Skip to main content

💼 NIST SP 800-53 Revision 5

  • ID: /frameworks/nist-sp-800-53-r5

Description​

Empty...

Similar​

  • Internal
    • ID: dec-a-815f9955

Sub Sections​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
💼 AC Access Control25104153no data
　💼 AC-1 Policy and Proceduresno data
　💼 AC-2 Account Management132035no data
　　💼 AC-2(1) Account Management _ Automated System Account Management416no data
　　💼 AC-2(2) Account Management _ Automated Temporary and Emergency Account Managementno data
　　💼 AC-2(3) Account Management _ Disable Accounts14no data
　　💼 AC-2(4) Account Management _ Automated Audit Actions1416no data
　　💼 AC-2(5) Account Management _ Inactivity Logoutno data
　　💼 AC-2(6) Account Management _ Dynamic Privilege Managementno data
　　💼 AC-2(7) Account Management _ Privileged User Accounts11no data
　　💼 AC-2(8) Account Management _ Dynamic Account Managementno data
　　💼 AC-2(9) Account Management _ Restrictions on Use of Shared and Group Accountsno data
　　💼 AC-2(10) Account Management _ Shared and Group Account Credential Changeno data
　　💼 AC-2(11) Account Management _ Usage Conditionsno data
　　💼 AC-2(12) Account Management _ Account Monitoring for Atypical Usage1no data
　　💼 AC-2(13) Account Management _ Disable Accounts for High-risk Individualsno data
　💼 AC-3 Access Enforcement15537no data
　　💼 AC-3(1) Access Enforcement _ Restricted Access to Privileged Functionsno data
　　💼 AC-3(2) Access Enforcement _ Dual Authorizationno data
　　💼 AC-3(3) Access Enforcement _ Mandatory Access Controlno data
　　💼 AC-3(4) Access Enforcement _ Discretionary Access Controlno data
　　💼 AC-3(5) Access Enforcement _ Security-relevant Informationno data
　　💼 AC-3(6) Access Enforcement _ Protection of User and System Informationno data
　　💼 AC-3(7) Access Enforcement _ Role-based Access Control14no data
　　💼 AC-3(8) Access Enforcement _ Revocation of Access Authorizationsno data
　　💼 AC-3(9) Access Enforcement _ Controlled Releaseno data
　　💼 AC-3(10) Access Enforcement _ Audited Override of Access Control Mechanismsno data
　　💼 AC-3(11) Access Enforcement _ Restrict Access to Specific Information Typesno data
　　💼 AC-3(12) Access Enforcement _ Assert and Enforce Application Accessno data
　　💼 AC-3(13) Access Enforcement _ Attribute-based Access Controlno data
　　💼 AC-3(14) Access Enforcement _ Individual Accessno data
　　💼 AC-3(15) Access Enforcement _ Discretionary and Mandatory Access Control11no data
　💼 AC-4 Information Flow Enforcement326889no data
　　💼 AC-4(1) Information Flow Enforcement _ Object Security and Privacy Attributesno data
　　💼 AC-4(2) Information Flow Enforcement _ Processing Domains3032no data
　　💼 AC-4(3) Information Flow Enforcement _ Dynamic Information Flow Controlno data
　　💼 AC-4(4) Information Flow Enforcement _ Flow Control of Encrypted Informationno data
　　💼 AC-4(5) Information Flow Enforcement _ Embedded Data Types11no data
　　💼 AC-4(6) Information Flow Enforcement _ Metadatano data
　　💼 AC-4(7) Information Flow Enforcement _ One-way Flow Mechanismsno data
　　💼 AC-4(8) Information Flow Enforcement _ Security and Privacy Policy Filtersno data
　　💼 AC-4(9) Information Flow Enforcement _ Human Reviewsno data
　　💼 AC-4(10) Information Flow Enforcement _ Enable and Disable Security or Privacy Policy Filtersno data
　　💼 AC-4(11) Information Flow Enforcement _ Configuration of Security or Privacy Policy Filtersno data
　　💼 AC-4(12) Information Flow Enforcement _ Data Type Identifiersno data
　　💼 AC-4(13) Information Flow Enforcement _ Decomposition into Policy-relevant Subcomponentsno data
　　💼 AC-4(14) Information Flow Enforcement _ Security or Privacy Policy Filter Constraints22no data
　　💼 AC-4(15) Information Flow Enforcement _ Detection of Unsanctioned Information910no data
　　💼 AC-4(16) Information Flow Enforcement _ Information Transfers on Interconnected Systemsno data
　　💼 AC-4(17) Information Flow Enforcement _ Domain Authenticationno data
　　💼 AC-4(18) Information Flow Enforcement _ Security Attribute Bindingno data
　　💼 AC-4(19) Information Flow Enforcement _ Validation of Metadatano data
　　💼 AC-4(20) Information Flow Enforcement _ Approved Solutionsno data
　　💼 AC-4(21) Information Flow Enforcement _ Physical or Logical Separation of Information Flows3746no data
　　💼 AC-4(22) Information Flow Enforcement _ Access Onlyno data
　　💼 AC-4(23) Information Flow Enforcement _ Modify Non-releasable Informationno data
　　💼 AC-4(24) Information Flow Enforcement _ Internal Normalized Formatno data
　　💼 AC-4(25) Information Flow Enforcement _ Data Sanitizationno data
　　💼 AC-4(26) Information Flow Enforcement _ Audit Filtering Actions9no data
　　💼 AC-4(27) Information Flow Enforcement _ Redundant/independent Filtering Mechanismsno data
　　💼 AC-4(28) Information Flow Enforcement _ Linear Filter Pipelinesno data
　　💼 AC-4(29) Information Flow Enforcement _ Filter Orchestration Enginesno data
　　💼 AC-4(30) Information Flow Enforcement _ Filter Mechanisms Using Multiple Processesno data
　　💼 AC-4(31) Information Flow Enforcement _ Failed Content Transfer Preventionno data
　　💼 AC-4(32) Information Flow Enforcement _ Process Requirements for Information Transferno data
　💼 AC-5 Separation of Duties13no data
　💼 AC-6 Least Privilege102349no data
　　💼 AC-6(1) Least Privilege _ Authorize Access to Security Functions22no data
　　💼 AC-6(2) Least Privilege _ Non-privileged Access for Nonsecurity Functions44no data
　　💼 AC-6(3) Least Privilege _ Network Access to Privileged Commands2no data
　　💼 AC-6(4) Least Privilege _ Separate Processing Domainsno data
　　💼 AC-6(5) Least Privilege _ Privileged Accounts33no data
　　💼 AC-6(6) Least Privilege _ Privileged Access by Non-organizational Usersno data
　　💼 AC-6(7) Least Privilege _ Review of User Privilegesno data
　　💼 AC-6(8) Least Privilege _ Privilege Levels for Code Executionno data
　　💼 AC-6(9) Least Privilege _ Log Use of Privileged Functions1719no data
　　💼 AC-6(10) Least Privilege _ Prohibit Non-privileged Users from Executing Privileged Functions2no data
　💼 AC-7 Unsuccessful Logon Attempts4no data
　　💼 AC-7(1) Unsuccessful Logon Attempts _ Automatic Account Lockno data
　　💼 AC-7(2) Unsuccessful Logon Attempts _ Purge or Wipe Mobile Deviceno data
　　💼 AC-7(3) Unsuccessful Logon Attempts _ Biometric Attempt Limitingno data
　　💼 AC-7(4) Unsuccessful Logon Attempts _ Use of Alternate Authentication Factorno data
　💼 AC-8 System Use Notificationno data
　💼 AC-9 Previous Logon Notification4no data
　　💼 AC-9(1) Previous Logon Notification _ Unsuccessful Logonsno data
　　💼 AC-9(2) Previous Logon Notification _ Successful and Unsuccessful Logonsno data
　　💼 AC-9(3) Previous Logon Notification _ Notification of Account Changesno data
　　💼 AC-9(4) Previous Logon Notification _ Additional Logon Informationno data
　💼 AC-10 Concurrent Session Controlno data
　💼 AC-11 Device Lock1no data
　　💼 AC-11(1) Device Lock _ Pattern-hiding Displaysno data
　💼 AC-12 Session Termination3no data
　　💼 AC-12(1) Session Termination _ User-initiated Logoutsno data
　　💼 AC-12(2) Session Termination _ Termination Messageno data
　　💼 AC-12(3) Session Termination _ Timeout Warning Messageno data
　💼 AC-13 Supervision and Review — Access Controlno data
　💼 AC-14 Permitted Actions Without Identification or Authentication1no data
　　💼 AC-14(1) Permitted Actions Without Identification or Authentication _ Necessary Usesno data
　💼 AC-15 Automated Markingno data
　💼 AC-16 Security and Privacy Attributes10no data
　　💼 AC-16(1) Security and Privacy Attributes _ Dynamic Attribute Associationno data
　　💼 AC-16(2) Security and Privacy Attributes _ Attribute Value Changes by Authorized Individualsno data
　　💼 AC-16(3) Security and Privacy Attributes _ Maintenance of Attribute Associations by Systemno data
　　💼 AC-16(4) Security and Privacy Attributes _ Association of Attributes by Authorized Individualsno data
　　💼 AC-16(5) Security and Privacy Attributes _ Attribute Displays on Objects to Be Outputno data
　　💼 AC-16(6) Security and Privacy Attributes _ Maintenance of Attribute Associationno data
　　💼 AC-16(7) Security and Privacy Attributes _ Consistent Attribute Interpretationno data
　　💼 AC-16(8) Security and Privacy Attributes _ Association Techniques and Technologiesno data
　　💼 AC-16(9) Security and Privacy Attributes _ Attribute Reassignment — Regrading Mechanismsno data
　　💼 AC-16(10) Security and Privacy Attributes _ Attribute Configuration by Authorized Individualsno data
　💼 AC-17 Remote Access101319no data
　　💼 AC-17(1) Remote Access _ Monitoring and Control11no data
　　💼 AC-17(2) Remote Access _ Protection of Confidentiality and Integrity Using Encryption1217no data
　　💼 AC-17(3) Remote Access _ Managed Access Control Pointsno data
　　💼 AC-17(4) Remote Access _ Privileged Commands and Accessno data
　　💼 AC-17(5) Remote Access _ Monitoring for Unauthorized Connectionsno data
　　💼 AC-17(6) Remote Access _ Protection of Mechanism Informationno data
　　💼 AC-17(7) Remote Access _ Additional Protection for Security Function Accessno data
　　💼 AC-17(8) Remote Access _ Disable Nonsecure Network Protocolsno data
　　💼 AC-17(9) Remote Access _ Disconnect or Disable Accessno data
　　💼 AC-17(10) Remote Access _ Authenticate Remote Commandsno data
　💼 AC-18 Wireless Access55no data
　　💼 AC-18(1) Wireless Access _ Authentication and Encryptionno data
　　💼 AC-18(2) Wireless Access _ Monitoring Unauthorized Connectionsno data
　　💼 AC-18(3) Wireless Access _ Disable Wireless Networkingno data
　　💼 AC-18(4) Wireless Access _ Restrict Configurations by Usersno data
　　💼 AC-18(5) Wireless Access _ Antennas and Transmission Power Levelsno data
　💼 AC-19 Access Control for Mobile Devices5no data
　　💼 AC-19(1) Access Control for Mobile Devices _ Use of Writable and Portable Storage Devicesno data
　　💼 AC-19(2) Access Control for Mobile Devices _ Use of Personally Owned Portable Storage Devicesno data
　　💼 AC-19(3) Access Control for Mobile Devices _ Use of Portable Storage Devices with No Identifiable Ownerno data
　　💼 AC-19(4) Access Control for Mobile Devices _ Restrictions for Classified Informationno data
　　💼 AC-19(5) Access Control for Mobile Devices _ Full Device or Container-based Encryptionno data
　💼 AC-20 Use of External Systems5no data
　　💼 AC-20(1) Use of External Systems _ Limits on Authorized Useno data
　　💼 AC-20(2) Use of External Systems _ Portable Storage Devices — Restricted Useno data
　　💼 AC-20(3) Use of External Systems _ Non-organizationally Owned Systems — Restricted Useno data
　　💼 AC-20(4) Use of External Systems _ Network Accessible Storage Devices — Prohibited Useno data
　　💼 AC-20(5) Use of External Systems _ Portable Storage Devices — Prohibited Useno data
　💼 AC-21 Information Sharing28no data
　　💼 AC-21(1) Information Sharing _ Automated Decision Supportno data
