22. Facility Related Control Systems Overlay_FINAL (FOUO).pdf

UNCLASSIFIED//FOUO

Facility Related Control Systems (FRCS) Overlay

RMF TAG Secretariat RMF Implementation Division

DoD-CIO, DCIO-CS, CSRM

NIPR: OSD.RMFTAG-Secretariat@mail.mil

Last Updated: 31 May 2019 mailto:OSD.RMFTAG-Secretariat@mail.mil

FRCS Overlay

1. Overview

This overlay applies to facilities-related control systems (FRCS) at a Moderate-Moderate-

Moderate Confidentiality-Integrity-Availability level. Refer to the Risk Management

Framework (RMF) Knowledge Service (KS) for additional information regarding the development, background, tailoring, and applicability of the FRCS Overlay. RMF KS:

https://rmfks.osd.mil/rmf/Pages/default.aspx.

2. FRCS Overlay Controls

The FRCS Overlay consists of 402 controls, including sub controls. In the table below, an “x” indicates that supplemental control guidance is available.

Table 1: FRCS Overlay Controls

Facility Related Control Systems Overlay

Control ID Control Name Supplemental Guidance Included

AC-1 Access Control Policy and Procedures

AC-2 Account Management

AC-2 (1) Account Management | Automated System Account Management

AC-2 (2) Account Management | Removal of Temporary / Emergency Accounts

AC-2 (3) Account Management | Disable Inactive Accounts

AC-2 (4) Account Management | Automated Audit Actions

AC-2 (5) Account Management | Inactivity Logout

AC-2 (7) Account Management | Role- based Schemes

AC-2 (9) Account Management | Restrictions On Use Of Shared Groups / Accounts

AC-2 (10) Account Management | Shared / Group Account Credential Termination

AC-2 (12) Account Management | Account Monitoring / Atypical Usage

AC-2 (13) Account Management | Disable Accounts For High- Risk Individuals

AC-3 Access Enforcement

AC-3 (4) Access Enforcement | Discretionary Access Control

AC-4 Information Flow Enforcement https://rmfks.osd.mil/rmf/Pages/default.aspx

AC-5 Separation Of Duties

AC-6 Least Privilege

AC-6 (1) Least Privilege | Authorize Access To Security Functions

AC-6 (2) Least Privilege | Non- Privileged Access For Nonsecurity Functions

AC-6(5) Least Privilege |Privileged Accounts

AC-6 (7) Least Privilege | Review Of User Privileges

AC-6 (8) Least Privilege | Privilege Levels For Code Execution

AC-6 (9) Least Privilege | Auditing Use Of Privileged Functions

AC-6 (10) Least Privilege | Prohibit Non Privileged Users From Executing Privileged Functions

AC-7 Unsuccessful Login Attempts

AC-8 System Use Notification

AC-10 Concurrent Session Control

AC-11 Session Lock

AC-11 (1) Session Lock | Pattern- Hiding Displays

AC-12 Session Termination

AC-14 Permitted Actions Without Identification or Authentication

AC-16 Security Attributes X

AC-16 (6) Security Attributes | Maintenance Of Attribute Association By Organization X

AC-17 Remote Access

AC-17 (1) Remote Access | Automated Monitoring / Control

AC-17 (2) Remote Access | Protection of Confidentiality / Integrity Using Encryption

AC-17 (3) Remote Access | Managed Access Control Points

AC-17 (4) Remote Access | Privileged Commands / Access

AC-17 (6) Remote Access | Protection of Information

AC-17 (9) Remote Access | Disconnect / Disable Access

AC-18 Wireless Access

AC-18 (1) Wireless Access | Authentication And Encryption

AC-18 (3) Wireless Access | Disable Wireless Networking

AC-18 (4) Wireless Access | Restrict Configurations By Users

AC-19 Access Control for Mobile Devices

AC-19 (5) Access Control for Mobile Devices | Full Device / Container-Based Encryption

AC-20 Use of External Information Systems

AC-20 (1) Use of External Information Systems | Limits On Authorized Use

AC-20 (2) Use of External Information Systems | Portable Storage Devices

AC-20 (3) Use of External Information Systems | Non- Organizationally Owned Systems / Components / Devices

AC-21 Collaboration and Information Sharing

AC-22 Publicly Accessible Content

AT-1 Security Awareness and Training Policy and Procedures

AT-2 Security Awareness Training

AT-2 (2) Security Awareness | Insider Threat

AT-3 Role-Based Security Training

AT-3 (2) Security Training | Physical Security Controls

AT-3 (4) Security Training | Suspicious Communications And Anomalous System Behavior

