Sign In Register

NIST SP 800-53 · Rev 5Reference standard · cross-referenced from CMMC

Security and Privacy Controls (Revision 5)

A reference standard cross-referenced from CMMC. Open any control to see the CMMC practices it supports and its related controls in the other standards.

Numbers, titles and cross-references are public. Sign in or create a free account to read the control text.

1196 controls · View source ↗

AC-1Policy and Procedures AC-2Account Management AC-2(1)Account Management | Automated System Account Management AC-2(2)Account Management | Automated Temporary and Emergency Account Management AC-2(3)Account Management | Disable Accounts AC-2(4)Account Management | Automated Audit Actions AC-2(5)Account Management | Inactivity Logout AC-2(6)Account Management | Dynamic Privilege Management AC-2(7)Account Management | Privileged User Accounts AC-2(8)Account Management | Dynamic Account Management AC-2(9)Account Management | Restrictions on Use of Shared and Group Accounts AC-2(10)Shared and Group Account Credential Changewithdrawn AC-2(11)Account Management | Usage Conditions AC-2(12)Account Management | Account Monitoring for Atypical Usage AC-2(13)Account Management | Disable Accounts for High-risk Individuals AC-3Access Enforcement AC-3(2)Access Enforcement | Dual Authorization AC-3(1)Restricted Access to Privileged Functionswithdrawn AC-3(3)Access Enforcement | Mandatory Access Control AC-3(4)Access Enforcement | Discretionary Access Control AC-3(5)Access Enforcement | Security-relevant Information AC-3(7)Access Enforcement | Role-based Access Control AC-3(8)Access Enforcement | Revocation of Access Authorizations AC-3(6)Protection of User and System Informationwithdrawn AC-3(9)Access Enforcement | Controlled Release AC-3(10)Access Enforcement | Audited Override of Access Control Mechanisms AC-3(11)Access Enforcement | Restrict Access to Specific Information Types AC-3(12)Access Enforcement | Assert and Enforce Application Access AC-3(13)Access Enforcement | Attribute-based Access Control AC-3(14)Access Enforcement | Individual Access AC-3(15)Access Enforcement | Discretionary and Mandatory Access Control AC-4Information Flow Enforcement AC-4(1)Information Flow Enforcement | Object Security and Privacy Attributes AC-4(2)Information Flow Enforcement | Processing Domains AC-4(3)Information Flow Enforcement | Dynamic Information Flow Control AC-4(4)Information Flow Enforcement | Flow Control of Encrypted Information AC-4(5)Information Flow Enforcement | Embedded Data Types AC-4(6)Information Flow Enforcement | Metadata AC-4(7)Information Flow Enforcement | One-way Flow Mechanisms AC-4(8)Information Flow Enforcement | Security and Privacy Policy Filters AC-4(9)Information Flow Enforcement | Human Reviews AC-4(10)Information Flow Enforcement | Enable and Disable Security or Privacy Policy Filters AC-4(11)Information Flow Enforcement | Configuration of Security or Privacy Policy Filters AC-4(12)Information Flow Enforcement | Data Type Identifiers AC-4(13)Information Flow Enforcement | Decomposition into Policy-relevant Subcomponents AC-4(14)Information Flow Enforcement | Security or Privacy Policy Filter Constraints AC-4(15)Information Flow Enforcement | Detection of Unsanctioned Information AC-4(17)Information Flow Enforcement | Domain Authentication AC-4(19)Information Flow Enforcement | Validation of Metadata AC-4(20)Information Flow Enforcement | Approved Solutions AC-4(16)Information Transfers on Interconnected Systemswithdrawn AC-4(21)Information Flow Enforcement | Physical or Logical Separation of Information Flows AC-4(22)Information Flow Enforcement | Access Only AC-4(18)Security Attribute Bindingwithdrawn AC-4(23)Information Flow Enforcement | Modify Non-releasable Information AC-4(24)Information Flow Enforcement | Internal Normalized Format AC-4(25)Information Flow Enforcement | Data Sanitization AC-4(26)Information Flow Enforcement | Audit Filtering Actions AC-4(27)Information Flow Enforcement | Redundant/independent Filtering Mechanisms AC-4(28)Information Flow Enforcement | Linear Filter Pipelines AC-4(29)Information Flow Enforcement | Filter Orchestration Engines AC-4(30)Information Flow Enforcement | Filter Mechanisms Using Multiple Processes AC-4(31)Information Flow Enforcement | Failed Content Transfer Prevention AC-4(32)Information Flow Enforcement | Process Requirements for Information Transfer AC-5Separation of Duties AC-6Least Privilege AC-6(1)Least Privilege | Authorize Access to Security Functions AC-6(2)Least Privilege | Non-privileged Access for Nonsecurity Functions AC-6(3)Least Privilege | Network Access to Privileged Commands AC-6(4)Least Privilege | Separate Processing Domains AC-6(5)Least Privilege | Privileged Accounts AC-6(6)Least Privilege | Privileged Access by Non-organizational Users AC-6(7)Least Privilege | Review of User Privileges AC-6(8)Least Privilege | Privilege Levels for Code Execution AC-6(9)Least Privilege | Log Use of Privileged Functions AC-6(10)Least Privilege | Prohibit Non-privileged Users from Executing Privileged Functions AC-7Unsuccessful Logon Attempts AC-7(2)Unsuccessful Logon Attempts | Purge or Wipe Mobile Device AC-7(3)Unsuccessful Logon Attempts | Biometric Attempt Limiting AC-7(4)Unsuccessful Logon Attempts | Use of Alternate Authentication Factor AC-8System Use Notification AC-9Previous Logon Notification AC-7(1)Automatic Account Lockwithdrawn AC-9(1)Previous Logon Notification | Unsuccessful Logons AC-9(2)Previous Logon Notification | Successful and Unsuccessful Logons AC-9(3)Previous Logon Notification | Notification of Account Changes AC-9(4)Previous Logon Notification | Additional Logon Information AC-10Concurrent Session Control AC-11Device Lock AC-11(1)Device Lock | Pattern-hiding Displays AC-12Session Termination AC-12(1)Session Termination | User-initiated Logouts AC-12(2)Session Termination | Termination Message AC-12(3)Session Termination | Timeout Warning Message AC-14Permitted Actions Without Identification or Authentication AC-16Security and Privacy Attributes AC-16(1)Security and Privacy Attributes | Dynamic Attribute Association AC-16(2)Security and Privacy Attributes | Attribute Value Changes by Authorized Individuals AC-16(3)Security and Privacy Attributes | Maintenance of Attribute Associations by System AC-16(4)Security and Privacy Attributes | Association of Attributes by Authorized Individuals AC-13Supervision and Review — Access Controlwithdrawn AC-16(5)Security and Privacy Attributes | Attribute Displays on Objects to Be Output AC-16(6)Security and Privacy Attributes | Maintenance of Attribute Association AC-14(1)Necessary Useswithdrawn AC-16(7)Security and Privacy Attributes | Consistent Attribute Interpretation AC-15Automated Markingwithdrawn AC-16(8)Security and Privacy Attributes | Association Techniques and Technologies AC-16(9)Security and Privacy Attributes | Attribute Reassignment — Regrading Mechanisms AC-16(10)Security and Privacy Attributes | Attribute Configuration by Authorized Individuals AC-17Remote Access AC-17(1)Remote Access | Monitoring and Control AC-17(2)Remote Access | Protection of Confidentiality and Integrity Using Encryption AC-17(3)Remote Access | Managed Access Control Points AC-17(4)Remote Access | Privileged Commands and Access AC-17(6)Remote Access | Protection of Mechanism Information AC-17(9)Remote Access | Disconnect or Disable Access AC-17(10)Remote Access | Authenticate Remote Commands AC-18Wireless Access AC-18(1)Wireless Access | Authentication and Encryption AC-18(3)Wireless Access | Disable Wireless Networking AC-18(4)Wireless Access | Restrict Configurations by Users AC-18(5)Wireless Access | Antennas and Transmission Power Levels AC-19Access Control for Mobile Devices AC-17(5)Monitoring for Unauthorized Connectionswithdrawn AC-19(4)Access Control for Mobile Devices | Restrictions for Classified Information AC-19(5)Access Control for Mobile Devices | Full Device or Container-based Encryption AC-17(7)Additional Protection for Security Function Accesswithdrawn AC-20Use of External Systems AC-17(8)Disable Nonsecure Network Protocolswithdrawn AC-20(1)Use of External Systems | Limits on Authorized Use AC-20(2)Use of External Systems | Portable Storage Devices — Restricted Use AC-20(3)Use of External Systems | Non-organizationally Owned Systems — Restricted Use AC-20(4)Use of External Systems | Network Accessible Storage Devices — Prohibited Use AC-20(5)Use of External Systems | Portable Storage Devices — Prohibited Use AC-18(2)Monitoring Unauthorized Connectionswithdrawn AC-21Information Sharing AC-21(1)Information Sharing | Automated Decision Support AC-21(2)Information Sharing | Information Search and Retrieval AC-22Publicly Accessible Content AC-23Data Mining Protection AC-19(1)Use of Writable and Portable Storage Deviceswithdrawn AC-24Access Control Decisions AC-19(2)Use of Personally Owned Portable Storage Deviceswithdrawn AC-24(1)Access Control Decisions | Transmit Access Authorization Information AC-19(3)Use of Portable Storage Devices with No Identifiable Ownerwithdrawn AC-24(2)Access Control Decisions | No User or Process Identity AC-25Reference Monitor AT-1Policy and Procedures AT-2Literacy Training and Awareness AT-2(1)Literacy Training and Awareness | Practical Exercises AT-2(2)Literacy Training and Awareness | Insider Threat AT-2(3)Literacy Training and Awareness | Social Engineering and Mining AT-2(4)Literacy Training and Awareness | Suspicious Communications and Anomalous System Behavior AT-2(5)Literacy Training and Awareness | Advanced Persistent Threat AT-2(6)Literacy Training and Awareness | Cyber Threat Environment AT-3Role-based Training AT-3(1)Role-based Training | Environmental Controls AT-3(2)Role-based Training | Physical Security Controls AT-3(3)Role-based Training | Practical Exercises AT-3(5)Role-based Training | Processing Personally Identifiable Information AT-4Training Records AT-6Training Feedback AU-1Policy and Procedures AU-2Event Logging AU-3Content of Audit Records AU-3(1)Content of Audit Records | Additional Audit Information AU-3(3)Content of Audit Records | Limit Personally Identifiable Information Elements AU-4Audit Log Storage Capacity AU-4(1)Audit Log Storage Capacity | Transfer to Alternate Storage AU-5Response to Audit Logging Process Failures AU-5(1)Response to Audit Logging Process Failures | Storage Capacity Warning AU-5(2)Response to Audit Logging Process Failures | Real-time Alerts AU-5(3)Response to Audit Logging Process Failures | Configurable Traffic Volume Thresholds AU-5(4)Response to Audit Logging Process Failures | Shutdown on Failure AU-5(5)Response to Audit Logging Process Failures | Alternate Audit Logging Capability AT-3(4)Suspicious Communications and Anomalous System Behaviorwithdrawn AU-6Audit Record Review, Analysis, and Reporting AU-6(1)Audit Record Review, Analysis, and Reporting | Automated Process Integration AU-6(3)Audit Record Review, Analysis, and Reporting | Correlate Audit Record Repositories AT-5Contacts with Security Groups and Associationswithdrawn AU-6(4)Audit Record Review, Analysis, and Reporting | Central Review and Analysis AU-6(5)Audit Record Review, Analysis, and Reporting | Integrated Analysis of Audit Records AU-6(6)Audit Record Review, Analysis, and Reporting | Correlation with Physical Monitoring AU-6(7)Audit Record Review, Analysis, and Reporting | Permitted Actions AU-2(1)Compilation of Audit Records from Multiple Sourceswithdrawn AU-6(8)Audit Record Review, Analysis, and Reporting | Full Text Analysis of Privileged Commands AU-2(2)Selection of Audit Events by Componentwithdrawn AU-6(9)Audit Record Review, Analysis, and Reporting | Correlation with Information from Nontechnical Sources AU-2(3)Reviews and Updateswithdrawn AU-7Audit Record Reduction and Report Generation AU-2(4)Privileged Functionswithdrawn AU-7(1)Audit Record Reduction and Report Generation | Automatic Processing AU-8Time Stamps AU-9Protection of Audit Information AU-3(2)Centralized Management of Planned Audit Record Contentwithdrawn AU-9(1)Protection of Audit Information | Hardware Write-once Media AU-9(2)Protection of Audit Information | Store on Separate Physical Systems or Components AU-9(3)Protection of Audit Information | Cryptographic Protection AU-9(4)Protection of Audit Information | Access by Subset of Privileged Users AU-9(5)Protection of Audit Information | Dual Authorization AU-9(6)Protection of Audit Information | Read-only Access AU-9(7)Protection of Audit Information | Store on Component with Different Operating System AU-10Non-repudiation AU-10(1)Non-repudiation | Association of Identities AU-10(2)Non-repudiation | Validate Binding of Information Producer Identity AU-10(3)Non-repudiation | Chain of Custody AU-10(4)Non-repudiation | Validate Binding of Information Reviewer Identity AU-11Audit Record Retention AU-6(2)Automated Security Alertswithdrawn AU-11(1)Audit Record Retention | Long-term Retrieval Capability AU-12Audit Record Generation AU-12(1)Audit Record Generation | System-wide and Time-correlated Audit Trail AU-12(2)Audit Record Generation | Standardized Formats AU-12(3)Audit Record Generation | Changes by Authorized Individuals AU-12(4)Audit Record Generation | Query Parameter Audits of Personally Identifiable Information AU-13Monitoring for Information Disclosure AU-13(1)Monitoring for Information Disclosure | Use of Automated Tools AU-6(10)Audit Level Adjustmentwithdrawn AU-13(2)Monitoring for Information Disclosure | Review of Monitored Sites AU-13(3)Monitoring for Information Disclosure | Unauthorized Replication of Information AU-14Session Audit AU-7(2)Automatic Sort and Searchwithdrawn AU-14(1)Session Audit | System Start-up AU-14(3)Session Audit | Remote Viewing and Listening AU-8(1)Synchronization with Authoritative Time Sourcewithdrawn AU-16Cross-organizational Audit Logging AU-8(2)Secondary Authoritative Time Sourcewithdrawn AU-16(1)Cross-organizational Audit Logging | Identity Preservation AU-16(2)Cross-organizational Audit Logging | Sharing of Audit Information AU-16(3)Cross-organizational Audit Logging | Disassociability CA-1Policy and Procedures CA-2Control Assessments CA-2(1)Control Assessments | Independent Assessors CA-2(2)Control Assessments | Specialized Assessments CA-2(3)Control Assessments | Leveraging Results from External Organizations CA-3Information Exchange CA-3(6)Information Exchange | Transfer Authorizations CA-3(7)Information Exchange | Transitive Information Exchanges CA-5Plan of Action and Milestones CA-5(1)Plan of Action and Milestones | Automation Support for Accuracy and Currency AU-10(5)Digital Signatureswithdrawn CA-6Authorization CA-6(1)Authorization | Joint Authorization - Intra-organization CA-6(2)Authorization | Joint Authorization - Inter-organization CA-7Continuous Monitoring CA-7(1)Continuous Monitoring | Independent Assessment CA-7(3)Continuous Monitoring | Trend Analyses CA-7(4)Continuous Monitoring | Risk Monitoring CA-7(5)Continuous Monitoring | Consistency Analysis CA-7(6)Continuous Monitoring | Automation Support for Monitoring CA-8Penetration Testing CA-8(1)Penetration Testing | Independent Penetration Testing Agent or Team CA-8(2)Penetration Testing | Red Team Exercises CA-8(3)Penetration Testing | Facility Penetration Testing CA-9Internal System Connections AU-14(2)Capture and Record Contentwithdrawn CA-9(1)Internal System Connections | Compliance Checks CM-1Policy and Procedures AU-15Alternate Audit Logging Capabilitywithdrawn CM-2Baseline Configuration CM-2(2)Baseline Configuration | Automation Support for Accuracy and Currency CM-2(3)Baseline Configuration | Retention of Previous Configurations CM-2(6)Baseline Configuration | Development and Test Environments CM-2(7)Baseline Configuration | Configure Systems and Components for High-risk Areas CM-3Configuration Change Control CM-3(1)Configuration Change Control | Automated Documentation, Notification, and Prohibition of Changes CM-3(2)Configuration Change Control | Testing, Validation, and Documentation of Changes CM-3(3)Configuration Change Control | Automated Change Implementation CM-3(4)Configuration Change Control | Security and Privacy Representatives CM-3(5)Configuration Change Control | Automated Security Response CA-3(1)Unclassified National Security System Connectionswithdrawn CM-3(6)Configuration Change Control | Cryptography Management CA-3(2)Classified National Security System Connectionswithdrawn CM-3(7)Configuration Change Control | Review System Changes CA-3(3)Unclassified Non-national Security System Connectionswithdrawn CM-3(8)Configuration Change Control | Prevent or Restrict Configuration Changes CA-3(4)Connections to Public Networkswithdrawn CM-4Impact Analyses CA-3(5)Restrictions on External System Connectionswithdrawn CM-4(1)Impact Analyses | Separate Test Environments CM-4(2)Impact Analyses | Verification of Controls CM-5Access Restrictions for Change CA-4Security Certificationwithdrawn CM-5(1)Access Restrictions for Change | Automated Access