Space Segment Cybersecurity Profile

In TOR-2023-02161 Rev A, The Aerospace Corporation presents a cybersecurity profile approach to defining and performing threat-focused space segment risk assessment. The described cybersecurity profile significantly leverages SPARTA to show tailoring rationale of the Committee on National Security Systems Instruction (CNSSI) No. 1253F space platform overlay and the High-High-High baseline. This threat-focused analysis creates unique tailoring that provides a notional maximum control baseline from which system security engineering can more efficiently define cybersecurity requirements before development begins. Aerospace also presents a notional minimum control baseline that is based on SPARTA notional risk scores. While these notional min/max baselines were created in the context of National Security Systems (NSS), these baselines in general provide a more accurate starting point for any space systems engineer developing a cybersecurity control baseline. Since many governmental agencies and commercial space entities are leveraging NIST SP 800-53B or CNSSI No. 1253 control baselines, the below table has been provided to for controls in the context of SPARTA. Furthermore, within SPARTA there are published requirements that align with each of the selected space segment controls. In the event an organization does not have resident space systems engineering, these notional min/max baselines from TOR-2023-02161 Rev A with the accompanying requirements should provide a robust approach for spacecraft acquisitions. The approach includes example acquisition requirements for a contract, control selection rationale for implementation, and threat-based rationale for accurate security control assessment.

ID Name Description SPARTA Countermeasures MIN MAX
AC-1 Policy and Procedures a. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles]: 1. [Selection (one or more): organization-level; mission/business process-level; system-level] access control policy that: (a) Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and (b) Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and 2. Procedures to facilitate the implementation of the access control policy and the associated access controls; b. Designate an [Assignment: organization-defined official] to manage the development, documentation, and dissemination of the access control policy and procedures; and c. Review and update the current access control: 1. Policy [Assignment: organization-defined frequency] and following [Assignment: organization-defined events]; and 2. Procedures [Assignment: organization-defined frequency] and following [Assignment: organization-defined events]. CM0088 CM0005 NA YES
AC-2 Account Management a. Define and document the types of accounts allowed and specifically prohibited for use within the system; b. Assign account managers; c. Require [Assignment: organization-defined prerequisites and criteria] for group and role membership; d. Specify: 1. Authorized users of the system; 2. Group and role membership; and 3. Access authorizations (i.e., privileges) and [Assignment: organization-defined attributes (as required)] for each account; e. Require approvals by [Assignment: organization-defined personnel or roles] for requests to create accounts; f. Create, enable, modify, disable, and remove accounts in accordance with [Assignment: organization-defined policy, procedures, prerequisites, and criteria]; g. Monitor the use of accounts; h. Notify account managers and [Assignment: organization-defined personnel or roles] within: 1. [Assignment: organization-defined time period] when accounts are no longer required; 2. [Assignment: organization-defined time period] when users are terminated or transferred; and 3. [Assignment: organization-defined time period] when system usage or need-to-know changes for an individual; i. Authorize access to the system based on: 1. A valid access authorization; 2. Intended system usage; and 3. [Assignment: organization-defined attributes (as required)]; j. Review accounts for compliance with account management requirements [Assignment: organization-defined frequency]; k. Establish and implement a process for changing shared or group account authenticators (if deployed) when individuals are removed from the group; and l. Align account management processes with personnel termination and transfer processes. CM0039 CM0005 NA NA
1 Account Management | Automated System Account Management Support the management of system accounts using [Assignment: organization-defined automated mechanisms]. CM0005 CM0002 CM0055 NA NA
2 Account Management | Automated Temporary and Emergency Account Management Automatically [Selection: remove; disable] temporary and emergency accounts after [Assignment: organization-defined time period for each type of account]. CM0005 CM0002 CM0055 NA NA
3 Account Management | Disable Accounts Disable accounts within [Assignment: organization-defined time period] when the accounts: (a) Have expired; (b) Are no longer associated with a user or individual; (c) Are in violation of organizational policy; or (d) Have been inactive for [Assignment: organization-defined time period]. CM0005 CM0002 CM0055 NA NA
4 Account Management | Automated Audit Actions Automatically audit account creation, modification, enabling, disabling, and removal actions. CM0005 CM0002 CM0055 NA NA
5 Account Management | Inactivity Logout Require that users log out when [Assignment: organization-defined time period of expected inactivity or description of when to log out]. CM0005 CM0002 CM0055 NA NA
6 Account Management | Dynamic Privilege Management Implement [Assignment: organization-defined dynamic privilege management capabilities]. CM0005 CM0002 CM0055 NA NA
7 Account Management | Privileged User Accounts (a) Establish and administer privileged user accounts in accordance with [Selection: a role-based access scheme; an attribute-based access scheme]; (b) Monitor privileged role or attribute assignments; (c) Monitor changes to roles or attributes; and (d) Revoke access when privileged role or attribute assignments are no longer appropriate. CM0005 CM0002 CM0055 NA NA
8 Account Management | Dynamic Account Management Create, activate, manage, and deactivate [Assignment: organization-defined system accounts] dynamically. CM0005 CM0002 CM0055 NA NA
9 Account Management | Restrictions on Use of Shared and Group Accounts Only permit the use of shared and group accounts that meet [Assignment: organization-defined conditions for establishing shared and group accounts]. CM0005 CM0002 CM0055 NA NA
11 Account Management | Usage Conditions Enforce [Assignment: organization-defined circumstances and/or usage conditions] for [Assignment: organization-defined system accounts]. CM0005 CM0002 CM0055 NA NA
12 Account Management | Account Monitoring for Atypical Usage (a) Monitor system accounts for [Assignment: organization-defined atypical usage]; and (b) Report atypical usage of system accounts to [Assignment: organization-defined personnel or roles]. CM0005 CM0002 CM0055 NA NA
13 Account Management | Disable Accounts for High-risk Individuals Disable accounts of individuals within [Assignment: organization-defined time period] of discovery of [Assignment: organization-defined significant risks]. CM0005 CM0002 CM0055 NA NA
AC-3 Access Enforcement Enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies. CM0055 CM0005 NA YES
2 Access Enforcement | Dual Authorization Enforce dual authorization for [Assignment: organization-defined privileged commands and/or other organization-defined actions]. CM0054 CM0055 CM0005 CM0002 CM0001 CM0008 CM0052 CM0049 CM0004 CM0007 CM0035 CM0039 YES YES
3 Access Enforcement | Mandatory Access Control Enforce [Assignment: organization-defined mandatory access control policy] over the set of covered subjects and objects specified in the policy, and where the policy: (a) Is uniformly enforced across the covered subjects and objects within the system; (b) Specifies that a subject that has been granted access to information is constrained from doing any of the following; (1) Passing the information to unauthorized subjects or objects; (2) Granting its privileges to other subjects; (3) Changing one or more security attributes (specified by the policy) on subjects, objects, the system, or system components; (4) Choosing the security attributes and attribute values (specified by the policy) to be associated with newly created or modified objects; and (5) Changing the rules governing access control; and (c) Specifies that [Assignment: organization-defined subjects] may explicitly be granted [Assignment: organization-defined privileges] such that they are not limited by any defined subset (or all) of the above constraints. CM0054 CM0055 CM0005 CM0002 CM0001 CM0008 CM0052 CM0049 CM0004 CM0007 CM0035 CM0039 NA YES
4 Access Enforcement | Discretionary Access Control Enforce [Assignment: organization-defined discretionary access control policy] over the set of covered subjects and objects specified in the policy, and where the policy specifies that a subject that has been granted access to information can do one or more of the following: (a) Pass the information to any other subjects or objects; (b) Grant its privileges to other subjects; (c) Change security attributes on subjects, objects, the system, or the system’s components; (d) Choose the security attributes to be associated with newly created or revised objects; or (e) Change the rules governing access control. CM0054 CM0055 CM0005 CM0002 CM0001 CM0008 CM0052 CM0049 CM0004 CM0007 CM0035 CM0039 NA YES
5 Access Enforcement | Security-relevant Information Prevent access to [Assignment: organization-defined security-relevant information] except during secure, non-operable system states. CM0054 CM0055 CM0005 CM0002 CM0001 CM0008 CM0052 CM0049 CM0004 CM0007 CM0035 CM0039 NA NA
7 Access Enforcement | Role-based Access Control Enforce a role-based access control policy over defined subjects and objects and control access based upon [Assignment: organization-defined roles and users authorized to assume such roles]. CM0054 CM0055 CM0005 CM0002 CM0001 CM0008 CM0052 CM0049 CM0004 CM0007 CM0035 CM0039 NA NA
8 Access Enforcement | Revocation of Access Authorizations Enforce the revocation of access authorizations resulting from changes to the security attributes of subjects and objects based on [Assignment: organization-defined rules governing the timing of revocations of access authorizations]. CM0054 CM0055 CM0005 CM0002 CM0001 CM0008 CM0052 CM0049 CM0004 CM0007 CM0035 CM0039 NA YES
9 Access Enforcement | Controlled Release Release information outside of the system only if: (a) The receiving [Assignment: organization-defined system or system component] provides [Assignment: organization-defined controls]; and (b) [Assignment: organization-defined controls] are used to validate the appropriateness of the information designated for release. CM0054 CM0055 CM0005 CM0002 CM0001 CM0008 CM0052 CM0049 CM0004 CM0007 CM0035 CM0039 NA NA
10 Access Enforcement | Audited Override of Access Control Mechanisms Employ an audited override of automated access control mechanisms under [Assignment: organization-defined conditions] by [Assignment: organization-defined roles]. CM0054 CM0055 CM0005 CM0002 CM0001 CM0008 CM0052 CM0049 CM0004 CM0007 CM0035 CM0039 YES YES
11 Access Enforcement | Restrict Access to Specific Information Types Restrict access to data repositories containing [Assignment: organization-defined information types]. CM0054 CM0055 CM0005 CM0002 CM0001 CM0008 CM0052 CM0049 CM0004 CM0007 CM0035 CM0039 YES YES
12 Access Enforcement | Assert and Enforce Application Access (a) Require applications to assert, as part of the installation process, the access needed to the following system applications and functions: [Assignment: organization-defined system applications and functions]; (b) Provide an enforcement mechanism to prevent unauthorized access; and (c) Approve access changes after initial installation of the application. CM0054 CM0055 CM0005 CM0002 CM0001 CM0008 CM0052 CM0049 CM0004 CM0007 CM0035 CM0039 NA NA
13 Access Enforcement | Attribute-based Access Control Enforce attribute-based access control policy over defined subjects and objects and control access based upon [Assignment: organization-defined attributes to assume access permissions]. CM0054 CM0055 CM0005 CM0002 CM0001 CM0008 CM0052 CM0049 CM0004 CM0007 CM0035 CM0039 YES YES
14 Access Enforcement | Individual Access Provide [Assignment: organization-defined mechanisms] to enable individuals to have access to the following elements of their personally identifiable information: [Assignment: organization-defined elements]. CM0054 CM0055 CM0005 CM0002 CM0001 CM0008 CM0052 CM0049 CM0004 CM0007 CM0035 CM0039 NA NA
15 Access Enforcement | Discretionary and Mandatory Access Control (a) Enforce [Assignment: organization-defined mandatory access control policy] over the set of covered subjects and objects specified in the policy; and (b) Enforce [Assignment: organization-defined discretionary access control policy] over the set of covered subjects and objects specified in the policy. CM0054 CM0055 CM0005 CM0002 CM0001 CM0008 CM0052 CM0049 CM0004 CM0007 CM0035 CM0039 NA NA
AC-4 Information Flow Enforcement Enforce approved authorizations for controlling the flow of information within the system and between connected systems based on [Assignment: organization-defined information flow control policies]. CM0050 CM0005 CM0038 YES YES
1 Information Flow Enforcement | Object Security and Privacy Attributes Use [Assignment: organization-defined security and privacy attributes] associated with [Assignment: organization-defined information, source, and destination objects] to enforce [Assignment: organization-defined information flow control policies] as a basis for flow control decisions. CM0039 CM0038 CM0001 CM0040 CM0050 CM0005 NA NA
2 Information Flow Enforcement | Processing Domains Use protected processing domains to enforce [Assignment: organization-defined information flow control policies] as a basis for flow control decisions. CM0039 CM0038 CM0001 CM0040 CM0050 CM0005 YES YES
3 Information Flow Enforcement | Dynamic Information Flow Control Enforce [Assignment: organization-defined information flow control policies]. CM0039 CM0038 CM0001 CM0040 CM0050 CM0005 NA NA
4 Information Flow Enforcement | Flow Control of Encrypted Information Prevent encrypted information from bypassing [Assignment: organization-defined information flow control mechanisms] by [Selection (one or more): decrypting the information; blocking the flow of the encrypted information; terminating communications sessions attempting to pass encrypted information; [Assignment: organization-defined procedure or method] ]. CM0039 CM0038 CM0001 CM0040 CM0050 CM0005 NA NA
