The file's text, extracted by GovTribe without its formatting.
System for Documents NIST RMF Rev 4 Workflow
06C25R0075, R1
Requirements Traceability Matrix
(RTM)
Prepared for Department of Homeland Security
8 April 2021 Comment by EDINGER, STEPHEN C (OCC), PRIVILEGED/WORK PRODUCT: Please update this date as appropriate.
FOR OFFICIAL USE ONLY
FOR OFFICIAL USE ONLY
Introduction
The Requirements Traceability Matrix (RTM) relates requirements from requirement source documents to the security certification process. It ensures that all security requirements are identified and investigated. Each row of the matrix identifies a specific requirement and provides the details of how it was tested or analyzed and the results.
The table is arranged to display the system security requirements from the applicable regulation documents, which are listed below:
· NIST 800-53 w/ DHS 4300A Rev 4 - Department of Homeland Security Sensitive Systems Policy Directive 4300A Version 12 (with NIST 800-53 Rev 4)
The columns of the RTM are defined as follows:
| Control Ref. |
| Refers to the name (short title) of the source document and the ID or paragraph number of the listed control or requirement. |
Security Req./ Control Short title describing the security control or requirement (and the text of the control/requirement, which may be paraphrased for brevity).
| Security Category |
| Category and class associated with the security control. |
| Control Type |
| Auto populated if the requirement is identified with two security control types: common and system-specific; i.e., a part of the requirement is identified as common type and another part of it is system-specific. |
· Common. Auto populated if the requirement is designated to one or more information systems.
· Hybrid. Auto populated if the requirement is identified with two security control types: common and system-specific; i.e., a part of the requirement is identified as common type and another part of it is system-specific.
· System-Specific. Auto populated if the requirement is assigned to a specific information system.
· Inherited. Auto populated if the requirement is inherited from another system.
· Not Specified. Auto populated if the requirement does not require any security control.
| Planned Imp. |
| Auto populated if the requirement is identified with two security control types: common and system-specific; i.e., a part of the requirement is identified as common type and another part of it is system-specific. |
· Common. Auto populated if the requirement is designated to one or more information systems.
· Hybrid. Auto populated if the requirement is identified with two security control types: common and system-specific; i.e., a part of the requirement is identified as common type and another part of it is system-specific.
· System-Specific. Auto populated if the requirement is assigned to a specific information system.
· Inherited. Auto populated if the requirement is inherited from another system.
· Not Specified. Auto populated if the requirement does not require any security control.
| Actual Imp. |
| Identification whether the control is in place and how it has been implemented, or differences in how the control was implemented compared to what was planned. |
· As Planned. Auto populated if Implemented control status is selected and Planned Implementation column does not read Not Entered.
· Pending Implementation. Auto populated if Planned control status is selected and Planned Implementation column does not read Not Entered.
· Partially Implemented. Auto populated if Partial control status is selected and Planned Implementation column does not read Not Entered.
· Not Entered. Auto populated if the Planned Implementation column reads Not Entered.
· Not Assigned. Auto populated if the Control Type and/or Control Status were not selected.
| Test #(s) |
| The ID number of the specific test procedure(s) that is used to validate the requirement or control. |
· -. The control is not applicable.
| Methods |
| The evaluation method (or methods) used to assess the requirement. |
· I. Interview.
· E. Examine.
· T. Testing.
· -. The control is not applicable.
| Tailored |
| The tailored control that modifies the control set. |
· In. The control was tailored in.
· Out. The control was tailored out.
· - . The control was not affected from tailoring.
| Overlays |
| The controls included or excluded from the controls already in the baseline. |
· In. The control was added in to the controls in the baseline.
· Out. The control was removed from the controls in the baseline.
· - . The control was not affected from overlay(s).
| Result |
| The summarized result for the test procedures that cover the requirement/control. |
· Met - Requirement fully satisfied.
· Not Met - Requirement not satisfied.
· Not Applicable - Requirement not applicable.
| Notes |
| Identifies the factor, and the basis for; any tailoring of controls from the NIST 800-53 w/ DHS 4300A Rev 4 baseline or organizational overlay that was used for the system. |
ii Requirements Traceability Matrix
| Control Ref. |
| Security Req./ |
Control
| Security Category |
| Control |
Type Planned Imp.