AT-4 Security Training Records

AU-1 Audit and Accountability Policy and Procedures

AU-2 Audit Events

AU-2 (3) Audit Events | Reviews And Updates

AU-3 Content of Audit Records

AU-3 (1) Content of Audit Records | Additional Audit Information

AU-4 Audit Storage Capacity

AU-4 (1) Audit Storage Capacity | Transfer To Alternate Storage

AU-5 Response to Audit Processing Failures

AU-5 (1) Response to Audit Processing Failures | Audit Storage Capacity

AU-6 Audit Review, Analysis, and Reporting

AU-6 (1) Audit Review, Analysis, and Reporting | Process Integration

AU-6 (3) Audit Review, Analysis, and Reporting | Correlate Audit Repositories

AU-6 (4) Audit Review, Analysis, and Reporting | Central Review And Analysis x

AU-6 (10) Audit Review, Analysis, and Reporting | Audit Level Adjustment

AU-7 Audit Reduction and Report Generation

AU-7 (1) Audit Reduction and Report Generation | Automatic Processing

AU-8 Time Stamps

AU-8 (1) Time Stamps | Synchronization With Authoritative Time Source

AU-9 Protection of Audit Information

AU-9 (4) Protection of Audit Information | Access By Subset Of Privileged Users

AU-10 Non-Repudiation

AU-11 Audit Record Retention

AU-11 (1) Audit Record Retention | Long-Term Retrieval Capability

AU-12 Audit Generation

AU-12 (1) Audit Generation | System- Wide / Time-Correlated Audit Trail

AU-12 (3) Audit Generation | Changes By Authorized Individuals

AU-14 Session Audit X

AU-14 (1) Session Audit | System Start- Up X

AU-14 (2) Session Audit | Capture/Record And Log Content X

AU-14 (3) Session Audit | Remote Viewing / Listening X

CA-1 Security Assessment and Authorization Policy and Procedures

CA-2 Security Assessments

CA-2 (1) Security Assessments | Independent Assessors

CA-3 Information System Connections

CA-3 (1) System Interconnections | Unclassified National Security System Connections

X

CA-3 (5) System Interconnections | Restrictions On External System Connections

CA-5 Plan of Action and Milestones

CA-6 Security Authorization

CA-7 Continuous Monitoring

CA-7 (1) Continuous Monitoring | Independent Assessment

CA-9 Internal System Connections

CM-1 Configuration Management Policy and Procedures

CM-2 Baseline Configuration

CM-2 (1) Baseline Configuration | Reviews And Updates

CM-2 (3) Baseline Configuration | Retention Of Previous Configurations

CM-2 (7) Baseline Configuration | Configure Systems, Components, Or Devices For High-Risk Areas

CM-3 Configuration Change Control

CM-3 (2) Configuration Change Control | Test / Validation / Document Changes

CM-3 (4) Configuration Change Control | Security Representative X

CM-3 (6) Configuration Change Control | Cryptography Management

CM-4 Security Impact Analysis

CM-4 (1) Security Impact Analysis | Separate Test Environments

CM-5 Access Restrictions for Change

CM-5 (1) Access Restrictions for Change | Automated Access Enforcement / Auditing

CM-5 (2) Access Restrictions for Change | Review System Changes

CM-5 (5) Access Restrictions for Change | Limit Production / Operational Privileges

CM-5 (6) Access Restrictions for Change | Limit Library Privileges

CM-6 Configuration Settings

CM-6 (1) Configuration Settings | Automated Central Management / Application / Verification

X

CM-7 Least Functionality

CM-7 (1) Least Functionality | Periodic Review

CM-7 (2) Least Functionality | Prevent Program Execution

CM-7 (3) Least Functionality | Registration Compliance

CM-7 (5) Least Functionality | Authorized Software / Whitelisting X

CM-8 Information System Component Inventory

CM-8 (1) Information System Component Inventory | Updates During Installations / Removals

CM-8 (2) Information System Component Inventory | Automated Maintenance

CM-8 (3) Information System Component Inventory | Automated Unauthorized Component Detection

CM-8 (5) Information System Component Inventory | No Duplicate Accounting Of Components

CM-9 Configuration Management Plan

CM-10 Software Usage Restrictions

CM-10 (1) Software Usage Restrictions | Open Source Software

CM-11 User-Installed Software

CM-11 (2) User-Installed Software | Prohibit Installation Without Privileged Status