　　💼 AC-21(2) Information Sharing _ Information Search and Retrievalno data
　💼 AC-22 Publicly Accessible Contentno data
　💼 AC-23 Data Mining Protectionno data
　💼 AC-24 Access Control Decisions2no data
　　💼 AC-24(1) Access Control Decisions _ Transmit Access Authorization Informationno data
　　💼 AC-24(2) Access Control Decisions _ No User or Process Identityno data
　💼 AC-25 Reference Monitorno data
💼 AT Awareness And Training6no data
　💼 AT-1 Policy and Proceduresno data
　💼 AT-2 Literacy Training and Awareness6no data
　　💼 AT-2(1) Literacy Training and Awareness _ Practical Exercisesno data
　　💼 AT-2(2) Literacy Training and Awareness _ Insider Threatno data
　　💼 AT-2(3) Literacy Training and Awareness _ Social Engineering and Miningno data
　　💼 AT-2(4) Literacy Training and Awareness _ Suspicious Communications and Anomalous System Behaviorno data
　　💼 AT-2(5) Literacy Training and Awareness _ Advanced Persistent Threatno data
　　💼 AT-2(6) Literacy Training and Awareness _ Cyber Threat Environmentno data
　💼 AT-3 Role-based Training5no data
　　💼 AT-3(1) Role-based Training _ Environmental Controlsno data
　　💼 AT-3(2) Role-based Training _ Physical Security Controlsno data
　　💼 AT-3(3) Role-based Training _ Practical Exercisesno data
　　💼 AT-3(4) Role-based Training _ Suspicious Communications and Anomalous System Behaviorno data
　　💼 AT-3(5) Role-based Training _ Processing Personally Identifiable Informationno data
　💼 AT-4 Training Recordsno data
　💼 AT-5 Contacts with Security Groups and Associationsno data
　💼 AT-6 Training Feedbackno data
💼 AU Audit And Accountability165174no data
　💼 AU-1 Policy and Proceduresno data
　💼 AU-2 Event Logging417no data
　　💼 AU-2(1) Event Logging _ Compilation of Audit Records from Multiple Sourcesno data
　　💼 AU-2(2) Event Logging _ Selection of Audit Events by Componentno data
　　💼 AU-2(3) Event Logging _ Reviews and Updatesno data
　　💼 AU-2(4) Event Logging _ Privileged Functionsno data
　💼 AU-3 Content of Audit Records31328no data
　　💼 AU-3(1) Content of Audit Records _ Additional Audit Information1314no data
　　💼 AU-3(2) Content of Audit Records _ Centralized Management of Planned Audit Record Contentno data
　　💼 AU-3(3) Content of Audit Records _ Limit Personally Identifiable Information Elementsno data
　💼 AU-4 Audit Log Storage Capacity1no data
　　💼 AU-4(1) Audit Log Storage Capacity _ Transfer to Alternate Storageno data
　💼 AU-5 Response to Audit Logging Process Failures5no data
　　💼 AU-5(1) Response to Audit Logging Process Failures _ Storage Capacity Warningno data
　　💼 AU-5(2) Response to Audit Logging Process Failures _ Real-time Alertsno data
　　💼 AU-5(3) Response to Audit Logging Process Failures _ Configurable Traffic Volume Thresholdsno data
　　💼 AU-5(4) Response to Audit Logging Process Failures _ Shutdown on Failureno data
　　💼 AU-5(5) Response to Audit Logging Process Failures _ Alternate Audit Logging Capabilityno data
　💼 AU-6 Audit Record Review, Analysis, and Reporting10113no data
　　💼 AU-6(1) Audit Record Review, Analysis, and Reporting _ Automated Process Integration13no data
　　💼 AU-6(2) Audit Record Review, Analysis, and Reporting _ Automated Security Alertsno data
　　💼 AU-6(3) Audit Record Review, Analysis, and Reporting _ Correlate Audit Record Repositories8no data
　　💼 AU-6(4) Audit Record Review, Analysis, and Reporting _ Central Review and Analysis8no data
　　💼 AU-6(5) Audit Record Review, Analysis, and Reporting _ Integrated Analysis of Audit Records2no data
　　💼 AU-6(6) Audit Record Review, Analysis, and Reporting _ Correlation with Physical Monitoringno data
　　💼 AU-6(7) Audit Record Review, Analysis, and Reporting _ Permitted Actionsno data
　　💼 AU-6(8) Audit Record Review, Analysis, and Reporting _ Full Text Analysis of Privileged Commandsno data
　　💼 AU-6(9) Audit Record Review, Analysis, and Reporting _ Correlation with Information from Nontechnical Sourcesno data
　　💼 AU-6(10) Audit Record Review, Analysis, and Reporting _ Audit Level Adjustmentno data
　💼 AU-7 Audit Record Reduction and Report Generation2118no data
　　💼 AU-7(1) Audit Record Reduction and Report Generation _ Automatic Processing11no data
　　💼 AU-7(2) Audit Record Reduction and Report Generation _ Automatic Sort and Searchno data
　💼 AU-8 Time Stamps2no data
　　💼 AU-8(1) Time Stamps _ Synchronization with Authoritative Time Sourceno data
　　💼 AU-8(2) Time Stamps _ Secondary Authoritative Time Sourceno data
　💼 AU-9 Protection of Audit Information724no data
　　💼 AU-9(1) Protection of Audit Information _ Hardware Write-once Mediano data
　　💼 AU-9(2) Protection of Audit Information _ Store on Separate Physical Systems or Componentsno data
　　💼 AU-9(3) Protection of Audit Information _ Cryptographic Protectionno data
　　💼 AU-9(4) Protection of Audit Information _ Access by Subset of Privileged Users22no data
　　💼 AU-9(5) Protection of Audit Information _ Dual Authorizationno data
　　💼 AU-9(6) Protection of Audit Information _ Read-only Accessno data
　　💼 AU-9(7) Protection of Audit Information _ Store on Component with Different Operating Systemno data
　💼 AU-10 Non-repudiation57no data
　　💼 AU-10(1) Non-repudiation _ Association of Identitiesno data
　　💼 AU-10(2) Non-repudiation _ Validate Binding of Information Producer Identityno data
　　💼 AU-10(3) Non-repudiation _ Chain of Custodyno data
　　💼 AU-10(4) Non-repudiation _ Validate Binding of Information Reviewer Identityno data
　　💼 AU-10(5) Non-repudiation _ Digital Signaturesno data
　💼 AU-11 Audit Record Retention1no data
　　💼 AU-11(1) Audit Record Retention _ Long-term Retrieval Capabilityno data
　💼 AU-12 Audit Record Generation44765no data
　　💼 AU-12(1) Audit Record Generation _ System-wide and Time-correlated Audit Trailno data
　　💼 AU-12(2) Audit Record Generation _ Standardized Formatsno data
　　💼 AU-12(3) Audit Record Generation _ Changes by Authorized Individualsno data
　　💼 AU-12(4) Audit Record Generation _ Query Parameter Audits of Personally Identifiable Informationno data
　💼 AU-13 Monitoring for Information Disclosure3no data
　　💼 AU-13(1) Monitoring for Information Disclosure _ Use of Automated Toolsno data
　　💼 AU-13(2) Monitoring for Information Disclosure _ Review of Monitored Sitesno data
　　💼 AU-13(3) Monitoring for Information Disclosure _ Unauthorized Replication of Informationno data
　💼 AU-14 Session Audit31no data
　　💼 AU-14(1) Session Audit _ System Start-up1no data
　　💼 AU-14(2) Session Audit _ Capture and Record Contentno data
　　💼 AU-14(3) Session Audit _ Remote Viewing and Listeningno data
　💼 AU-15 Alternate Audit Logging Capabilityno data
　💼 AU-16 Cross-organizational Audit Logging3no data
　　💼 AU-16(1) Cross-organizational Audit Logging _ Identity Preservationno data
　　💼 AU-16(2) Cross-organizational Audit Logging _ Sharing of Audit Informationno data
　　💼 AU-16(3) Cross-organizational Audit Logging _ Disassociabilityno data
💼 CA Assessment, Authorization, And Monitoring936no data
　💼 CA-1 Policy and Proceduresno data
　💼 CA-2 Control Assessments3no data
　　💼 CA-2(1) Control Assessments _ Independent Assessorsno data
　　💼 CA-2(2) Control Assessments _ Specialized Assessmentsno data
　　💼 CA-2(3) Control Assessments _ Leveraging Results from External Organizationsno data
　💼 CA-3 Information Exchange7no data
　　💼 CA-3(1) Information Exchange _ Unclassified National Security System Connectionsno data
　　💼 CA-3(2) Information Exchange _ Classified National Security System Connectionsno data
　　💼 CA-3(3) Information Exchange _ Unclassified Non-national Security System Connectionsno data
　　💼 CA-3(4) Information Exchange _ Connections to Public Networksno data
　　💼 CA-3(5) Information Exchange _ Restrictions on External System Connectionsno data
　　💼 CA-3(6) Information Exchange _ Transfer Authorizationsno data
　　💼 CA-3(7) Information Exchange _ Transitive Information Exchangesno data
　💼 CA-4 Security Certificationno data
　💼 CA-5 Plan of Action and Milestones1no data
　　💼 CA-5(1) Plan of Action and Milestones _ Automation Support for Accuracy and Currencyno data
　💼 CA-6 Authorization2no data
　　💼 CA-6(1) Authorization _ Joint Authorization — Intra-organizationno data
　　💼 CA-6(2) Authorization _ Joint Authorization — Inter-organizationno data
　💼 CA-7 Continuous Monitoring612no data
　　💼 CA-7(1) Continuous Monitoring _ Independent Assessmentno data
　　💼 CA-7(2) Continuous Monitoring _ Types of Assessmentsno data
　　💼 CA-7(3) Continuous Monitoring _ Trend Analysesno data
　　💼 CA-7(4) Continuous Monitoring _ Risk Monitoringno data
　　💼 CA-7(5) Continuous Monitoring _ Consistency Analysisno data
　　💼 CA-7(6) Continuous Monitoring _ Automation Support for Monitoringno data
　💼 CA-8 Penetration Testing3no data
　　💼 CA-8(1) Penetration Testing _ Independent Penetration Testing Agent or Teamno data
　　💼 CA-8(2) Penetration Testing _ Red Team Exercisesno data
　　💼 CA-8(3) Penetration Testing _ Facility Penetration Testingno data
　💼 CA-9 Internal System Connections124no data
　　💼 CA-9(1) Internal System Connections _ Compliance Checks23no data
💼 CM Configuration Management141760no data
　💼 CM-1 Policy and Procedures3no data
　💼 CM-2 Baseline Configuration727no data
　　💼 CM-2(1) Baseline Configuration _ Reviews and Updatesno data
　　💼 CM-2(2) Baseline Configuration _ Automation Support for Accuracy and Currency16no data
　　💼 CM-2(3) Baseline Configuration _ Retention of Previous Configurationsno data
　　💼 CM-2(4) Baseline Configuration _ Unauthorized Softwareno data
　　💼 CM-2(5) Baseline Configuration _ Authorized Softwareno data
　　💼 CM-2(6) Baseline Configuration _ Development and Test Environmentsno data
　　💼 CM-2(7) Baseline Configuration _ Configure Systems and Components for High-risk Areasno data
　💼 CM-3 Configuration Change Control81725no data
　　💼 CM-3(1) Configuration Change Control _ Automated Documentation, Notification, and Prohibition of Changesno data
　　💼 CM-3(2) Configuration Change Control _ Testing, Validation, and Documentation of Changesno data
　　💼 CM-3(3) Configuration Change Control _ Automated Change Implementationno data
　　💼 CM-3(4) Configuration Change Control _ Security and Privacy Representativesno data
　　💼 CM-3(5) Configuration Change Control _ Automated Security Responseno data
　　💼 CM-3(6) Configuration Change Control _ Cryptography Management6no data
　　💼 CM-3(7) Configuration Change Control _ Review System Changesno data
　　💼 CM-3(8) Configuration Change Control _ Prevent or Restrict Configuration Changesno data
　💼 CM-4 Impact Analyses2no data
　　💼 CM-4(1) Impact Analyses _ Separate Test Environmentsno data
　　💼 CM-4(2) Impact Analyses _ Verification of Controlsno data
　💼 CM-5 Access Restrictions for Change7no data
　　💼 CM-5(1) Access Restrictions for Change _ Automated Access Enforcement and Audit Recordsno data
　　💼 CM-5(2) Access Restrictions for Change _ Review System Changesno data