Actual Imp.
Test #(s)
| Methods |
| Tailored |
| Result |
| Notes |
| NIST 800-53 w/ DHS 4300A Rev 4 AC-1 |
| Access Control Policy and Procedures |
| Access Control Policy and Procedures (T) |
| System-Specific |
| Not Entered |
| Not Assigned |
| AC-1.1, AC-1.1, AC-1.1, AC-1.2, AC-1.2, AC-1.2 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 AC-1 (DHS-5.1.1.c) |
| Sharing of Personal Passwords |
| Access Control Policy and Procedures (T) |
| System-Specific |
| Not Entered |
| Not Assigned |
| AC-1(DHS-5.1.1.c), AC-1(DHS-5.1.1.c), AC-1(DHS-5.1.1.c) |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 AC-2 |
| Account Management |
| Account Management (T) |
| System-Specific |
| Not Entered |
| Not Assigned |
| AC-2.1, AC-2.1, AC-2.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 AC-3 |
| Access Enforcement |
| Access Enforcement (T) |
| System-Specific |
| Not Entered |
| Not Assigned |
| AC-3.1, AC-3.1, AC-3.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 AC-3 (DHS-5.1.1.d) |
| Use of group passwords |
| Access Enforcement (T) |
| System-Specific |
| Not Entered |
| Not Assigned |
| AC-3(DHS-5.1.1.d), AC-3(DHS-5.1.1.d), AC-3(DHS-5.1.1.d) |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 AC-7 |
| Unsuccessful Logon Attempts |
| Unsuccessful Logon Attempts (T) |
| System-Specific |
| Not Entered |
| Not Assigned |
| AC-7.1, AC-7.1, AC-7.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 AC-8 |
| System Use Notification |
| System Use Notification (T) |
| System-Specific |
| Not Entered |
| Not Assigned |
| AC-8.1, AC-8.1, AC-8.1, AC-8.2, AC-8.2, AC-8.2 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 AC-8 (DHS-4.8.5.d) |
| Government Funded Office Equipment |
| System Use Notification (T) |
| System-Specific |
| Not Entered |
| Not Assigned |
| AC-8(DHS-4.8.5.d), AC-8(DHS-4.8.5.d), AC-8(DHS-4.8.5.d) |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 AC-14 |
| Permitted Actions without Identification or Authentication |
| Permitted Actions without Identification or Authentication (T) |
| System-Specific |
| Not Entered |
| Not Assigned |
| AC-14.1, AC-14.1, AC-14.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 AC-17 |
| Remote Access |
| Remote Access (T) |
| System-Specific |
| Not Entered |
| Not Assigned |
| AC-17.1, AC-17.1, AC-17.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 AC-17 (DHS-5.4.1.b) |
| Remote Access Connection Management |
| Remote Access (T) |
| System-Specific |
| Not Entered |
| Not Assigned |
| AC-17(DHS-5.4.1.b), AC-17(DHS-5.4.1.b), AC-17(DHS-5.4.1.b) |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 AC-17 (DHS-5.4.1.c) |
| Remote Access of PII |
| Remote Access (T) |
| System-Specific |
| Not Entered |
| Not Assigned |
| AC-17(DHS-5.4.1.c), AC-17(DHS-5.4.1.c), AC-17(DHS-5.4.1.c) |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 AC-18 |
| Wireless Access |
| Wireless Access (T) |
| System-Specific |
| Not Entered |
| Not Assigned |
| AC-18.1, AC-18.1, AC-18.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 AC-18 (DHS-4.8.6.a) |
| Wireless Settings for Peripheral Equipment |
| Wireless Access (T) |
| System-Specific |
| Not Entered |
| Not Assigned |
| AC-18(DHS-4.8.6.a), AC-18(DHS-4.8.6.a), AC-18(DHS-4.8.6.a) |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 AC-18 (DHS-4.8.6.b) |
| Disabling Wireless |
| Wireless Access (T) |
| System-Specific |
| Not Entered |
| Not Assigned |
| AC-18(DHS-4.8.6.b), AC-18(DHS-4.8.6.b), AC-18(DHS-4.8.6.b) |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 AC-19 |
| Access Control for Mobile Devices |
| Access Control for Mobile Devices (T) |