CP-1 Contingency Planning Policy and Procedures

CP-2 Contingency Plan

CP-2 (1) Contingency Plan | Coordinate With Related Plans

CP-2 (3) Contingency Plan | Resume Essential Missions / Business Functions

CP-2 (8) Contingency Plan | Identify Critical Assets

CP-3 Contingency Training

CP-4 Contingency Plan Testing

CP-4 (1) Contingency Plan Testing | Coordinate With Related Plans

CP-6 Alternate Storage Site

CP-6 (1) Alternate Storage Site | Separation From Primary Site

CP-6 (3) Alternate Storage Site | Accessibility

CP-7 Alternate Processing Site

CP-7 (1) Alternate Processing Site | Separation From Primary Site

CP-7 (2) Alternate Processing Site | Accessibility

CP-7 (3) Alternate Processing Site | Priority Of Service

CP-8 Telecommunications Services

CP-8 (1) Telecommunications Services | Priority Of Service Provisions

CP-8 (2) Telecommunications Services | Single Points Of Failure

CP-9 Information System Backup

CP-9 (1) Information System Backup | Testing For Reliability / Integrity

CP-9 (5) Information System Backup | Transfer To Alternate Storage Site .

CP-10 Information System Recovery and Reconstitution

CP-10 (2) Information System Recovery and Reconstitution | Transaction Recovery

CP-12 Safe Mode X

IA-1 Identification and Authentication Policy and Procedures

IA-2 Identification and Authentication (Organizational Users)

IA-2 (1) Identification and Authentication | Network

IA-2 (2) Identification and Authentication | Network Access To Non-Privileged Accounts

IA-2 (3) Identification and Authentication | Local Access To Privileged Accounts

IA-2 (4) Identification and Authentication | Local Access To Non-Privileged Accounts

IA-2 (5) Identification and Authentication | Group Authentication

IA-2 (8) Identification and Authentication | Network Access To Privileged Accounts - Replay Resistant

IA-2 (9) Identification and Authentication | Network Access To Non-Privileged Accounts - Replay Resistant

IA-2 (11) Identification and Authentication | Remote Access - Separate Device

IA-2 (12) Identification and Authentication | Acceptance Of PIV Credentials

IA-3 Device Identification and Authentication

IA-3 (1) Device Identification and Authentication | Cryptographic Bidirectional Authentication

IA-3(4) Device Identification and Authentication | Device Attestation

IA-4 Identifier Management

IA-4 (4) Identifier Management | Identify User Status

IA-5 Authenticator Management

IA-5 (1) Authenticator Management | Password-Based Authentication

IA-5 (2) Authenticator Management | PKI-Based Authentication

IA-5 (3) Authenticator Management | In-Person Or Trusted Third- Party Registration

IA-5 (4) Authenticator Management | Automated Support For Password Strength Determination

IA-5 (7) Authenticator Management | No Embedded Unencrypted Static Authenticators

IA-5 (8) Authenticator Management | Multiple Information System Accounts

IA-5 (11) Authenticator Management | Hardware Token-Based Authentication

IA-5 (13) Authenticator Management | Expiration Of Cached Authenticators

IA-5 (14) Authenticator Management | Managing Content Of PKI Trust Stores

IA-6 Authenticator Feedback

IA-7 Cryptographic Module Authentication

IA-8 Identification and Authentication (Non- Organizational Users)

IA-8 (1) Identification and Authentication | Acceptance Of PIV Credentials From Other Agencies

IA-8 (2) Identification and Authentication | Acceptance Of Third-Party Credentials

IA-8 (3) Identification and Authentication | Use Of FICAM-Approved Products

IA-8 (4) Identification and Authentication | Use Of FICAM-Issued Profiles

IR-1 Incident Response Policy and Procedures

IR-2 Incident Response Training

IR-3 Incident Response Testing

IR-3 (2) Incident Response Testing | Coordination With Related Plans

IR-4 Incident Handling

IR-4 (1) Incident Handling | Automated Incident Handling Processes X

IR-4 (3) Incident Handling | Continuity Of Operations

IR-4 (4) Incident Handling | Information Correlation

IR-4 (6) Incident Handling | Insider Threats - Specific Capabilities

IR-4 (7) Incident Handling | Insider Threats - Intra-Organization Coordination

IR-4 (8) Incident Handling | Correlation With External Organizations

IR-5 Incident Monitoring

IR-6 Incident Reporting

IR-6 (1) Incident Reporting | Automated Reporting X

IR-6 (2) Incident Reporting | Vulnerabilities Related To Incidents

IR-7 Incident Response Assistance

IR-7 (1) Incident Response Assistance | Automation Support For Availability Of Information / Support