　　💼 CM-5(3) Access Restrictions for Change _ Signed Componentsno data
　　💼 CM-5(4) Access Restrictions for Change _ Dual Authorizationno data
　　💼 CM-5(5) Access Restrictions for Change _ Privilege Limitation for Production and Operationno data
　　💼 CM-5(6) Access Restrictions for Change _ Limit Library Privilegesno data
　　💼 CM-5(7) Access Restrictions for Change _ Automatic Implementation of Security Safeguardsno data
　💼 CM-6 Configuration Settings412no data
　　💼 CM-6(1) Configuration Settings _ Automated Management, Application, and Verification1no data
　　💼 CM-6(2) Configuration Settings _ Respond to Unauthorized Changesno data
　　💼 CM-6(3) Configuration Settings _ Unauthorized Change Detectionno data
　　💼 CM-6(4) Configuration Settings _ Conformance Demonstrationno data
　💼 CM-7 Least Functionality923no data
　　💼 CM-7(1) Least Functionality _ Periodic Reviewno data
　　💼 CM-7(2) Least Functionality _ Prevent Program Executionno data
　　💼 CM-7(3) Least Functionality _ Registration Complianceno data
　　💼 CM-7(4) Least Functionality _ Unauthorized Software — Deny-by-exceptionno data
　　💼 CM-7(5) Least Functionality _ Authorized Software — Allow-by-exceptionno data
　　💼 CM-7(6) Least Functionality _ Confined Environments with Limited Privilegesno data
　　💼 CM-7(7) Least Functionality _ Code Execution in Protected Environmentsno data
　　💼 CM-7(8) Least Functionality _ Binary or Machine Executable Codeno data
　　💼 CM-7(9) Least Functionality _ Prohibiting The Use of Unauthorized Hardwareno data
　💼 CM-8 System Component Inventory95no data
　　💼 CM-8(1) System Component Inventory _ Updates During Installation and Removal2no data
　　💼 CM-8(2) System Component Inventory _ Automated Maintenance1no data
　　💼 CM-8(3) System Component Inventory _ Automated Unauthorized Component Detection1no data
　　💼 CM-8(4) System Component Inventory _ Accountability Informationno data
　　💼 CM-8(5) System Component Inventory _ No Duplicate Accounting of Componentsno data
　　💼 CM-8(6) System Component Inventory _ Assessed Configurations and Approved Deviationsno data
　　💼 CM-8(7) System Component Inventory _ Centralized Repositoryno data
　　💼 CM-8(8) System Component Inventory _ Automated Location Trackingno data
　　💼 CM-8(9) System Component Inventory _ Assignment of Components to Systemsno data
　💼 CM-9 Configuration Management Plan18no data
　　💼 CM-9(1) Configuration Management Plan _ Assignment of Responsibilityno data
　💼 CM-10 Software Usage Restrictions1no data
　　💼 CM-10(1) Software Usage Restrictions _ Open-source Softwareno data
　💼 CM-11 User-installed Software3no data
　　💼 CM-11(1) User-installed Software _ Alerts for Unauthorized Installationsno data
　　💼 CM-11(2) User-installed Software _ Software Installation with Privileged Statusno data
　　💼 CM-11(3) User-installed Software _ Automated Enforcement and Monitoringno data
　💼 CM-12 Information Location1no data
　　💼 CM-12(1) Information Location _ Automated Tools to Support Information Locationno data
　💼 CM-13 Data Action Mappingno data
　💼 CM-14 Signed Componentsno data
💼 CP Contingency Planning1310no data
　💼 CP-1 Policy and Proceduresno data
　💼 CP-2 Contingency Plan82no data
　　💼 CP-2(1) Contingency Plan _ Coordinate with Related Plansno data
　　💼 CP-2(2) Contingency Plan _ Capacity Planning2no data
　　💼 CP-2(3) Contingency Plan _ Resume Mission and Business Functionsno data
　　💼 CP-2(4) Contingency Plan _ Resume All Mission and Business Functionsno data
　　💼 CP-2(5) Contingency Plan _ Continue Mission and Business Functionsno data
　　💼 CP-2(6) Contingency Plan _ Alternate Processing and Storage Sitesno data
　　💼 CP-2(7) Contingency Plan _ Coordinate with External Service Providersno data
　　💼 CP-2(8) Contingency Plan _ Identify Critical Assetsno data
　💼 CP-3 Contingency Training2no data
　　💼 CP-3(1) Contingency Training _ Simulated Eventsno data
　　💼 CP-3(2) Contingency Training _ Mechanisms Used in Training Environmentsno data
　💼 CP-4 Contingency Plan Testing5no data
　　💼 CP-4(1) Contingency Plan Testing _ Coordinate with Related Plansno data
　　💼 CP-4(2) Contingency Plan Testing _ Alternate Processing Siteno data
　　💼 CP-4(3) Contingency Plan Testing _ Automated Testingno data
　　💼 CP-4(4) Contingency Plan Testing _ Full Recovery and Reconstitutionno data
　　💼 CP-4(5) Contingency Plan Testing _ Self-challengeno data
　💼 CP-5 Contingency Plan Updateno data
　💼 CP-6 Alternate Storage Site37no data
　　💼 CP-6(1) Alternate Storage Site _ Separation from Primary Siteno data
　　💼 CP-6(2) Alternate Storage Site _ Recovery Time and Recovery Point Objectives7no data
　　💼 CP-6(3) Alternate Storage Site _ Accessibilityno data
　💼 CP-7 Alternate Processing Site6no data
　　💼 CP-7(1) Alternate Processing Site _ Separation from Primary Siteno data
　　💼 CP-7(2) Alternate Processing Site _ Accessibilityno data
　　💼 CP-7(3) Alternate Processing Site _ Priority of Serviceno data
　　💼 CP-7(4) Alternate Processing Site _ Preparation for Useno data
　　💼 CP-7(5) Alternate Processing Site _ Equivalent Information Security Safeguardsno data
　　💼 CP-7(6) Alternate Processing Site _ Inability to Return to Primary Siteno data
　💼 CP-8 Telecommunications Services5no data
　　💼 CP-8(1) Telecommunications Services _ Priority of Service Provisionsno data
　　💼 CP-8(2) Telecommunications Services _ Single Points of Failureno data
　　💼 CP-8(3) Telecommunications Services _ Separation of Primary and Alternate Providersno data
　　💼 CP-8(4) Telecommunications Services _ Provider Contingency Planno data
　　💼 CP-8(5) Telecommunications Services _ Alternate Telecommunication Service Testingno data
　💼 CP-9 System Backup84no data
　　💼 CP-9(1) System Backup _ Testing for Reliability and Integrityno data
　　💼 CP-9(2) System Backup _ Test Restoration Using Samplingno data
　　💼 CP-9(3) System Backup _ Separate Storage for Critical Informationno data
　　💼 CP-9(4) System Backup _ Protection from Unauthorized Modificationno data
　　💼 CP-9(5) System Backup _ Transfer to Alternate Storage Siteno data
　　💼 CP-9(6) System Backup _ Redundant Secondary Systemno data
　　💼 CP-9(7) System Backup _ Dual Authorization for Deletion or Destructionno data
　　💼 CP-9(8) System Backup _ Cryptographic Protection1no data
　💼 CP-10 System Recovery and Reconstitution68no data
　　💼 CP-10(1) System Recovery and Reconstitution _ Contingency Plan Testingno data
　　💼 CP-10(2) System Recovery and Reconstitution _ Transaction Recoveryno data
　　💼 CP-10(3) System Recovery and Reconstitution _ Compensating Security Controlsno data
　　💼 CP-10(4) System Recovery and Reconstitution _ Restore Within Time Periodno data
　　💼 CP-10(5) System Recovery and Reconstitution _ Failover Capabilityno data
　　💼 CP-10(6) System Recovery and Reconstitution _ Component Protectionno data
　💼 CP-11 Alternate Communications Protocolsno data
　💼 CP-12 Safe Modeno data
　💼 CP-13 Alternative Security Mechanismsno data
💼 IA Identification And Authentication1218no data
　💼 IA-1 Policy and Proceduresno data
　💼 IA-2 Identification and Authentication (organizational Users)132no data
　　💼 IA-2(1) Identification and Authentication (organizational Users) _ Multi-factor Authentication to Privileged Accounts2no data
　　💼 IA-2(2) Identification and Authentication (organizational Users) _ Multi-factor Authentication to Non-privileged Accounts2no data
　　💼 IA-2(3) Identification and Authentication (organizational Users) _ Local Access to Privileged Accountsno data
　　💼 IA-2(4) Identification and Authentication (organizational Users) _ Local Access to Non-privileged Accountsno data
　　💼 IA-2(5) Identification and Authentication (organizational Users) _ Individual Authentication with Group Authenticationno data
　　💼 IA-2(6) Identification and Authentication (organizational Users) _ Access to Accounts —separate Device2no data
　　💼 IA-2(7) Identification and Authentication (organizational Users) _ Network Access to Non-privileged Accounts — Separate Deviceno data
　　💼 IA-2(8) Identification and Authentication (organizational Users) _ Access to Accounts — Replay Resistant2no data
　　💼 IA-2(9) Identification and Authentication (organizational Users) _ Network Access to Non-privileged Accounts — Replay Resistantno data
　　💼 IA-2(10) Identification and Authentication (organizational Users) _ Single Sign-onno data
　　💼 IA-2(11) Identification and Authentication (organizational Users) _ Remote Access — Separate Deviceno data
　　💼 IA-2(12) Identification and Authentication (organizational Users) _ Acceptance of PIV Credentialsno data
　　💼 IA-2(13) Identification and Authentication (organizational Users) _ Out-of-band Authenticationno data
　💼 IA-3 Device Identification and Authentication4no data
　　💼 IA-3(1) Device Identification and Authentication _ Cryptographic Bidirectional Authenticationno data
　　💼 IA-3(2) Device Identification and Authentication _ Cryptographic Bidirectional Network Authenticationno data
　　💼 IA-3(3) Device Identification and Authentication _ Dynamic Address Allocationno data
　　💼 IA-3(4) Device Identification and Authentication _ Device Attestationno data
　💼 IA-4 Identifier Management9no data
　　💼 IA-4(1) Identifier Management _ Prohibit Account Identifiers as Public Identifiersno data
　　💼 IA-4(2) Identifier Management _ Supervisor Authorizationno data
　　💼 IA-4(3) Identifier Management _ Multiple Forms of Certificationno data
　　💼 IA-4(4) Identifier Management _ Identify User Statusno data
　　💼 IA-4(5) Identifier Management _ Dynamic Managementno data
　　💼 IA-4(6) Identifier Management _ Cross-organization Managementno data
　　💼 IA-4(7) Identifier Management _ In-person Registrationno data
　　💼 IA-4(8) Identifier Management _ Pairwise Pseudonymous Identifiersno data
　　💼 IA-4(9) Identifier Management _ Attribute Maintenance and Protectionno data
　💼 IA-5 Authenticator Management1816no data
　　💼 IA-5(1) Authenticator Management _ Password-based Authentication8no data
　　💼 IA-5(2) Authenticator Management _ Public Key-based Authenticationno data
　　💼 IA-5(3) Authenticator Management _ In-person or Trusted External Party Registrationno data
　　💼 IA-5(4) Authenticator Management _ Automated Support for Password Strength Determinationno data
　　💼 IA-5(5) Authenticator Management _ Change Authenticators Prior to Deliveryno data
　　💼 IA-5(6) Authenticator Management _ Protection of Authenticatorsno data
　　💼 IA-5(7) Authenticator Management _ No Embedded Unencrypted Static Authenticatorsno data
　　💼 IA-5(8) Authenticator Management _ Multiple System Accountsno data
　　💼 IA-5(9) Authenticator Management _ Federated Credential Managementno data
　　💼 IA-5(10) Authenticator Management _ Dynamic Credential Bindingno data
　　💼 IA-5(11) Authenticator Management _ Hardware Token-based Authenticationno data
　　💼 IA-5(12) Authenticator Management _ Biometric Authentication Performanceno data