5 Information Flow Enforcement | Embedded Data Types Enforce [Assignment: organization-defined limitations] on embedding data types within other data types. CM0039 CM0038 CM0001 CM0040 CM0050 CM0005 NA NA
6 Information Flow Enforcement | Metadata Enforce information flow control based on [Assignment: organization-defined metadata]. CM0039 CM0038 CM0001 CM0040 CM0050 CM0005 NA NA
7 Information Flow Enforcement | One-way Flow Mechanisms Enforce one-way information flows through hardware-based flow control mechanisms. CM0039 CM0038 CM0001 CM0040 CM0050 CM0005 NA NA
8 Information Flow Enforcement | Security and Privacy Policy Filters (a) Enforce information flow control using [Assignment: organization-defined security or privacy policy filters] as a basis for flow control decisions for [Assignment: organization-defined information flows]; and (b) [Selection (one or more): Block; Strip; Modify; Quarantine] data after a filter processing failure in accordance with [Assignment: organization-defined security or privacy policy]. CM0039 CM0038 CM0001 CM0040 CM0050 CM0005 NA NA
9 Information Flow Enforcement | Human Reviews Enforce the use of human reviews for [Assignment: organization-defined information flows] under the following conditions: [Assignment: organization-defined conditions]. CM0039 CM0038 CM0001 CM0040 CM0050 CM0005 NA NA
10 Information Flow Enforcement | Enable and Disable Security or Privacy Policy Filters Provide the capability for privileged administrators to enable and disable [Assignment: organization-defined security or privacy policy filters] under the following conditions: [Assignment: organization-defined conditions]. CM0039 CM0038 CM0001 CM0040 CM0050 CM0005 NA NA
11 Information Flow Enforcement | Configuration of Security or Privacy Policy Filters Provide the capability for privileged administrators to configure [Assignment: organization-defined security or privacy policy filters] to support different security or privacy policies. CM0039 CM0038 CM0001 CM0040 CM0050 CM0005 NA NA
12 Information Flow Enforcement | Data Type Identifiers When transferring information between different security domains, use [Assignment: organization-defined data type identifiers] to validate data essential for information flow decisions. CM0039 CM0038 CM0001 CM0040 CM0050 CM0005 NA NA
13 Information Flow Enforcement | Decomposition into Policy-relevant Subcomponents When transferring information between different security domains, decompose information into [Assignment: organization-defined policy-relevant subcomponents] for submission to policy enforcement mechanisms. CM0039 CM0038 CM0001 CM0040 CM0050 CM0005 NA NA
14 Information Flow Enforcement | Security or Privacy Policy Filter Constraints When transferring information between different security domains, implement [Assignment: organization-defined security or privacy policy filters] requiring fully enumerated formats that restrict data structure and content. CM0039 CM0038 CM0001 CM0040 CM0050 CM0005 YES YES
15 Information Flow Enforcement | Detection of Unsanctioned Information When transferring information between different security domains, examine the information for the presence of [Assignment: organization-defined unsanctioned information] and prohibit the transfer of such information in accordance with the [Assignment: organization-defined security or privacy policy]. CM0039 CM0038 CM0001 CM0040 CM0050 CM0005 NA NA
17 Information Flow Enforcement | Domain Authentication Uniquely identify and authenticate source and destination points by [Selection (one or more): organization; system; application; service; individual] for information transfer. CM0039 CM0038 CM0001 CM0040 CM0050 CM0005 NA NA
19 Information Flow Enforcement | Validation of Metadata When transferring information between different security domains, implement [Assignment: organization-defined security or privacy policy filters] on metadata. CM0039 CM0038 CM0001 CM0040 CM0050 CM0005 NA NA
20 Information Flow Enforcement | Approved Solutions Employ [Assignment: organization-defined solutions in approved configurations] to control the flow of [Assignment: organization-defined information] across security domains. CM0039 CM0038 CM0001 CM0040 CM0050 CM0005 NA NA
21 Information Flow Enforcement | Physical or Logical Separation of Information Flows Separate information flows logically or physically using [Assignment: organization-defined mechanisms and/or techniques] to accomplish [Assignment: organization-defined required separations by types of information]. CM0039 CM0038 CM0001 CM0040 CM0050 CM0005 NA NA
22 Information Flow Enforcement | Access Only Provide access from a single device to computing platforms, applications, or data residing in multiple different security domains, while preventing information flow between the different security domains. CM0039 CM0038 CM0001 CM0040 CM0050 CM0005 NA NA
23 Information Flow Enforcement | Modify Non-releasable Information When transferring information between different security domains, modify non-releasable information by implementing [Assignment: organization-defined modification action]. CM0039 CM0038 CM0001 CM0040 CM0050 CM0005 NA NA
24 Information Flow Enforcement | Internal Normalized Format When transferring information between different security domains, parse incoming data into an internal normalized format and regenerate the data to be consistent with its intended specification. CM0039 CM0038 CM0001 CM0040 CM0050 CM0005 NA NA
25 Information Flow Enforcement | Data Sanitization When transferring information between different security domains, sanitize data to minimize [Selection (one or more): delivery of malicious content, command and control of malicious code, malicious code augmentation, and steganography encoded data; spillage of sensitive information] in accordance with [Assignment: organization-defined policy]]. CM0039 CM0038 CM0001 CM0040 CM0050 CM0005 NA NA
26 Information Flow Enforcement | Audit Filtering Actions When transferring information between different security domains, record and audit content filtering actions and results for the information being filtered. CM0039 CM0038 CM0001 CM0040 CM0050 CM0005 NA NA
27 Information Flow Enforcement | Redundant/independent Filtering Mechanisms When transferring information between different security domains, implement content filtering solutions that provide redundant and independent filtering mechanisms for each data type. CM0039 CM0038 CM0001 CM0040 CM0050 CM0005 NA NA
28 Information Flow Enforcement | Linear Filter Pipelines When transferring information between different security domains, implement a linear content filter pipeline that is enforced with discretionary and mandatory access controls. CM0039 CM0038 CM0001 CM0040 CM0050 CM0005 NA NA
29 Information Flow Enforcement | Filter Orchestration Engines When transferring information between different security domains, employ content filter orchestration engines to ensure that: (a) Content filtering mechanisms successfully complete execution without errors; and (b) Content filtering actions occur in the correct order and comply with [Assignment: organization-defined policy]. CM0039 CM0038 CM0001 CM0040 CM0050 CM0005 NA NA
30 Information Flow Enforcement | Filter Mechanisms Using Multiple Processes When transferring information between different security domains, implement content filtering mechanisms using multiple processes. CM0039 CM0038 CM0001 CM0040 CM0050 CM0005 NA NA
31 Information Flow Enforcement | Failed Content Transfer Prevention When transferring information between different security domains, prevent the transfer of failed content to the receiving domain. CM0039 CM0038 CM0001 CM0040 CM0050 CM0005 NA NA
32 Information Flow Enforcement | Process Requirements for Information Transfer When transferring information between different security domains, the process that transfers information between filter pipelines: (a) Does not filter message content; (b) Validates filtering metadata; (c) Ensures the content associated with the filtering metadata has successfully completed filtering; and (d) Transfers the content to the destination filter pipeline. CM0039 CM0038 CM0001 CM0040 CM0050 CM0005 NA NA
AC-5 Separation of Duties a. Identify and document [Assignment: organization-defined duties of individuals requiring separation]; and b. Define system access authorizations to support separation of duties. NA NA
AC-6 Least Privilege Employ the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) that are necessary to accomplish assigned organizational tasks. CM0052 CM0039 CM0005 CM0038 YES YES
1 Least Privilege | Authorize Access to Security Functions Authorize access for [Assignment: organization-defined individuals or roles] to: (a) [Assignment: organization-defined security functions (deployed in hardware, software, and firmware)]; and (b) [Assignment: organization-defined security-relevant information]. CM0005 NA NA
2 Least Privilege | Non-privileged Access for Nonsecurity Functions Require that users of system accounts (or roles) with access to [Assignment: organization-defined security functions or security-relevant information] use non-privileged accounts or roles, when accessing nonsecurity functions. CM0005 NA NA
3 Least Privilege | Network Access to Privileged Commands Authorize network access to [Assignment: organization-defined privileged commands] only for [Assignment: organization-defined compelling operational needs] and document the rationale for such access in the security plan for the system. CM0005 NA NA
4 Least Privilege | Separate Processing Domains Provide separate processing domains to enable finer-grained allocation of user privileges. CM0005 NA NA
5 Least Privilege | Privileged Accounts Restrict privileged accounts on the system to [Assignment: organization-defined personnel or roles]. CM0005 NA NA
6 Least Privilege | Privileged Access by Non-organizational Users Prohibit privileged access to the system by non-organizational users. CM0005 NA NA
7 Least Privilege | Review of User Privileges (a) Review [Assignment: organization-defined frequency] the privileges assigned to [Assignment: organization-defined roles or classes of users] to validate the need for such privileges; and (b) Reassign or remove privileges, if necessary, to correctly reflect organizational mission and business needs. CM0005 NA NA
8 Least Privilege | Privilege Levels for Code Execution Prevent the following software from executing at higher privilege levels than users executing the software: [Assignment: organization-defined software]. CM0005 NA NA
9 Least Privilege | Log Use of Privileged Functions Log the execution of privileged functions. CM0005 NA YES
10 Least Privilege | Prohibit Non-privileged Users from Executing Privileged Functions Prevent non-privileged users from executing privileged functions. CM0005 NA NA
AC-7 Unsuccessful Logon Attempts a. Enforce a limit of [Assignment: organization-defined number] consecutive invalid logon attempts by a user during a [Assignment: organization-defined time period]; and b. Automatically [Selection (one or more): lock the account or node for an [Assignment: organization-defined time period] ; lock the account or node until released by an administrator; delay next logon prompt per [Assignment: organization-defined delay algorithm] ; notify system administrator; take other [Assignment: organization-defined action] ] when the maximum number of unsuccessful attempts is exceeded. CM0005 NA NA
2 Unsuccessful Logon Attempts | Purge or Wipe Mobile Device Purge or wipe information from [Assignment: organization-defined mobile devices] based on [Assignment: organization-defined purging or wiping requirements and techniques] after [Assignment: organization-defined number] consecutive, unsuccessful device logon attempts. NA NA
3 Unsuccessful Logon Attempts | Biometric Attempt Limiting Limit the number of unsuccessful biometric logon attempts to [Assignment: organization-defined number]. NA NA
4 Unsuccessful Logon Attempts | Use of Alternate Authentication Factor (a) Allow the use of [Assignment: organization-defined authentication factors] that are different from the primary authentication factors after the number of organization-defined consecutive invalid logon attempts have been exceeded; and (b) Enforce a limit of [Assignment: organization-defined number] consecutive invalid logon attempts through use of the alternative factors by a user during a [Assignment: organization-defined time period]. NA NA
AC-8 System Use Notification a. Display [Assignment: organization-defined system use notification message or banner] to users before granting access to the system that provides privacy and security notices consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines and state that: 1. Users are accessing a U.S. Government system; 2. System usage may be monitored, recorded, and subject to audit; 3. Unauthorized use of the system is prohibited and subject to criminal and civil penalties; and 4. Use of the system indicates consent to monitoring and recording; b. Retain the notification message or banner on the screen until users acknowledge the usage conditions and take explicit actions to log on to or further access the system; and c. For publicly accessible systems: 1. Display system use information [Assignment: organization-defined conditions], before granting further access to the publicly accessible system; 2. Display references, if any, to monitoring, recording, or auditing that are consistent with privacy accommodations for such systems that generally prohibit those activities; and 3. Include a description of the authorized uses of the system. CM0005 NA NA
AC-9 Previous Logon Notification Notify the user, upon successful logon to the system, of the date and time of the last logon. NA NA
1 Previous Logon Notification | Unsuccessful Logons Notify the user, upon successful logon, of the number of unsuccessful logon attempts since the last successful logon. NA NA
2 Previous Logon Notification | Successful and Unsuccessful Logons Notify the user, upon successful logon, of the number of [Selection: successful logons; unsuccessful logon attempts; both] during [Assignment: organization-defined time period]. NA NA
3 Previous Logon Notification | Notification of Account Changes Notify the user, upon successful logon, of changes to [Assignment: organization-defined security-related characteristics or parameters of the user’s account] during [Assignment: organization-defined time period]. NA NA
4 Previous Logon Notification | Additional Logon Information Notify the user, upon successful logon, of the following additional information: [Assignment: organization-defined additional information]. NA NA
AC-10 Concurrent Session Control Limit the number of concurrent sessions for each [Assignment: organization-defined account and/or account type] to [Assignment: organization-defined number]. CM0005 NA NA