IR-7 (2) Incident Response Assistance | Coordination With External Providers X

IR-8 Incident Response Plan

IR-9 Information Spillage Response

IR-9 (1) Information Spillage Response | Responsible Personnel

IR-9 (2) Information Spillage Response | Training

IR-9 (3) Information Spillage Response | Post-Spill Operations

IR-9 (4) Information Spillage Response | Exposure To Unauthorized Personnel

IR-10 Integrated Information Security Analysis Team X

MA-1 System Maintenance Policy and Procedures

MA-2 Controlled Maintenance

MA-3 Maintenance Tools

MA-3 (1) Maintenance Tools | Inspect Tools

MA-3 (2) Maintenance Tools | Inspect Media

MA-3 (3) Maintenance Tools | Prevent Unauthorized Removal

MA-4 Non-Local Maintenance

MA-4 (1) Non-Local Maintenance | Auditing And Review X

MA-4 (2) Non-Local Maintenance | Document Nonlocal Maintenance

MA-4 (3) Non-Local Maintenance | Comparable Security / Sanitization X

MA-4 (6) Non-Local Maintenance | Cryptographic Protection X

MA-4 (7) Non-Local Maintenance | Remote Disconnect Verification X

MA-5 Maintenance Personnel

MA-6 Timely Maintenance

MP-1 Media Protection Policy and Procedures

MP-2 Media Access

MP-3 Media Marking

MP-4 Media Storage

MP-5 Media Transport

MP-5 (4) Media Transport | Cryptographic Protection

MP-6 Media Sanitization

MP-7 Media Use

MP-7 (1) Media Use | Prohibit Use Without Owner

PE-1 Physical and Environmental Protection Policy and Procedures

PE-2 Physical Access Authorizations

PE-3 Physical Access Control

PE-3 (1) Physical Access Control | Information System Access

PE-4 Access Control for Transmission Medium

PE-5 Access Control for Output Devices

PE-6 Monitoring Physical Access

PE-6 (1) Monitoring Physical Access | Intrusion Alarms / Surveillance Equipment

PE-6 (4) Monitoring Physical Access | Monitoring Physical Access To Information Systems

PE-8 Visitor Access Records

PE-9 Power Equipment and Cabling

PE-10 Emergency Shutoff

PE-11 Emergency Power

PE-11 (1) Emergency Power | Long- Term Alternate Power Supply - Minimal Operational Capability

PE-12 Emergency Lighting

PE-13 Fire Protection

PE-14 Temperature and Humidity Controls

PE-15 Water Damage Protection

PE-16 Delivery and Removal

PL-1 Security Planning Policy and Procedures

PL-2 System Security Plan

PL-2 (3) System Security Plan | Plan / Coordinate With Other Organizational Entities

PL-4 Rules of Behavior X

PL-8 Information Security Architecture

PL-8 (1) Information Security Architecture | Defense-In- Depth

PS-1 Personnel Security Policy and Procedures

PS-2 Position Risk Designation

PS-3 Personnel Screening

PS-4 Personnel Termination

PS-4 (1) Personnel Termination | Post-Employment Requirements

PS-5 Personnel Transfer

PS-6 Access Agreements

PS-6 (3) Access Agreements | Post- Employment Requirements

PS-7 Third-Party Personnel Security

PS-8 Personnel Sanctions

RA-1 Risk Assessment Policy and Procedures

RA-2 Security Categorization

RA-3 Risk Assessment

RA-5 Vulnerability Scanning

RA-5 (1) Vulnerability Scanning | Update Tool Capability

RA-5 (2) Vulnerability Scanning | Update By Frequency / Prior To New Scan / When Identified

RA-5 (5) Vulnerability Scanning | Privileged Access X

SA-1 System and Services Acquisition Policy and Procedures

SA-2 Allocation of Resources

SA-3 System Development Life Cycle

SA-4 Acquisition Process

SA-4 (1) Acquisition Process | Functional Properties Of Security Controls

SA-4 (2) Acquisition Process | Design / Implementation Information For Security Controls

SA-4 (7) Acquisition Process | NIAP- Approved Protection Profiles

SA-4 (9) Acquisition Process | Functions / Ports / Protocols / Services In Use

SA-4 (10) Acquisition Process | Use Of Approved PIV Products

SA-5 Information System Documentation

SA-8 Security Engineering Principles

SA-9 External Information System Services

SA-9 (1) External Information Systems | Risk Assessments / Organizational Approvals