　　💼 IA-5(13) Authenticator Management _ Expiration of Cached Authenticatorsno data
　　💼 IA-5(14) Authenticator Management _ Managing Content of PKI Trust Storesno data
　　💼 IA-5(15) Authenticator Management _ GSA-approved Products and Servicesno data
　　💼 IA-5(16) Authenticator Management _ In-person or Trusted External Party Authenticator Issuanceno data
　　💼 IA-5(17) Authenticator Management _ Presentation Attack Detection for Biometric Authenticatorsno data
　　💼 IA-5(18) Authenticator Management _ Password Managersno data
　💼 IA-6 Authentication Feedbackno data
　💼 IA-7 Cryptographic Module Authenticationno data
　💼 IA-8 Identification and Authentication (non-organizational Users)6no data
　　💼 IA-8(1) Identification and Authentication (non-organizational Users) _ Acceptance of PIV Credentials from Other Agenciesno data
　　💼 IA-8(2) Identification and Authentication (non-organizational Users) _ Acceptance of External Authenticatorsno data
　　💼 IA-8(3) Identification and Authentication (non-organizational Users) _ Use of FICAM-approved Productsno data
　　💼 IA-8(4) Identification and Authentication (non-organizational Users) _ Use of Defined Profilesno data
　　💼 IA-8(5) Identification and Authentication (non-organizational Users) _ Acceptance of PVI-I Credentialsno data
　　💼 IA-8(6) Identification and Authentication (non-organizational Users) _ Disassociabilityno data
　💼 IA-9 Service Identification and Authentication2no data
　　💼 IA-9(1) Service Identification and Authentication _ Information Exchangeno data
　　💼 IA-9(2) Service Identification and Authentication _ Transmission of Decisionsno data
　💼 IA-10 Adaptive Authenticationno data
　💼 IA-11 Re-authenticationno data
　💼 IA-12 Identity Proofing6no data
　　💼 IA-12(1) Identity Proofing _ Supervisor Authorizationno data
　　💼 IA-12(2) Identity Proofing _ Identity Evidenceno data
　　💼 IA-12(3) Identity Proofing _ Identity Evidence Validation and Verificationno data
　　💼 IA-12(4) Identity Proofing _ In-person Validation and Verificationno data
　　💼 IA-12(5) Identity Proofing _ Address Confirmationno data
　　💼 IA-12(6) Identity Proofing _ Accept Externally-proofed Identitiesno data
💼 IR Incident Response101no data
　💼 IR-1 Policy and Proceduresno data
　💼 IR-2 Incident Response Training3no data
　　💼 IR-2(1) Incident Response Training _ Simulated Eventsno data
　　💼 IR-2(2) Incident Response Training _ Automated Training Environmentsno data
　　💼 IR-2(3) Incident Response Training _ Breachno data
　💼 IR-3 Incident Response Testing3no data
　　💼 IR-3(1) Incident Response Testing _ Automated Testingno data
　　💼 IR-3(2) Incident Response Testing _ Coordination with Related Plansno data
　　💼 IR-3(3) Incident Response Testing _ Continuous Improvementno data
　💼 IR-4 Incident Handling15no data
　　💼 IR-4(1) Incident Handling _ Automated Incident Handling Processesno data
　　💼 IR-4(2) Incident Handling _ Dynamic Reconfigurationno data
　　💼 IR-4(3) Incident Handling _ Continuity of Operationsno data
　　💼 IR-4(4) Incident Handling _ Information Correlationno data
　　💼 IR-4(5) Incident Handling _ Automatic Disabling of Systemno data
　　💼 IR-4(6) Incident Handling _ Insider Threatsno data
　　💼 IR-4(7) Incident Handling _ Insider Threats — Intra-organization Coordinationno data
　　💼 IR-4(8) Incident Handling _ Correlation with External Organizationsno data
　　💼 IR-4(9) Incident Handling _ Dynamic Response Capabilityno data
　　💼 IR-4(10) Incident Handling _ Supply Chain Coordinationno data
　　💼 IR-4(11) Incident Handling _ Integrated Incident Response Teamno data
　　💼 IR-4(12) Incident Handling _ Malicious Code and Forensic Analysisno data
　　💼 IR-4(13) Incident Handling _ Behavior Analysisno data
　　💼 IR-4(14) Incident Handling _ Security Operations Centerno data
　　💼 IR-4(15) Incident Handling _ Public Relations and Reputation Repairno data
　💼 IR-5 Incident Monitoring1no data
　　💼 IR-5(1) Incident Monitoring _ Automated Tracking, Data Collection, and Analysisno data
　💼 IR-6 Incident Reporting31no data
　　💼 IR-6(1) Incident Reporting _ Automated Reportingno data
　　💼 IR-6(2) Incident Reporting _ Vulnerabilities Related to Incidentsno data
　　💼 IR-6(3) Incident Reporting _ Supply Chain Coordinationno data
　💼 IR-7 Incident Response Assistance2no data
　　💼 IR-7(1) Incident Response Assistance _ Automation Support for Availability of Information and Supportno data
　　💼 IR-7(2) Incident Response Assistance _ Coordination with External Providersno data
　💼 IR-8 Incident Response Plan1no data
　　💼 IR-8(1) Incident Response Plan _ Breachesno data
　💼 IR-9 Information Spillage Response4no data
　　💼 IR-9(1) Information Spillage Response _ Responsible Personnelno data
　　💼 IR-9(2) Information Spillage Response _ Trainingno data
　　💼 IR-9(3) Information Spillage Response _ Post-spill Operationsno data
　　💼 IR-9(4) Information Spillage Response _ Exposure to Unauthorized Personnelno data
　💼 IR-10 Integrated Information Security Analysis Teamno data
💼 MA Maintenance71no data
　💼 MA-1 Policy and Proceduresno data
　💼 MA-2 Controlled Maintenance2no data
　　💼 MA-2(1) Controlled Maintenance _ Record Contentno data
　　💼 MA-2(2) Controlled Maintenance _ Automated Maintenance Activitiesno data
　💼 MA-3 Maintenance Tools6no data
　　💼 MA-3(1) Maintenance Tools _ Inspect Toolsno data
　　💼 MA-3(2) Maintenance Tools _ Inspect Mediano data
　　💼 MA-3(3) Maintenance Tools _ Prevent Unauthorized Removalno data
　　💼 MA-3(4) Maintenance Tools _ Restricted Tool Useno data
　　💼 MA-3(5) Maintenance Tools _ Execution with Privilegeno data
　　💼 MA-3(6) Maintenance Tools _ Software Updates and Patchesno data
　💼 MA-4 Nonlocal Maintenance71no data
　　💼 MA-4(1) Nonlocal Maintenance _ Logging and Reviewno data
　　💼 MA-4(2) Nonlocal Maintenance _ Document Nonlocal Maintenanceno data
　　💼 MA-4(3) Nonlocal Maintenance _ Comparable Security and Sanitizationno data
　　💼 MA-4(4) Nonlocal Maintenance _ Authentication and Separation of Maintenance Sessionsno data
　　💼 MA-4(5) Nonlocal Maintenance _ Approvals and Notificationsno data
　　💼 MA-4(6) Nonlocal Maintenance _ Cryptographic Protectionno data
　　💼 MA-4(7) Nonlocal Maintenance _ Disconnect Verificationno data
　💼 MA-5 Maintenance Personnel5no data
　　💼 MA-5(1) Maintenance Personnel _ Individuals Without Appropriate Accessno data
　　💼 MA-5(2) Maintenance Personnel _ Security Clearances for Classified Systemsno data
　　💼 MA-5(3) Maintenance Personnel _ Citizenship Requirements for Classified Systemsno data
　　💼 MA-5(4) Maintenance Personnel _ Foreign Nationalsno data
　　💼 MA-5(5) Maintenance Personnel _ Non-system Maintenanceno data
　💼 MA-6 Timely Maintenance3no data
　　💼 MA-6(1) Timely Maintenance _ Preventive Maintenanceno data
　　💼 MA-6(2) Timely Maintenance _ Predictive Maintenanceno data
　　💼 MA-6(3) Timely Maintenance _ Automated Support for Predictive Maintenanceno data
　💼 MA-7 Field Maintenanceno data
💼 MP Media Protection812no data
　💼 MP-1 Policy and Proceduresno data
　💼 MP-2 Media Access212no data
　　💼 MP-2(1) Media Access _ Automated Restricted Accessno data
　　💼 MP-2(2) Media Access _ Cryptographic Protectionno data
　💼 MP-3 Media Markingno data
　💼 MP-4 Media Storage2no data
　　💼 MP-4(1) Media Storage _ Cryptographic Protectionno data
　　💼 MP-4(2) Media Storage _ Automated Restricted Accessno data
　💼 MP-5 Media Transport4no data
　　💼 MP-5(1) Media Transport _ Protection Outside of Controlled Areasno data
　　💼 MP-5(2) Media Transport _ Documentation of Activitiesno data
　　💼 MP-5(3) Media Transport _ Custodiansno data
　　💼 MP-5(4) Media Transport _ Cryptographic Protectionno data
　💼 MP-6 Media Sanitization8no data
　　💼 MP-6(1) Media Sanitization _ Review, Approve, Track, Document, and Verifyno data
　　💼 MP-6(2) Media Sanitization _ Equipment Testingno data
　　💼 MP-6(3) Media Sanitization _ Nondestructive Techniquesno data
　　💼 MP-6(4) Media Sanitization _ Controlled Unclassified Informationno data
　　💼 MP-6(5) Media Sanitization _ Classified Informationno data
　　💼 MP-6(6) Media Sanitization _ Media Destructionno data
　　💼 MP-6(7) Media Sanitization _ Dual Authorizationno data
　　💼 MP-6(8) Media Sanitization _ Remote Purging or Wiping of Informationno data
　💼 MP-7 Media Use2no data
　　💼 MP-7(1) Media Use _ Prohibit Use Without Ownerno data
　　💼 MP-7(2) Media Use _ Prohibit Use of Sanitization-resistant Mediano data
　💼 MP-8 Media Downgrading4no data
　　💼 MP-8(1) Media Downgrading _ Documentation of Processno data
　　💼 MP-8(2) Media Downgrading _ Equipment Testingno data
　　💼 MP-8(3) Media Downgrading _ Controlled Unclassified Informationno data
　　💼 MP-8(4) Media Downgrading _ Classified Informationno data
💼 PE Physical And Environmental Protection23no data
　💼 PE-1 Policy and Proceduresno data
　💼 PE-2 Physical Access Authorizations3no data
　　💼 PE-2(1) Physical Access Authorizations _ Access by Position or Roleno data
　　💼 PE-2(2) Physical Access Authorizations _ Two Forms of Identificationno data
　　💼 PE-2(3) Physical Access Authorizations _ Restrict Unescorted Accessno data
　💼 PE-3 Physical Access Control8no data
　　💼 PE-3(1) Physical Access Control _ System Accessno data
　　💼 PE-3(2) Physical Access Control _ Facility and Systemsno data
　　💼 PE-3(3) Physical Access Control _ Continuous Guardsno data
　　💼 PE-3(4) Physical Access Control _ Lockable Casingsno data
　　💼 PE-3(5) Physical Access Control _ Tamper Protectionno data
　　💼 PE-3(6) Physical Access Control _ Facility Penetration Testingno data
　　💼 PE-3(7) Physical Access Control _ Physical Barriersno data
　　💼 PE-3(8) Physical Access Control _ Access Control Vestibulesno data
　💼 PE-4 Access Control for Transmissionno data
　💼 PE-5 Access Control for Output Devices3no data
　　💼 PE-5(1) Access Control for Output Devices _ Access to Output by Authorized Individualsno data
　　💼 PE-5(2) Access Control for Output Devices _ Link to Individual Identityno data
　　💼 PE-5(3) Access Control for Output Devices _ Marking Output Devicesno data
　💼 PE-6 Monitoring Physical Access4no data
　　💼 PE-6(1) Monitoring Physical Access _ Intrusion Alarms and Surveillance Equipmentno data
　　💼 PE-6(2) Monitoring Physical Access _ Automated Intrusion Recognition and Responsesno data
　　💼 PE-6(3) Monitoring Physical Access _ Video Surveillanceno data
　　💼 PE-6(4) Monitoring Physical Access _ Monitoring Physical Access to Systemsno data
　💼 PE-7 Visitor Controlno data
　💼 PE-8 Visitor Access Records3no data
　　💼 PE-8(1) Visitor Access Records _ Automated Records Maintenance and Reviewno data
　　💼 PE-8(2) Visitor Access Records _ Physical Access Recordsno data
　　💼 PE-8(3) Visitor Access Records _ Limit Personally Identifiable Information Elementsno data
　💼 PE-9 Power Equipment and Cabling2no data
　　💼 PE-9(1) Power Equipment and Cabling _ Redundant Cablingno data
　　💼 PE-9(2) Power Equipment and Cabling _ Automatic Voltage Controlsno data
　💼 PE-10 Emergency Shutoff1no data