AC-11 Device Lock a. Prevent further access to the system by [Selection (one or more): initiating a device lock after [Assignment: organization-defined time period] of inactivity; requiring the user to initiate a device lock before leaving the system unattended]; and b. Retain the device lock until the user reestablishes access using established identification and authentication procedures. CM0005 NA NA
1 Device Lock | Pattern-hiding Displays Conceal, via the device lock, information previously visible on the display with a publicly viewable image. CM0005 NA NA
AC-12 Session Termination Automatically terminate a user session after [Assignment: organization-defined conditions, or trigger events requiring session disconnect]. CM0036 CM0005 YES YES
1 Session Termination | User-initiated Logouts Provide a logout capability for user-initiated communications sessions whenever authentication is used to gain access to [Assignment: organization-defined information resources]. CM0005 CM0036 NA YES
2 Session Termination | Termination Message Display an explicit logout message to users indicating the termination of authenticated communications sessions. CM0005 CM0036 NA YES
3 Session Termination | Timeout Warning Message Display an explicit message to users indicating that the session will end in [Assignment: organization-defined time until end of session]. CM0005 CM0036 NA NA
AC-14 Permitted Actions Without Identification or Authentication a. Identify [Assignment: organization-defined user actions] that can be performed on the system without identification or authentication consistent with organizational mission and business functions; and b. Document and provide supporting rationale in the security plan for the system, user actions not requiring identification or authentication. CM0024 CM0027 CM0028 CM0052 CM0054 CM0031 CM0021 CM0005 CM0053 CM0014 CM0037 CM0043 YES YES
AC-16 Security and Privacy Attributes a. Provide the means to associate [Assignment: organization-defined types of security and privacy attributes] with [Assignment: organization-defined security and privacy attribute values] for information in storage, in process, and/or in transmission; b. Ensure that the attribute associations are made and retained with the information; c. Establish the following permitted security and privacy attributes from the attributes defined in AC-16a for [Assignment: organization-defined systems]: [Assignment: organization-defined security and privacy attributes]; d. Determine the following permitted attribute values or ranges for each of the established attributes: [Assignment: organization-defined attribute values or ranges for established attributes]; e. Audit changes to attributes; and f. Review [Assignment: organization-defined security and privacy attributes] for applicability [Assignment: organization-defined frequency]. CM0005 NA NA
1 Security and Privacy Attributes | Dynamic Attribute Association Dynamically associate security and privacy attributes with [Assignment: organization-defined subjects and objects] in accordance with the following security and privacy policies as information is created and combined: [Assignment: organization-defined security and privacy policies]. CM0005 NA NA
2 Security and Privacy Attributes | Attribute Value Changes by Authorized Individuals Provide authorized individuals (or processes acting on behalf of individuals) the capability to define or change the value of associated security and privacy attributes. CM0005 NA NA
3 Security and Privacy Attributes | Maintenance of Attribute Associations by System Maintain the association and integrity of [Assignment: organization-defined security and privacy attributes] to [Assignment: organization-defined subjects and objects]. CM0005 NA NA
4 Security and Privacy Attributes | Association of Attributes by Authorized Individuals Provide the capability to associate [Assignment: organization-defined security and privacy attributes] with [Assignment: organization-defined subjects and objects] by authorized individuals (or processes acting on behalf of individuals). CM0005 NA NA
5 Security and Privacy Attributes | Attribute Displays on Objects to Be Output Display security and privacy attributes in human-readable form on each object that the system transmits to output devices to identify [Assignment: organization-defined special dissemination, handling, or distribution instructions] using [Assignment: organization-defined human-readable, standard naming conventions]. CM0005 NA NA
6 Security and Privacy Attributes | Maintenance of Attribute Association Require personnel to associate and maintain the association of [Assignment: organization-defined security and privacy attributes] with [Assignment: organization-defined subjects and objects] in accordance with [Assignment: organization-defined security and privacy policies]. CM0005 NA NA
7 Security and Privacy Attributes | Consistent Attribute Interpretation Provide a consistent interpretation of security and privacy attributes transmitted between distributed system components. CM0005 NA NA
8 Security and Privacy Attributes | Association Techniques and Technologies Implement [Assignment: organization-defined techniques and technologies] in associating security and privacy attributes to information. CM0005 NA NA
9 Security and Privacy Attributes | Attribute Reassignment — Regrading Mechanisms Change security and privacy attributes associated with information only via regrading mechanisms validated using [Assignment: organization-defined techniques or procedures]. CM0005 NA NA
10 Security and Privacy Attributes | Attribute Configuration by Authorized Individuals Provide authorized individuals the capability to define or change the type and value of security and privacy attributes available for association with subjects and objects. CM0005 NA NA
AC-17 Remote Access a. Establish and document usage restrictions, configuration/connection requirements, and implementation guidance for each type of remote access allowed; and b. Authorize each type of remote access to the system prior to allowing such connections. CM0002 CM0031 CM0004 CM0005 CM0070 CM0029 YES YES
1 Remote Access | Monitoring and Control Employ automated mechanisms to monitor and control remote access methods. CM0002 CM0055 CM0005 CM0034 CM0031 CM0035 CM0033 YES YES
2 Remote Access | Protection of Confidentiality and Integrity Using Encryption Implement cryptographic mechanisms to protect the confidentiality and integrity of remote access sessions. CM0002 CM0055 CM0005 CM0034 CM0031 CM0035 CM0033 YES YES
3 Remote Access | Managed Access Control Points Route remote accesses through authorized and managed network access control points. CM0002 CM0055 CM0005 CM0034 CM0031 CM0035 CM0033 NA NA
4 Remote Access | Privileged Commands and Access (a) Authorize the execution of privileged commands and access to security-relevant information via remote access only in a format that provides assessable evidence and for the following needs: [Assignment: organization-defined needs]; and (b) Document the rationale for remote access in the security plan for the system. CM0002 CM0055 CM0005 CM0034 CM0031 CM0035 CM0033 NA YES
6 Remote Access | Protection of Mechanism Information Protect information about remote access mechanisms from unauthorized use and disclosure. CM0002 CM0055 CM0005 CM0034 CM0031 CM0035 CM0033 NA YES
9 Remote Access | Disconnect or Disable Access Provide the capability to disconnect or disable remote access to the system within [Assignment: organization-defined time period]. CM0002 CM0055 CM0005 CM0034 CM0031 CM0035 CM0033 NA NA
10 Remote Access | Authenticate Remote Commands Implement [Assignment: organization-defined mechanisms] to authenticate [Assignment: organization-defined remote commands]. CM0002 CM0055 CM0005 CM0034 CM0031 CM0035 CM0033 YES YES
AC-18 Wireless Access a. Establish configuration requirements, connection requirements, and implementation guidance for each type of wireless access; and b. Authorize each type of wireless access to the system prior to allowing such connections. CM0002 CM0031 CM0004 CM0005 CM0029 NA NA
1 Wireless Access | Authentication and Encryption Protect wireless access to the system using authentication of [Selection (one or more): users; devices] and encryption. CM0002 CM0031 CM0005 CM0029 NA NA
3 Wireless Access | Disable Wireless Networking Disable, when not intended for use, wireless networking capabilities embedded within system components prior to issuance and deployment. CM0002 CM0031 CM0005 CM0029 NA NA
4 Wireless Access | Restrict Configurations by Users Identify and explicitly authorize users allowed to independently configure wireless networking capabilities. CM0002 CM0031 CM0005 CM0029 NA NA
5 Wireless Access | Antennas and Transmission Power Levels Select radio antennas and calibrate transmission power levels to reduce the probability that signals from wireless access points can be received outside of organization-controlled boundaries. CM0002 CM0031 CM0005 CM0029 NA NA
AC-19 Access Control for Mobile Devices a. Establish configuration requirements, connection requirements, and implementation guidance for organization-controlled mobile devices, to include when such devices are outside of controlled areas; and b. Authorize the connection of mobile devices to organizational systems. CM0005 NA NA
4 Access Control for Mobile Devices | Restrictions for Classified Information (a) Prohibit the use of unclassified mobile devices in facilities containing systems processing, storing, or transmitting classified information unless specifically permitted by the authorizing official; and (b) Enforce the following restrictions on individuals permitted by the authorizing official to use unclassified mobile devices in facilities containing systems processing, storing, or transmitting classified information: (1) Connection of unclassified mobile devices to classified systems is prohibited; (2) Connection of unclassified mobile devices to unclassified systems requires approval from the authorizing official; (3) Use of internal or external modems or wireless interfaces within the unclassified mobile devices is prohibited; and (4) Unclassified mobile devices and the information stored on those devices are subject to random reviews and inspections by [Assignment: organization-defined security officials], and if classified information is found, the incident handling policy is followed. (c) Restrict the connection of classified mobile devices to classified systems in accordance with [Assignment: organization-defined security policies]. CM0005 NA NA
5 Access Control for Mobile Devices | Full Device or Container-based Encryption Employ [Selection: full-device encryption; container-based encryption] to protect the confidentiality and integrity of information on [Assignment: organization-defined mobile devices]. CM0005 NA NA
AC-20 Use of External Systems a. [Selection (one or more): Establish [Assignment: organization-defined terms and conditions] ; Identify [Assignment: organization-defined controls asserted to be implemented on external systems] ], consistent with the trust relationships established with other organizations owning, operating, and/or maintaining external systems, allowing authorized individuals to: 1. Access the system from external systems; and 2. Process, store, or transmit organization-controlled information using external systems; or b. Prohibit the use of [Assignment: organizationally-defined types of external systems]. CM0005 NA YES
1 Use of External Systems | Limits on Authorized Use Permit authorized individuals to use an external system to access the system or to process, store, or transmit organization-controlled information only after: (a) Verification of the implementation of controls on the external system as specified in the organization’s security and privacy policies and security and privacy plans; or (b) Retention of approved system connection or processing agreements with the organizational entity hosting the external system. CM0005 CM0024 CM0026 CM0004 NA YES
2 Use of External Systems | Portable Storage Devices — Restricted Use Restrict the use of organization-controlled portable storage devices by authorized individuals on external systems using [Assignment: organization-defined restrictions]. CM0005 CM0024 CM0026 CM0004 NA NA
3 Use of External Systems | Non-organizationally Owned Systems — Restricted Use Restrict the use of non-organizationally owned systems or system components to process, store, or transmit organizational information using [Assignment: organization-defined restrictions]. CM0005 CM0024 CM0026 CM0004 NA YES
4 Use of External Systems | Network Accessible Storage Devices — Prohibited Use Prohibit the use of [Assignment: organization-defined network accessible storage devices] in external systems. CM0005 CM0024 CM0026 CM0004 NA NA
5 Use of External Systems | Portable Storage Devices — Prohibited Use Prohibit the use of organization-controlled portable storage devices by authorized individuals on external systems. CM0005 CM0024 CM0026 CM0004 NA NA
AC-21 Information Sharing a. Enable authorized users to determine whether access authorizations assigned to a sharing partner match the information’s access and use restrictions for [Assignment: organization-defined information sharing circumstances where user discretion is required]; and b. Employ [Assignment: organization-defined automated mechanisms or manual processes] to assist users in making information sharing and collaboration decisions. CM0005 NA NA
1 Information Sharing | Automated Decision Support Employ [Assignment: organization-defined automated mechanisms] to enforce information-sharing decisions by authorized users based on access authorizations of sharing partners and access restrictions on information to be shared. NA NA
2 Information Sharing | Information Search and Retrieval Implement information search and retrieval services that enforce [Assignment: organization-defined information sharing restrictions]. NA NA
AC-22 Publicly Accessible Content a. Designate individuals authorized to make information publicly accessible; b. Train authorized individuals to ensure that publicly accessible information does not contain nonpublic information; c. Review the proposed content of information prior to posting onto the publicly accessible system to ensure that nonpublic information is not included; and d. Review the content on the publicly accessible system for nonpublic information [Assignment: organization-defined frequency] and remove such information, if discovered. CM0005 NA NA
AC-23 Data Mining Protection Employ [Assignment: organization-defined data mining prevention and detection techniques] for [Assignment: organization-defined data storage objects] to detect and protect against unauthorized data mining. NA NA
AC-24 Access Control Decisions [Selection: Establish procedures; Implement mechanisms] to ensure [Assignment: organization-defined access control decisions] are applied to each access request prior to access enforcement. NA NA