Enforcement and Audit Records CM-5(4)Access Restrictions for Change | Dual Authorization CM-5(5)Access Restrictions for Change | Privilege Limitation for Production and Operation CM-5(6)Access Restrictions for Change | Limit Library Privileges CM-6Configuration Settings CM-6(1)Configuration Settings | Automated Management, Application, and Verification CM-6(2)Configuration Settings | Respond to Unauthorized Changes CM-7Least Functionality CA-7(2)Types of Assessmentswithdrawn CM-7(1)Least Functionality | Periodic Review CM-7(2)Least Functionality | Prevent Program Execution CM-7(3)Least Functionality | Registration Compliance CM-7(4)Least Functionality | Unauthorized Software - Deny-by-exception CM-7(5)Least Functionality | Authorized Software - Allow-by-exception CM-7(6)Least Functionality | Confined Environments with Limited Privileges CM-7(7)Least Functionality | Code Execution in Protected Environments CM-7(8)Least Functionality | Binary or Machine Executable Code CM-7(9)Least Functionality | Prohibiting The Use of Unauthorized Hardware CM-8System Component Inventory CM-8(1)System Component Inventory | Updates During Installation and Removal CM-8(2)System Component Inventory | Automated Maintenance CM-8(3)System Component Inventory | Automated Unauthorized Component Detection CM-2(1)Reviews and Updateswithdrawn CM-8(4)System Component Inventory | Accountability Information CM-8(6)System Component Inventory | Assessed Configurations and Approved Deviations CM-8(7)System Component Inventory | Centralized Repository CM-2(4)Unauthorized Softwarewithdrawn CM-8(8)System Component Inventory | Automated Location Tracking CM-2(5)Authorized Softwarewithdrawn CM-8(9)System Component Inventory | Assignment of Components to Systems CM-9Configuration Management Plan CM-9(1)Configuration Management Plan | Assignment of Responsibility CM-10Software Usage Restrictions CM-10(1)Software Usage Restrictions | Open-source Software CM-11User-installed Software CM-11(2)User-installed Software | Software Installation with Privileged Status CM-11(3)User-installed Software | Automated Enforcement and Monitoring CM-12Information Location CM-12(1)Information Location | Automated Tools to Support Information Location CM-13Data Action Mapping CM-14Signed Components CP-1Policy and Procedures CP-2Contingency Plan CP-2(1)Contingency Plan | Coordinate with Related Plans CP-2(2)Contingency Plan | Capacity Planning CP-2(3)Contingency Plan | Resume Mission and Business Functions CM-5(2)Review System Changeswithdrawn CP-2(5)Contingency Plan | Continue Mission and Business Functions CM-5(3)Signed Componentswithdrawn CP-2(6)Contingency Plan | Alternate Processing and Storage Sites CP-2(7)Contingency Plan | Coordinate with External Service Providers CP-2(8)Contingency Plan | Identify Critical Assets CP-3Contingency Training CM-5(7)Automatic Implementation of Security Safeguardswithdrawn CP-3(1)Contingency Training | Simulated Events CP-3(2)Contingency Training | Mechanisms Used in Training Environments CP-4Contingency Plan Testing CP-4(1)Contingency Plan Testing | Coordinate with Related Plans CM-6(3)Unauthorized Change Detectionwithdrawn CP-4(2)Contingency Plan Testing | Alternate Processing Site CM-6(4)Conformance Demonstrationwithdrawn CP-4(3)Contingency Plan Testing | Automated Testing CP-4(4)Contingency Plan Testing | Full Recovery and Reconstitution CP-4(5)Contingency Plan Testing | Self-challenge CP-6Alternate Storage Site CP-6(1)Alternate Storage Site | Separation from Primary Site CP-6(2)Alternate Storage Site | Recovery Time and Recovery Point Objectives CP-6(3)Alternate Storage Site | Accessibility CP-7Alternate Processing Site CP-7(1)Alternate Processing Site | Separation from Primary Site CP-7(2)Alternate Processing Site | Accessibility CP-7(3)Alternate Processing Site | Priority of Service CP-7(4)Alternate Processing Site | Preparation for Use CP-7(6)Alternate Processing Site | Inability to Return to Primary Site CP-8Telecommunications Services CP-8(1)Telecommunications Services | Priority of Service Provisions CP-8(2)Telecommunications Services | Single Points of Failure CM-8(5)No Duplicate Accounting of Componentswithdrawn CP-8(3)Telecommunications Services | Separation of Primary and Alternate Providers CP-8(4)Telecommunications Services | Provider Contingency Plan CP-8(5)Telecommunications Services | Alternate Telecommunication Service Testing CP-9System Backup CP-9(1)System Backup | Testing for Reliability and Integrity CP-9(2)System Backup | Test Restoration Using Sampling CP-9(3)System Backup | Separate Storage for Critical Information CP-9(5)System Backup | Transfer to Alternate Storage Site CP-9(6)System Backup | Redundant Secondary System CP-9(7)System Backup | Dual Authorization for Deletion or Destruction CM-11(1)Alerts for Unauthorized Installationswithdrawn CP-9(8)System Backup | Cryptographic Protection CP-10System Recovery and Reconstitution CP-10(2)System Recovery and Reconstitution | Transaction Recovery CP-10(4)System Recovery and Reconstitution | Restore Within Time Period CP-10(6)System Recovery and Reconstitution | Component Protection CP-11Alternate Communications Protocols CP-12Safe Mode CP-13Alternative Security Mechanisms IA-1Policy and Procedures IA-2Identification and Authentication (organizational Users)IA-2(1)Identification and Authentication (organizational Users) | Multi-factor Authentication to Privileged Accounts IA-2(2)Identification and Authentication (organizational Users) | Multi-factor Authentication to Non-privileged Accounts CP-2(4)Resume All Mission and Business Functionswithdrawn IA-2(5)Identification and Authentication (organizational Users) | Individual Authentication with Group Authentication IA-2(6)Identification and Authentication (organizational Users) | Access to Accounts - separate Device IA-2(8)Identification and Authentication (organizational Users) | Access to Accounts - Replay Resistant IA-2(10)Identification and Authentication (organizational Users) | Single Sign-on IA-2(12)Identification and Authentication (organizational Users) | Acceptance of PIV Credentials IA-2(13)Identification and Authentication (organizational Users) | Out-of-band Authentication IA-3Device Identification and Authentication IA-3(1)Device Identification and Authentication | Cryptographic Bidirectional Authentication IA-3(3)Device Identification and Authentication | Dynamic Address Allocation IA-3(4)Device Identification and Authentication | Device Attestation IA-4Identifier Management IA-4(1)Identifier Management | Prohibit Account Identifiers as Public Identifiers IA-4(4)Identifier Management | Identify User Status IA-4(5)Identifier Management | Dynamic Management CP-5Contingency Plan Updatewithdrawn IA-4(6)Identifier Management | Cross-organization Management IA-4(8)Identifier Management | Pairwise Pseudonymous Identifiers IA-4(9)Identifier Management | Attribute Maintenance and Protection IA-5Authenticator Management IA-5(1)Authenticator Management | Password-based Authentication IA-5(2)Authenticator Management | Public Key-based Authentication IA-5(5)Authenticator Management | Change Authenticators Prior to Delivery IA-5(6)Authenticator Management | Protection of Authenticators IA-5(7)Authenticator Management | No Embedded Unencrypted Static Authenticators IA-5(8)Authenticator Management | Multiple System Accounts CP-7(5)Equivalent Information Security Safeguardswithdrawn IA-5(9)Authenticator Management | Federated Credential Management IA-5(10)Authenticator Management | Dynamic Credential Binding IA-5(12)Authenticator Management | Biometric Authentication Performance IA-5(13)Authenticator Management | Expiration of Cached Authenticators IA-5(14)Authenticator Management | Managing Content of PKI Trust Stores IA-5(15)Authenticator Management | GSA-approved Products and Services IA-5(16)Authenticator Management | In-person or Trusted External Party Authenticator Issuance IA-5(17)Authenticator Management | Presentation Attack Detection for Biometric Authenticators IA-5(18)Authenticator Management | Password Managers IA-6Authentication Feedback IA-7Cryptographic Module Authentication IA-8Identification and Authentication (non-organizational Users)CP-9(4)Protection from Unauthorized Modificationwithdrawn IA-8(1)Identification and Authentication (non-organizational Users) | Acceptance of PIV Credentials from Other Agencies IA-8(2)Identification and Authentication (non-organizational Users) | Acceptance of External Authenticators