　　💼 PE-10(1) Emergency Shutoff _ Accidental and Unauthorized Activationno data
　💼 PE-11 Emergency Power2no data
　　💼 PE-11(1) Emergency Power _ Alternate Power Supply — Minimal Operational Capabilityno data
　　💼 PE-11(2) Emergency Power _ Alternate Power Supply — Self-containedno data
　💼 PE-12 Emergency Lighting1no data
　　💼 PE-12(1) Emergency Lighting _ Essential Mission and Business Functionsno data
　💼 PE-13 Fire Protection4no data
　　💼 PE-13(1) Fire Protection _ Detection Systems — Automatic Activation and Notificationno data
　　💼 PE-13(2) Fire Protection _ Suppression Systems — Automatic Activation and Notificationno data
　　💼 PE-13(3) Fire Protection _ Automatic Fire Suppressionno data
　　💼 PE-13(4) Fire Protection _ Inspectionsno data
　💼 PE-14 Environmental Controls2no data
　　💼 PE-14(1) Environmental Controls _ Automatic Controlsno data
　　💼 PE-14(2) Environmental Controls _ Monitoring with Alarms and Notificationsno data
　💼 PE-15 Water Damage Protection1no data
　　💼 PE-15(1) Water Damage Protection _ Automation Supportno data
　💼 PE-16 Delivery and Removalno data
　💼 PE-17 Alternate Work Siteno data
　💼 PE-18 Location of System Components1no data
　　💼 PE-18(1) Location of System Components _ Facility Siteno data
　💼 PE-19 Information Leakage1no data
　　💼 PE-19(1) Information Leakage _ National Emissions Policies and Proceduresno data
　💼 PE-20 Asset Monitoring and Trackingno data
　💼 PE-21 Electromagnetic Pulse Protectionno data
　💼 PE-22 Component Markingno data
　💼 PE-23 Facility Locationno data
💼 PL Planning113no data
　💼 PL-1 Policy and Proceduresno data
　💼 PL-2 System Security and Privacy Plans3no data
　　💼 PL-2(1) System Security and Privacy Plans _ Concept of Operationsno data
　　💼 PL-2(2) System Security and Privacy Plans _ Functional Architectureno data
　　💼 PL-2(3) System Security and Privacy Plans _ Plan and Coordinate with Other Organizational Entitiesno data
　💼 PL-3 System Security Plan Updateno data
　💼 PL-4 Rules of Behavior1no data
　　💼 PL-4(1) Rules of Behavior _ Social Media and External Site/application Usage Restrictionsno data
　💼 PL-5 Privacy Impact Assessmentno data
　💼 PL-6 Security-related Activity Planningno data
　💼 PL-7 Concept of Operationsno data
　💼 PL-8 Security and Privacy Architectures23no data
　　💼 PL-8(1) Security and Privacy Architectures _ Defense in Depthno data
　　💼 PL-8(2) Security and Privacy Architectures _ Supplier Diversityno data
　💼 PL-9 Central Managementno data
　💼 PL-10 Baseline Selectionno data
　💼 PL-11 Baseline Tailoringno data
💼 PM Program Management321no data
　💼 PM-1 Information Security Program Planno data
　💼 PM-2 Information Security Program Leadership Roleno data
　💼 PM-3 Information Security and Privacy Resourcesno data
　💼 PM-4 Plan of Action and Milestones Processno data
　💼 PM-5 System Inventory11no data
　　💼 PM-5(1) System Inventory _ Inventory of Personally Identifiable Informationno data
　💼 PM-6 Measures of Performanceno data
　💼 PM-7 Enterprise Architecture1no data
　　💼 PM-7(1) Enterprise Architecture _ Offloadingno data
　💼 PM-8 Critical Infrastructure Planno data
　💼 PM-9 Risk Management Strategyno data
　💼 PM-10 Authorization Processno data
　💼 PM-11 Mission and Business Process Definitionno data
　💼 PM-12 Insider Threat Programno data
　💼 PM-13 Security and Privacy Workforceno data
　💼 PM-14 Testing, Training, and Monitoringno data
　💼 PM-15 Security and Privacy Groups and Associationsno data
　💼 PM-16 Threat Awareness Program1no data
　　💼 PM-16(1) Threat Awareness Program _ Automated Means for Sharing Threat Intelligenceno data
　💼 PM-17 Protecting Controlled Unclassified Information on External Systemsno data
　💼 PM-18 Privacy Program Planno data
　💼 PM-19 Privacy Program Leadership Roleno data
　💼 PM-20 Dissemination of Privacy Program Information1no data
　　💼 PM-20(1) Dissemination of Privacy Program Information _ Privacy Policies on Websites, Applications, and Digital Servicesno data
　💼 PM-21 Accounting of Disclosuresno data
　💼 PM-22 Personally Identifiable Information Quality Managementno data
　💼 PM-23 Data Governance Bodyno data
　💼 PM-24 Data Integrity Boardno data
　💼 PM-25 Minimization of Personally Identifiable Information Used in Testing, Training, and Researchno data
　💼 PM-26 Complaint Managementno data
　💼 PM-27 Privacy Reportingno data
　💼 PM-28 Risk Framingno data
　💼 PM-29 Risk Management Program Leadership Rolesno data
　💼 PM-30 Supply Chain Risk Management Strategy1no data
　　💼 PM-30(1) Supply Chain Risk Management Strategy _ Suppliers of Critical or Mission-essential Itemsno data
　💼 PM-31 Continuous Monitoring Strategyno data
　💼 PM-32 Purposingno data
💼 PS Personnel Security9no data
　💼 PS-1 Policy and Proceduresno data
　💼 PS-2 Position Risk Designationno data
　💼 PS-3 Personnel Screening4no data
　　💼 PS-3(1) Personnel Screening _ Classified Informationno data
　　💼 PS-3(2) Personnel Screening _ Formal Indoctrinationno data
　　💼 PS-3(3) Personnel Screening _ Information Requiring Special Protective Measuresno data
　　💼 PS-3(4) Personnel Screening _ Citizenship Requirementsno data
　💼 PS-4 Personnel Termination2no data
　　💼 PS-4(1) Personnel Termination _ Post-employment Requirementsno data
　　💼 PS-4(2) Personnel Termination _ Automated Actionsno data
　💼 PS-5 Personnel Transferno data
　💼 PS-6 Access Agreements3no data
　　💼 PS-6(1) Access Agreements _ Information Requiring Special Protectionno data
　　💼 PS-6(2) Access Agreements _ Classified Information Requiring Special Protectionno data
　　💼 PS-6(3) Access Agreements _ Post-employment Requirementsno data
　💼 PS-7 External Personnel Securityno data
　💼 PS-8 Personnel Sanctionsno data
　💼 PS-9 Position Descriptionsno data
💼 PT Personally Identifiable Information Processing And Transparency8no data
　💼 PT-1 Policy and Proceduresno data
　💼 PT-2 Authority to Process Personally Identifiable Information2no data
　　💼 PT-2(1) Authority to Process Personally Identifiable Information _ Data Taggingno data
　　💼 PT-2(2) Authority to Process Personally Identifiable Information _ Automationno data
　💼 PT-3 Personally Identifiable Information Processing Purposes2no data
　　💼 PT-3(1) Personally Identifiable Information Processing Purposes _ Data Taggingno data
　　💼 PT-3(2) Personally Identifiable Information Processing Purposes _ Automationno data
　💼 PT-4 Consent3no data
　　💼 PT-4(1) Consent _ Tailored Consentno data
　　💼 PT-4(2) Consent _ Just-in-time Consentno data
　　💼 PT-4(3) Consent _ Revocationno data
　💼 PT-5 Privacy Notice2no data
　　💼 PT-5(1) Privacy Notice _ Just-in-time Noticeno data
　　💼 PT-5(2) Privacy Notice _ Privacy Act Statementsno data
　💼 PT-6 System of Records Notice2no data
　　💼 PT-6(1) System of Records Notice _ Routine Usesno data
　　💼 PT-6(2) System of Records Notice _ Exemption Rulesno data
　💼 PT-7 Specific Categories of Personally Identifiable Information2no data
　　💼 PT-7(1) Specific Categories of Personally Identifiable Information _ Social Security Numbersno data
　　💼 PT-7(2) Specific Categories of Personally Identifiable Information _ First Amendment Informationno data
　💼 PT-8 Computer Matching Requirementsno data
💼 RA Risk Assessment102no data
　💼 RA-1 Policy and Proceduresno data
　💼 RA-2 Security Categorization1no data
　　💼 RA-2(1) Security Categorization _ Impact-level Prioritizationno data
　💼 RA-3 Risk Assessment41no data
　　💼 RA-3(1) Risk Assessment _ Supply Chain Risk Assessmentno data
　　💼 RA-3(2) Risk Assessment _ Use of All-source Intelligenceno data
　　💼 RA-3(3) Risk Assessment _ Dynamic Threat Awarenessno data
　　💼 RA-3(4) Risk Assessment _ Predictive Cyber Analytics1no data
　💼 RA-4 Risk Assessment Updateno data
　💼 RA-5 Vulnerability Monitoring and Scanning111no data
　　💼 RA-5(1) Vulnerability Monitoring and Scanning _ Update Tool Capabilityno data
　　💼 RA-5(2) Vulnerability Monitoring and Scanning _ Update Vulnerabilities to Be Scannedno data
　　💼 RA-5(3) Vulnerability Monitoring and Scanning _ Breadth and Depth of Coverageno data
　　💼 RA-5(4) Vulnerability Monitoring and Scanning _ Discoverable Informationno data
　　💼 RA-5(5) Vulnerability Monitoring and Scanning _ Privileged Accessno data
　　💼 RA-5(6) Vulnerability Monitoring and Scanning _ Automated Trend Analysesno data
　　💼 RA-5(7) Vulnerability Monitoring and Scanning _ Automated Detection and Notification of Unauthorized Componentsno data
　　💼 RA-5(8) Vulnerability Monitoring and Scanning _ Review Historic Audit Logsno data
　　💼 RA-5(9) Vulnerability Monitoring and Scanning _ Penetration Testing and Analysesno data
　　💼 RA-5(10) Vulnerability Monitoring and Scanning _ Correlate Scanning Informationno data
　　💼 RA-5(11) Vulnerability Monitoring and Scanning _ Public Disclosure Programno data
　💼 RA-6 Technical Surveillance Countermeasures Surveyno data
　💼 RA-7 Risk Responseno data
　💼 RA-8 Privacy Impact Assessmentsno data
　💼 RA-9 Criticality Analysisno data
　💼 RA-10 Threat Huntingno data
💼 SA System And Services Acquisition23110no data
　💼 SA-1 Policy and Proceduresno data
　💼 SA-2 Allocation of Resourcesno data
　💼 SA-3 System Development Life Cycle34no data
　　💼 SA-3(1) System Development Life Cycle _ Manage Preproduction Environmentno data
　　💼 SA-3(2) System Development Life Cycle _ Use of Live or Operational Datano data
　　💼 SA-3(3) System Development Life Cycle _ Technology Refreshno data
　💼 SA-4 Acquisition Process12no data
　　💼 SA-4(1) Acquisition Process _ Functional Properties of Controlsno data
　　💼 SA-4(2) Acquisition Process _ Design and Implementation Information for Controlsno data
　　💼 SA-4(3) Acquisition Process _ Development Methods, Techniques, and Practicesno data
　　💼 SA-4(4) Acquisition Process _ Assignment of Components to Systemsno data
　　💼 SA-4(5) Acquisition Process _ System, Component, and Service Configurationsno data
　　💼 SA-4(6) Acquisition Process _ Use of Information Assurance Productsno data
　　💼 SA-4(7) Acquisition Process _ NIAP-approved Protection Profilesno data
　　💼 SA-4(8) Acquisition Process _ Continuous Monitoring Plan for Controlsno data
　　💼 SA-4(9) Acquisition Process _ Functions, Ports, Protocols, and Services in Useno data
　　💼 SA-4(10) Acquisition Process _ Use of Approved PIV Productsno data
　　💼 SA-4(11) Acquisition Process _ System of Recordsno data
　　💼 SA-4(12) Acquisition Process _ Data Ownershipno data
　💼 SA-5 System Documentation5no data
　　💼 SA-5(1) System Documentation _ Functional Properties of Security Controlsno data
　　💼 SA-5(2) System Documentation _ Security-relevant External System Interfacesno data
　　💼 SA-5(3) System Documentation _ High-level Designno data
　　💼 SA-5(4) System Documentation _ Low-level Designno data
　　💼 SA-5(5) System Documentation _ Source Codeno data
　💼 SA-6 Software Usage Restrictionsno data
　💼 SA-7 User-installed Softwareno data
　💼 SA-8 Security and Privacy Engineering Principles338no data
　　💼 SA-8(1) Security and Privacy Engineering Principles _ Clear Abstractionsno data
