minimize the use of personally identifiable information for research;

+ -

are used to minimize the use of personally identifiable information for testing;

+ -

are used to minimize the use of personally identifiable information for training.

+ + @@ -80852,22 +80852,22 @@ - -

are used to dispose of information following the retention period;

+ -

are used to destroy information following the retention period;

+ -

are used to erase information following the retention period.

+ + @@ -80957,17 +80957,17 @@ - -

mean time to failure (MTTF) is determined for in specific environments of operation;

+ -

substitute system components and a means to exchange active and standby components are provided in accordance with .

+ + @@ -81025,8 +81025,8 @@ -

system components are taken out of service by transferring component responsibilities to substitute components no later than of mean time to failure.

+ @@ -81093,8 +81093,8 @@ -

transfers are initiated manually between active and standby system components when the use of the active component reaches of the mean time to failure.

+ @@ -81186,17 +81186,17 @@ - -

the standby components are successfully and transparently installed within if system component failures are detected;

+ -

are performed if system component failures are detected.

+ + @@ -81268,8 +81268,8 @@ -

is provided for the system.

+ @@ -81349,17 +81349,17 @@ - -

non-persistent that are initiated in a known state are implemented;

+ -

non-persistent are terminated .

+ + @@ -81416,8 +81416,8 @@ -

the software and data employed during system component and service refreshes are obtained from .

+ @@ -81505,17 +81505,17 @@ - -

is performed;

+ -

information is deleted when no longer needed.

+ + @@ -81573,17 +81573,17 @@ - -

connections to the system are established on demand;

+ -

connections to the system are terminated after .

+ + @@ -81643,8 +81643,8 @@ -

information output from is validated to ensure that the information is consistent with the expected content.

+ @@ -81705,8 +81705,8 @@ -

are implemented to protect the system memory from unauthorized code execution.

+ @@ -81779,8 +81779,8 @@ -

are implemented when occur.

+ @@ -81880,36 +81880,36 @@ - - -

the accuracy of personally identifiable information across the information life cycle is checked ;

+ -

the relevance of personally identifiable information across the information life cycle is checked ;

+ -

the timeliness of personally identifiable information across the information life cycle is checked ;

+ -

the completeness of personally identifiable information across the information life cycle is checked ;

+ + -

inaccurate or outdated personally identifiable information is corrected or deleted.

+ + @@ -81974,8 +81974,8 @@ -

are used to correct or delete personally identifiable information that is inaccurate, outdated, incorrectly determined regarding impact, or incorrectly de-identified.

+ @@ -82032,8 +82032,8 @@ -

data tags are employed to automate the correction or deletion of personally identifiable information across the information life cycle within organizational systems.

+ @@ -82086,8 +82086,8 @@ -

personally identifiable information is collected directly from the individual.

+ @@ -82139,8 +82139,8 @@ -

personally identifiable information is corrected or deleted upon request by individuals or their designated representatives.

+ @@ -82202,8 +82202,8 @@ -

and individuals are notified when the personally identifiable information has been corrected or deleted.

+ @@ -82288,17 +82288,17 @@ - -

are removed from datasets;

+ -

the effectiveness of de-identification is evaluated .

+ + @@ -82349,8 +82349,8 @@ -

the dataset is de-identified upon collection by not collecting personally identifiable information.

+ @@ -82402,8 +82402,8 @@ -

the archiving of personally identifiable information elements is prohibited if those elements in a dataset will not be needed after the dataset is archived.

+ @@ -82455,8 +82455,8 @@ -

personally identifiable information elements are removed from a dataset prior to its release if those elements in the dataset do not need to be part of the data release.

+ @@ -82509,8 +82509,8 @@ -

direct identifiers in a dataset are removed, masked, encrypted, hashed, or replaced.

+ @@ -82562,22 +82562,22 @@ - -

numerical data is manipulated so that no individual or organization is identifiable in the results of the analysis;

+ -

contingency tables are manipulated so that no individual or organization is identifiable in the results of the analysis;

+ -

statistical findings are manipulated so that no individual or organization is identifiable in the results of the analysis.