IA-8(4)Identification and Authentication (non-organizational Users) | Use of Defined Profiles IA-8(5)Identification and Authentication (Non-organizational Users) | Acceptance of PIV-I Credentials IA-8(6)Identification and Authentication (non-organizational Users) | Disassociability IA-9Service Identification and Authentication CP-10(1)Contingency Plan Testingwithdrawn IA-10Adaptive Authentication IA-11Re-authentication CP-10(3)Compensating Security Controlswithdrawn IA-12Identity Proofing IA-12(1)Identity Proofing | Supervisor Authorization CP-10(5)Failover Capabilitywithdrawn IA-12(2)Identity Proofing | Identity Evidence IA-12(3)Identity Proofing | Identity Evidence Validation and Verification IA-12(4)Identity Proofing | In-person Validation and Verification IA-12(5)Identity Proofing | Address Confirmation IA-12(6)Identity Proofing | Accept Externally-proofed Identities IR-1Policy and Procedures IR-2Incident Response Training IR-2(1)Incident Response Training | Simulated Events IR-2(2)Incident Response Training | Automated Training Environments IA-2(3)Local Access to Privileged Accountswithdrawn IR-2(3)Incident Response Training | Breach IA-2(4)Local Access to Non-privileged Accountswithdrawn IR-3Incident Response Testing IR-3(1)Incident Response Testing | Automated Testing IR-3(2)Incident Response Testing | Coordination with Related Plans IA-2(7)Network Access to Non-privileged Accounts — Separate Devicewithdrawn IR-3(3)Incident Response Testing | Continuous Improvement IR-4Incident Handling IA-2(9)Network Access to Non-privileged Accounts — Replay Resistantwithdrawn IR-4(1)Incident Handling | Automated Incident Handling Processes IR-4(2)Incident Handling | Dynamic Reconfiguration IA-2(11)Remote Access — Separate Devicewithdrawn IR-4(3)Incident Handling | Continuity of Operations IR-4(4)Incident Handling | Information Correlation IR-4(5)Incident Handling | Automatic Disabling of System IR-4(6)Incident Handling | Insider Threats IR-4(7)Incident Handling | Insider Threats - Intra-organization Coordination IA-3(2)Cryptographic Bidirectional Network Authenticationwithdrawn IR-4(8)Incident Handling | Correlation with External Organizations IR-4(9)Incident Handling | Dynamic Response Capability IR-4(10)Incident Handling | Supply Chain Coordination IR-4(11)Incident Handling | Integrated Incident Response Team IR-4(12)Incident Handling | Malicious Code and Forensic Analysis IA-4(2)Supervisor Authorizationwithdrawn IR-4(13)Incident Handling | Behavior Analysis IA-4(3)Multiple Forms of Certificationwithdrawn IR-4(14)Incident Handling | Security Operations Center IR-4(15)Incident Handling | Public Relations and Reputation Repair IR-5Incident Monitoring IR-5(1)Incident Monitoring | Automated Tracking, Data Collection, and Analysis IA-4(7)In-person Registrationwithdrawn IR-6Incident Reporting IR-6(1)Incident Reporting | Automated Reporting IR-6(2)Incident Reporting | Vulnerabilities Related to Incidents IR-6(3)Incident Reporting | Supply Chain Coordination IR-7Incident Response Assistance IR-7(1)Incident Response Assistance | Automation Support for Availability of Information and Support IA-5(3)In-person or Trusted External Party Registrationwithdrawn IR-7(2)Incident Response Assistance | Coordination with External Providers IA-5(4)Automated Support for Password Strength Determinationwithdrawn IR-8Incident Response Plan IR-8(1)Incident Response Plan | Breaches IR-9Information Spillage Response IR-9(2)Information Spillage Response | Training IR-9(3)Information Spillage Response | Post-spill Operations IR-9(4)Information Spillage Response | Exposure to Unauthorized Personnel MA-1Policy and Procedures IA-5(11)Hardware Token-based Authenticationwithdrawn MA-2Controlled Maintenance MA-2(2)Controlled Maintenance | Automated Maintenance Activities MA-3Maintenance Tools MA-3(1)Maintenance Tools | Inspect Tools MA-3(2)Maintenance Tools | Inspect Media MA-3(3)Maintenance Tools | Prevent Unauthorized Removal MA-3(4)Maintenance Tools | Restricted Tool Use MA-3(5)Maintenance Tools | Execution with Privilege MA-3(6)Maintenance Tools | Software Updates and Patches MA-4Nonlocal Maintenance MA-4(1)Nonlocal Maintenance | Logging and Review MA-4(3)Nonlocal Maintenance | Comparable Security and Sanitization MA-4(4)Nonlocal Maintenance | Authentication and Separation of Maintenance Sessions IA-8(3)Use of FICAM-approved Productswithdrawn MA-4(5)Nonlocal Maintenance | Approvals and Notifications MA-4(6)Nonlocal Maintenance | Cryptographic Protection MA-4(7)Nonlocal Maintenance | Disconnect Verification MA-5Maintenance Personnel MA-5(1)Maintenance Personnel | Individuals Without Appropriate Access IA-9(1)Information Exchangewithdrawn MA-5(2)Maintenance Personnel | Security Clearances for Classified Systems IA-9(2)Transmission of Decisionswithdrawn MA-5(3)Maintenance Personnel | Citizenship Requirements for Classified Systems MA-5(4)Maintenance Personnel | Foreign Nationals MA-5(5)Maintenance Personnel | Non-system Maintenance MA-6Timely Maintenance MA-6(1)Timely Maintenance | Preventive Maintenance MA-6(2)Timely Maintenance | Predictive Maintenance MA-6(3)Timely Maintenance | Automated Support for Predictive Maintenance MA-7Field Maintenance MP-1Policy and Procedures MP-2Media Access IA-13Identity Providers and Authorization Servers MP-3Media Marking IA-13(1)Identity Providers and Authorization Servers | Protection of Cryptographic Keys MP-4Media Storage IA-13(2)Identity Providers and Authorization Servers | Verification of Identity Assertions and Access Tokens MP-4(2)Media Storage | Automated Restricted Access IA-13(3)Identity Providers and Authorization Servers | Token Management MP-5Media Transport MP-5(3)Media Transport | Custodians MP-6Media Sanitization MP-6(1)Media Sanitization | Review, Approve, Track, Document, and Verify MP-6(2)Media Sanitization | Equipment Testing MP-6(3)Media Sanitization | Nondestructive Techniques MP-6(7)Media Sanitization | Dual Authorization MP-6(8)Media Sanitization | Remote Purging or Wiping of Information MP-7Media Use MP-7(2)Media Use | Prohibit Use of Sanitization-resistant Media MP-8Media Downgrading MP-8(1)Media Downgrading | Documentation of Process MP-8(2)Media Downgrading | Equipment Testing MP-8(3)Media Downgrading | Controlled Unclassified Information MP-8(4)Media Downgrading | Classified Information PE-1Policy and Procedures PE-2Physical Access Authorizations PE-2(1)Physical Access Authorizations | Access by Position or Role PE-2(2)Physical Access Authorizations | Two Forms of Identification PE-2(3)Physical Access Authorizations | Restrict Unescorted Access PE-3Physical Access Control PE-3(1)Physical Access Control | System Access PE-3(2)Physical Access Control | Facility and Systems PE-3(3)Physical Access Control | Continuous Guards PE-3(4)Physical Access Control | Lockable Casings PE-3(5)Physical Access Control | Tamper Protection PE-3(7)Physical Access Control | Physical Barriers PE-3(8)Physical Access Control | Access Control Vestibules PE-4Access Control for Transmission PE-5Access Control for Output Devices PE-5(2)Access Control for Output Devices | Link to Individual Identity PE-6Monitoring Physical Access PE-6(1)Monitoring Physical Access | Intrusion Alarms and Surveillance Equipment PE-6(2)Monitoring Physical Access | Automated Intrusion Recognition and Responses PE-6(3)Monitoring Physical Access | Video Surveillance PE-6(4)Monitoring Physical Access | Monitoring Physical Access to Systems PE-8Visitor Access Records PE-8(1)Visitor Access Records | Automated Records Maintenance and Review IR-9(1)Responsible Personnelwithdrawn PE-8(3)Visitor Access Records | Limit Personally Identifiable Information Elements PE-9Power Equipment and Cabling PE-9(1)Power Equipment and Cabling | Redundant Cabling PE-9(2)Power Equipment and Cabling | Automatic Voltage Controls IR-10Integrated Information Security Analysis Teamwithdrawn PE-10Emergency Shutoff PE-11Emergency Power PE-11(1)Emergency Power | Alternate Power Supply - Minimal Operational Capability MA-2(1)Record Contentwithdrawn PE-11(2)Emergency Power | Alternate Power Supply - Self-contained PE-12Emergency Lighting PE-12(1)Emergency Lighting | Essential Mission and Business Functions PE-13Fire Protection PE-13(1)Fire Protection | Detection Systems - Automatic Activation and Notification PE-13(2)Fire Protection | Suppression Systems - Automatic Activation and Notification PE-13(4)Fire Protection | Inspections PE-14Environmental Controls PE-14(1)Environmental Controls | Automatic Controls