SA-9 (2) External Information Systems | Identification Of Functions / Ports / Protocols / Services

SA-10 Developer Configuration Management

SA-10 (1) Developer Configuration Management | Software / Firmware Integrity Verification

SA-11 Developer Security Testing And Evaluation

SA-12 Supply Chain Protection

SA-15 Development Process, Standards, And Tools

SA-19 Component Authenticity

SC-1 System and Communications Protection Policy and Procedures

SC-2 Application Partitioning

SC-4 Information in Shared Resources

SC-5 Denial of Service Protection

SC-5 (1) Denial of Service Protection | Restrict Internal Users

SC-5 (2) Denial of Service Protection | Excess Capacity / Bandwidth / Redundancy

SC-5 (3) Denial of Service Protection | Detection / Monitoring

SC-7 Boundary Protection

SC-7 (3) Boundary Protection | Access Points

SC-7 (4) Boundary Protection | External Telecommunications Services

SC-7 (5) Boundary Protection | Deny By Default / Allow By Exception

SC-7 (7) Boundary Protection | Prevent Split Tunneling For Remote Devices

SC-7 (8) Boundary Protection | Route Traffic To Authenticated Proxy Servers

SC-7 (9) Boundary Protection | Restrict Threatening Outgoing Communications Traffic

X

SC-7 (10) Boundary Protection | Prevent Unauthorized Exfiltration

SC-7 (11) Boundary Protection | Restrict Incoming Communications Traffic

SC-7 (12) Boundary Protection | Host- Based Protection

SC-7 (13) Boundary Protection | Isolation Of Security Tools / Mechanisms / Support

SC-7 (14) Boundary Protection | Protects Against Unauthorized Physical Connections

SC-7(18) Boundary Protection | Fail Secure

SC-8 Transmission Confidentiality And Integrity

SC-8 (1) Transmission Confidentiality And Integrity | Cryptographic Or Alternative Physical Protection

SC-8 (2) Transmission Confidentiality And Integrity | Pre / Post Transmission Handling

SC-10 Network Disconnect

SC-12 Cryptographic Key Establishment and Management

SC-13 Cryptographic Protection

SC-15 Collaborative Computing Devices

SC-17 Public Key Infrastructure Certificates

SC-18 Mobile Code

SC-18 (1) Mobile Code | Identify Unacceptable Code / Take Corrective Actions

SC-18 (2) Mobile Code | Acquisition / Development / Use

SC-18 (3) Mobile Code | Prevent Downloading / Execution

SC-18 (4) Mobile Code | Prevent Automatic Execution

SC-19 Voice Over Internet Protocol

SC-20 Secure Name / Address Resolution Service (Authoritative Source)

SC-21 Secure Name / Address Resolution Service (Recursive or Caching Resolver)

SC-22 Architecture and Provisioning for Name / Address Resolution Service

SC-23 Session Authenticity

SC-23 (1) Session Authenticity | Invalidate Session Identifiers At Logout

SC-23 (3) Session Authenticity | Unique Session Identifiers With Randomization

SC-23 (5) Session Authenticity | Allowed Certificate Authorities

SC-24 Fail in Known State

SC-28 Protection of Information at Rest

SC-28 (1) Protection of Information at Rest | Cryptographic Protection

SC-38 Operations Security

SC-39 Process Isolation

SC-41 Port and I/O Device Access

SI-1 System and Information Integrity Policy and Procedures

SI-2 Flaw Remediation

SI-2 (1) Flaw Remediation | Central Management X

SI-2 (2) Flaw Remediation | Automated Flaw Remediation Status

SI-2 (6) Flaw Remediation | Removal Of Previous Versions Of Software / Firmware

SI-3 Malicious Code Protection

SI-3 (1) Malicious Code Protection | Central Management

SI-3 (2) Malicious Code Protection | Automatic Updates

SI-3 (10) Malicious Code Protection | Malicious Code Analysis

SI-4 Information System Monitoring

SI-4 (1) Information System Monitoring | System-Wide Intrusion Detection System

SI-4 (2) Information System Monitoring | Automated Tools For Real-Time Analysis

SI-4 (4) Information System Monitoring | Inbound And Outbound Communications Traffic

SI-4 (5) Information System Monitoring | System- Generated Alerts

SI-4 (10) Information System Monitoring | Visibility Of Encrypted Communications

SI-4 (11) Information System Monitoring | Analyze Communications Traffic Anomalies