| System-Specific |
| Not Entered |
| Not Assigned |
| AC-19.1, AC-19.1, AC-19.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 AC-20 |
| Use of External Information Systems |
| Use of External Information Systems (T) |
| System-Specific |
| Not Entered |
| Not Assigned |
| AC-20.1, AC-20.1, AC-20.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 AC-22 |
| Publicly Accessible Content |
| Publicly Accessible Content (T) |
| System-Specific |
| Not Entered |
| Not Assigned |
| AC-22.1, AC-22.1, AC-22.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 AT-1 |
| Security Awareness and Training Policy and Procedures |
| Security Awareness and Training Policy and Procedures (O) |
| System-Specific |
| Not Entered |
| Not Assigned |
| AT-1.1, AT-1.1, AT-1.1, AT-1.2, AT-1.2, AT-1.2 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 AT-2 |
| Security Awareness Training |
| Security Awareness Training (O) |
| System-Specific |
| Not Entered |
| Not Assigned |
| AT-2.1, AT-2.1, AT-2.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 AT-3 |
| Role-Based Security Training |
| Role-Based Security Training (O) |
| System-Specific |
| Not Entered |
| Not Assigned |
| AT-3.1, AT-3.1, AT-3.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 AT-4 |
| Security Training Records |
| Security Training Records (O) |
| System-Specific |
| Not Entered |
| Not Assigned |
| AT-4.1, AT-4.1, AT-4.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 AU-1 |
| Audit and Accountability Policy and Procedures |
| Audit and Accountability Policy and Procedures (T) |
| System-Specific |
| Not Entered |
| Not Assigned |
| AU-1.1, AU-1.1, AU-1.1, AU-1.2, AU-1.2, AU-1.2 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 AU-2 |
| Audit Events |
| Audit Events (T) |
| System-Specific |
| Not Entered |
| Not Assigned |
| AU-2.1, AU-2.1, AU-2.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 AU-3 |
| Content of Audit Records |
| Content of Audit Records (T) |
| System-Specific |
| Not Entered |
| Not Assigned |
| AU-3.1, AU-3.1, AU-3.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 AU-3 (DHS-5.3.a) |
| DHS Required Contents for Audit Records |
| Content of Audit Records (T) |
| System-Specific |
| Not Entered |
| Not Assigned |
| AU-3(DHS-5.3.a), AU-3(DHS-5.3.a), AU-3(DHS-5.3.a) |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 AU-4 |
| Audit Storage Capacity |
| Audit Storage Capacity (T) |
| System-Specific |
| Not Entered |
| Not Assigned |
| AU-4.1, AU-4.1, AU-4.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 AU-5 |
| Response to Audit Processing Failures |
| Response to Audit Processing Failures (T) |
| System-Specific |
| Not Entered |
| Not Assigned |
| AU-5.1, AU-5.1, AU-5.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 AU-6 |
| Audit Review, Analysis, and Reporting |
| Audit Review, Analysis, and Reporting (T) |
| System-Specific |
| Not Entered |
| Not Assigned |
| AU-6.1, AU-6.1, AU-6.1, AU-6.2, AU-6.2, AU-6.2 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 AU-6 (DHS-5.3.h) |
| Audit Reduction and Report Generation Capability |
| Audit Review, Analysis, and Reporting (T) |
| System-Specific |
| Not Entered |
| Not Assigned |
| AU-6(DHS-5.3.h), AU-6(DHS-5.3.h), AU-6(DHS-5.3.h) |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 AU-6 (DHS-5.3.i) |
| Audit Time Stamps |
| Audit Review, Analysis, and Reporting (T) |
| System-Specific |
| Not Entered |
| Not Assigned |
| AU-6(DHS-5.3.i), AU-6(DHS-5.3.i), AU-6(DHS-5.3.i) |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 AU-6 (DHS-5.4.6.f) |
| Mail Server Administration |