1 Access Control Decisions | Transmit Access Authorization Information Transmit [Assignment: organization-defined access authorization information] using [Assignment: organization-defined controls] to [Assignment: organization-defined systems] that enforce access control decisions. NA NA
2 Access Control Decisions | No User or Process Identity Enforce access control decisions based on [Assignment: organization-defined security or privacy attributes] that do not include the identity of the user or process acting on behalf of the user. NA NA
AC-25 Reference Monitor Implement a reference monitor for [Assignment: organization-defined access control policies] that is tamperproof, always invoked, and small enough to be subject to analysis and testing, the completeness of which can be assured. CM0001 CM0028 NA YES
AT-1 Policy and Procedures a. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles]: 1. [Selection (one or more): organization-level; mission/business process-level; system-level] awareness and training policy that: (a) Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and (b) Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and 2. Procedures to facilitate the implementation of the awareness and training policy and the associated awareness and training controls; b. Designate an [Assignment: organization-defined official] to manage the development, documentation, and dissemination of the awareness and training policy and procedures; and c. Review and update the current awareness and training: 1. Policy [Assignment: organization-defined frequency] and following [Assignment: organization-defined events]; and 2. Procedures [Assignment: organization-defined frequency] and following [Assignment: organization-defined events]. CM0088 NA NA
AT-2 Literacy Training and Awareness a. Provide security and privacy literacy training to system users (including managers, senior executives, and contractors): 1. As part of initial training for new users and [Assignment: organization-defined frequency] thereafter; and 2. When required by system changes or following [Assignment: organization-defined events]; b. Employ the following techniques to increase the security and privacy awareness of system users [Assignment: organization-defined awareness techniques]; c. Update literacy training and awareness content [Assignment: organization-defined frequency] and following [Assignment: organization-defined events]; and d. Incorporate lessons learned from internal or external security or privacy incidents into literacy training and awareness techniques. CM0041 CM0052 NA NA
1 Literacy Training and Awareness | Practical Exercises Provide practical exercises in literacy training that simulate events and incidents. CM0041 CM0052 CM0005 NA NA
2 Literacy Training and Awareness | Insider Threat Provide literacy training on recognizing and reporting potential indicators of insider threat. CM0041 CM0052 CM0005 NA NA
3 Literacy Training and Awareness | Social Engineering and Mining Provide literacy training on recognizing and reporting potential and actual instances of social engineering and social mining. CM0041 CM0052 CM0005 NA NA
4 Literacy Training and Awareness | Suspicious Communications and Anomalous System Behavior Provide literacy training on recognizing suspicious communications and anomalous behavior in organizational systems using [Assignment: organization-defined indicators of malicious code]. CM0041 CM0052 CM0005 NA NA
5 Literacy Training and Awareness | Advanced Persistent Threat Provide literacy training on the advanced persistent threat. CM0041 CM0052 CM0005 NA NA
6 Literacy Training and Awareness | Cyber Threat Environment (a) Provide literacy training on the cyber threat environment; and (b) Reflect current cyber threat information in system operations. CM0041 CM0052 CM0005 NA NA
AT-3 Role-based Training a. Provide role-based security and privacy training to personnel with the following roles and responsibilities: [Assignment: organization-defined roles and responsibilities]: 1. Before authorizing access to the system, information, or performing assigned duties, and [Assignment: organization-defined frequency] thereafter; and 2. When required by system changes; b. Update role-based training content [Assignment: organization-defined frequency] and following [Assignment: organization-defined events]; and c. Incorporate lessons learned from internal or external security or privacy incidents into role-based training. CM0041 CM0005 NA NA
1 Role-based Training | Environmental Controls Provide [Assignment: organization-defined personnel or roles] with initial and [Assignment: organization-defined frequency] training in the employment and operation of environmental controls. CM0005 CM0041 NA NA
2 Role-based Training | Physical Security Controls Provide [Assignment: organization-defined personnel or roles] with initial and [Assignment: organization-defined frequency] training in the employment and operation of physical security controls. CM0005 CM0041 NA NA
3 Role-based Training | Practical Exercises Provide practical exercises in security and privacy training that reinforce training objectives. CM0005 CM0041 NA NA
5 Role-based Training | Processing Personally Identifiable Information Provide [Assignment: organization-defined personnel or roles] with initial and [Assignment: organization-defined frequency] training in the employment and operation of personally identifiable information processing and transparency controls. CM0005 CM0041 NA NA
AT-4 Training Records a. Document and monitor information security and privacy training activities, including security and privacy awareness training and specific role-based security and privacy training; and b. Retain individual training records for [Assignment: organization-defined time period]. CM0005 NA NA
AT-6 Training Feedback Provide feedback on organizational training results to the following personnel [Assignment: organization-defined frequency]: [Assignment: organization-defined personnel]. NA NA
AU-1 Policy and Procedures a. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles]: 1. [Selection (one or more): organization-level; mission/business process-level; system-level] audit and accountability policy that: (a) Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and (b) Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and 2. Procedures to facilitate the implementation of the audit and accountability policy and the associated audit and accountability controls; b. Designate an [Assignment: organization-defined official] to manage the development, documentation, and dissemination of the audit and accountability policy and procedures; and c. Review and update the current audit and accountability: 1. Policy [Assignment: organization-defined frequency] and following [Assignment: organization-defined events]; and 2. Procedures [Assignment: organization-defined frequency] and following [Assignment: organization-defined events]. CM0088 NA YES
AU-2 Event Logging a. Identify the types of events that the system is capable of logging in support of the audit function: [Assignment: organization-defined event types that the system is capable of logging]; b. Coordinate the event logging function with other organizational entities requiring audit-related information to guide and inform the selection criteria for events to be logged; c. Specify the following event types for logging within the system: [Assignment: organization-defined event types (subset of the event types defined in AU-2a.) along with the frequency of (or situation requiring) logging for each identified event type]; d. Provide a rationale for why the event types selected for logging are deemed to be adequate to support after-the-fact investigations of incidents; and e. Review and update the event types selected for logging [Assignment: organization-defined frequency]. CM0005 CM0032 YES YES
AU-3 Content of Audit Records Ensure that audit records contain information that establishes the following: a. What type of event occurred; b. When the event occurred; c. Where the event occurred; d. Source of the event; e. Outcome of the event; and f. Identity of any individuals, subjects, or objects/entities associated with the event. CM0005 CM0032 YES YES
1 Content of Audit Records | Additional Audit Information Generate audit records containing the following additional information: [Assignment: organization-defined additional information]. CM0005 CM0034 CM0032 YES YES
3 Content of Audit Records | Limit Personally Identifiable Information Elements Limit personally identifiable information contained in audit records to the following elements identified in the privacy risk assessment: [Assignment: organization-defined elements]. CM0005 CM0034 CM0032 NA NA
AU-4 Audit Log Storage Capacity Allocate audit log storage capacity to accommodate [Assignment: organization-defined audit log retention requirements]. CM0005 CM0032 YES YES
1 Audit Log Storage Capacity | Transfer to Alternate Storage Transfer audit logs [Assignment: organization-defined frequency] to a different system, system component, or media other than the system or system component conducting the logging. CM0005 CM0032 YES YES
AU-5 Response to Audit Logging Process Failures a. Alert [Assignment: organization-defined personnel or roles] within [Assignment: organization-defined time period] in the event of an audit logging process failure; and b. Take the following additional actions: [Assignment: organization-defined additional actions]. CM0005 CM0032 YES YES
1 Response to Audit Logging Process Failures | Storage Capacity Warning Provide a warning to [Assignment: organization-defined personnel, roles, and/or locations] within [Assignment: organization-defined time period] when allocated audit log storage volume reaches [Assignment: organization-defined percentage] of repository maximum audit log storage capacity. CM0005 CM0032 NA YES
2 Response to Audit Logging Process Failures | Real-time Alerts Provide an alert within [Assignment: organization-defined real-time period] to [Assignment: organization-defined personnel, roles, and/or locations] when the following audit failure events occur: [Assignment: organization-defined audit logging failure events requiring real-time alerts]. CM0005 CM0032 YES YES
3 Response to Audit Logging Process Failures | Configurable Traffic Volume Thresholds Enforce configurable network communications traffic volume thresholds reflecting limits on audit log storage capacity and [Selection: reject; delay] network traffic above those thresholds. CM0005 CM0032 NA NA
4 Response to Audit Logging Process Failures | Shutdown on Failure Invoke a [Selection: full system shutdown; partial system shutdown; degraded operational mode with limited mission or business functionality available] in the event of [Assignment: organization-defined audit logging failures], unless an alternate audit logging capability exists. CM0005 CM0032 NA NA
5 Response to Audit Logging Process Failures | Alternate Audit Logging Capability Provide an alternate audit logging capability in the event of a failure in primary audit logging capability that implements [Assignment: organization-defined alternate audit logging functionality]. CM0005 CM0032 YES YES
AU-6 Audit Record Review, Analysis, and Reporting a. Review and analyze system audit records [Assignment: organization-defined frequency] for indications of [Assignment: organization-defined inappropriate or unusual activity] and the potential impact of the inappropriate or unusual activity; b. Report findings to [Assignment: organization-defined personnel or roles]; and c. Adjust the level of audit record review, analysis, and reporting within the system when there is a change in risk based on law enforcement information, intelligence information, or other credible sources of information. CM0052 CM0005 YES YES
1 Audit Record Review, Analysis, and Reporting | Automated Process Integration Integrate audit record review, analysis, and reporting processes using [Assignment: organization-defined automated mechanisms]. CM0005 CM0032 YES YES
3 Audit Record Review, Analysis, and Reporting | Correlate Audit Record Repositories Analyze and correlate audit records across different repositories to gain organization-wide situational awareness. CM0005 CM0032 NA NA
4 Audit Record Review, Analysis, and Reporting | Central Review and Analysis Provide and implement the capability to centrally review and analyze audit records from multiple components within the system. CM0005 CM0032 YES YES
5 Audit Record Review, Analysis, and Reporting | Integrated Analysis of Audit Records Integrate analysis of audit records with analysis of [Selection (one or more): vulnerability scanning information; performance data; system monitoring information; [Assignment: organization-defined data/information collected from other sources] ] to further enhance the ability to identify inappropriate or unusual activity. CM0005 CM0032 NA NA
6 Audit Record Review, Analysis, and Reporting | Correlation with Physical Monitoring Correlate information from audit records with information obtained from monitoring physical access to further enhance the ability to identify suspicious, inappropriate, unusual, or malevolent activity. CM0005 CM0032 NA NA
7 Audit Record Review, Analysis, and Reporting | Permitted Actions Specify the permitted actions for each [Selection (one or more): system process; role; user] associated with the review, analysis, and reporting of audit record information. CM0005 CM0032 NA NA
8 Audit Record Review, Analysis, and Reporting | Full Text Analysis of Privileged Commands Perform a full text analysis of logged privileged commands in a physically distinct component or subsystem of the system, or other system that is dedicated to that analysis. CM0005 CM0032 NA NA
9 Audit Record Review, Analysis, and Reporting | Correlation with Information from Nontechnical Sources Correlate information from nontechnical sources with audit record information to enhance organization-wide situational awareness. CM0005 CM0032 NA NA
AU-7 Audit Record Reduction and Report Generation Provide and implement an audit record reduction and report generation capability that: a. Supports on-demand audit record review, analysis, and reporting requirements and after-the-fact investigations of incidents; and b. Does not alter the original content or time ordering of audit records. CM0052 CM0005 NA NA
1 Audit Record Reduction and Report Generation | Automatic Processing Provide and implement the capability to process, sort, and search audit records for events of interest based on the following content: [Assignment: organization-defined fields within audit records]. CM0005 NA NA