　　💼 SA-8(2) Security and Privacy Engineering Principles _ Least Common Mechanismno data
　　💼 SA-8(3) Security and Privacy Engineering Principles _ Modularity and Layeringno data
　　💼 SA-8(4) Security and Privacy Engineering Principles _ Partially Ordered Dependenciesno data
　　💼 SA-8(5) Security and Privacy Engineering Principles _ Efficiently Mediated Accessno data
　　💼 SA-8(6) Security and Privacy Engineering Principles _ Minimized Sharingno data
　　💼 SA-8(7) Security and Privacy Engineering Principles _ Reduced Complexityno data
　　💼 SA-8(8) Security and Privacy Engineering Principles _ Secure Evolvabilityno data
　　💼 SA-8(9) Security and Privacy Engineering Principles _ Trusted Componentsno data
　　💼 SA-8(10) Security and Privacy Engineering Principles _ Hierarchical Trustno data
　　💼 SA-8(11) Security and Privacy Engineering Principles _ Inverse Modification Thresholdno data
　　💼 SA-8(12) Security and Privacy Engineering Principles _ Hierarchical Protectionno data
　　💼 SA-8(13) Security and Privacy Engineering Principles _ Minimized Security Elementsno data
　　💼 SA-8(14) Security and Privacy Engineering Principles _ Least Privilegeno data
　　💼 SA-8(15) Security and Privacy Engineering Principles _ Predicate Permissionno data
　　💼 SA-8(16) Security and Privacy Engineering Principles _ Self-reliant Trustworthinessno data
　　💼 SA-8(17) Security and Privacy Engineering Principles _ Secure Distributed Compositionno data
　　💼 SA-8(18) Security and Privacy Engineering Principles _ Trusted Communications Channelsno data
　　💼 SA-8(19) Security and Privacy Engineering Principles _ Continuous Protection1no data
　　💼 SA-8(20) Security and Privacy Engineering Principles _ Secure Metadata Managementno data
　　💼 SA-8(21) Security and Privacy Engineering Principles _ Self-analysis1no data
　　💼 SA-8(22) Security and Privacy Engineering Principles _ Accountability and Traceability1no data
　　💼 SA-8(23) Security and Privacy Engineering Principles _ Secure Defaultsno data
　　💼 SA-8(24) Security and Privacy Engineering Principles _ Secure Failure and Recoveryno data
　　💼 SA-8(25) Security and Privacy Engineering Principles _ Economic Security1no data
　　💼 SA-8(26) Security and Privacy Engineering Principles _ Performance Securityno data
　　💼 SA-8(27) Security and Privacy Engineering Principles _ Human Factored Securityno data
　　💼 SA-8(28) Security and Privacy Engineering Principles _ Acceptable Securityno data
　　💼 SA-8(29) Security and Privacy Engineering Principles _ Repeatable and Documented Proceduresno data
　　💼 SA-8(30) Security and Privacy Engineering Principles _ Procedural Rigorno data
　　💼 SA-8(31) Security and Privacy Engineering Principles _ Secure System Modificationno data
　　💼 SA-8(32) Security and Privacy Engineering Principles _ Sufficient Documentationno data
　　💼 SA-8(33) Security and Privacy Engineering Principles _ Minimizationno data
　💼 SA-9 External System Services811no data
　　💼 SA-9(1) External System Services _ Risk Assessments and Organizational Approvalsno data
　　💼 SA-9(2) External System Services _ Identification of Functions, Ports, Protocols, and Servicesno data
　　💼 SA-9(3) External System Services _ Establish and Maintain Trust Relationship with Providersno data
　　💼 SA-9(4) External System Services _ Consistent Interests of Consumers and Providersno data
　　💼 SA-9(5) External System Services _ Processing, Storage, and Service Location11no data
　　💼 SA-9(6) External System Services _ Organization-controlled Cryptographic Keysno data
　　💼 SA-9(7) External System Services _ Organization-controlled Integrity Checkingno data
　　💼 SA-9(8) External System Services _ Processing and Storage Location — U.S. Jurisdictionno data
　💼 SA-10 Developer Configuration Management73no data
　　💼 SA-10(1) Developer Configuration Management _ Software and Firmware Integrity Verificationno data
　　💼 SA-10(2) Developer Configuration Management _ Alternative Configuration Management Processesno data
　　💼 SA-10(3) Developer Configuration Management _ Hardware Integrity Verificationno data
　　💼 SA-10(4) Developer Configuration Management _ Trusted Generationno data
　　💼 SA-10(5) Developer Configuration Management _ Mapping Integrity for Version Controlno data
　　💼 SA-10(6) Developer Configuration Management _ Trusted Distributionno data
　　💼 SA-10(7) Developer Configuration Management _ Security and Privacy Representativesno data
　💼 SA-11 Developer Testing and Evaluation91no data
　　💼 SA-11(1) Developer Testing and Evaluation _ Static Code Analysis1no data
　　💼 SA-11(2) Developer Testing and Evaluation _ Threat Modeling and Vulnerability Analysesno data
　　💼 SA-11(3) Developer Testing and Evaluation _ Independent Verification of Assessment Plans and Evidenceno data
　　💼 SA-11(4) Developer Testing and Evaluation _ Manual Code Reviewsno data
　　💼 SA-11(5) Developer Testing and Evaluation _ Penetration Testingno data
　　💼 SA-11(6) Developer Testing and Evaluation _ Attack Surface Reviews1no data
　　💼 SA-11(7) Developer Testing and Evaluation _ Verify Scope of Testing and Evaluationno data
　　💼 SA-11(8) Developer Testing and Evaluation _ Dynamic Code Analysisno data
　　💼 SA-11(9) Developer Testing and Evaluation _ Interactive Application Security Testingno data
　💼 SA-12 Supply Chain Protection15no data
　　💼 SA-12(1) Supply Chain Protection _ Acquisition Strategies / Tools / Methodsno data
　　💼 SA-12(2) Supply Chain Protection _ Supplier Reviewsno data
　　💼 SA-12(3) Supply Chain Protection _ Trusted Shipping and Warehousingno data
　　💼 SA-12(4) Supply Chain Protection _ Diversity of Suppliersno data
　　💼 SA-12(5) Supply Chain Protection _ Limitation of Harmno data
　　💼 SA-12(6) Supply Chain Protection _ Minimizing Procurement Timeno data
　　💼 SA-12(7) Supply Chain Protection _ Assessments Prior to Selection / Acceptance / Updateno data
　　💼 SA-12(8) Supply Chain Protection _ Use of All-source Intelligenceno data
　　💼 SA-12(9) Supply Chain Protection _ Operations Securityno data
　　💼 SA-12(10) Supply Chain Protection _ Validate as Genuine and Not Alteredno data
　　💼 SA-12(11) Supply Chain Protection _ Penetration Testing / Analysis of Elements, Processes, and Actorsno data
　　💼 SA-12(12) Supply Chain Protection _ Inter-organizational Agreementsno data
　　💼 SA-12(13) Supply Chain Protection _ Critical Information System Componentsno data
　　💼 SA-12(14) Supply Chain Protection _ Identity and Traceabilityno data
　　💼 SA-12(15) Supply Chain Protection _ Processes to Address Weaknesses or Deficienciesno data
　💼 SA-13 Trustworthinessno data
　💼 SA-14 Criticality Analysis1no data
　　💼 SA-14(1) Criticality Analysis _ Critical Components with No Viable Alternative Sourcingno data
　💼 SA-15 Development Process, Standards, and Tools121no data
　　💼 SA-15(1) Development Process, Standards, and Tools _ Quality Metricsno data
　　💼 SA-15(2) Development Process, Standards, and Tools _ Security and Privacy Tracking Tools1no data
　　💼 SA-15(3) Development Process, Standards, and Tools _ Criticality Analysisno data
　　💼 SA-15(4) Development Process, Standards, and Tools _ Threat Modeling and Vulnerability Analysisno data
　　💼 SA-15(5) Development Process, Standards, and Tools _ Attack Surface Reductionno data
　　💼 SA-15(6) Development Process, Standards, and Tools _ Continuous Improvementno data
　　💼 SA-15(7) Development Process, Standards, and Tools _ Automated Vulnerability Analysisno data
　　💼 SA-15(8) Development Process, Standards, and Tools _ Reuse of Threat and Vulnerability Information1no data
　　💼 SA-15(9) Development Process, Standards, and Tools _ Use of Live Datano data
　　💼 SA-15(10) Development Process, Standards, and Tools _ Incident Response Planno data
　　💼 SA-15(11) Development Process, Standards, and Tools _ Archive System or Componentno data
　　💼 SA-15(12) Development Process, Standards, and Tools _ Minimize Personally Identifiable Informationno data
　💼 SA-16 Developer-provided Trainingno data
　💼 SA-17 Developer Security and Privacy Architecture and Design9no data
　　💼 SA-17(1) Developer Security and Privacy Architecture and Design _ Formal Policy Modelno data
　　💼 SA-17(2) Developer Security and Privacy Architecture and Design _ Security-relevant Componentsno data
　　💼 SA-17(3) Developer Security and Privacy Architecture and Design _ Formal Correspondenceno data
　　💼 SA-17(4) Developer Security and Privacy Architecture and Design _ Informal Correspondenceno data
　　💼 SA-17(5) Developer Security and Privacy Architecture and Design _ Conceptually Simple Designno data
　　💼 SA-17(6) Developer Security and Privacy Architecture and Design _ Structure for Testingno data
　　💼 SA-17(7) Developer Security and Privacy Architecture and Design _ Structure for Least Privilegeno data
　　💼 SA-17(8) Developer Security and Privacy Architecture and Design _ Orchestrationno data
　　💼 SA-17(9) Developer Security and Privacy Architecture and Design _ Design Diversityno data
　💼 SA-18 Tamper Resistance and Detection2no data
　　💼 SA-18(1) Tamper Resistance and Detection _ Multiple Phases of System Development Life Cycleno data
　　💼 SA-18(2) Tamper Resistance and Detection _ Inspection of Systems or Componentsno data
　💼 SA-19 Component Authenticity4no data
　　💼 SA-19(1) Component Authenticity _ Anti-counterfeit Trainingno data
　　💼 SA-19(2) Component Authenticity _ Configuration Control for Component Service and Repairno data
　　💼 SA-19(3) Component Authenticity _ Component Disposalno data
　　💼 SA-19(4) Component Authenticity _ Anti-counterfeit Scanningno data
　💼 SA-20 Customized Development of Critical Componentsno data
　💼 SA-21 Developer Screening1no data
　　💼 SA-21(1) Developer Screening _ Validation of Screeningno data
　💼 SA-22 Unsupported System Components1no data
　　💼 SA-22(1) Unsupported System Components _ Alternative Sources for Continued Supportno data
　💼 SA-23 Specializationno data
💼 SC System And Communications Protection512682no data
　💼 SC-1 Policy and Proceduresno data
　💼 SC-2 Separation of System and User Functionality2no data
　　💼 SC-2(1) Separation of System and User Functionality _ Interfaces for Non-privileged Usersno data
　　💼 SC-2(2) Separation of System and User Functionality _ Disassociabilityno data
　💼 SC-3 Security Function Isolation5no data
　　💼 SC-3(1) Security Function Isolation _ Hardware Separationno data
　　💼 SC-3(2) Security Function Isolation _ Access and Flow Control Functionsno data
　　💼 SC-3(3) Security Function Isolation _ Minimize Nonsecurity Functionalityno data
　　💼 SC-3(4) Security Function Isolation _ Module Coupling and Cohesivenessno data
　　💼 SC-3(5) Security Function Isolation _ Layered Structuresno data
　💼 SC-4 Information in Shared System Resources2no data
　　💼 SC-4(1) Information in Shared System Resources _ Security Levelsno data