| Audit Review, Analysis, and Reporting (T) |
| System-Specific |
| Not Entered |
| Not Assigned |
| AU-6(DHS-5.4.6.f), AU-6(DHS-5.4.6.f), AU-6(DHS-5.4.6.f) |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 AU-8 |
| Time Stamps |
| Time Stamps (T) |
| System-Specific |
| Not Entered |
| Not Assigned |
| AU-8.1, AU-8.1, AU-8.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 AU-9 |
| Protection of Audit Information |
| Protection of Audit Information (T) |
| System-Specific |
| Not Entered |
| Not Assigned |
| AU-9.1, AU-9.1, AU-9.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 AU-11 |
| Audit Record Retention |
| Audit Record Retention (T) |
| System-Specific |
| Not Entered |
| Not Assigned |
| AU-11.1, AU-11.1, AU-11.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 AU-11 (DHS-5.3.d) |
| Audit Log Retention |
| Audit Record Retention (T) |
| System-Specific |
| Not Entered |
| Not Assigned |
| AU-11(DHS-5.3.d), AU-11(DHS-5.3.d), AU-11(DHS-5.3.d) |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 AU-12 |
| Audit Generation |
| Audit Generation (T) |
| System-Specific |
| Not Entered |
| Not Assigned |
| AU-12.1, AU-12.1, AU-12.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 AU-12 (DHS-5.3.g) |
| Audit Coordination with Component or DHS SOC |
| Audit Generation (T) |
| System-Specific |
| Not Entered |
| Not Assigned |
| AU-12(DHS-5.3.g), AU-12(DHS-5.3.g), AU-12(DHS-5.3.g) |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 CA-1 |
| Security Assessment and Authorization Policies and Procedures |
| Security Assessment and Authorization Policies and Procedures (M) |
| System-Specific |
| Not Entered |
| Not Assigned |
| CA-1.1, CA-1.1, CA-1.1, CA-1.2, CA-1.2, CA-1.2 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 CA-1 (DHS-3.18.c) |
| Cloud Environment Usage |
| Security Assessment and Authorization Policies and Procedures (M) |
| System-Specific |
| Not Entered |
| Not Assigned |
| CA-1(DHS-3.18.c), CA-1(DHS-3.18.c), CA-1(DHS-3.18.c) |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 CA-1 (DHS-3.18.d) |
| Usage of FedRAMP for Cloud Systems |
| Security Assessment and Authorization Policies and Procedures (M) |
| System-Specific |
| Not Entered |
| Not Assigned |
| CA-1(DHS-3.18.d), CA-1(DHS-3.18.d), CA-1(DHS-3.18.d) |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 CA-1 (DHS-3.18.e) |
| Usage of Public Cloud Service Provider |
| Security Assessment and Authorization Policies and Procedures (M) |
| System-Specific |
| Not Entered |
| Not Assigned |
| CA-1(DHS-3.18.e), CA-1(DHS-3.18.e), CA-1(DHS-3.18.e) |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 CA-2 |
| Security Assessments |
| Security Assessments (M) |
| System-Specific |
| Not Entered |
| Not Assigned |
| CA-2.1, CA-2.1, CA-2.1, CA-2.2, CA-2.2, CA-2.2 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 CA-2 (DHS-3.15.h) |
| Key Security Control Assessments |
| Security Assessments (M) |
| System-Specific |
| Not Entered |
| Not Assigned |
| CA-2(DHS-3.15.h), CA-2(DHS-3.15.h), CA-2(DHS-3.15.h) |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 CA-2 (DHS-3.18.b) |
| Cloud Systems Provided to External Departments |
| Security Assessments (M) |
| System-Specific |
| Not Entered |
| Not Assigned |
| CA-2(DHS-3.18.b), CA-2(DHS-3.18.b), CA-2(DHS-3.18.b) |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 CA-3 |
| System Interconnections |
| System Interconnections (M) |
| System-Specific |
| Not Entered |
| Not Assigned |
| CA-3.1, CA-3.1, CA-3.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 CA-3 (DHS-5.4.3.b) |
| Interconnection Establishment Procedures |