AU-8 Time Stamps a. Use internal system clocks to generate time stamps for audit records; and b. Record time stamps for audit records that meet [Assignment: organization-defined granularity of time measurement] and that use Coordinated Universal Time, have a fixed local time offset from Coordinated Universal Time, or that include the local time offset as part of the time stamp. CM0005 CM0032 YES YES
AU-9 Protection of Audit Information a. Protect audit information and audit logging tools from unauthorized access, modification, and deletion; and b. Alert [Assignment: organization-defined personnel or roles] upon detection of unauthorized access, modification, or deletion of audit information. CM0005 CM0032 YES YES
1 Protection of Audit Information | Hardware Write-once Media Write audit trails to hardware-enforced, write-once media. CM0005 CM0032 CM0054 NA NA
2 Protection of Audit Information | Store on Separate Physical Systems or Components Store audit records [Assignment: organization-defined frequency] in a repository that is part of a physically different system or system component than the system or component being audited. CM0005 CM0032 CM0054 YES YES
3 Protection of Audit Information | Cryptographic Protection Implement cryptographic mechanisms to protect the integrity of audit information and audit tools. CM0005 CM0032 CM0054 YES YES
4 Protection of Audit Information | Access by Subset of Privileged Users Authorize access to management of audit logging functionality to only [Assignment: organization-defined subset of privileged users or roles]. CM0005 CM0032 CM0054 NA NA
5 Protection of Audit Information | Dual Authorization Enforce dual authorization for [Selection (one or more): movement; deletion] of [Assignment: organization-defined audit information]. CM0005 CM0032 CM0054 NA YES
6 Protection of Audit Information | Read-only Access Authorize read-only access to audit information to [Assignment: organization-defined subset of privileged users or roles]. CM0005 CM0032 CM0054 NA NA
7 Protection of Audit Information | Store on Component with Different Operating System Store audit information on a component running a different operating system than the system or component being audited. CM0005 CM0032 CM0054 NA NA
AU-10 Non-repudiation Provide irrefutable evidence that an individual (or process acting on behalf of an individual) has performed [Assignment: organization-defined actions to be covered by non-repudiation]. CM0052 CM0005 NA NA
1 Non-repudiation | Association of Identities (a) Bind the identity of the information producer with the information to [Assignment: organization-defined strength of binding]; and (b) Provide the means for authorized individuals to determine the identity of the producer of the information. NA NA
2 Non-repudiation | Validate Binding of Information Producer Identity (a) Validate the binding of the information producer identity to the information at [Assignment: organization-defined frequency]; and (b) Perform [Assignment: organization-defined actions] in the event of a validation error. NA NA
3 Non-repudiation | Chain of Custody Maintain reviewer or releaser credentials within the established chain of custody for information reviewed or released. NA NA
4 Non-repudiation | Validate Binding of Information Reviewer Identity (a) Validate the binding of the information reviewer identity to the information at the transfer or release points prior to release or transfer between [Assignment: organization-defined security domains]; and (b) Perform [Assignment: organization-defined actions] in the event of a validation error. NA NA
AU-11 Audit Record Retention Retain audit records for [Assignment: organization-defined time period consistent with records retention policy] to provide support for after-the-fact investigations of incidents and to meet regulatory and organizational information retention requirements. CM0005 NA NA
1 Audit Record Retention | Long-term Retrieval Capability Employ [Assignment: organization-defined measures] to ensure that long-term audit records generated by the system can be retrieved. NA NA
AU-12 Audit Record Generation a. Provide audit record generation capability for the event types the system is capable of auditing as defined in AU-2a on [Assignment: organization-defined system components]; b. Allow [Assignment: organization-defined personnel or roles] to select the event types that are to be logged by specific components of the system; and c. Generate audit records for the event types defined in AU-2c that include the audit record content defined in AU-3. CM0052 CM0005 YES YES
1 Audit Record Generation | System-wide and Time-correlated Audit Trail Compile audit records from [Assignment: organization-defined system components] into a system-wide (logical or physical) audit trail that is time-correlated to within [Assignment: organization-defined level of tolerance for the relationship between time stamps of individual records in the audit trail]. CM0005 NA NA
2 Audit Record Generation | Standardized Formats Produce a system-wide (logical or physical) audit trail composed of audit records in a standardized format. CM0005 NA NA
3 Audit Record Generation | Changes by Authorized Individuals Provide and implement the capability for [Assignment: organization-defined individuals or roles] to change the logging to be performed on [Assignment: organization-defined system components] based on [Assignment: organization-defined selectable event criteria] within [Assignment: organization-defined time thresholds]. CM0005 NA YES
4 Audit Record Generation | Query Parameter Audits of Personally Identifiable Information Provide and implement the capability for auditing the parameters of user query events for data sets containing personally identifiable information. CM0005 NA NA
AU-13 Monitoring for Information Disclosure a. Monitor [Assignment: organization-defined open-source information and/or information sites] [Assignment: organization-defined frequency] for evidence of unauthorized disclosure of organizational information; and b. If an information disclosure is discovered: 1. Notify [Assignment: organization-defined personnel or roles]; and 2. Take the following additional actions: [Assignment: organization-defined additional actions]. CM0052 NA NA
1 Monitoring for Information Disclosure | Use of Automated Tools Monitor open-source information and information sites using [Assignment: organization-defined automated mechanisms]. NA NA
2 Monitoring for Information Disclosure | Review of Monitored Sites Review the list of open-source information sites being monitored [Assignment: organization-defined frequency]. NA NA
3 Monitoring for Information Disclosure | Unauthorized Replication of Information Employ discovery techniques, processes, and tools to determine if external entities are replicating organizational information in an unauthorized manner. NA NA
AU-14 Session Audit a. Provide and implement the capability for [Assignment: organization-defined users or roles] to [Selection (one or more): record; view; hear; log] the content of a user session under [Assignment: organization-defined circumstances]; and b. Develop, integrate, and use session auditing activities in consultation with legal counsel and in accordance with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines. CM0005 CM0032 NA NA
1 Session Audit | System Start-up Initiate session audits automatically at system start-up. CM0005 NA NA
3 Session Audit | Remote Viewing and Listening Provide and implement the capability for authorized users to remotely view and hear content related to an established user session in real time. CM0005 NA NA
AU-16 Cross-organizational Audit Logging Employ [Assignment: organization-defined methods] for coordinating [Assignment: organization-defined audit information] among external organizations when audit information is transmitted across organizational boundaries. NA NA
1 Cross-organizational Audit Logging | Identity Preservation Preserve the identity of individuals in cross-organizational audit trails. NA NA
2 Cross-organizational Audit Logging | Sharing of Audit Information Provide cross-organizational audit information to [Assignment: organization-defined organizations] based on [Assignment: organization-defined cross-organizational sharing agreements]. NA NA
3 Cross-organizational Audit Logging | Disassociability Implement [Assignment: organization-defined measures] to disassociate individuals from audit information transmitted across organizational boundaries. NA NA
CA-1 Policy and Procedures a. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles]: 1. [Selection (one or more): organization-level; mission/business process-level; system-level] assessment, authorization, and monitoring policy that: (a) Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and (b) Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and 2. Procedures to facilitate the implementation of the assessment, authorization, and monitoring policy and the associated assessment, authorization, and monitoring controls; b. Designate an [Assignment: organization-defined official] to manage the development, documentation, and dissemination of the assessment, authorization, and monitoring policy and procedures; and c. Review and update the current assessment, authorization, and monitoring: 1. Policy [Assignment: organization-defined frequency] and following [Assignment: organization-defined events]; and 2. Procedures [Assignment: organization-defined frequency] and following [Assignment: organization-defined events]. CM0088 NA YES
CA-2 Control Assessments a. Select the appropriate assessor or assessment team for the type of assessment to be conducted; b. Develop a control assessment plan that describes the scope of the assessment including: 1. Controls and control enhancements under assessment; 2. Assessment procedures to be used to determine control effectiveness; and 3. Assessment environment, assessment team, and assessment roles and responsibilities; c. Ensure the control assessment plan is reviewed and approved by the authorizing official or designated representative prior to conducting the assessment; d. Assess the controls in the system and its environment of operation [Assignment: organization-defined frequency] to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting established security and privacy requirements; e. Produce a control assessment report that document the results of the assessment; and f. Provide the results of the control assessment to [Assignment: organization-defined individuals or roles]. CM0089 NA YES
1 Control Assessments | Independent Assessors Employ independent assessors or assessment teams to conduct control assessments. CM0089 NA YES
2 Control Assessments | Specialized Assessments Include as part of control assessments, [Assignment: organization-defined frequency], [Selection: announced; unannounced], [Selection (one or more): in-depth monitoring; security instrumentation; automated security test cases; vulnerability scanning; malicious user testing; insider threat assessment; performance and load testing; data leakage or data loss assessment [Assignment: organization-defined other forms of assessment] ]. CM0089 NA YES
3 Control Assessments | Leveraging Results from External Organizations Leverage the results of control assessments performed by [Assignment: organization-defined external organization] on [Assignment: organization-defined system] when the assessment meets [Assignment: organization-defined requirements]. CM0089 NA NA
CA-3 Information Exchange a. Approve and manage the exchange of information between the system and other systems using [Selection (one or more): interconnection security agreements; information exchange security agreements; memoranda of understanding or agreement; service level agreements; user agreements; nondisclosure agreements; [Assignment: organization-defined type of agreement] ]; b. Document, as part of each exchange agreement, the interface characteristics, security and privacy requirements, controls, and responsibilities for each system, and the impact level of the information communicated; and c. Review and update the agreements [Assignment: organization-defined frequency]. CM0001 CM0020 CM0002 CM0005 CM0038 CM0029 YES YES
6 Information Exchange | Transfer Authorizations Verify that individuals or systems transferring data between interconnecting systems have the requisite authorizations (i.e., write permissions or privileges) prior to accepting such data. CM0039 CM0005 CM0053 CM0065 CM0055 CM0038 YES YES
7 Information Exchange | Transitive Information Exchanges (a) Identify transitive (downstream) information exchanges with other systems through the systems identified in CA-3a; and (b) Take measures to ensure that transitive (downstream) information exchanges cease when the controls on identified transitive (downstream) systems cannot be verified or validated. CM0039 CM0005 CM0053 CM0065 CM0055 CM0038 YES YES
CA-5 Plan of Action and Milestones a. Develop a plan of action and milestones for the system to document the planned remediation actions of the organization to correct weaknesses or deficiencies noted during the assessment of the controls and to reduce or eliminate known vulnerabilities in the system; and b. Update existing plan of action and milestones [Assignment: organization-defined frequency] based on the findings from control assessments, independent audits or reviews, and continuous monitoring activities. CM0089 NA YES
1 Plan of Action and Milestones | Automation Support for Accuracy and Currency Ensure the accuracy, currency, and availability of the plan of action and milestones for the system using [Assignment: organization-defined automated mechanisms]. NA NA
CA-6 Authorization a. Assign a senior official as the authorizing official for the system; b. Assign a senior official as the authorizing official for common controls available for inheritance by organizational systems; c. Ensure that the authorizing official for the system, before commencing operations: 1. Accepts the use of common controls inherited by the system; and 2. Authorizes the system to operate; d. Ensure that the authorizing official for common controls authorizes the use of those controls for inheritance by organizational systems; e. Update the authorizations [Assignment: organization-defined frequency]. CM0089 NA YES
1 Authorization | Joint Authorization — Intra-organization Employ a joint authorization process for the system that includes multiple authorizing officials from the same organization conducting the authorization. NA NA
2 Authorization | Joint Authorization — Inter-organization Employ a joint authorization process for the system that includes multiple authorizing officials with at least one authorizing official from an organization external to the organization conducting the authorization. NA NA