SI-4 (12) Information System Monitoring | Automated Alerts

SI-4 (14) Information System Monitoring | Wireless Intrusion Detection

SI-4 (15) Information System Monitoring Wireless To Wireline Communications

SI-4 (16) Information System Monitoring | Correlate Monitoring Information

SI-4 (19) Information System Monitoring | Individuals Posing Greater Risk

SI-4 (20) Information System Monitoring | Privileged User

SI-4 (22) Information System Monitoring | Unauthorized Network Services

SI-4 (23) Information System Monitoring | Host-Based Devices

SI-5 Security Alerts, Advisories, and Directives

SI-7 Software, Firmware, and Information Integrity

SI-7 (1) Software, Firmware, and Information Integrity | Integrity Checks

SI-7 (7) Software, Firmware, and Information Integrity | Integration Of Detection And Response

SI-7 (8) Software, Firmware, and Information Integrity | Auditing Capability For Significant Events

X

SI-7 (14) Software, Firmware, and Information Integrity | Binary Or Machine Executable Code

SI-8 SPAM Protection

SI-8 (1) SPAM Protection | Central Management

SI-8 (2) SPAM Protection | Automatic Updates

SI-10 Information Input Validation

SI-10 (3) Information Input Validation | Predictable Behavior

SI-11 Error Handling

SI-12 Information Handling and Retention

SI-16 Memory Protection

SI-17 Fail-Safe Procedures

PM-1 Information Security Program Plan

PM-2 Senior Information Security Officer

PM-3 Information Security Resources

PM-4 Plan of Action and Milestones Process

PM-5 Information System Inventory

PM-6 Information Security Measures of Performance

PM-7 Enterprise Architecture

PM-8 Critical Infrastructure Plan

PM-9 Risk Management Strategy

PM-10 Security Authorization Process

PM-11 Mission/Business Process Definition

PM-12 Insider Threat Program

PM-13 Information Security Workforce

PM-14 Testing, Training, and Monitoring

PM-15 Contacts with Security Groups and Associations

PM-16 Threat Awareness Program

3. Supplemental Guidance

During the development of the FRCS Overlay, 25 controls were identified as requiring additional supplemental guidance. These controls include:

AC-16

AC-16 (6)

AU-6 (4)

AU-14

AU-14 (1)

AU-14 (2)

AU-14 (3)

CA-3 (1)

CM-3 (4)

CM-6 (1)

CM-7 (5)

CP-12

IR-4 (1)

IR-6 (1)

IR-7 (2)

IR-10

MA-4 (1)

MA-4 (3)

MA-4 (6)

MA-4 (7)

PL-4

RA-5 (5)

SC-7 (9)

SI-2 (1)

SI-7 (8)

The specific control language can be found in Table 2: FRCS Supplemental Guidance.

Table 2: FRCS Supplemental Guidance

FRCS Supplemental Guidance

Control ID Control Name Supplemental Guidance

AC-16 Security Attributes An organization should determine security attributes and consider specific requirements for its control systems. By specifying permitted attribute ranges and values, organizations can ensure security attribute values are meaningful and relevant. The term security labeling refers to associating security attributes with subjects and objects represented by internal data structures within organizational information systems to enable information system-based enforcement of information security policies. The AC-16 base control requires user-based attribute association (marking). AC-16 enhancements require additional steps including information system-based attribute association (labeling). As an example, attributes may include classification level for objects and clearance (access authorization) level for subjects. Related controls: AC-3, AC-

4, AC-6, AC-21, AU-2, AU-10, SC-16, MP-3.

AC-16 (6) Security Attributes | Maintenance Of Attribute Association By Organization

Organizations maintaining security attributes should consider special considerations related to control systems.

AU-6 (4) Audit Review, Analysis, and Reporting | Central Review And Analysis

Audit review, analysis, and reporting covers information security-related auditing performed by organizations, such as auditing the monitoring results from account usage, remote access, wireless connectivity, mobile device connection, configuration settings, system component inventory, use of maintenance tools and nonlocal maintenance, physical access, temperature and humidity, equipment delivery and removal, communications at the information system boundaries, use of mobile code, and use of Voice over Internet Protocol. Report review findings should be reported to organizational entities, such as the incident response team, help desk, or the information security group/department. If prohibited from reviewing and analyzing audit information or unable to conduct such activities (e.g., in certain national security applications or systems), then the organization may grant another organization the authority to perform the review and analysis. Additionally, not all control systems can support centralized reviews as outlined in the supplemental guidance. In the absence of such capabilities, organizations should meet the intent of the control to the maximum extent technically feasible.