PE-14(2)Environmental Controls | Monitoring with Alarms and Notifications PE-15Water Damage Protection MA-4(2)Document Nonlocal Maintenancewithdrawn PE-15(1)Water Damage Protection | Automation Support PE-16Delivery and Removal PE-17Alternate Work Site PE-18Location of System Components PE-19Information Leakage PE-19(1)Information Leakage | National Emissions Policies and Procedures PE-20Asset Monitoring and Tracking PE-21Electromagnetic Pulse Protection PE-22Component Marking PE-23Facility Location PL-1Policy and Procedures PL-2System Security and Privacy Plans PL-4Rules of Behavior PL-4(1)Rules of Behavior | Social Media and External Site/application Usage Restrictions PL-7Concept of Operations PL-8Security and Privacy Architectures PL-8(1)Security and Privacy Architectures | Defense in Depth PL-8(2)Security and Privacy Architectures | Supplier Diversity PL-9Central Management MP-2(1)Automated Restricted Accesswithdrawn PL-10Baseline Selection MP-2(2)Cryptographic Protectionwithdrawn PL-11Baseline Tailoring PM-1Information Security Program Plan PM-2Information Security Program Leadership Role MP-4(1)Cryptographic Protectionwithdrawn PM-3Information Security and Privacy Resources PM-4Plan of Action and Milestones Process PM-5System Inventory MP-5(1)Protection Outside of Controlled Areaswithdrawn PM-5(1)System Inventory | Inventory of Personally Identifiable Information MP-5(2)Documentation of Activitieswithdrawn PM-6Measures of Performance PM-7Enterprise Architecture MP-5(4)Cryptographic Protectionwithdrawn PM-7(1)Enterprise Architecture | Offloading PM-8Critical Infrastructure Plan PM-9Risk Management Strategy PM-10Authorization Process PM-11Mission and Business Process Definition MP-6(4)Controlled Unclassified Informationwithdrawn PM-12Insider Threat Program MP-6(5)Classified Informationwithdrawn PM-13Security and Privacy Workforce MP-6(6)Media Destructionwithdrawn PM-14Testing, Training, and Monitoring PM-15Security and Privacy Groups and Associations PM-16Threat Awareness Program PM-16(1)Threat Awareness Program | Automated Means for Sharing Threat Intelligence MP-7(1)Prohibit Use Without Ownerwithdrawn PM-17Protecting Controlled Unclassified Information on External Systems PM-18Privacy Program Plan PM-19Privacy Program Leadership Role PM-20Dissemination of Privacy Program Information PM-20(1)Dissemination of Privacy Program Information | Privacy Policies on Websites, Applications, and Digital Services PM-21Accounting of Disclosures PM-22Personally Identifiable Information Quality Management PM-23Data Governance Body PM-24Data Integrity Board PM-25Minimization of Personally Identifiable Information Used in Testing, Training, and Research PM-26Complaint Management PM-27Privacy Reporting PM-28Risk Framing PM-29Risk Management Program Leadership Roles PM-30Supply Chain Risk Management Strategy PM-30(1)Supply Chain Risk Management Strategy | Suppliers of Critical or Mission-essential Items PM-31Continuous Monitoring Strategy PM-32Purposing PE-3(6)Facility Penetration Testingwithdrawn PS-1Policy and Procedures PS-2Position Risk Designation PS-3Personnel Screening PS-3(1)Personnel Screening | Classified Information PS-3(2)Personnel Screening | Formal Indoctrination PE-5(1)Access to Output by Authorized Individualswithdrawn PS-3(3)Personnel Screening | Information Requiring Special Protective Measures PS-3(4)Personnel Screening | Citizenship Requirements PE-5(3)Marking Output Deviceswithdrawn PS-4Personnel Termination PS-4(1)Personnel Termination | Post-employment Requirements PS-4(2)Personnel Termination | Automated Actions PS-5Personnel Transfer PS-6Access Agreements PS-6(2)Access Agreements | Classified Information Requiring Special Protection PE-7Visitor Controlwithdrawn PS-6(3)Access Agreements | Post-employment Requirements PS-7External Personnel Security PS-8Personnel Sanctions PE-8(2)Physical Access Recordswithdrawn PS-9Position Descriptions PT-1Policy and Procedures PT-2Authority to Process Personally Identifiable Information PT-2(1)Authority to Process Personally Identifiable Information | Data Tagging PT-2(2)Authority to Process Personally Identifiable Information | Automation PT-3Personally Identifiable Information Processing Purposes PE-10(1)Accidental and Unauthorized Activationwithdrawn PT-3(1)Personally Identifiable Information Processing Purposes | Data Tagging PT-3(2)Personally Identifiable Information Processing Purposes | Automation PT-4Consent PT-4(1)Consent | Tailored Consent PT-4(2)Consent | Just-in-time Consent PT-4(3)Consent | Revocation PT-5Privacy Notice PT-5(1)Privacy Notice | Just-in-time Notice PT-5(2)Privacy Notice | Privacy Act Statements PE-13(3)Automatic Fire Suppressionwithdrawn PT-6System of Records Notice PT-6(1)System of Records Notice | Routine Uses PT-6(2)System of Records Notice | Exemption Rules PT-7Specific Categories of Personally Identifiable Information PT-7(1)Specific Categories of Personally Identifiable Information | Social Security Numbers PT-7(2)Specific Categories of Personally Identifiable Information | First Amendment Information PT-8Computer Matching Requirements RA-1Policy and Procedures RA-2Security Categorization RA-2(1)Security Categorization | Impact-level Prioritization PE-18(1)Facility Sitewithdrawn RA-3Risk Assessment RA-3(1)Risk Assessment | Supply Chain Risk Assessment RA-3(2)Risk Assessment | Use of All-source Intelligence RA-3(3)Risk Assessment | Dynamic Threat Awareness RA-3(4)Risk Assessment | Predictive Cyber Analytics RA-5Vulnerability Monitoring and Scanning RA-5(2)Vulnerability Monitoring and Scanning | Update Vulnerabilities to Be Scanned RA-5(3)Vulnerability Monitoring and Scanning | Breadth and Depth of Coverage RA-5(4)Vulnerability Monitoring and Scanning | Discoverable Information PL-2(1)Concept of Operationswithdrawn RA-5(5)Vulnerability Monitoring and Scanning | Privileged Access PL-2(2)Functional Architecturewithdrawn RA-5(6)Vulnerability Monitoring and Scanning | Automated Trend Analyses PL-2(3)Plan and Coordinate with Other Organizational Entitieswithdrawn RA-5(8)Vulnerability Monitoring and Scanning | Review Historic Audit Logs PL-3System Security Plan Updatewithdrawn RA-5(10)Vulnerability Monitoring and Scanning | Correlate Scanning Information RA-5(11)Vulnerability Monitoring and Scanning | Public Disclosure Program RA-6Technical Surveillance Countermeasures Survey PL-5Privacy Impact Assessmentwithdrawn RA-7Risk Response PL-6Security-related Activity Planningwithdrawn RA-8Privacy Impact Assessments RA-9Criticality Analysis RA-10Threat Hunting SA-1Policy and Procedures SA-2Allocation of Resources SA-3System Development Life Cycle SA-3(1)System Development Life Cycle | Manage Preproduction Environment SA-3(2)System Development Life Cycle | Use of Live or Operational Data SA-3(3)System Development Life Cycle | Technology Refresh SA-4Acquisition Process SA-4(1)Acquisition Process | Functional Properties of Controls SA-4(2)Acquisition Process | Design and Implementation Information for Controls SA-4(3)Acquisition Process | Development Methods, Techniques, and Practices SA-4(5)Acquisition Process | System, Component, and Service Configurations SA-4(6)Acquisition Process | Use of Information Assurance Products SA-4(7)Acquisition Process | NIAP-approved Protection Profiles SA-4(8)Acquisition Process | Continuous Monitoring Plan for Controls SA-4(9)Acquisition Process | Functions, Ports, Protocols, and Services in Use SA-4(10)Acquisition Process | Use of Approved PIV Products SA-4(11)Acquisition Process | System of Records SA-4(12)Acquisition Process | Data Ownership SA-5System Documentation SA-8Security and Privacy Engineering Principles SA-8(1)Security and Privacy Engineering Principles | Clear Abstractions SA-8(2)Security and Privacy Engineering Principles | Least Common Mechanism SA-8(3)Security and Privacy Engineering Principles | Modularity and Layering SA-8(4)Security and Privacy Engineering Principles | Partially Ordered Dependencies SA-8(5)Security and Privacy Engineering Principles | Efficiently Mediated Access SA-8(6)Security and Privacy Engineering Principles | Minimized Sharing SA-8(7)Security and Privacy Engineering Principles | Reduced Complexity SA-8(8)Security and Privacy Engineering Principles | Secure Evolvability SA-8(9)Security and Privacy Engineering Principles | Trusted Components SA-8(10)Security and Privacy Engineering Principles | Hierarchical Trust SA-8(11)Security and Privacy Engineering Principles | Inverse Modification Threshold SA-8(12)Security