　　💼 SC-4(2) Information in Shared System Resources _ Multilevel or Periods Processingno data
　💼 SC-5 Denial-of-service Protection38no data
　　💼 SC-5(1) Denial-of-service Protection _ Restrict Ability to Attack Other Systems1no data
　　💼 SC-5(2) Denial-of-service Protection _ Capacity, Bandwidth, and Redundancy7no data
　　💼 SC-5(3) Denial-of-service Protection _ Detection and Monitoring1no data
　💼 SC-6 Resource Availabilityno data
　💼 SC-7 Boundary Protection29450no data
　　💼 SC-7(1) Boundary Protection _ Physically Separated Subnetworksno data
　　💼 SC-7(2) Boundary Protection _ Public Accessno data
　　💼 SC-7(3) Boundary Protection _ Access Points8no data
　　💼 SC-7(4) Boundary Protection _ External Telecommunications Services28no data
　　💼 SC-7(5) Boundary Protection _ Deny by Default — Allow by Exception418no data
　　💼 SC-7(6) Boundary Protection _ Response to Recognized Failuresno data
　　💼 SC-7(7) Boundary Protection _ Split Tunneling for Remote Devicesno data
　　💼 SC-7(8) Boundary Protection _ Route Traffic to Authenticated Proxy Serversno data
　　💼 SC-7(9) Boundary Protection _ Restrict Threatening Outgoing Communications Traffic14no data
　　💼 SC-7(10) Boundary Protection _ Prevent Exfiltration6no data
　　💼 SC-7(11) Boundary Protection _ Restrict Incoming Communications Traffic22no data
　　💼 SC-7(12) Boundary Protection _ Host-based Protectionno data
　　💼 SC-7(13) Boundary Protection _ Isolation of Security Tools, Mechanisms, and Support Componentsno data
　　💼 SC-7(14) Boundary Protection _ Protect Against Unauthorized Physical Connectionsno data
　　💼 SC-7(15) Boundary Protection _ Networked Privileged Accessesno data
　　💼 SC-7(16) Boundary Protection _ Prevent Discovery of System Components23no data
　　💼 SC-7(17) Boundary Protection _ Automated Enforcement of Protocol Formatsno data
　　💼 SC-7(18) Boundary Protection _ Fail Secureno data
　　💼 SC-7(19) Boundary Protection _ Block Communication from Non-organizationally Configured Hostsno data
　　💼 SC-7(20) Boundary Protection _ Dynamic Isolation and Segregation8no data
　　💼 SC-7(21) Boundary Protection _ Isolation of System Components22no data
　　💼 SC-7(22) Boundary Protection _ Separate Subnets for Connecting to Different Security Domainsno data
　　💼 SC-7(23) Boundary Protection _ Disable Sender Feedback on Protocol Validation Failureno data
　　💼 SC-7(24) Boundary Protection _ Personally Identifiable Informationno data
　　💼 SC-7(25) Boundary Protection _ Unclassified National Security System Connectionsno data
　　💼 SC-7(26) Boundary Protection _ Classified National Security System Connectionsno data
　　💼 SC-7(27) Boundary Protection _ Unclassified Non-national Security System Connectionsno data
　　💼 SC-7(28) Boundary Protection _ Connections to Public Networksno data
　　💼 SC-7(29) Boundary Protection _ Separate Subnets to Isolate Functionsno data
　💼 SC-8 Transmission Confidentiality and Integrity5816no data
　　💼 SC-8(1) Transmission Confidentiality and Integrity _ Cryptographic Protection815no data
　　💼 SC-8(2) Transmission Confidentiality and Integrity _ Pre- and Post-transmission Handling7no data
　　💼 SC-8(3) Transmission Confidentiality and Integrity _ Cryptographic Protection for Message Externalsno data
　　💼 SC-8(4) Transmission Confidentiality and Integrity _ Conceal or Randomize Communicationsno data
　　💼 SC-8(5) Transmission Confidentiality and Integrity _ Protected Distribution Systemno data
　💼 SC-9 Transmission Confidentialityno data
　💼 SC-10 Network Disconnectno data
　💼 SC-11 Trusted Path1no data
　　💼 SC-11(1) Trusted Path _ Irrefutable Communications Pathno data
　💼 SC-12 Cryptographic Key Establishment and Management617no data
　　💼 SC-12(1) Cryptographic Key Establishment and Management _ Availabilityno data
　　💼 SC-12(2) Cryptographic Key Establishment and Management _ Symmetric Keys11no data
　　💼 SC-12(3) Cryptographic Key Establishment and Management _ Asymmetric Keys6no data
　　💼 SC-12(4) Cryptographic Key Establishment and Management _ PKI Certificatesno data
　　💼 SC-12(5) Cryptographic Key Establishment and Management _ PKI Certificates / Hardware Tokensno data
　　💼 SC-12(6) Cryptographic Key Establishment and Management _ Physical Control of Keysno data
　💼 SC-13 Cryptographic Protection413no data
　　💼 SC-13(1) Cryptographic Protection _ FIPS-validated Cryptographyno data
　　💼 SC-13(2) Cryptographic Protection _ NSA-approved Cryptographyno data
　　💼 SC-13(3) Cryptographic Protection _ Individuals Without Formal Access Approvalsno data
　　💼 SC-13(4) Cryptographic Protection _ Digital Signaturesno data
　💼 SC-14 Public Access Protectionsno data
　💼 SC-15 Collaborative Computing Devices and Applications4no data
　　💼 SC-15(1) Collaborative Computing Devices and Applications _ Physical or Logical Disconnectno data
　　💼 SC-15(2) Collaborative Computing Devices and Applications _ Blocking Inbound and Outbound Communications Trafficno data
　　💼 SC-15(3) Collaborative Computing Devices and Applications _ Disabling and Removal in Secure Work Areasno data
　　💼 SC-15(4) Collaborative Computing Devices and Applications _ Explicitly Indicate Current Participantsno data
　💼 SC-16 Transmission of Security and Privacy Attributes3no data
　　💼 SC-16(1) Transmission of Security and Privacy Attributes _ Integrity Verificationno data
　　💼 SC-16(2) Transmission of Security and Privacy Attributes _ Anti-spoofing Mechanismsno data
　　💼 SC-16(3) Transmission of Security and Privacy Attributes _ Cryptographic Bindingno data
　💼 SC-17 Public Key Infrastructure Certificatesno data
　💼 SC-18 Mobile Code5no data
　　💼 SC-18(1) Mobile Code _ Identify Unacceptable Code and Take Corrective Actionsno data
　　💼 SC-18(2) Mobile Code _ Acquisition, Development, and Useno data
　　💼 SC-18(3) Mobile Code _ Prevent Downloading and Executionno data
　　💼 SC-18(4) Mobile Code _ Prevent Automatic Executionno data
　　💼 SC-18(5) Mobile Code _ Allow Execution Only in Confined Environmentsno data
　💼 SC-19 Voice Over Internet Protocolno data
　💼 SC-20 Secure Name/address Resolution Service (authoritative Source)2no data
　　💼 SC-20(1) Secure Name/address Resolution Service (authoritative Source) _ Child Subspacesno data
　　💼 SC-20(2) Secure Name/address Resolution Service (authoritative Source) _ Data Origin and Integrityno data
　💼 SC-21 Secure Name/address Resolution Service (recursive or Caching Resolver)1no data
　　💼 SC-21(1) Secure Name/address Resolution Service (recursive or Caching Resolver) _ Data Origin and Integrityno data
　💼 SC-22 Architecture and Provisioning for Name/address Resolution Serviceno data
　💼 SC-23 Session Authenticity57no data
　　💼 SC-23(1) Session Authenticity _ Invalidate Session Identifiers at Logoutno data
　　💼 SC-23(2) Session Authenticity _ User-initiated Logouts and Message Displaysno data
　　💼 SC-23(3) Session Authenticity _ Unique System-generated Session Identifiers6no data
　　💼 SC-23(4) Session Authenticity _ Unique Session Identifiers with Randomizationno data
　　💼 SC-23(5) Session Authenticity _ Allowed Certificate Authoritiesno data
　💼 SC-24 Fail in Known Stateno data
　💼 SC-25 Thin Nodesno data
　💼 SC-26 Decoys1no data
　　💼 SC-26(1) Decoys _ Detection of Malicious Codeno data
　💼 SC-27 Platform-independent Applicationsno data
　💼 SC-28 Protection of Information at Rest31625no data
　　💼 SC-28(1) Protection of Information at Rest _ Cryptographic Protection1014no data
　　💼 SC-28(2) Protection of Information at Rest _ Offline Storageno data
　　💼 SC-28(3) Protection of Information at Rest _ Cryptographic Keys1no data
　💼 SC-29 Heterogeneity1no data
　　💼 SC-29(1) Heterogeneity _ Virtualization Techniquesno data
　💼 SC-30 Concealment and Misdirection5no data
　　💼 SC-30(1) Concealment and Misdirection _ Virtualization Techniquesno data
　　💼 SC-30(2) Concealment and Misdirection _ Randomnessno data
　　💼 SC-30(3) Concealment and Misdirection _ Change Processing and Storage Locationsno data
　　💼 SC-30(4) Concealment and Misdirection _ Misleading Informationno data
　　💼 SC-30(5) Concealment and Misdirection _ Concealment of System Componentsno data
　💼 SC-31 Covert Channel Analysis3no data
　　💼 SC-31(1) Covert Channel Analysis _ Test Covert Channels for Exploitabilityno data
　　💼 SC-31(2) Covert Channel Analysis _ Maximum Bandwidthno data
　　💼 SC-31(3) Covert Channel Analysis _ Measure Bandwidth in Operational Environmentsno data
　💼 SC-32 System Partitioning1no data
　　💼 SC-32(1) System Partitioning _ Separate Physical Domains for Privileged Functionsno data
　💼 SC-33 Transmission Preparation Integrityno data
　💼 SC-34 Non-modifiable Executable Programs3no data
　　💼 SC-34(1) Non-modifiable Executable Programs _ No Writable Storageno data
　　💼 SC-34(2) Non-modifiable Executable Programs _ Integrity Protection on Read-only Mediano data
　　💼 SC-34(3) Non-modifiable Executable Programs _ Hardware-based Protectionno data
　💼 SC-35 External Malicious Code Identificationno data
　💼 SC-36 Distributed Processing and Storage25no data
　　💼 SC-36(1) Distributed Processing and Storage _ Polling Techniquesno data
　　💼 SC-36(2) Distributed Processing and Storage _ Synchronizationno data
　💼 SC-37 Out-of-band Channels1no data
　　💼 SC-37(1) Out-of-band Channels _ Ensure Delivery and Transmissionno data
　💼 SC-38 Operations Securityno data
　💼 SC-39 Process Isolation2no data
　　💼 SC-39(1) Process Isolation _ Hardware Separationno data
　　💼 SC-39(2) Process Isolation _ Separate Execution Domain Per Threadno data
　💼 SC-40 Wireless Link Protection4no data
　　💼 SC-40(1) Wireless Link Protection _ Electromagnetic Interferenceno data
　　💼 SC-40(2) Wireless Link Protection _ Reduce Detection Potentialno data
　　💼 SC-40(3) Wireless Link Protection _ Imitative or Manipulative Communications Deceptionno data
　　💼 SC-40(4) Wireless Link Protection _ Signal Parameter Identificationno data
　💼 SC-41 Port and I/O Device Accessno data
　💼 SC-42 Sensor Capability and Data5no data
　　💼 SC-42(1) Sensor Capability and Data _ Reporting to Authorized Individuals or Rolesno data
　　💼 SC-42(2) Sensor Capability and Data _ Authorized Useno data
　　💼 SC-42(3) Sensor Capability and Data _ Prohibit Use of Devicesno data
　　💼 SC-42(4) Sensor Capability and Data _ Notice of Collectionno data
　　💼 SC-42(5) Sensor Capability and Data _ Collection Minimizationno data
　💼 SC-43 Usage Restrictionsno data
　💼 SC-44 Detonation Chambersno data
　💼 SC-45 System Time Synchronization2no data
　　💼 SC-45(1) System Time Synchronization _ Synchronization with Authoritative Time Sourceno data
　　💼 SC-45(2) System Time Synchronization _ Secondary Authoritative Time Sourceno data
　💼 SC-46 Cross Domain Policy Enforcementno data
　💼 SC-47 Alternate Communications Pathsno data
　💼 SC-48 Sensor Relocation1no data
　　💼 SC-48(1) Sensor Relocation _ Dynamic Relocation of Sensors or Monitoring Capabilitiesno data
　💼 SC-49 Hardware-enforced Separation and Policy Enforcementno data