AU-14 Session Audit Session audits can include, but are not limited to, monitoring keystrokes, tracking websites visited, and recording transfers of information or files. To ensure they are complying with applicable federal laws, Executive Orders, directives, policies, regulations, or standards, organizations should consult legal counsel while developing, integrating, and using session auditing activities.

In the absence of an ability to execute a full session audit, organizations should implement the control to the maximum extent technically feasible. Organizations must maintain accurate audit logs as well as complete and detailed operator schedules to allow, to the greatest extent possible, organizations the ability to ""triangulate"" the session usage to the operator on duty.

AU-14 (1) Session Audit | System Start- Up

Control systems should initiate user session audits upon system start up to provide a full picture of user activity. In the absence of this system capability, information should be captured from the beginning of a users' session on the control system. Specific policy to capture the entire user session for audit should be defined by the organization. Related controls: AU-2.

AU-14 (2) Session Audit | Capture/Record And Log Content

In the absence of an ability to capture content related to users' sessions, organizations should develop appropriate audit policies associated with authorized users.

AU-14 (3) Session Audit | Remote Viewing / Listening

In the absence of an ability to remotely audit users, organizations should develop appropriate audit policies commensurate with system capabilities and limitations.

CA-3 (1) System Interconnections | Unclassified National Security System Connections

Organizations should develop connection and boundary limitations at the system level in consultation with appropriate parties (ex:

Authorizing Official (AO), Information System Security Manager (ISSM), Cyber Security Service Provider (CSSP)). Organizations should document and define system interconnections in organizational security policies. Related control: SC-7.

CM-3 (4) Configuration Change Control | Security Representative

Information security representatives can include senior agency information security officers, information system security officers, or information system security managers. It is important to involve personnel with information security expertise in this process because changes to information system configurations can have unintended side effects, some of which may be security-relevant.

Detecting such changes early in the process can help avoid negative consequences that could ultimately affect the security state of organizational information systems. The configuration change control element in this control enhancement reflects the change control elements defined by organizations in CM-3.

In the absence of a senior agency official, organizations can define the appropriate security representative based on their technically-qualified personnel, mission need, system-specific qualifications, and organizational availability.

CM-6 (1) Configuration Settings | Automated Central Management / Application / Verification

Control systems, to the maximum extent technically feasible, should automatically manage configuration settings. Organizations must identify and document the configuration management policy and implement automated processes to centrally manage configuration settings. In the absence of these system capabilities, organizations should provide automated management consistent with system capabilities and limitations. Organizations should consider a system's overall risk tolerance and the level of risk the Authorizing Official is willing to accept before utilizing automated management of configuration settings.

CM-7 (5) Least Functionality | Authorized Software / Whitelisting

Whitelisting refers to the process which identifies software programs authorized to execute on organizational information systems. In addition to whitelisting, organizations can verify the integrity of white-listed software programs using other methods, such as cryptographic checksums, digital signatures, or hash functions.

Verifying white-listed software can occur prior to execution or at system startup. The organization being inspected or assessed must define and document software programs authorized to execute on its information systems. DoD has determined a comprehensive list of unauthorized software programs is not appropriate to define at the enterprise-level. All other software not on the organization’s whitelist should be prohibited. Related controls: CM-2, CM-6, CM-8, PM-5, SA-10, SC-34, SI-7.

CP-12 Safe Mode For information systems supporting critical missions/business functions including, for example, military operations and weapons systems, civilian space operations, nuclear power plant operations, and air traffic control operations (especially real-time operational environments), organizations may choose to identify certain conditions under which those systems revert to a predefined safe mode of operation. The safe mode of operation, which can be activated automatically or manually, restricts the types of activities or operations information systems could execute when those conditions are encountered. Restriction includes, for example, allowing only certain functions that could be carried out under limited power or with reduced communications bandwidth. The organization should determine the parameters of "safe mode" based on the criticality of controlled equipment, organizational requirements, and system-specific industry safety requirements (e.g.: North American Electric Reliability Corporation (NERC), Occupational Safety and Health Administration (OSHA) standards).

IR-4 (1) Incident Handling | Automated Incident Handling Processes

In the event automated incident handling processes are performed by a 3rd party or external organization (ex: CSSP, etc.), the processes may be accomplished by such parties or organizations.

In the event automated incident handling processes are not technically feasible, the system defaults to manual processes defined by the organization.

IR-6 (1) Incident Reporting | Automated Reporting

In the event incident reporting is an activity of a 3rd party or external organizations (ex: CSSP, etc.), automated mechanisms may be accomplished by such parties or organizations.

