| AC.L1-b.1.iAuthorized Access Control [FCI Data] | 3.1.1 | 03.01.01 | AC-2AC-3AC-17 | — |
| AC.L1-b.1.iiTransaction & Function Control [FCI Data] | 3.1.2 | 03.01.02 | AC-2AC-3AC-17 | — |
| AC.L1-b.1.iiiExternal Connections [FCI Data] | 3.1.20 | 03.01.20 | AC-20AC-20 (1) | — |
| AC.L1-b.1.ivControl Public Information [FCI Data] | 3.1.22 | 03.01.22 | AC-22 | — |
| AC.L2-3.1.1Authorized Access Control [CUI Data] | 3.1.1 | 03.01.01 | AC-2AC-3AC-17 | — |
| AC.L2-3.1.2Transaction & Function Control [CUI Data] | 3.1.2 | 03.01.02 | AC-2AC-3AC-17 | — |
| AC.L2-3.1.3Control CUI Flow | 3.1.3 | 03.01.03 | AC-4 | — |
| AC.L2-3.1.4Separation of Duties | 3.1.4 | 03.01.04 | AC-5 | — |
| AC.L2-3.1.5Least Privilege | 3.1.5 | 03.01.05 | AC-6AC-6 (1)AC-6 (5) | — |
| AC.L2-3.1.6Non-Privileged Account Use | 3.1.6 | 03.01.06 | AC-6 (2) | — |
| AC.L2-3.1.7Privileged Functions | 3.1.7 | 03.01.07 | AC-6 (9)AC-6 (10) | — |
| AC.L2-3.1.8Unsuccessful Logon Attempts | 3.1.8 | 03.01.08 | AC-7 | — |
| AC.L2-3.1.9Privacy & Security Notices | 3.1.9 | 03.01.09 | AC-8 | — |
| AC.L2-3.1.10Session Lock | 3.1.10 | 03.01.10 | AC-11AC-11 (1) | — |
| AC.L2-3.1.11Session Termination | 3.1.11 | 03.01.11 | AC-12 | — |
| AC.L2-3.1.12Control Remote Access | 3.1.12 | 03.01.12 | AC-17 (1) | — |
| AC.L2-3.1.13Remote Access Confidentiality | 3.1.13 | — | AC-17 (2) | — |
| AC.L2-3.1.14Remote Access Routing | 3.1.14 | — | AC-17 (3) | — |
| AC.L2-3.1.15Privileged Remote Access | 3.1.15 | — | AC-17 (4) | — |
| AC.L2-3.1.16Wireless Access Authorization | 3.1.16 | 03.01.16 | AC-18 | — |
| AC.L2-3.1.17Wireless Access Protection | 3.1.17 | — | AC-18 (1) | — |
| AC.L2-3.1.18Mobile Device Connection | 3.1.18 | 03.01.18 | AC-19 | — |
| AC.L2-3.1.19Encrypt CUI on Mobile | 3.1.19 | — | AC-19 (5) | — |
| AC.L2-3.1.20External Connections [CUI Data] | 3.1.20 | 03.01.20 | AC-20AC-20 (1) | — |
| AC.L2-3.1.21Portable Storage Use | 3.1.21 | — | AC-20 (2) | — |
| AC.L2-3.1.22Control Public Information [CUI Data] | 3.1.22 | 03.01.22 | AC-22 | — |
| AC.L3-3.1.2eOrganizationally Controlled Assets | — | — | — | — |
| AC.L3-3.1.3eSecured Information Transfer | — | — | — | — |
| AT.L2-3.2.1Role-Based Risk Awareness | 3.2.1 | 03.02.01 | AT-2AT-3 | — |
| AT.L2-3.2.2Role-Based Training | 3.2.2 | 03.02.02 | AT-2AT-3 | — |
| AT.L2-3.2.3Insider Threat Awareness | 3.2.3 | — | AT-2 (2) | — |
| AT.L3-3.2.1eAdvanced Threat Awareness | — | — | — | — |
| AT.L3-3.2.2ePractical Training Exercises | — | — | — | — |
| AU.L2-3.3.1System Auditing | 3.3.1 | 03.03.01 | AU-2AU-3AU-3 (1)AU-6AU-11AU-12 | — |
| AU.L2-3.3.2User Accountability | 3.3.2 | 03.03.02 | AU-2AU-3AU-3 (1)AU-6AU-11AU-12 | — |
| AU.L2-3.3.3Event Review | 3.3.3 | 03.03.03 | AU-2 (3) | — |