+ + @@ -82632,8 +82632,8 @@ -

the disclosure of personally identifiable information is prevented by adding non-deterministic noise to the results of mathematical operations before the results are reported.

+ @@ -82685,17 +82685,17 @@ - -

de-identification is performed using validated algorithms;

+ -

de-identification is performed using software that is validated to implement the algorithms.

+ + @@ -82747,8 +82747,8 @@ -

a motivated intruder test is performed on the de-identified dataset to determine if the identified data remains or if the de-identified data can be re-identified.

+ @@ -82812,8 +82812,8 @@ -

data or capabilities are embedded in to determine if organizational data has been exfiltrated or improperly removed from the organization.

+ @@ -82885,8 +82885,8 @@ -

the is refreshed or is generated on demand and deleted when no longer needed.

+ @@ -82972,17 +82972,17 @@ - -

for are identified;

+ -

an alternative information source is used for the execution of essential functions or services on when the primary source of information is corrupted or unavailable.

+ + @@ -83065,17 +83065,17 @@ - -

under , is fragmented;

+ -

under , the fragmented information is distributed across .

+ + @@ -83250,116 +83250,116 @@ - - -

a supply chain risk management policy is developed and documented;

+ -

the supply chain risk management policy is disseminated to ;

+ -

supply chain risk management procedures to facilitate the implementation of the supply chain risk management policy and the associated supply chain risk management controls are developed and documented;

+ -

the supply chain risk management procedures are disseminated to .

+ - - -

the supply chain risk management policy addresses purpose;

+ -

the supply chain risk management policy addresses scope;

+ -

supply chain risk management policy addresses roles;

+ -

the supply chain risk management policy addresses responsibilities;

+ -

the supply chain risk management policy addresses management commitment;

+ -

the supply chain risk management policy addresses coordination among organizational entities;

+ -

the supply chain risk management policy addresses compliance.

+ + -

the supply chain risk management policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines;

+ + + -

the is designated to manage the development, documentation, and dissemination of the supply chain risk management policy and procedures;

+ - - -

the current supply chain risk management policy is reviewed and updated ;

+ -

the current supply chain risk management policy is reviewed and updated following ;

+ + - -

the current supply chain risk management procedures are reviewed and updated ;

+ -

the current supply chain risk management procedures are reviewed and updated following .

+ + + + @@ -83450,75 +83450,75 @@ - - -

a plan for managing supply chain risks is developed;

+ -

the supply chain risk management plan addresses risks associated with the research and development of ;

+ -

the supply chain risk management plan addresses risks associated with the design of ;

+ -

the supply chain risk management plan addresses risks associated with the manufacturing of ;

+ -

the supply chain risk management plan addresses risks associated with the acquisition of ;

+ -

the supply chain risk management plan addresses risks associated with the delivery of ;

+ -

the supply chain risk management plan addresses risks associated with the integration of ;

+ -

the supply chain risk management plan addresses risks associated with the operation and maintenance of ;

+ -

the supply chain risk management plan addresses risks associated with the disposal of ;

+ + -

the supply chain risk management plan is reviewed and updated or as required to address threat, organizational, or environmental changes;

+ - -

the supply chain risk management plan is protected from unauthorized disclosure;

+ -

the supply chain risk management plan is protected from unauthorized modification.

+ + + @@ -83598,8 +83598,8 @@ -

a supply chain risk management team consisting of is established to lead and support .

+ @@ -83728,31 +83728,31 @@ - - -

a process or processes is/are established to identify and address weaknesses or deficiencies in the supply chain elements and processes of ;

+ -

the process or processes to identify and address weaknesses or deficiencies in the supply chain elements and processes of is/are coordinated with ;

+ + -

are employed to protect against supply chain risks to the system, system component, or system service and to limit the harm or consequences from supply chain-related events;

+ -

the selected and implemented supply chain processes and controls are documented in .

+ + @@ -83827,17 +83827,17 @@ - -

a diverse set of sources is employed for ;

+ -

a diverse set of sources is employed for .