IR-7 (2) Incident Response Assistance | Coordination With External Providers

Incident response should be coordinated and documented with relevant internal and external parties (ex: fire department, CSSP, computer response teams, power distributors, police department, etc.) In the event this control does not apply to an organization's control system, tailor out with justification.

IR-10 Integrated Information Security Analysis Team

An integrated team is not limited to immediate organizational staff and may consist of both internal and external personnel (e.g.: CSSPs, 3rd parties, external service providers, etc.). The organization being inspected and assessed establishes an integrated team of forensic and malicious code analysts, tool developers, and real-time operations personnel. The organization appoints team members and defines and documents roles and responsibilities for each member.

MA-4 (1) Non-Local Maintenance | Auditing And Review

Control systems provide audits and reviews of non-local maintenance, such as defined processes for vendor connection and disconnections processes and activity monitoring. Audit and review activities for control systems should be system-specific and defined at the system or organizational level.

MA-4 (3) Non-Local Maintenance | Comparable Security / Sanitization

Non-local, 3rd party maintenance, and diagnostic services for control systems should employ security measures consistent with the security level and requirements of the system being serviced, as well as applicable acquisition language and policy (e.g.: National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171, Defense Federal Acquisition Regulation Supplement (DFARs), Controlled Unclassified Information (CUI) requirements, etc.) . The security level on control systems, diagnostic tools, and equipment providing maintenance services implies that the implemented security controls on those systems, tools, and equipment are at least as comprehensive as the controls on the information system being serviced. Security requirements for vendor connections should be formalized and documented as required by the organization. Related controls: MA-3, SA-12, SI-3, SI-7.

MA-4 (6) Non-Local Maintenance | Cryptographic Protection

Maintenance and diagnostic communications of control systems should use cryptographic protections to the maximum extent technically feasible to protect the integrity and confidentiality of maintenance and diagnostic communications. Organizations should determine the level of cryptographic protection for a specific system based on the risk and requirements of individual systems. At a minimum, organizations must implement protection at the CUI level.

MA-4 (7) Non-Local Maintenance | Remote Disconnect Verification

Control systems employing nonlocal maintenance and diagnostic sessions should verify remote disconnect to ensure that remote connections (e.g. vendor connections, 3rd party maintenance, patching, etc.) have been terminated and are no longer available for use.

PL-4 Rules of Behavior DoD policy on mobile devices is governed by DoD Directives (DoDD)

8100.02 and organization-specific guidance. System owners can provide additional restrictions or guidance as required by risk to a specific control system. In addition, personnel are not permitted to make wired or wireless connections from a personal mobile device to a control system unless previously authorized by the system owner (e.g. this includes charging, remote logins, or Wi-Fi connections).

RA-5 (5) Vulnerability Scanning | Privileged Access

When permitted, vulnerability scans on control systems should require privileged access. In certain situations, the nature of the vulnerability scanning may be more intrusive or the information system components subject to the scanning may contain highly sensitive information. Authorizing privileged access to selected system components facilitates more thorough vulnerability scanning and protects the sensitive information exposed to such scanning.

When scanning is not permitted on active control systems, organizations should develop system-specific scanning procedures that consider the risk, requirements, and vulnerabilities of individual systems.

SC-7 (9) Boundary Protection | Restrict Threatening Outgoing Communications Traffic

Detecting outgoing communications traffic from internal actions that may pose threats to external information systems is sometimes termed “extrusion detection.” Extrusion detection at information system boundaries as part of managed interfaces analyzes incoming and outgoing communications traffic and searches for indications of internal threats to the security of external systems. Such threats include, for example, traffic indicative of denial of service attacks and traffic containing malicious code. In the event communications traffic monitoring is an activity of a 3rd party or external organization (e.g.: CSSP, etc.), communications traffic monitoring may be accomplished by such parties or organizations. Related controls: AU-

2, AU-6, SC-38, SC-44, SI-3, SI-4.

SI-2 (1) Flaw Remediation | Central Management

Central management is the organization-wide management and implementation of flaw remediation processes. Central management includes planning, implementing, assessing, authorizing, and monitoring the organization-defined, centrally managed flaw remediation security controls.

In the event flaw remediation is an activity of a 3rd party or external organization (ex: CSSP, etc.), flaw remediation management may be accomplished by such parties or organizations.

SI-7 (8) Software, Firmware, and Information Integrity | Auditing Capability For Significant Events

In the event auditing activities are a role of a 3rd party or external organization (ex: CSSP, etc.), these event auditing activities may be accomplished by such parties or organizations.