and Privacy Engineering Principles | Hierarchical Protection SA-8(13)Security and Privacy Engineering Principles | Minimized Security Elements SA-8(14)Security and Privacy Engineering Principles | Least Privilege SA-8(15)Security and Privacy Engineering Principles | Predicate Permission SA-8(16)Security and Privacy Engineering Principles | Self-reliant Trustworthiness SA-8(17)Security and Privacy Engineering Principles | Secure Distributed Composition SA-8(18)Security and Privacy Engineering Principles | Trusted Communications Channels SA-8(19)Security and Privacy Engineering Principles | Continuous Protection SA-8(20)Security and Privacy Engineering Principles | Secure Metadata Management SA-8(21)Security and Privacy Engineering Principles | Self-analysis SA-8(22)Security and Privacy Engineering Principles | Accountability and Traceability SA-8(23)Security and Privacy Engineering Principles | Secure Defaults SA-8(24)Security and Privacy Engineering Principles | Secure Failure and Recovery SA-8(25)Security and Privacy Engineering Principles | Economic Security SA-8(26)Security and Privacy Engineering Principles | Performance Security SA-8(27)Security and Privacy Engineering Principles | Human Factored Security SA-8(28)Security and Privacy Engineering Principles | Acceptable Security SA-8(29)Security and Privacy Engineering Principles | Repeatable and Documented Procedures SA-8(30)Security and Privacy Engineering Principles | Procedural Rigor SA-8(31)Security and Privacy Engineering Principles | Secure System Modification SA-8(32)Security and Privacy Engineering Principles | Sufficient Documentation SA-8(33)Security and Privacy Engineering Principles | Minimization SA-9External System Services PS-6(1)Information Requiring Special Protectionwithdrawn SA-9(1)External System Services | Risk Assessments and Organizational Approvals SA-9(2)External System Services | Identification of Functions, Ports, Protocols, and Services SA-9(3)External System Services | Establish and Maintain Trust Relationship with Providers SA-9(4)External System Services | Consistent Interests of Consumers and Providers SA-9(5)External System Services | Processing, Storage, and Service Location SA-9(6)External System Services | Organization-controlled Cryptographic Keys SA-9(7)External System Services | Organization-controlled Integrity Checking SA-9(8)External System Services | Processing and Storage Location - U.S. Jurisdiction SA-10Developer Configuration Management SA-10(1)Developer Configuration Management | Software and Firmware Integrity Verification SA-10(2)Developer Configuration Management | Alternative Configuration Management Processes SA-10(3)Developer Configuration Management | Hardware Integrity Verification SA-10(4)Developer Configuration Management | Trusted Generation SA-10(5)Developer Configuration Management | Mapping Integrity for Version Control SA-10(6)Developer Configuration Management | Trusted Distribution SA-10(7)Developer Configuration Management | Security and Privacy Representatives SA-11Developer Testing and Evaluation SA-11(1)Developer Testing and Evaluation | Static Code Analysis SA-11(2)Developer Testing and Evaluation | Threat Modeling and Vulnerability Analyses SA-11(3)Developer Testing and Evaluation | Independent Verification of Assessment Plans and Evidence SA-11(4)Developer Testing and Evaluation | Manual Code Reviews SA-11(5)Developer Testing and Evaluation | Penetration Testing SA-11(6)Developer Testing and Evaluation | Attack Surface Reviews SA-11(7)Developer Testing and Evaluation | Verify Scope of Testing and Evaluation SA-11(8)Developer Testing and Evaluation | Dynamic Code Analysis SA-11(9)Developer Testing and Evaluation | Interactive Application Security Testing SA-15Development Process, Standards, and Tools SA-15(1)Development Process, Standards, and Tools | Quality Metrics SA-15(2)Development Process, Standards, and Tools | Security and Privacy Tracking Tools SA-15(3)Development Process, Standards, and Tools | Criticality Analysis SA-15(5)Development Process, Standards, and Tools | Attack Surface Reduction SA-15(6)Development Process, Standards, and Tools | Continuous Improvement SA-15(7)Development Process, Standards, and Tools | Automated Vulnerability Analysis SA-15(8)Development Process, Standards, and Tools | Reuse of Threat and Vulnerability Information SA-15(10)Development Process, Standards, and Tools | Incident Response Plan RA-4Risk Assessment Updatewithdrawn SA-15(11)Development Process, Standards, and Tools | Archive System or Component SA-15(12)Development Process, Standards, and Tools | Minimize Personally Identifiable Information RA-5(1)Update Tool Capabilitywithdrawn SA-16Developer-provided Training SA-17Developer Security and Privacy Architecture and Design SA-17(1)Developer Security and Privacy Architecture and Design | Formal Policy Model SA-17(2)Developer Security and Privacy Architecture and Design | Security-relevant Components SA-17(3)Developer Security and Privacy Architecture and Design | Formal Correspondence SA-17(4)Developer Security and Privacy Architecture and Design | Informal Correspondence RA-5(7)Automated Detection and Notification of Unauthorized Componentswithdrawn SA-17(5)Developer Security and Privacy Architecture and Design | Conceptually Simple Design SA-17(6)Developer Security and Privacy Architecture and Design | Structure for Testing RA-5(9)Penetration Testing and Analyseswithdrawn SA-17(7)Developer Security and Privacy Architecture and Design | Structure for Least Privilege SA-17(8)Developer Security and Privacy Architecture and Design | Orchestration SA-17(9)Developer Security and Privacy Architecture and Design | Design Diversity SA-20Customized Development of Critical Components SA-21Developer Screening SA-22Unsupported System Components SA-23Specialization SC-1Policy and Procedures SC-2Separation of System and User Functionality SC-2(1)Separation of System and User Functionality | Interfaces for Non-privileged Users SC-2(2)Separation of System and User Functionality | Disassociability SC-3Security Function Isolation SC-3(1)Security Function Isolation | Hardware Separation SC-3(2)Security Function Isolation | Access and Flow Control Functions SC-3(3)Security Function Isolation | Minimize Nonsecurity Functionality SC-3(4)Security Function Isolation | Module Coupling and Cohesiveness SC-3(5)Security Function Isolation | Layered Structures SC-4Information in Shared System Resources SA-4(4)Assignment of Components to Systemswithdrawn SC-4(2)Information in Shared System Resources | Multilevel or Periods Processing SC-5Denial-of-service Protection SC-5(1)Denial-of-service Protection | Restrict Ability to Attack Other Systems SC-5(2)Denial-of-service Protection | Capacity, Bandwidth, and Redundancy SC-5(3)Denial-of-service Protection | Detection and Monitoring SC-6Resource Availability SC-7Boundary Protection SC-7(3)Boundary Protection | Access Points SC-7(4)Boundary Protection | External Telecommunications Services SC-7(5)Boundary Protection | Deny by Default - Allow by Exception SA-5(1)Functional Properties of Security Controlswithdrawn SC-7(7)Boundary Protection | Split Tunneling for Remote Devices SA-5(2)Security-relevant External System Interfaceswithdrawn SC-7(8)Boundary Protection | Route Traffic to Authenticated Proxy Servers SA-5(3)High-level Designwithdrawn SC-7(9)Boundary Protection | Restrict Threatening Outgoing Communications Traffic SA-5(4)Low-level Designwithdrawn SC-7(10)Boundary Protection | Prevent Exfiltration SA-5(5)Source Codewithdrawn SC-7(11)Boundary Protection | Restrict Incoming Communications Traffic SA-6Software Usage Restrictionswithdrawn SC-7(12)Boundary Protection | Host-based Protection SA-7User-installed Softwarewithdrawn SC-7(13)Boundary Protection | Isolation of Security Tools, Mechanisms, and Support Components SC-7(14)Boundary Protection | Protect Against Unauthorized Physical Connections SC-7(15)Boundary Protection | Networked Privileged Accesses SC-7(16)Boundary Protection | Prevent Discovery of System Components SC-7(17)Boundary Protection | Automated Enforcement of Protocol Formats SC-7(18)Boundary Protection | Fail Secure SC-7(19)Boundary Protection | Block Communication from Non-organizationally Configured Hosts SC-7(20)Boundary Protection | Dynamic Isolation and Segregation SC-7(21)Boundary Protection | Isolation of System Components SC-7(22)Boundary Protection | Separate Subnets for Connecting to Different Security Domains SC-7(23)Boundary