+ + @@ -83898,8 +83898,8 @@ -

are employed to limit harm from potential adversaries identifying and targeting the organizational supply chain.

+ @@ -83961,8 +83961,8 @@ -

the controls included in the contracts of prime contractors are also included in the contracts of subcontractors.

+ @@ -84038,22 +84038,22 @@ - -

valid provenance is documented for ;

+ -

valid provenance is monitored for ;

+ -

valid provenance is maintained for .

+ + @@ -84118,17 +84118,17 @@ - -

unique identification of is established;

+ -

unique identification of is maintained.

+ + @@ -84191,17 +84191,17 @@ - -

the unique identification of is established for tracking through the supply chain;

+ -

the unique identification of is maintained for tracking through the supply chain.

+ + @@ -84275,17 +84275,17 @@ - -

are employed to validate that the system or system component received is genuine;

+ -

are employed to validate that the system or system component received has not been altered.

+ + @@ -84360,17 +84360,17 @@ - -

are employed to ensure the integrity of the system and system components;

+ -

is conducted to ensure the integrity of the system and system components.

+ + @@ -84454,22 +84454,22 @@ - -

are employed to protect against supply chain risks;

+ -

are employed to identify supply chain risks;

+ -

are employed to mitigate supply chain risks.

+ + @@ -84542,8 +84542,8 @@ -

are employed to ensure an adequate supply of .

+ @@ -84606,27 +84606,27 @@ - -

the system, system component, or system service is assessed prior to selection;

+ -

the system, system component, or system service is assessed prior to acceptance;

+ -

the system, system component, or system service is assessed prior to modification;

+ -

the system, system component, or system service is assessed prior to update.

+ + @@ -84701,8 +84701,8 @@ -

the supply chain-related risks associated with suppliers or contractors and the systems, system components, or system services they provide are assessed and reviewed .

+ @@ -84772,8 +84772,8 @@ -

is/are employed on associated with the system, system component, or system service.

+ @@ -84839,8 +84839,8 @@ -

are employed to protect supply chain-related information for the system, system component, or system service.

+ @@ -84922,8 +84922,8 @@ -

agreements and procedures are established with entities involved in the supply chain for the system, system components, or system service for .

+ @@ -84984,8 +84984,8 @@ -

a tamper protection program is implemented for the system, system component, or system service.

+ @@ -85040,8 +85040,8 @@ -

anti-tamper technologies, tools, and techniques are employed throughout the system development life cycle.

+ @@ -85143,8 +85143,8 @@ -

are inspected to detect tampering.

+ @@ -85235,36 +85235,36 @@ - - -

an anti-counterfeit policy is developed and implemented;

+ -

anti-counterfeit procedures are developed and implemented;

+ -

the anti-counterfeit procedures include the means to detect counterfeit components entering the system;

+ -

the anti-counterfeit procedures include the means to prevent counterfeit components from entering the system;

+ + -

counterfeit system components are reported to .

+ + @@ -85331,8 +85331,8 @@ -

are trained to detect counterfeit system components (including hardware, software, and firmware).

+ @@ -85397,17 +85397,17 @@ - -

configuration control over awaiting service or repair is maintained;

+ -

configuration control over serviced or repaired awaiting return to service is maintained.

+ + @@ -85467,8 +85467,8 @@ -

scanning for counterfeit system components is conducted .

+ @@ -85541,8 +85541,8 @@ -

are disposed of using .

+ diff --git a/src/nist.gov/SP800-53/rev5/xml/oscal-objectives-enhance.xsl b/src/nist.gov/SP800-53/rev5/xml/oscal-objectives-enhance.xsl index 2546d00f..413c496a 100644 --- a/src/nist.gov/SP800-53/rev5/xml/oscal-objectives-enhance.xsl +++ b/src/nist.gov/SP800-53/rev5/xml/oscal-objectives-enhance.xsl @@ -98,19 +98,35 @@ --> - - - - - - - - - - - No link made for part '{ @value }' + + + + + + + + + + + + + + + + + + + No link made for part '{ o:label(.) }' + + + + + + + + \ No newline at end of file