| AU.L2-3.3.4Audit Failure Alerting | 3.3.4 | 03.03.04 | AU-5 | — |
| AU.L2-3.3.5Audit Correlation | 3.3.5 | 03.03.05 | AU-6 (3) | — |
| AU.L2-3.3.6Reduction & Reporting | 3.3.6 | 03.03.06 | AU-7 | — |
| AU.L2-3.3.7Authoritative Time Source | 3.3.7 | 03.03.07 | AU-8AU-8 (1) | — |
| AU.L2-3.3.8Audit Protection | 3.3.8 | 03.03.08 | AU-9 | — |
| AU.L2-3.3.9Audit Management | 3.3.9 | — | AU-9 (4) | — |
| CA.L2-3.12.1Security Control Assessment | 3.12.1 | 03.12.01 | CA-2CA-5CA-7PL-2 | — |
| CA.L2-3.12.2Operational Plan of Action | 3.12.2 | 03.12.02 | CA-2CA-5CA-7PL-2 | — |
| CA.L2-3.12.3Security Control Monitoring | 3.12.3 | 03.12.03 | CA-2CA-5CA-7PL-2 | — |
| CA.L2-3.12.4System Security Plan | 3.12.4 | — | CA-2CA-5CA-7PL-2 | — |
| CA.L3-3.12.1ePenetration Testing | — | — | — | — |
| CM.L2-3.4.1System Baselining | 3.4.1 | 03.04.01 | CM-2CM-6CM-8CM-8 (1) | — |
| CM.L2-3.4.2Security Configuration Enforcement | 3.4.2 | 03.04.02 | CM-2CM-6CM-8CM-8 (1) | — |
| CM.L2-3.4.3System Change Management | 3.4.3 | 03.04.03 | CM-3 | — |
| CM.L2-3.4.4Security Impact Analysis | 3.4.4 | 03.04.04 | CM-4 | — |
| CM.L2-3.4.5Access Restrictions for Change | 3.4.5 | 03.04.05 | CM-5 | — |
| CM.L2-3.4.6Least Functionality | 3.4.6 | 03.04.06 | CM-7 | — |
| CM.L2-3.4.7Nonessential Functionality | 3.4.7 | — | CM-7 (1)CM-7 (2) | — |
| CM.L2-3.4.8Application Execution Policy | 3.4.8 | 03.04.08 | CM-7 (4)CM-7 (5) | — |
| CM.L2-3.4.9User-Installed Software | 3.4.9 | — | CM-11 | — |
| CM.L3-3.4.1eAuthoritative Repository | — | — | — | — |
| CM.L3-3.4.2eAutomated Detection & Remediation | — | — | — | — |
| CM.L3-3.4.3eAutomated Inventory | — | — | — | — |
| IA.L1-b.1.vIdentification [FCI Data] | 3.5.1 | 03.05.01 | IA-2IA-3IA-5 | — |
| IA.L1-b.1.viAuthentication [FCI Data] | 3.5.2 | 03.05.02 | IA-2IA-3IA-5 | — |
| IA.L2-3.5.1Identification [CUI Data] | 3.5.1 | 03.05.01 | IA-2IA-3IA-5 | — |
| IA.L2-3.5.2Authentication [CUI Data] | 3.5.2 | 03.05.02 | IA-2IA-3IA-5 | — |
| IA.L2-3.5.3Multifactor Authentication | 3.5.3 | 03.05.03 | IA-2 (1)IA-2 (2)IA-2 (3) | — |
| IA.L2-3.5.4Replay-Resistant Authentication | 3.5.4 | 03.05.04 | IA-2 (8)IA-2 (9) | — |
| IA.L2-3.5.5Identifier Reuse | 3.5.5 | 03.05.05 | IA-4 | — |
| IA.L2-3.5.6Identifier Handling | 3.5.6 | — | IA-4 | — |
| IA.L2-3.5.7Password Complexity | 3.5.7 | 03.05.07 | IA-5 (1) | — |
| IA.L2-3.5.8Password Reuse | 3.5.8 | — | IA-5 (1) | — |
| IA.L2-3.5.9Temporary Passwords | 3.5.9 | — | IA-5 (1) | — |
| IA.L2-3.5.10Cryptographically-Protected Passwords | 3.5.10 | — | IA-5 (1) | — |
| IA.L2-3.5.11Obscure Feedback | 3.5.11 | 03.05.11 | IA-6 | — |
| IA.L3-3.5.1eBidirectional Authentication | — | — | — | — |