Protection | Disable Sender Feedback on Protocol Validation Failure SC-7(24)Boundary Protection | Personally Identifiable Information SC-7(25)Boundary Protection | Unclassified National Security System Connections SC-7(26)Boundary Protection | Classified National Security System Connections SC-7(27)Boundary Protection | Unclassified Non-national Security System Connections SC-7(28)Boundary Protection | Connections to Public Networks SC-7(29)Boundary Protection | Separate Subnets to Isolate Functions SC-8Transmission Confidentiality and Integrity SC-8(1)Transmission Confidentiality and Integrity | Cryptographic Protection SC-8(2)Transmission Confidentiality and Integrity | Pre- and Post-transmission Handling SC-8(3)Transmission Confidentiality and Integrity | Cryptographic Protection for Message Externals SC-8(4)Transmission Confidentiality and Integrity | Conceal or Randomize Communications SC-8(5)Transmission Confidentiality and Integrity | Protected Distribution System SC-10Network Disconnect SC-11Trusted Path SC-11(1)Trusted Path | Irrefutable Communications Path SC-12Cryptographic Key Establishment and Management SC-12(1)Cryptographic Key Establishment and Management | Availability SC-12(2)Cryptographic Key Establishment and Management | Symmetric Keys SC-12(3)Cryptographic Key Establishment and Management | Asymmetric Keys SC-12(6)Cryptographic Key Establishment and Management | Physical Control of Keys SC-13Cryptographic Protection SC-15Collaborative Computing Devices and Applications SC-15(1)Collaborative Computing Devices and Applications | Physical or Logical Disconnect SC-15(3)Collaborative Computing Devices and Applications | Disabling and Removal in Secure Work Areas SC-15(4)Collaborative Computing Devices and Applications | Explicitly Indicate Current Participants SC-16Transmission of Security and Privacy Attributes SC-16(1)Transmission of Security and Privacy Attributes | Integrity Verification SC-16(2)Transmission of Security and Privacy Attributes | Anti-spoofing Mechanisms SC-16(3)Transmission of Security and Privacy Attributes | Cryptographic Binding SC-17Public Key Infrastructure Certificates SC-18Mobile Code SC-18(1)Mobile Code | Identify Unacceptable Code and Take Corrective Actions SC-18(2)Mobile Code | Acquisition, Development, and Use SC-18(3)Mobile Code | Prevent Downloading and Execution SC-18(4)Mobile Code | Prevent Automatic Execution SC-18(5)Mobile Code | Allow Execution Only in Confined Environments SC-20Secure Name/address Resolution Service (authoritative Source)SC-20(2)Secure Name/address Resolution Service (authoritative Source) | Data Origin and Integrity SC-21Secure Name/address Resolution Service (recursive or Caching Resolver)SC-22Architecture and Provisioning for Name/address Resolution Service SC-23Session Authenticity SC-23(1)Session Authenticity | Invalidate Session Identifiers at Logout SC-23(3)Session Authenticity | Unique System-generated Session Identifiers SC-23(5)Session Authenticity | Allowed Certificate Authorities SC-24Fail in Known State SC-25Thin Nodes SC-26Decoys SC-27Platform-independent Applications SC-28Protection of Information at Rest SC-28(1)Protection of Information at Rest | Cryptographic Protection SC-28(2)Protection of Information at Rest | Offline Storage SA-12Supply Chain Protectionwithdrawn SC-28(3)Protection of Information at Rest | Cryptographic Keys SA-12(1)Acquisition Strategies / Tools / Methodswithdrawn SC-29Heterogeneity SA-12(2)Supplier Reviewswithdrawn SC-29(1)Heterogeneity | Virtualization Techniques SA-12(3)Trusted Shipping and Warehousingwithdrawn SC-30Concealment and Misdirection SA-12(4)Diversity of Supplierswithdrawn SC-30(2)Concealment and Misdirection | Randomness SA-12(5)Limitation of Harmwithdrawn SC-30(3)Concealment and Misdirection | Change Processing and Storage Locations SA-12(6)Minimizing Procurement Timewithdrawn SC-30(4)Concealment and Misdirection | Misleading Information SA-12(7)Assessments Prior to Selection / Acceptance / Updatewithdrawn SC-30(5)Concealment and Misdirection | Concealment of System Components SA-12(8)Use of All-source Intelligencewithdrawn SC-31Covert Channel Analysis SA-12(9)Operations Securitywithdrawn SC-31(1)Covert Channel Analysis | Test Covert Channels for Exploitability SA-12(10)Validate as Genuine and Not Alteredwithdrawn SC-31(2)Covert Channel Analysis | Maximum Bandwidth SA-12(11)Penetration Testing / Analysis of Elements, Processes, and Actorswithdrawn SC-31(3)Covert Channel Analysis | Measure Bandwidth in Operational Environments SA-12(12)Inter-organizational Agreementswithdrawn SC-32System Partitioning SA-12(13)Critical Information System Componentswithdrawn SC-32(1)System Partitioning | Separate Physical Domains for Privileged Functions SA-12(14)Identity and Traceabilitywithdrawn SC-34Non-modifiable Executable Programs SA-12(15)Processes to Address Weaknesses or Deficiencieswithdrawn SC-34(1)Non-modifiable Executable Programs | No Writable Storage SA-13Trustworthinesswithdrawn SC-34(2)Non-modifiable Executable Programs | Integrity Protection on Read-only Media SA-14Criticality Analysiswithdrawn SC-35External Malicious Code Identification SA-14(1)Critical Components with No Viable Alternative Sourcingwithdrawn SC-36Distributed Processing and Storage SC-36(1)Distributed Processing and Storage | Polling Techniques SC-36(2)Distributed Processing and Storage | Synchronization SC-37Out-of-band Channels SC-37(1)Out-of-band Channels | Ensure Delivery and Transmission SA-15(4)Threat Modeling and Vulnerability Analysiswithdrawn SC-38Operations Security SC-39Process Isolation SC-39(1)Process Isolation | Hardware Separation SC-39(2)Process Isolation | Separate Execution Domain Per Thread SC-40Wireless Link Protection SA-15(9)Use of Live Datawithdrawn SC-40(1)Wireless Link Protection | Electromagnetic Interference SC-40(2)Wireless Link Protection | Reduce Detection Potential SC-40(3)Wireless Link Protection | Imitative or Manipulative Communications Deception SC-40(4)Wireless Link Protection | Signal Parameter Identification SA-15(13)Development Process, Standards, and Tools | Logging Syntax SC-41Port and I/O Device Access SC-42Sensor Capability and Data SC-42(1)Sensor Capability and Data | Reporting to Authorized Individuals or Roles SC-42(2)Sensor Capability and Data | Authorized Use SC-42(4)Sensor Capability and Data | Notice of Collection SC-42(5)Sensor Capability and Data | Collection Minimization SC-43Usage Restrictions SC-44Detonation Chambers SC-45System Time Synchronization SC-45(1)System Time Synchronization | Synchronization with Authoritative Time Source SC-45(2)System Time Synchronization | Secondary Authoritative Time Source SC-46Cross Domain Policy Enforcement SA-18Tamper Resistance and Detectionwithdrawn SC-47Alternate Communications Paths SA-18(1)Multiple Phases of System Development Life Cyclewithdrawn SC-48Sensor Relocation SA-18(2)Inspection of Systems or Componentswithdrawn SC-48(1)Sensor Relocation | Dynamic Relocation of Sensors or Monitoring Capabilities SA-19Component Authenticitywithdrawn SC-49Hardware-enforced Separation and Policy Enforcement SA-19(1)Anti-counterfeit Trainingwithdrawn SC-50Software-enforced Separation and Policy Enforcement SA-19(2)Configuration Control for Component Service and Repairwithdrawn SC-51Hardware-based Protection SA-19(3)Component Disposalwithdrawn SI-1Policy and Procedures SA-19(4)Anti-counterfeit Scanningwithdrawn SI-2Flaw Remediation SI-2(2)Flaw Remediation | Automated Flaw Remediation Status SI-2(3)Flaw Remediation | Time to Remediate Flaws and Benchmarks for Corrective Actions SA-21(1)Validation of Screeningwithdrawn SI-2(4)Flaw Remediation | Automated Patch Management Tools SI-2(5)Flaw Remediation | Automatic Software and Firmware Updates SA-22(1)Alternative Sources for Continued Supportwithdrawn SI-2(6)Flaw Remediation | Removal of Previous Versions of Software and Firmware SI-3Malicious Code Protection SA-24Design For Cyber Resiliency SI-3(4)Malicious Code Protection | Updates Only by Privileged Users SI-3(6)Malicious Code Protection | Testing and Verification SI-3(8)Malicious Code Protection | Detect Unauthorized Commands SI-3(10)Malicious Code Protection | Malicious Code Analysis SI-4System Monitoring SI-4(1)System Monitoring | System-wide Intrusion Detection System SI-4(2)System Monitoring | Automated Tools and Mechanisms for Real-time Analysis SI-4(3)System Monitoring | Automated Tool and Mechanism Integration SI-4(4)System Monitoring | Inbound and Outbound