CA-7 Continuous Monitoring Develop a system-level continuous monitoring strategy and implement continuous monitoring in accordance with the organization-level continuous monitoring strategy that includes: a. Establishing the following system-level metrics to be monitored: [Assignment: organization-defined system-level metrics]; b. Establishing [Assignment: organization-defined frequencies] for monitoring and [Assignment: organization-defined frequencies] for assessment of control effectiveness; c. Ongoing control assessments in accordance with the continuous monitoring strategy; d. Ongoing monitoring of system and organization-defined metrics in accordance with the continuous monitoring strategy; e. Correlation and analysis of information generated by control assessments and monitoring; f. Response actions to address results of the analysis of control assessment and monitoring information; and g. Reporting the security and privacy status of the system to [Assignment: organization-defined personnel or roles] [Assignment: organization-defined frequency]. CM0052 CM0090 CM0005 YES YES
1 Continuous Monitoring | Independent Assessment Employ independent assessors or assessment teams to monitor the controls in the system on an ongoing basis. CM0090 CM0005 CM0034 CM0032 NA YES
3 Continuous Monitoring | Trend Analyses Employ trend analyses to determine if control implementations, the frequency of continuous monitoring activities, and the types of activities used in the continuous monitoring process need to be modified based on empirical data. CM0090 CM0005 CM0034 CM0032 NA YES
4 Continuous Monitoring | Risk Monitoring Ensure risk monitoring is an integral part of the continuous monitoring strategy that includes the following: (a) Effectiveness monitoring; (b) Compliance monitoring; and (c) Change monitoring. CM0090 CM0005 CM0034 CM0032 NA YES
5 Continuous Monitoring | Consistency Analysis Employ the following actions to validate that policies are established and implemented controls are operating in a consistent manner: [Assignment: organization-defined actions]. CM0090 CM0005 CM0034 CM0032 NA YES
6 Continuous Monitoring | Automation Support for Monitoring Ensure the accuracy, currency, and availability of monitoring results for the system using [Assignment: organization-defined automated mechanisms]. CM0090 CM0005 CM0034 CM0032 YES YES
CA-8 Penetration Testing Conduct penetration testing [Assignment: organization-defined frequency] on [Assignment: organization-defined systems or system components]. CM0008 CM0004 CM0018 CM0005 CM0053 YES YES
1 Penetration Testing | Independent Penetration Testing Agent or Team Employ an independent penetration testing agent or team to perform penetration testing on the system or system components. CM0008 CM0028 CM0004 CM0018 CM0005 CM0053 NA YES
2 Penetration Testing | Red Team Exercises Employ the following red-team exercises to simulate attempts by adversaries to compromise organizational systems in accordance with applicable rules of engagement: [Assignment: organization-defined red team exercises]. CM0008 CM0028 CM0004 CM0018 CM0005 CM0053 NA NA
3 Penetration Testing | Facility Penetration Testing Employ a penetration testing process that includes [Assignment: organization-defined frequency] [Selection: announced; unannounced] attempts to bypass or circumvent controls associated with physical access points to the facility. CM0008 CM0028 CM0004 CM0018 CM0005 CM0053 NA NA
CA-9 Internal System Connections a. Authorize internal connections of [Assignment: organization-defined system components or classes of components] to the system; b. Document, for each internal connection, the interface characteristics, security and privacy requirements, and the nature of the information communicated; c. Terminate internal system connections after [Assignment: organization-defined conditions]; and d. Review [Assignment: organization-defined frequency] the continued need for each internal connection. CM0005 NA YES
1 Internal System Connections | Compliance Checks Perform security and privacy compliance checks on constituent system components prior to the establishment of the internal connection. NA NA
CM-1 Policy and Procedures a. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles]: 1. [Selection (one or more): organization-level; mission/business process-level; system-level] configuration management policy that: (a) Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and (b) Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and 2. Procedures to facilitate the implementation of the configuration management policy and the associated configuration management controls; b. Designate an [Assignment: organization-defined official] to manage the development, documentation, and dissemination of the configuration management policy and procedures; and c. Review and update the current configuration management: 1. Policy [Assignment: organization-defined frequency] and following [Assignment: organization-defined events]; and 2. Procedures [Assignment: organization-defined frequency] and following [Assignment: organization-defined events]. CM0088 NA YES
CM-2 Baseline Configuration a. Develop, document, and maintain under configuration control, a current baseline configuration of the system; and b. Review and update the baseline configuration of the system: 1. [Assignment: organization-defined frequency]; 2. When required due to [Assignment: Assignment organization-defined circumstances]; and 3. When system components are installed or upgraded. CM0007 CM0012 CM0013 CM0015 CM0023 CM0005 YES YES
2 Baseline Configuration | Automation Support for Accuracy and Currency Maintain the currency, completeness, accuracy, and availability of the baseline configuration of the system using [Assignment: organization-defined automated mechanisms]. CM0004 CM0005 NA YES
3 Baseline Configuration | Retention of Previous Configurations Retain [Assignment: organization-defined number] of previous versions of baseline configurations of the system to support rollback. CM0004 CM0005 NA NA
6 Baseline Configuration | Development and Test Environments Maintain a baseline configuration for system development and test environments that is managed separately from the operational baseline configuration. CM0004 CM0005 NA NA
7 Baseline Configuration | Configure Systems and Components for High-risk Areas (a) Issue [Assignment: organization-defined systems or system components] with [Assignment: organization-defined configurations] to individuals traveling to locations that the organization deems to be of significant risk; and (b) Apply the following controls to the systems or components when the individuals return from travel: [Assignment: organization-defined controls]. CM0004 CM0005 NA NA
CM-3 Configuration Change Control a. Determine and document the types of changes to the system that are configuration-controlled; b. Review proposed configuration-controlled changes to the system and approve or disapprove such changes with explicit consideration for security and privacy impact analyses; c. Document configuration change decisions associated with the system; d. Implement approved configuration-controlled changes to the system; e. Retain records of configuration-controlled changes to the system for [Assignment: organization-defined time period]; f. Monitor and review activities associated with configuration-controlled changes to the system; and g. Coordinate and provide oversight for configuration change control activities through [Assignment: organization-defined configuration change control element] that convenes [Selection (one or more): [Assignment: organization-defined frequency] ; when [Assignment: organization-defined configuration change conditions] ]. CM0005 CM0072 NA YES
1 Configuration Change Control | Automated Documentation, Notification, and Prohibition of Changes Use [Assignment: organization-defined automated mechanisms] to: (a) Document proposed changes to the system; (b) Notify [Assignment: organization-defined approval authorities] of proposed changes to the system and request change approval; (c) Highlight proposed changes to the system that have not been approved or disapproved within [Assignment: organization-defined time period]; (d) Prohibit changes to the system until designated approvals are received; (e) Document all changes to the system; and (f) Notify [Assignment: organization-defined personnel] when approved changes to the system are completed. CM0005 CM0004 CM0010 CM0023 CM0030 CM0035 NA YES
2 Configuration Change Control | Testing, Validation, and Documentation of Changes Test, validate, and document changes to the system before finalizing the implementation of the changes. CM0005 CM0004 CM0010 CM0023 CM0030 CM0035 YES YES
3 Configuration Change Control | Automated Change Implementation Implement changes to the current system baseline and deploy the updated baseline across the installed base using [Assignment: organization-defined automated mechanisms]. CM0005 CM0004 CM0010 CM0023 CM0030 CM0035 NA NA
4 Configuration Change Control | Security and Privacy Representatives Require [Assignment: organization-defined security and privacy representatives] to be members of the [Assignment: organization-defined configuration change control element]. CM0005 CM0004 CM0010 CM0023 CM0030 CM0035 NA YES
5 Configuration Change Control | Automated Security Response Implement the following security responses automatically if baseline configurations are changed in an unauthorized manner: [Assignment: organization-defined security responses]. CM0005 CM0004 CM0010 CM0023 CM0030 CM0035 NA YES
6 Configuration Change Control | Cryptography Management Ensure that cryptographic mechanisms used to provide the following controls are under configuration management: [Assignment: organization-defined controls]. CM0005 CM0004 CM0010 CM0023 CM0030 CM0035 NA YES
7 Configuration Change Control | Review System Changes Review changes to the system [Assignment: organization-defined frequency] or when [Assignment: organization-defined circumstances] to determine whether unauthorized changes have occurred. CM0005 CM0004 CM0010 CM0023 CM0030 CM0035 YES YES
8 Configuration Change Control | Prevent or Restrict Configuration Changes Prevent or restrict changes to the configuration of the system under the following circumstances: [Assignment: organization-defined circumstances]. CM0005 CM0004 CM0010 CM0023 CM0030 CM0035 YES YES
CM-4 Impact Analyses Analyze changes to the system to determine potential security and privacy impacts prior to change implementation. CM0008 CM0020 CM0022 CM0010 CM0015 CM0023 CM0005 YES YES
1 Impact Analyses | Separate Test Environments Analyze changes to the system in a separate test environment before implementation in an operational environment, looking for security and privacy impacts due to flaws, weaknesses, incompatibility, or intentional malice. CM0004 CM0010 CM0018 CM0019 YES YES
2 Impact Analyses | Verification of Controls After system changes, verify that the impacted controls are implemented correctly, operating as intended, and producing the desired outcome with regard to meeting the security and privacy requirements for the system. CM0004 CM0010 CM0018 CM0019 NA YES
CM-5 Access Restrictions for Change Define, document, approve, and enforce physical and logical access restrictions associated with changes to the system. CM0023 YES YES
1 Access Restrictions for Change | Automated Access Enforcement and Audit Records (a) Enforce access restrictions using [Assignment: organization-defined automated mechanisms]; and (b) Automatically generate audit records of the enforcement actions. CM0005 CM0004 CM0010 CM0012 CM0013 CM0015 CM0021 CM0023 NA YES
4 Access Restrictions for Change | Dual Authorization Enforce dual authorization for implementing changes to [Assignment: organization-defined system components and system-level information]. CM0005 CM0004 CM0010 CM0012 CM0013 CM0015 CM0021 CM0023 NA NA
5 Access Restrictions for Change | Privilege Limitation for Production and Operation (a) Limit privileges to change system components and system-related information within a production or operational environment; and (b) Review and reevaluate privileges [Assignment: organization-defined frequency]. CM0005 CM0004 CM0010 CM0012 CM0013 CM0015 CM0021 CM0023 NA YES
6 Access Restrictions for Change | Limit Library Privileges Limit privileges to change software resident within software libraries. CM0005 CM0004 CM0010 CM0012 CM0013 CM0015 CM0021 CM0023 NA YES
CM-6 Configuration Settings a. Establish and document configuration settings for components employed within the system that reflect the most restrictive mode consistent with operational requirements using [Assignment: organization-defined common secure configurations]; b. Implement the configuration settings; c. Identify, document, and approve any deviations from established configuration settings for [Assignment: organization-defined system components] based on [Assignment: organization-defined operational requirements]; and d. Monitor and control changes to the configuration settings in accordance with organizational policies and procedures. CM0005 NA YES
1 Configuration Settings | Automated Management, Application, and Verification Manage, apply, and verify configuration settings for [Assignment: organization-defined system components] using [Assignment: organization-defined automated mechanisms]. CM0005 NA NA
2 Configuration Settings | Respond to Unauthorized Changes Take the following actions in response to unauthorized changes to [Assignment: organization-defined configuration settings]: [Assignment: organization-defined actions]. CM0005 NA NA
CM-7 Least Functionality a. Configure the system to provide only [Assignment: organization-defined mission essential capabilities]; and b. Prohibit or restrict the use of the following functions, ports, protocols, software, and/or services: [Assignment: organization-defined prohibited or restricted functions, system ports, protocols, software, and/or services]. CM0039 CM0047 CM0005 YES YES
1 Least Functionality | Periodic Review (a) Review the system [Assignment: organization-defined frequency] to identify unnecessary and/or nonsecure functions, ports, protocols, software, and services; and (b) Disable or remove [Assignment: organization-defined functions, ports, protocols, software, and services within the system deemed to be unnecessary and/or nonsecure]. CM0005 CM0012 CM0010 CM0039 CM0047 CM0069 CM0004 CM0015 CM0024 CM0028 NA YES
2 Least Functionality | Prevent Program Execution Prevent program execution in accordance with [Selection (one or more): [Assignment: organization-defined policies, rules of behavior, and/or access agreements regarding software program usage and restrictions] ; rules authorizing the terms and conditions of software program usage]. CM0005 CM0012 CM0010 CM0039 CM0047 CM0069 CM0004 CM0015 CM0024 CM0028 NA YES
3 Least Functionality | Registration Compliance Ensure compliance with [Assignment: organization-defined registration requirements for functions, ports, protocols, and services]. CM0005 CM0012 CM0010 CM0039 CM0047 CM0069 CM0004 CM0015 CM0024 CM0028 NA NA