| IA.L3-3.5.3eBlock Untrusted Assets | — | — | — | — |
| IR.L2-3.6.1Incident Handling | 3.6.1 | 03.06.01 | IR-2IR-4IR-5IR-6IR-7 | — |
| IR.L2-3.6.2Incident Reporting | 3.6.2 | 03.06.02 | IR-2IR-4IR-5IR-6IR-7 | — |
| IR.L2-3.6.3Incident Response Testing | 3.6.3 | 03.06.03 | IR-3 | — |
| IR.L3-3.6.1eSecurity Operations Center | — | — | — | — |
| IR.L3-3.6.2eCyber Incident Response Team | — | — | — | — |
| MA.L2-3.7.1Perform Maintenance | 3.7.1 | — | MA-2MA-3MA-3 (1)MA-3 (2) | — |
| MA.L2-3.7.2System Maintenance Control | 3.7.2 | — | MA-2MA-3MA-3 (1)MA-3 (2) | — |
| MA.L2-3.7.3Equipment Sanitization | 3.7.3 | — | MA-2 | — |
| MA.L2-3.7.4Media Inspection | 3.7.4 | 03.07.04 | MA-3 (2) | — |
| MA.L2-3.7.5Nonlocal Maintenance | 3.7.5 | 03.07.05 | MA-4 | — |
| MA.L2-3.7.6Maintenance Personnel | 3.7.6 | 03.07.06 | MA-5 | — |
| MP.L1-b.1.viiMedia Disposal [FCI Data] | 3.8.3 | 03.08.03 | MP-2MP-4MP-6 | — |
| MP.L2-3.8.1Media Protection | 3.8.1 | 03.08.01 | MP-2MP-4MP-6 | — |
| MP.L2-3.8.2Media Access | 3.8.2 | 03.08.02 | MP-2MP-4MP-6 | — |
| MP.L2-3.8.3Media Disposal [CUI Data] | 3.8.3 | 03.08.03 | MP-2MP-4MP-6 | — |
| MP.L2-3.8.4Media Markings | 3.8.4 | 03.08.04 | MP-3 | — |
| MP.L2-3.8.5Media Accountability | 3.8.5 | 03.08.05 | MP-5 | — |
| MP.L2-3.8.6Portable Storage Encryption | 3.8.6 | — | MP-5 (4) | — |
| MP.L2-3.8.7Removable Media | 3.8.7 | 03.08.07 | MP-7 | — |
| MP.L2-3.8.8Shared Media | 3.8.8 | — | MP-7 (1) | — |
| MP.L2-3.8.9Protect Backups | 3.8.9 | 03.08.09 | CP-9 | — |
| PE.L1-b.1.ixManage Visitors & Physical Access [FCI Data] | 3.10.33.10.43.10.5 | — | PE-3 | — |
| PE.L1-b.1.viiiLimit Physical Access [FCI Data] | 3.10.1 | 03.10.01 | PE-2PE-4PE-5PE-6 | — |
| PE.L2-3.10.1Limit Physical Access [CUI Data] | 3.10.1 | 03.10.01 | PE-2PE-4PE-5PE-6 | — |
| PE.L2-3.10.2Monitor Facility | 3.10.2 | 03.10.02 | PE-2PE-4PE-5PE-6 | — |
| PE.L2-3.10.3Escort Visitors [CUI Data] | 3.10.3 | — | PE-3 | — |
| PE.L2-3.10.4Physical Access Logs [CUI Data] | 3.10.4 | — | PE-3 | — |
| PE.L2-3.10.5Manage Physical Access [CUI Data] | 3.10.5 | — | PE-3 | — |
| PE.L2-3.10.6Alternative Work Sites | 3.10.6 | 03.10.06 | PE-17 | — |
| PS.L2-3.9.1Screen Individuals | 3.9.1 | 03.09.01 | PS-3PS-4PS-5 | — |
| PS.L2-3.9.2Personnel Actions | 3.9.2 | 03.09.02 | PS-3PS-4PS-5 | — |
| PS.L3-3.9.2eAdverse Information | — | — | — | — |
| RA.L2-3.11.1Risk Assessments | 3.11.1 | 03.11.01 | RA-3 | — |
| RA.L2-3.11.2Vulnerability Scan | 3.11.2 | 03.11.02 | RA-5RA-5 (5) | — |
| RA.L2-3.11.3Vulnerability Remediation | 3.11.3 | — | RA-5 | — |
| RA.L3-3.11.1eThreat-Informed Risk Assessment | — | — | — | — |
| RA.L3-3.11.2eThreat Hunting | — | — | — | — |
| RA.L3-3.11.3eAdvanced Risk Identification | — | — | — | — |