Communications Traffic SI-4(5)System Monitoring | System-generated Alerts SI-4(7)System Monitoring | Automated Response to Suspicious Events SI-4(9)System Monitoring | Testing of Monitoring Tools and Mechanisms SC-4(1)Security Levelswithdrawn SI-4(10)System Monitoring | Visibility of Encrypted Communications SI-4(11)System Monitoring | Analyze Communications Traffic Anomalies SI-4(12)System Monitoring | Automated Organization-generated Alerts SI-4(13)System Monitoring | Analyze Traffic and Event Patterns SI-4(14)System Monitoring | Wireless Intrusion Detection SI-4(15)System Monitoring | Wireless to Wireline Communications SI-4(16)System Monitoring | Correlate Monitoring Information SI-4(17)System Monitoring | Integrated Situational Awareness SC-7(1)Physically Separated Subnetworkswithdrawn SI-4(18)System Monitoring | Analyze Traffic and Covert Exfiltration SC-7(2)Public Accesswithdrawn SI-4(19)System Monitoring | Risk for Individuals SI-4(20)System Monitoring | Privileged Users SI-4(21)System Monitoring | Probationary Periods SI-4(22)System Monitoring | Unauthorized Network Services SC-7(6)Response to Recognized Failureswithdrawn SI-4(23)System Monitoring | Host-based Devices SI-4(24)System Monitoring | Indicators of Compromise SI-4(25)System Monitoring | Optimize Network Traffic Analysis SI-5Security Alerts, Advisories, and Directives SI-5(1)Security Alerts, Advisories, and Directives | Automated Alerts and Advisories SI-6Security and Privacy Function Verification SI-6(2)Security and Privacy Function Verification | Automation Support for Distributed Testing SI-6(3)Security and Privacy Function Verification | Report Verification Results SI-7Software, Firmware, and Information Integrity SI-7(1)Software, Firmware, and Information Integrity | Integrity Checks SI-7(2)Software, Firmware, and Information Integrity | Automated Notifications of Integrity Violations SI-7(3)Software, Firmware, and Information Integrity | Centrally Managed Integrity Tools SI-7(5)Software, Firmware, and Information Integrity | Automated Response to Integrity Violations SI-7(6)Software, Firmware, and Information Integrity | Cryptographic Protection SI-7(7)Software, Firmware, and Information Integrity | Integration of Detection and Response SI-7(8)Software, Firmware, and Information Integrity | Auditing Capability for Significant Events SI-7(9)Software, Firmware, and Information Integrity | Verify Boot Process SI-7(10)Software, Firmware, and Information Integrity | Protection of Boot Firmware SI-7(12)Software, Firmware, and Information Integrity | Integrity Verification SI-7(15)Software, Firmware, and Information Integrity | Code Authentication SI-7(16)Software, Firmware, and Information Integrity | Time Limit on Process Execution Without Supervision SI-7(17)Software, Firmware, and Information Integrity | Runtime Application Self-protection SI-8Spam Protection SI-8(2)Spam Protection | Automatic Updates SI-8(3)Spam Protection | Continuous Learning Capability SI-10Information Input Validation SI-10(1)Information Input Validation | Manual Override Capability SI-10(2)Information Input Validation | Review and Resolve Errors SI-10(3)Information Input Validation | Predictable Behavior SI-10(4)Information Input Validation | Timing Interactions SC-9Transmission Confidentialitywithdrawn SI-10(5)Information Input Validation | Restrict Inputs to Trusted Sources and Approved Formats SI-10(6)Information Input Validation | Injection Prevention SI-11Error Handling SI-12Information Management and Retention SI-12(1)Information Management and Retention | Limit Personally Identifiable Information Elements SI-12(2)Information Management and Retention | Minimize Personally Identifiable Information in Testing, Training, and Research SI-12(3)Information Management and Retention | Information Disposal SI-13Predictable Failure Prevention SC-12(4)PKI Certificateswithdrawn SI-13(1)Predictable Failure Prevention | Transferring Component Responsibilities SC-12(5)PKI Certificates / Hardware Tokenswithdrawn SI-13(3)Predictable Failure Prevention | Manual Transfer Between Components SI-13(4)Predictable Failure Prevention | Standby Component Installation and Notification SI-13(5)Predictable Failure Prevention | Failover Capability SC-13(1)FIPS-validated Cryptographywithdrawn SI-14Non-persistence SC-13(2)NSA-approved Cryptographywithdrawn SI-14(1)Non-persistence | Refresh from Trusted Sources SC-13(3)Individuals Without Formal Access Approvalswithdrawn SI-14(2)Non-persistence | Non-persistent Information SC-13(4)Digital Signatureswithdrawn SI-14(3)Non-persistence | Non-persistent Connectivity SC-14Public Access Protectionswithdrawn SI-15Information Output Filtering SI-16Memory Protection SI-17Fail-safe Procedures SC-15(2)Blocking Inbound and Outbound Communications Trafficwithdrawn SI-18Personally Identifiable Information Quality Operations SI-18(1)Personally Identifiable Information Quality Operations | Automation Support SI-18(2)Personally Identifiable Information Quality Operations | Data Tags SI-18(3)Personally Identifiable Information Quality Operations | Collection SI-18(4)Personally Identifiable Information Quality Operations | Individual Requests SI-18(5)Personally Identifiable Information Quality Operations | Notice of Correction or Deletion SI-19De-identification SI-19(1)De-identification | Collection SI-19(2)De-identification | Archiving SI-19(3)De-identification | Release SI-19(4)De-identification | Removal, Masking, Encryption, Hashing, or Replacement of Direct Identifiers SI-19(5)De-identification | Statistical Disclosure Control SI-19(6)De-identification | Differential Privacy SI-19(7)De-identification | Validated Algorithms and Software SC-19Voice Over Internet Protocolwithdrawn SI-19(8)De-identification | Motivated Intruder SI-20Tainting SC-20(1)Child Subspaceswithdrawn SI-21Information Refresh SI-22Information Diversity SI-23Information Fragmentation SC-21(1)Data Origin and Integritywithdrawn SR-1Policy and Procedures SR-2Supply Chain Risk Management Plan SR-2(1)Supply Chain Risk Management Plan | Establish SCRM Team SR-3Supply Chain Controls and Processes SC-23(2)User-initiated Logouts and Message Displayswithdrawn SR-3(1)Supply Chain Controls and Processes | Diverse Supply Base SR-3(2)Supply Chain Controls and Processes | Limitation of Harm SC-23(4)Unique Session Identifiers with Randomizationwithdrawn SR-3(3)Supply Chain Controls and Processes | Sub-tier Flow Down SR-4Provenance SR-4(1)Provenance | Identity SR-4(2)Provenance | Track and Trace SR-4(3)Provenance | Validate as Genuine and Not Altered SC-26(1)Detection of Malicious Codewithdrawn SR-4(4)Provenance | Supply Chain Integrity - Pedigree SR-5Acquisition Strategies, Tools, and Methods SR-5(1)Acquisition Strategies, Tools, and Methods | Adequate Supply SR-5(2)Acquisition Strategies, Tools, and Methods | Assessments Prior to Selection, Acceptance, Modification, or Update SR-6Supplier Assessments and Reviews SR-6(1)Supplier Assessments and Reviews | Testing and Analysis SR-7Supply Chain Operations Security SR-8Notification Agreements SR-9Tamper Resistance and Detection SC-30(1)Virtualization Techniqueswithdrawn SR-9(1)Tamper Resistance and Detection | Multiple Stages of System Development Life Cycle SR-10Inspection of Systems or Components SR-11Component Authenticity SR-11(1)Component Authenticity | Anti-counterfeit Training SR-11(2)Component Authenticity | Configuration Control for Component Service and Repair SR-11(3)Component Authenticity | Anti-counterfeit Scanning SR-12Component Disposal SC-33Transmission Preparation Integritywithdrawn SC-34(3)Hardware-based Protectionwithdrawn SC-42(3)Prohibit Use of Deviceswithdrawn SI-2(1)Central Managementwithdrawn SI-2(7)Flaw Remediation | Root Cause Analysis SI-3(1)Central Managementwithdrawn SI-3(2)Automatic Updateswithdrawn SI-3(3)Non-privileged Userswithdrawn SI-3(5)Portable Storage Deviceswithdrawn SI-3(7)Nonsignature-based Detectionwithdrawn SI-3(9)Authenticate Remote Commandswithdrawn SI-4(6)Restrict Non-privileged Userswithdrawn SI-4(8)Protection of Monitoring Informationwithdrawn SI-6(1)Notification of Failed Security Testswithdrawn SI-7(4)Tamper-evident Packagingwithdrawn SI-7(11)Confined Environments with Limited Privilegeswithdrawn SI-7(13)Code Execution in Protected Environmentswithdrawn SI-7(14)Binary or Machine Executable Codewithdrawn SI-8(1)Central Managementwithdrawn SI-9Information Input Restrictionswithdrawn SI-13(2)Time Limit on Process Execution Without Supervisionwithdrawn