4 Least Functionality | Unauthorized Software (a) Identify [Assignment: organization-defined software programs not authorized to execute on the system]; (b) Employ an allow-all, deny-by-exception policy to prohibit the execution of unauthorized software programs on the system; and (c) Review and update the list of unauthorized software programs [Assignment: organization-defined frequency]. CM0005 CM0012 CM0010 CM0039 CM0047 CM0069 CM0004 CM0015 CM0024 CM0028 NA NA
5 Least Functionality | Authorized Software (a) Identify [Assignment: organization-defined software programs authorized to execute on the system]; (b) Employ a deny-all, permit-by-exception policy to allow the execution of authorized software programs on the system; and (c) Review and update the list of authorized software programs [Assignment: organization-defined frequency]. CM0005 CM0012 CM0010 CM0039 CM0047 CM0069 CM0004 CM0015 CM0024 CM0028 YES YES
6 Least Functionality | Confined Environments with Limited Privileges Require that the following user-installed software execute in a confined physical or virtual machine environment with limited privileges: [Assignment: organization-defined user-installed software]. CM0005 CM0012 CM0010 CM0039 CM0047 CM0069 CM0004 CM0015 CM0024 CM0028 NA NA
7 Least Functionality | Code Execution in Protected Environments Allow execution of binary or machine-executable code only in confined physical or virtual machine environments and with the explicit approval of [Assignment: organization-defined personnel or roles] when such code is: (a) Obtained from sources with limited or no warranty; and/or (b) Without the provision of source code. CM0005 CM0012 CM0010 CM0039 CM0047 CM0069 CM0004 CM0015 CM0024 CM0028 NA NA
8 Least Functionality | Binary or Machine Executable Code (a) Prohibit the use of binary or machine-executable code from sources with limited or no warranty or without the provision of source code; and (b) Allow exceptions only for compelling mission or operational requirements and with the approval of the authorizing official. CM0005 CM0012 CM0010 CM0039 CM0047 CM0069 CM0004 CM0015 CM0024 CM0028 YES YES
9 Least Functionality | Prohibiting The Use of Unauthorized Hardware (a) Identify [Assignment: organization-defined hardware components authorized for system use]; (b) Prohibit the use or connection of unauthorized hardware components; (c) Review and update the list of authorized hardware components [Assignment: organization-defined frequency]. CM0005 CM0012 CM0010 CM0039 CM0047 CM0069 CM0004 CM0015 CM0024 CM0028 YES YES
CM-8 System Component Inventory a. Develop and document an inventory of system components that: 1. Accurately reflects the system; 2. Includes all components within the system; 3. Does not include duplicate accounting of components or components assigned to any other system; 4. Is at the level of granularity deemed necessary for tracking and reporting; and 5. Includes the following information to achieve system component accountability: [Assignment: organization-defined information deemed necessary to achieve effective system component accountability]; and b. Review and update the system component inventory [Assignment: organization-defined frequency]. CM0012 CM0005 YES YES
1 System Component Inventory | Updates During Installation and Removal Update the inventory of system components as part of component installations, removals, and system updates. CM0005 CM0012 NA YES
2 System Component Inventory | Automated Maintenance Maintain the currency, completeness, accuracy, and availability of the inventory of system components using [Assignment: organization-defined automated mechanisms]. CM0005 CM0012 NA YES
3 System Component Inventory | Automated Unauthorized Component Detection (a) Detect the presence of unauthorized hardware, software, and firmware components within the system using [Assignment: organization-defined automated mechanisms] [Assignment: organization-defined frequency]; and (b) Take the following actions when unauthorized components are detected: [Selection (one or more): disable network access by such components; isolate the components; notify [Assignment: organization-defined personnel or roles] ]. CM0005 CM0012 NA YES
4 System Component Inventory | Accountability Information Include in the system component inventory information, a means for identifying by [Selection (one or more): name; position; role], individuals responsible and accountable for administering those components. CM0005 CM0012 NA YES
6 System Component Inventory | Assessed Configurations and Approved Deviations Include assessed component configurations and any approved deviations to current deployed configurations in the system component inventory. CM0005 CM0012 NA NA
7 System Component Inventory | Centralized Repository Provide a centralized repository for the inventory of system components. CM0005 CM0012 NA NA
8 System Component Inventory | Automated Location Tracking Support the tracking of system components by geographic location using [Assignment: organization-defined automated mechanisms]. CM0005 CM0012 NA NA
9 System Component Inventory | Assignment of Components to Systems (a) Assign system components to a system; and (b) Receive an acknowledgement from [Assignment: organization-defined personnel or roles] of this assignment. CM0005 CM0012 NA NA
CM-9 Configuration Management Plan Develop, document, and implement a configuration management plan for the system that: a. Addresses roles, responsibilities, and configuration management processes and procedures; b. Establishes a process for identifying configuration items throughout the system development life cycle and for managing the configuration of the configuration items; c. Defines the configuration items for the system and places the configuration items under configuration management; d. Is reviewed and approved by [Assignment: organization-defined personnel or roles]; and e. Protects the configuration management plan from unauthorized disclosure and modification. CM0005 NA YES
1 Configuration Management Plan | Assignment of Responsibility Assign responsibility for developing the configuration management process to organizational personnel that are not directly involved in system development. NA NA
CM-10 Software Usage Restrictions a. Use software and associated documentation in accordance with contract agreements and copyright laws; b. Track the use of software and associated documentation protected by quantity licenses to control copying and distribution; and c. Control and document the use of peer-to-peer file sharing technology to ensure that this capability is not used for the unauthorized distribution, display, performance, or reproduction of copyrighted work. CM0012 YES YES
1 Software Usage Restrictions | Open-source Software Establish the following restrictions on the use of open-source software: [Assignment: organization-defined restrictions]. CM0011 CM0012 CM0013 CM0005 YES YES
CM-11 User-installed Software a. Establish [Assignment: organization-defined policies] governing the installation of software by users; b. Enforce software installation policies through the following methods: [Assignment: organization-defined methods]; and c. Monitor policy compliance [Assignment: organization-defined frequency]. CM0004 CM0012 CM0013 CM0015 CM0021 CM0069 CM0005 NA NA
2 User-installed Software | Software Installation with Privileged Status Allow user installation of software only with explicit privileged status. CM0005 CM0012 CM0021 CM0023 CM0047 CM0032 NA NA
3 User-installed Software | Automated Enforcement and Monitoring Enforce and monitor compliance with software installation policies using [Assignment: organization-defined automated mechanisms]. CM0005 CM0012 CM0021 CM0023 CM0047 CM0032 NA NA
CM-12 Information Location a. Identify and document the location of [Assignment: organization-defined information] and the specific system components on which the information is processed and stored; b. Identify and document the users who have access to the system and system components where the information is processed and stored; and c. Document changes to the location (i.e., system or system components) where the information is processed and stored. CM0001 CM0005 NA YES
1 Information Location | Automated Tools to Support Information Location Use automated tools to identify [Assignment: organization-defined information by information type] on [Assignment: organization-defined system components] to ensure controls are in place to protect organizational information and individual privacy. CM0001 CM0005 NA YES
CM-13 Data Action Mapping Develop and document a map of system data actions. NA NA
CM-14 Signed Components Prevent the installation of [Assignment: organization-defined software and firmware components] without verification that the component has been digitally signed using a certificate that is recognized and approved by the organization. CM0004 CM0015 CM0021 CM0005 YES YES
CP-1 Policy and Procedures a. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles]: 1. [Selection (one or more): organization-level; mission/business process-level; system-level] contingency planning policy that: (a) Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and (b) Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and 2. Procedures to facilitate the implementation of the contingency planning policy and the associated contingency planning controls; b. Designate an [Assignment: organization-defined official] to manage the development, documentation, and dissemination of the contingency planning policy and procedures; and c. Review and update the current contingency planning: 1. Policy [Assignment: organization-defined frequency] and following [Assignment: organization-defined events]; and 2. Procedures [Assignment: organization-defined frequency] and following [Assignment: organization-defined events]. CM0088 NA YES
CP-2 Contingency Plan a. Develop a contingency plan for the system that: 1. Identifies essential mission and business functions and associated contingency requirements; 2. Provides recovery objectives, restoration priorities, and metrics; 3. Addresses contingency roles, responsibilities, assigned individuals with contact information; 4. Addresses maintaining essential mission and business functions despite a system disruption, compromise, or failure; 5. Addresses eventual, full system restoration without deterioration of the controls originally planned and implemented; 6. Addresses the sharing of contingency information; and 7. Is reviewed and approved by [Assignment: organization-defined personnel or roles]; b. Distribute copies of the contingency plan to [Assignment: organization-defined key contingency personnel (identified by name and/or by role) and organizational elements]; c. Coordinate contingency planning activities with incident handling activities; d. Review the contingency plan for the system [Assignment: organization-defined frequency]; e. Update the contingency plan to address changes to the organization, system, or environment of operation and problems encountered during contingency plan implementation, execution, or testing; f. Communicate contingency plan changes to [Assignment: organization-defined key contingency personnel (identified by name and/or by role) and organizational elements]; g. Incorporate lessons learned from contingency plan testing, training, or actual contingency activities into contingency testing and training; and h. Protect the contingency plan from unauthorized disclosure and modification. CM0020 CM0022 CM0041 CM0052 CM0054 CM0074 CM0075 CM0076 CM0079 CM0081 CM0087 CM0005 CM0070 CM0006 CM0042 CM0044 CM0043 CM0045 CM0048 YES YES
1 Contingency Plan | Coordinate with Related Plans Coordinate contingency plan development with organizational elements responsible for related plans. CM0079 CM0081 CM0087 CM0074 CM0075 CM0076 CM0005 CM0077 CM0044 CM0022 CM0004 YES YES
2 Contingency Plan | Capacity Planning Conduct capacity planning so that necessary capacity for information processing, telecommunications, and environmental support exists during contingency operations. CM0079 CM0081 CM0087 CM0074 CM0075 CM0076 CM0005 CM0077 CM0044 CM0022 CM0004 NA YES
3 Contingency Plan | Resume Mission and Business Functions Plan for the resumption of [Selection: all; essential] mission and business functions within [Assignment: organization-defined time period] of contingency plan activation. CM0079 CM0081 CM0087 CM0074 CM0075 CM0076 CM0005 CM0077 CM0044 CM0022 CM0004 YES YES
5 Contingency Plan | Continue Mission and Business Functions Plan for the continuance of [Selection: all; essential] mission and business functions with minimal or no loss of operational continuity and sustains that continuity until full system restoration at primary processing and/or storage sites. CM0079 CM0081 CM0087 CM0074 CM0075 CM0076 CM0005 CM0077 CM0044 CM0022 CM0004 YES YES
6 Contingency Plan | Alternate Processing and Storage Sites Plan for the transfer of [Selection: all; essential] mission and business functions to alternate processing and/or storage sites with minimal or no loss of operational continuity and sustain that continuity through system restoration to primary processing and/or storage sites. CM0079 CM0081 CM0087 CM0074 CM0075 CM0076 CM0005 CM0077 CM0044 CM0022 CM0004 NA YES
7 Contingency Plan | Coordinate with External Service Providers Coordinate the contingency plan with the contingency plans of external service providers to ensure that contingency requirements can be satisfied. CM0079 CM0081 CM0087 CM0074 CM0075 CM0076 CM0005 CM0077 CM0044 CM0022 CM0004 YES YES
8 Contingency Plan | Identify Critical Assets Identify critical system assets supporting [Selection: all; essential] mission and business functions. CM0079 CM0081 CM0087 CM0074 CM0075 CM0076 CM0005 CM0077 CM0044 CM0022 CM0004 YES YES
CP-3 Contingency Training a. Provide contingency training to system users consistent with assigned roles and responsibilities: 1. Within [Assignment: organization-defined time period] of assuming a contingency role or responsibility; 2. When required by system changes; and 3. [Assignment: organization-defined frequency] thereafter; and b. Review and update contingency training content [Assignment: organization-defined frequency] and following [Assignment: organization-defined events]. NA NA
1 Contingency Training | Simulated Events Incorporate simulated events into contingency training to facilitate effective response by personnel in crisis situations. CM0005 NA NA
2 Contingency Training | Mechanisms Used in Training Environments Employ mechanisms used in operations to provide a more thorough and realistic contingency training environment. CM0005 NA NA
CP-4 Contingency Plan Testing a. Test the contingency plan for the system [Assignment: organization-defined frequency] using the following tests to determine the effectiveness of the plan and the readiness to execute the plan: [Assignment: organization-defined tests]. b. Review the contingency plan test results; and c. Initiate corrective actions, if needed. CM0008 NA YES