　💼 SC-50 Software-enforced Separation and Policy Enforcementno data
　💼 SC-51 Hardware-based Protectionno data
💼 SI System And Information Integrity232057no data
　💼 SI-1 Policy and Proceduresno data
　💼 SI-2 Flaw Remediation6610no data
　　💼 SI-2(1) Flaw Remediation _ Central Managementno data
　　💼 SI-2(2) Flaw Remediation _ Automated Flaw Remediation Status14no data
　　💼 SI-2(3) Flaw Remediation _ Time to Remediate Flaws and Benchmarks for Corrective Actionsno data
　　💼 SI-2(4) Flaw Remediation _ Automated Patch Management Tools4no data
　　💼 SI-2(5) Flaw Remediation _ Automatic Software and Firmware Updates24no data
　　💼 SI-2(6) Flaw Remediation _ Removal of Previous Versions of Software and Firmware66no data
　💼 SI-3 Malicious Code Protection106no data
　　💼 SI-3(1) Malicious Code Protection _ Central Managementno data
　　💼 SI-3(2) Malicious Code Protection _ Automatic Updatesno data
　　💼 SI-3(3) Malicious Code Protection _ Non-privileged Usersno data
　　💼 SI-3(4) Malicious Code Protection _ Updates Only by Privileged Usersno data
　　💼 SI-3(5) Malicious Code Protection _ Portable Storage Devicesno data
　　💼 SI-3(6) Malicious Code Protection _ Testing and Verificationno data
　　💼 SI-3(7) Malicious Code Protection _ Nonsignature-based Detectionno data
　　💼 SI-3(8) Malicious Code Protection _ Detect Unauthorized Commands6no data
　　💼 SI-3(9) Malicious Code Protection _ Authenticate Remote Commandsno data
　　💼 SI-3(10) Malicious Code Protection _ Malicious Code Analysisno data
　💼 SI-4 System Monitoring25110no data
　　💼 SI-4(1) System Monitoring _ System-wide Intrusion Detection System1no data
　　💼 SI-4(2) System Monitoring _ Automated Tools and Mechanisms for Real-time Analysis1no data
　　💼 SI-4(3) System Monitoring _ Automated Tool and Mechanism Integrationno data
　　💼 SI-4(4) System Monitoring _ Inbound and Outbound Communications Traffic12no data
　　💼 SI-4(5) System Monitoring _ System-generated Alerts1no data
　　💼 SI-4(6) System Monitoring _ Restrict Non-privileged Usersno data
　　💼 SI-4(7) System Monitoring _ Automated Response to Suspicious Eventsno data
　　💼 SI-4(8) System Monitoring _ Protection of Monitoring Informationno data
　　💼 SI-4(9) System Monitoring _ Testing of Monitoring Tools and Mechanismsno data
　　💼 SI-4(10) System Monitoring _ Visibility of Encrypted Communicationsno data
　　💼 SI-4(11) System Monitoring _ Analyze Communications Traffic Anomaliesno data
　　💼 SI-4(12) System Monitoring _ Automated Organization-generated Alerts1no data
　　💼 SI-4(13) System Monitoring _ Analyze Traffic and Event Patterns1no data
　　💼 SI-4(14) System Monitoring _ Wireless Intrusion Detectionno data
　　💼 SI-4(15) System Monitoring _ Wireless to Wireline Communicationsno data
　　💼 SI-4(16) System Monitoring _ Correlate Monitoring Informationno data
　　💼 SI-4(17) System Monitoring _ Integrated Situational Awarenessno data
　　💼 SI-4(18) System Monitoring _ Analyze Traffic and Covert Exfiltrationno data
　　💼 SI-4(19) System Monitoring _ Risk for Individualsno data
　　💼 SI-4(20) System Monitoring _ Privileged Users5no data
　　💼 SI-4(21) System Monitoring _ Probationary Periodsno data
　　💼 SI-4(22) System Monitoring _ Unauthorized Network Services1no data
　　💼 SI-4(23) System Monitoring _ Host-based Devicesno data
　　💼 SI-4(24) System Monitoring _ Indicators of Compromiseno data
　　💼 SI-4(25) System Monitoring _ Optimize Network Traffic Analysis1no data
　💼 SI-5 Security Alerts, Advisories, and Directives1no data
　　💼 SI-5(1) Security Alerts, Advisories, and Directives _ Automated Alerts and Advisoriesno data
　💼 SI-6 Security and Privacy Function Verification3no data
　　💼 SI-6(1) Security and Privacy Function Verification _ Notification of Failed Security Testsno data
　　💼 SI-6(2) Security and Privacy Function Verification _ Automation Support for Distributed Testingno data
　　💼 SI-6(3) Security and Privacy Function Verification _ Report Verification Resultsno data
　💼 SI-7 Software, Firmware, and Information Integrity171943no data
　　💼 SI-7(1) Software, Firmware, and Information Integrity _ Integrity Checks1no data
　　💼 SI-7(2) Software, Firmware, and Information Integrity _ Automated Notifications of Integrity Violationsno data
　　💼 SI-7(3) Software, Firmware, and Information Integrity _ Centrally Managed Integrity Tools1no data
　　💼 SI-7(4) Software, Firmware, and Information Integrity _ Tamper-evident Packagingno data
　　💼 SI-7(5) Software, Firmware, and Information Integrity _ Automated Response to Integrity Violationsno data
　　💼 SI-7(6) Software, Firmware, and Information Integrity _ Cryptographic Protection12no data
　　💼 SI-7(7) Software, Firmware, and Information Integrity _ Integration of Detection and Response1no data
　　💼 SI-7(8) Software, Firmware, and Information Integrity _ Auditing Capability for Significant Events8no data
　　💼 SI-7(9) Software, Firmware, and Information Integrity _ Verify Boot Processno data
　　💼 SI-7(10) Software, Firmware, and Information Integrity _ Protection of Boot Firmwareno data
　　💼 SI-7(11) Software, Firmware, and Information Integrity _ Confined Environments with Limited Privilegesno data
　　💼 SI-7(12) Software, Firmware, and Information Integrity _ Integrity Verification1921no data
　　💼 SI-7(13) Software, Firmware, and Information Integrity _ Code Execution in Protected Environmentsno data
　　💼 SI-7(14) Software, Firmware, and Information Integrity _ Binary or Machine Executable Codeno data
　　💼 SI-7(15) Software, Firmware, and Information Integrity _ Code Authenticationno data
　　💼 SI-7(16) Software, Firmware, and Information Integrity _ Time Limit on Process Execution Without Supervisionno data
　　💼 SI-7(17) Software, Firmware, and Information Integrity _ Runtime Application Self-protectionno data
　💼 SI-8 Spam Protection3no data
　　💼 SI-8(1) Spam Protection _ Central Managementno data
　　💼 SI-8(2) Spam Protection _ Automatic Updatesno data
　　💼 SI-8(3) Spam Protection _ Continuous Learning Capabilityno data
　💼 SI-9 Information Input Restrictionsno data
　💼 SI-10 Information Input Validation6no data
　　💼 SI-10(1) Information Input Validation _ Manual Override Capabilityno data
　　💼 SI-10(2) Information Input Validation _ Review and Resolve Errorsno data
　　💼 SI-10(3) Information Input Validation _ Predictable Behaviorno data
　　💼 SI-10(4) Information Input Validation _ Timing Interactionsno data
　　💼 SI-10(5) Information Input Validation _ Restrict Inputs to Trusted Sources and Approved Formatsno data
　　💼 SI-10(6) Information Input Validation _ Injection Preventionno data
　💼 SI-11 Error Handlingno data
　💼 SI-12 Information Management and Retention32no data
　　💼 SI-12(1) Information Management and Retention _ Limit Personally Identifiable Information Elementsno data
　　💼 SI-12(2) Information Management and Retention _ Minimize Personally Identifiable Information in Testing, Training, and Researchno data
　　💼 SI-12(3) Information Management and Retention _ Information Disposalno data
　💼 SI-13 Predictable Failure Prevention57no data
　　💼 SI-13(1) Predictable Failure Prevention _ Transferring Component Responsibilitiesno data
　　💼 SI-13(2) Predictable Failure Prevention _ Time Limit on Process Execution Without Supervisionno data
　　💼 SI-13(3) Predictable Failure Prevention _ Manual Transfer Between Componentsno data
　　💼 SI-13(4) Predictable Failure Prevention _ Standby Component Installation and Notificationno data
　　💼 SI-13(5) Predictable Failure Prevention _ Failover Capability7no data
　💼 SI-14 Non-persistence3no data
　　💼 SI-14(1) Non-persistence _ Refresh from Trusted Sourcesno data
　　💼 SI-14(2) Non-persistence _ Non-persistent Informationno data
　　💼 SI-14(3) Non-persistence _ Non-persistent Connectivityno data
　💼 SI-15 Information Output Filteringno data
　💼 SI-16 Memory Protectionno data
　💼 SI-17 Fail-safe Proceduresno data
　💼 SI-18 Personally Identifiable Information Quality Operations5no data
　　💼 SI-18(1) Personally Identifiable Information Quality Operations _ Automation Supportno data
　　💼 SI-18(2) Personally Identifiable Information Quality Operations _ Data Tagsno data
　　💼 SI-18(3) Personally Identifiable Information Quality Operations _ Collectionno data
　　💼 SI-18(4) Personally Identifiable Information Quality Operations _ Individual Requestsno data
　　💼 SI-18(5) Personally Identifiable Information Quality Operations _ Notice of Correction or Deletionno data
　💼 SI-19 De-identification8no data
　　💼 SI-19(1) De-identification _ Collectionno data
　　💼 SI-19(2) De-identification _ Archivingno data
　　💼 SI-19(3) De-identification _ Releaseno data
　　💼 SI-19(4) De-identification _ Removal, Masking, Encryption, Hashing, or Replacement of Direct Identifiersno data
　　💼 SI-19(5) De-identification _ Statistical Disclosure Controlno data
　　💼 SI-19(6) De-identification _ Differential Privacyno data
　　💼 SI-19(7) De-identification _ Validated Algorithms and Softwareno data
　　💼 SI-19(8) De-identification _ Motivated Intruderno data
　💼 SI-20 Tainting1no data
　💼 SI-21 Information Refreshno data
　💼 SI-22 Information Diversityno data
　💼 SI-23 Information Fragmentationno data
💼 SR Supply Chain Risk Management12no data
　💼 SR-1 Policy and Proceduresno data
　💼 SR-2 Supply Chain Risk Management Plan1no data
　　💼 SR-2(1) Supply Chain Risk Management Plan _ Establish SCRM Teamno data
　💼 SR-3 Supply Chain Controls and Processes3no data
　　💼 SR-3(1) Supply Chain Controls and Processes _ Diverse Supply Baseno data
　　💼 SR-3(2) Supply Chain Controls and Processes _ Limitation of Harmno data
　　💼 SR-3(3) Supply Chain Controls and Processes _ Sub-tier Flow Downno data
　💼 SR-4 Provenance4no data
　　💼 SR-4(1) Provenance _ Identityno data
　　💼 SR-4(2) Provenance _ Track and Traceno data
　　💼 SR-4(3) Provenance _ Validate as Genuine and Not Alteredno data
　　💼 SR-4(4) Provenance _ Supply Chain Integrity — Pedigreeno data
　💼 SR-5 Acquisition Strategies, Tools, and Methods2no data
　　💼 SR-5(1) Acquisition Strategies, Tools, and Methods _ Adequate Supplyno data
　　💼 SR-5(2) Acquisition Strategies, Tools, and Methods _ Assessments Prior to Selection, Acceptance, Modification, or Updateno data
　💼 SR-6 Supplier Assessments and Reviews1no data
　　💼 SR-6(1) Supplier Assessments and Reviews _ Testing and Analysisno data
　💼 SR-7 Supply Chain Operations Securityno data
　💼 SR-8 Notification Agreementsno data
　💼 SR-9 Tamper Resistance and Detection1no data
　　💼 SR-9(1) Tamper Resistance and Detection _ Multiple Stages of System Development Life Cycleno data
　💼 SR-10 Inspection of Systems or Componentsno data
　💼 SR-11 Component Authenticity3no data
　　💼 SR-11(1) Component Authenticity _ Anti-counterfeit Trainingno data
　　💼 SR-11(2) Component Authenticity _ Configuration Control for Component Service and Repairno data
　　💼 SR-11(3) Component Authenticity _ Anti-counterfeit Scanningno data
　💼 SR-12 Component Disposalno data