| RA.L3-3.11.4eSecurity Solution Rationale | — | — | — | — |
| RA.L3-3.11.5eSecurity Solution Effectiveness | — | — | — | — |
| RA.L3-3.11.6eSupply Chain Risk Response | — | — | — | — |
| RA.L3-3.11.7eSupply Chain Risk Plan | — | — | — | — |
| SC.L1-b.1.xBoundary Protection [FCI Data] | 3.13.1 | 03.13.01 | SA-8SC-7 | — |
| SC.L1-b.1.xiPublic-Access System Separation [FCI Data] | 3.13.5 | — | SC-7 | — |
| SC.L2-3.13.1Boundary Protection [CUI Data] | 3.13.1 | 03.13.01 | SA-8SC-7 | — |
| SC.L2-3.13.2Security Engineering | 3.13.2 | — | SA-8SC-7 | — |
| SC.L2-3.13.3Role Separation | 3.13.3 | — | SC-2 | — |
| SC.L2-3.13.4Shared Resource Control | 3.13.4 | 03.13.04 | SC-4 | — |
| SC.L2-3.13.5Public-Access System Separation [CUI Data] | 3.13.5 | — | SC-7 | — |
| SC.L2-3.13.6Network Communication by Exception | 3.13.6 | 03.13.06 | SC-7 (5) | — |
| SC.L2-3.13.7Split Tunneling | 3.13.7 | — | SC-7 (7) | — |
| SC.L2-3.13.8Data in Transit | 3.13.8 | 03.13.08 | SC-8SC-8 (1) | — |
| SC.L2-3.13.9Connections Termination | 3.13.9 | 03.13.09 | SC-10 | — |
| SC.L2-3.13.10Key Management | 3.13.10 | 03.13.10 | SC-12 | — |
| SC.L2-3.13.11CUI Encryption | 3.13.11 | 03.13.11 | SC-13 | — |
| SC.L2-3.13.12Collaborative Device Control | 3.13.12 | 03.13.12 | SC-15 | — |
| SC.L2-3.13.13Mobile Code | 3.13.13 | 03.13.13 | SC-18 | — |
| SC.L2-3.13.14Voice over Internet Protocol | 3.13.14 | — | SC-19 | — |
| SC.L2-3.13.15Communications Authenticity | 3.13.15 | 03.13.15 | SC-23 | — |
| SC.L2-3.13.16Data at Rest | 3.13.16 | — | SC-28 | — |
| SC.L3-3.13.4eIsolation | — | — | — | — |
| SI.L1-b.1.xiiFlaw Remediation [FCI Data] | 3.14.1 | 03.14.01 | SI-2SI-3SI-5 | — |
| SI.L1-b.1.xiiiMalicious Code Protection [FCI Data] | 3.14.2 | 03.14.02 | SI-2SI-3SI-5 | — |
| SI.L1-b.1.xivUpdate Malicious Code Protection [FCI Data] | 3.14.4 | — | SI-3 | — |
| SI.L1-b.1.xvSystem & File Scanning [FCI Data] | 3.14.5 | — | SI-3 | — |
| SI.L2-3.14.1Flaw Remediation [CUI Data] | 3.14.1 | 03.14.01 | SI-2SI-3SI-5 | — |
| SI.L2-3.14.2Malicious Code Protection [CUI Data] | 3.14.2 | 03.14.02 | SI-2SI-3SI-5 | — |
| SI.L2-3.14.3Security Alerts & Advisories | 3.14.3 | 03.14.03 | SI-2SI-3SI-5 | — |
| SI.L2-3.14.4Update Malicious Code Protection [CUI Data] | 3.14.4 | — | SI-3 | — |
| SI.L2-3.14.5System & File Scanning [CUI Data] | 3.14.5 | — | SI-3 | — |
| SI.L2-3.14.6Monitor Communications for Attacks | 3.14.6 | 03.14.06 | SI-4SI-4 (4) | — |
| SI.L2-3.14.7Identify Unauthorized Use | 3.14.7 | — | SI-4 | — |
| SI.L3-3.14.1eIntegrity Verification | — | — | — | — |
| SI.L3-3.14.3eSpecialized Asset Security | — | — | — | — |
| SI.L3-3.14.6eThreat-Guided Intrusion Detection | — | — | — | — |