1 Contingency Plan Testing | Coordinate with Related Plans Coordinate contingency plan testing with organizational elements responsible for related plans. CM0041 CM0005 CM0070 CM0018 CM0042 CM0051 NA YES
2 Contingency Plan Testing | Alternate Processing Site Test the contingency plan at the alternate processing site: (a) To familiarize contingency personnel with the facility and available resources; and (b) To evaluate the capabilities of the alternate processing site to support contingency operations. CM0041 CM0005 CM0070 CM0018 CM0042 CM0051 NA YES
3 Contingency Plan Testing | Automated Testing Test the contingency plan using [Assignment: organization-defined automated mechanisms]. CM0041 CM0005 CM0070 CM0018 CM0042 CM0051 NA NA
4 Contingency Plan Testing | Full Recovery and Reconstitution Include a full recovery and reconstitution of the system to a known state as part of contingency plan testing. CM0041 CM0005 CM0070 CM0018 CM0042 CM0051 NA YES
5 Contingency Plan Testing | Self-challenge Employ [Assignment: organization-defined mechanisms] to [Assignment: organization-defined system or system component] to disrupt and adversely affect the system or system component. CM0041 CM0005 CM0070 CM0018 CM0042 CM0051 YES YES
CP-6 Alternate Storage Site a. Establish an alternate storage site, including necessary agreements to permit the storage and retrieval of system backup information; and b. Ensure that the alternate storage site provides controls equivalent to that of the primary site. NA NA
1 Alternate Storage Site | Separation from Primary Site Identify an alternate storage site that is sufficiently separated from the primary storage site to reduce susceptibility to the same threats. NA NA
2 Alternate Storage Site | Recovery Time and Recovery Point Objectives Configure the alternate storage site to facilitate recovery operations in accordance with recovery time and recovery point objectives. NA NA
3 Alternate Storage Site | Accessibility Identify potential accessibility problems to the alternate storage site in the event of an area-wide disruption or disaster and outline explicit mitigation actions. NA NA
CP-7 Alternate Processing Site a. Establish an alternate processing site, including necessary agreements to permit the transfer and resumption of [Assignment: organization-defined system operations] for essential mission and business functions within [Assignment: organization-defined time period consistent with recovery time and recovery point objectives] when the primary processing capabilities are unavailable; b. Make available at the alternate processing site, the equipment and supplies required to transfer and resume operations or put contracts in place to support delivery to the site within the organization-defined time period for transfer and resumption; and c. Provide controls at the alternate processing site that are equivalent to those at the primary site. NA NA
1 Alternate Processing Site | Separation from Primary Site Identify an alternate processing site that is sufficiently separated from the primary processing site to reduce susceptibility to the same threats. NA NA
2 Alternate Processing Site | Accessibility Identify potential accessibility problems to alternate processing sites in the event of an area-wide disruption or disaster and outlines explicit mitigation actions. NA NA
3 Alternate Processing Site | Priority of Service Develop alternate processing site agreements that contain priority-of-service provisions in accordance with availability requirements (including recovery time objectives). NA NA
4 Alternate Processing Site | Preparation for Use Prepare the alternate processing site so that the site can serve as the operational site supporting essential mission and business functions. NA NA
6 Alternate Processing Site | Inability to Return to Primary Site Plan and prepare for circumstances that preclude returning to the primary processing site. NA NA
CP-8 Telecommunications Services Establish alternate telecommunications services, including necessary agreements to permit the resumption of [Assignment: organization-defined system operations] for essential mission and business functions within [Assignment: organization-defined time period] when the primary telecommunications capabilities are unavailable at either the primary or alternate processing or storage sites. CM0005 CM0029 NA NA
1 Telecommunications Services | Priority of Service Provisions (a) Develop primary and alternate telecommunications service agreements that contain priority-of-service provisions in accordance with availability requirements (including recovery time objectives); and (b) Request Telecommunications Service Priority for all telecommunications services used for national security emergency preparedness if the primary and/or alternate telecommunications services are provided by a common carrier. CM0005 CM0070 NA NA
2 Telecommunications Services | Single Points of Failure Obtain alternate telecommunications services to reduce the likelihood of sharing a single point of failure with primary telecommunications services. CM0005 CM0070 NA NA
3 Telecommunications Services | Separation of Primary and Alternate Providers Obtain alternate telecommunications services from providers that are separated from primary service providers to reduce susceptibility to the same threats. CM0005 CM0070 NA NA
4 Telecommunications Services | Provider Contingency Plan (a) Require primary and alternate telecommunications service providers to have contingency plans; (b) Review provider contingency plans to ensure that the plans meet organizational contingency requirements; and (c) Obtain evidence of contingency testing and training by providers [Assignment: organization-defined frequency]. CM0005 CM0070 NA NA
5 Telecommunications Services | Alternate Telecommunication Service Testing Test alternate telecommunication services [Assignment: organization-defined frequency]. CM0005 CM0070 NA NA
CP-9 System Backup a. Conduct backups of user-level information contained in [Assignment: organization-defined system components] [Assignment: organization-defined frequency consistent with recovery time and recovery point objectives]; b. Conduct backups of system-level information contained in the system [Assignment: organization-defined frequency consistent with recovery time and recovery point objectives]; c. Conduct backups of system documentation, including security- and privacy-related documentation [Assignment: organization-defined frequency consistent with recovery time and recovery point objectives]; and d. Protect the confidentiality, integrity, and availability of backup information. CM0005 CM0056 NA NA
1 System Backup | Testing for Reliability and Integrity Test backup information [Assignment: organization-defined frequency] to verify media reliability and information integrity. CM0005 NA NA
2 System Backup | Test Restoration Using Sampling Use a sample of backup information in the restoration of selected system functions as part of contingency plan testing. CM0005 NA NA
3 System Backup | Separate Storage for Critical Information Store backup copies of [Assignment: organization-defined critical system software and other security-related information] in a separate facility or in a fire rated container that is not collocated with the operational system. CM0005 NA NA
5 System Backup | Transfer to Alternate Storage Site Transfer system backup information to the alternate storage site [Assignment: organization-defined time period and transfer rate consistent with the recovery time and recovery point objectives]. CM0005 NA NA
6 System Backup | Redundant Secondary System Conduct system backup by maintaining a redundant secondary system that is not collocated with the primary system and that can be activated without loss of information or disruption to operations. CM0005 NA NA
7 System Backup | Dual Authorization Enforce dual authorization for the deletion or destruction of [Assignment: organization-defined backup information]. CM0005 NA NA
8 System Backup | Cryptographic Protection Implement cryptographic mechanisms to prevent unauthorized disclosure and modification of [Assignment: organization-defined backup information]. CM0005 NA NA
CP-10 System Recovery and Reconstitution Provide for the recovery and reconstitution of the system to a known state within [Assignment: organization-defined time period consistent with recovery time and recovery point objectives] after a disruption, compromise, or failure. CM0005 CM0032 CM0044 YES YES
2 System Recovery and Reconstitution | Transaction Recovery Implement transaction recovery for systems that are transaction-based. CM0005 CM0032 CM0044 CM0074 CM0075 CM0079 CM0080 CM0081 CM0087 NA NA
4 System Recovery and Reconstitution | Restore Within Time Period Provide the capability to restore system components within [Assignment: organization-defined restoration time periods] from configuration-controlled and integrity-protected information representing a known, operational state for the components. CM0005 CM0032 CM0044 CM0074 CM0075 CM0079 CM0080 CM0081 CM0087 YES YES
6 System Recovery and Reconstitution | Component Protection Protect system components used for recovery and reconstitution. CM0005 CM0032 CM0044 CM0074 CM0075 CM0079 CM0080 CM0081 CM0087 YES YES
CP-11 Alternate Communications Protocols Provide the capability to employ [Assignment: organization-defined alternative communications protocols] in support of maintaining continuity of operations. CM0074 CM0075 CM0076 CM0072 NA NA
CP-12 Safe Mode When [Assignment: organization-defined conditions] are detected, enter a safe mode of operation with [Assignment: organization-defined restrictions of safe mode of operation]. CM0006 CM0044 YES YES
CP-13 Alternative Security Mechanisms Employ [Assignment: organization-defined alternative or supplemental security mechanisms] for satisfying [Assignment: organization-defined security functions] when the primary means of implementing the security function is unavailable or compromised. CM0074 CM0075 CM0076 CM0077 CM0079 CM0080 CM0081 CM0084 CM0085 CM0086 CM0087 YES YES
IA-1 Policy and Procedures a. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles]: 1. [Selection (one or more): organization-level; mission/business process-level; system-level] identification and authentication policy that: (a) Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and (b) Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and 2. Procedures to facilitate the implementation of the identification and authentication policy and the associated identification and authentication controls; b. Designate an [Assignment: organization-defined official] to manage the development, documentation, and dissemination of the identification and authentication policy and procedures; and c. Review and update the current identification and authentication: 1. Policy [Assignment: organization-defined frequency] and following [Assignment: organization-defined events]; and 2. Procedures [Assignment: organization-defined frequency] and following [Assignment: organization-defined events]. CM0088 NA YES
IA-2 Identification and Authentication (organizational Users) Uniquely identify and authenticate organizational users and associate that unique identification with processes acting on behalf of those users. CM0031 CM0021 CM0005 NA NA
1 Identification and Authentication (organizational Users) | Multi-factor Authentication to Privileged Accounts Implement multi-factor authentication for access to privileged accounts. CM0005 CM0065 CM0033 NA NA
2 Identification and Authentication (organizational Users) | Multi-factor Authentication to Non-privileged Accounts Implement multi-factor authentication for access to non-privileged accounts. CM0005 CM0065 CM0033 NA NA
5 Identification and Authentication (organizational Users) | Individual Authentication with Group Authentication When shared accounts or authenticators are employed, require users to be individually authenticated before granting access to the shared accounts or resources. CM0005 CM0065 CM0033 NA NA
6 Identification and Authentication (organizational Users) | Access to Accounts — Separate Device Implement multi-factor authentication for [Selection (one or more): local; network; remote] access to [Selection (one or more): privileged accounts; non-privileged accounts] such that: (a) One of the factors is provided by a device separate from the system gaining access; and (b) The device meets [Assignment: organization-defined strength of mechanism requirements]. CM0005 CM0065 CM0033 NA NA
8 Identification and Authentication (organizational Users) | Access to Accounts — Replay Resistant Implement replay-resistant authentication mechanisms for access to [Selection (one or more): privileged accounts; non-privileged accounts]. CM0005 CM0065 CM0033 NA NA
10 Identification and Authentication (organizational Users) | Single Sign-on Provide a single sign-on capability for [Assignment: organization-defined system accounts and services]. CM0005 CM0065 CM0033 NA NA
12 Identification and Authentication (organizational Users) | Acceptance of PIV Credentials Accept and electronically verify Personal Identity Verification-compliant credentials. CM0005 CM0065 CM0033 NA NA
13 Identification and Authentication (organizational Users) | Out-of-band Authentication Implement the following out-of-band authentication mechanisms under [Assignment: organization-defined conditions]: [Assignment: organization-defined out-of-band authentication]. CM0005 CM0065 CM0033 NA NA
IA-3 Device Identification and Authentication Uniquely identify and authenticate [Assignment: organization-defined devices and/or types of devices] before establishing a [Selection (one or more): local; remote; network] connection. CM0033 CM0005 YES YES
1 Device Identification and Authentication | Cryptographic Bidirectional Authentication Authenticate [Assignment: organization-defined devices and/or types of devices] before establishing [Selection (one or more): local; remote; network] connection using bidirectional authentication that is cryptographically based. CM0031 CM0033 CM0005 YES YES
3 Device Identification and Authentication | Dynamic Address Allocation (a) Where addresses are allocated dynamically, standardize dynamic address allocation lease information and the lease duration assigned to devices in accordance with [Assignment: organization-defined lease information and lease duration]; and (b) Audit lease information when assigned to a device. CM0031 CM0033 CM0005 NA NA
4 Device Identification and Authentication | Device Attestation Handle device identification and authentication based on attestation by [Assignment: organization-defined configuration management process]. CM0031 CM0033 CM0005