| System Interconnections (M) |
| System-Specific |
| Not Entered |
| Not Assigned |
| CA-3(DHS-5.4.3.b), CA-3(DHS-5.4.3.b), CA-3(DHS-5.4.3.b) |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 CA-3 (DHS-5.4.3.c) |
| DHS OneNet Interconnections |
| System Interconnections (M) |
| System-Specific |
| Not Entered |
| Not Assigned |
| CA-3(DHS-5.4.3.c), CA-3(DHS-5.4.3.c), CA-3(DHS-5.4.3.c) |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 CA-3 (DHS-5.4.3.f) |
| Interconnection Security Agreements |
| System Interconnections (M) |
| System-Specific |
| Not Entered |
| Not Assigned |
| CA-3(DHS-5.4.3.f), CA-3(DHS-5.4.3.f), CA-3(DHS-5.4.3.f) |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 CA-3 (DHS-5.4.3.m) |
| Interconnection Security Agreements |
| System Interconnections (M) |
| System-Specific |
| Not Entered |
| Not Assigned |
| CA-3(DHS-5.4.3.m), CA-3(DHS-5.4.3.m), CA-3(DHS-5.4.3.m) |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 CA-3 (DHS-5.4.3.n) |
| DHS Interconnections |
| System Interconnections (M) |
| System-Specific |
| Not Entered |
| Not Assigned |
| CA-3(DHS-5.4.3.n), CA-3(DHS-5.4.3.n), CA-3(DHS-5.4.3.n) |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 CA-5 |
| Plan of Action and Milestones |
| Plan of Action and Milestones (M) |
| System-Specific |
| Not Entered |
| Not Assigned |
| CA-5.1, CA-5.1, CA-5.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 CA-5 (DHS-2.2.8.d) |
| DHS POA&M Requirements |
| Plan of Action and Milestones (M) |
| System-Specific |
| Not Entered |
| Not Assigned |
| CA-5(DHS-2.2.8.d), CA-5(DHS-2.2.8.d), CA-5(DHS-2.2.8.d) |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 CA-6 |
| Security Authorization |
| Security Authorization (M) |
| System-Specific |
| Not Entered |
| Not Assigned |
| CA-6.1, CA-6.1, CA-6.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 CA-6 (DHS-4.12.d) |
| Network Printers and Facsimile Machines |
| Security Authorization (M) |
| System-Specific |
| Not Entered |
| Not Assigned |
| CA-6(DHS-4.12.d), CA-6(DHS-4.12.d), CA-6(DHS-4.12.d) |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 CA-7 |
| Continuous Monitoring |
| Continuous Monitoring (M) |
| System-Specific |
| Not Entered |
| Not Assigned |
| CA-7.1, CA-7.1, CA-7.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 CA-7 (DHS-4.6.2.4.a) |
| Bluetooth |
| Continuous Monitoring (M) |
| System-Specific |
| Not Entered |
| Not Assigned |
| CA-7(DHS-4.6.2.4.a), CA-7(DHS-4.6.2.4.a), CA-7(DHS-4.6.2.4.a) |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 CA-7 (DHS-4.6.3.a) |
| AO Notification on Disabling Security Features |
| Continuous Monitoring (M) |
| System-Specific |
| Not Entered |
| Not Assigned |
| CA-7(DHS-4.6.3.a), CA-7(DHS-4.6.3.a), CA-7(DHS-4.6.3.a) |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 CA-9 |
| Internal System Connections |
| Internal System Connections (M) |
| System-Specific |
| Not Entered |
| Not Assigned |
| CA-9.1, CA-9.1, CA-9.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 CM-1 |
| Configuration Management Policy and Procedures |
| Configuration Management Policy and Procedures (O) |
| System-Specific |
| Not Entered |
| Not Assigned |
| CM-1.1, CM-1.1, CM-1.1, CM-1.2, CM-1.2, CM-1.2 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 CM-2 |
| Baseline Configuration |
| Baseline Configuration (O) |
| System-Specific |
| Not Entered |
| Not Assigned |
| CM-2.1, CM-2.1, CM-2.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 CM-4 |
| Security Impact Analysis |
| Security Impact Analysis (O) |
| System-Specific |
| Not Entered |
| Not Assigned |
| CM-4.1, CM-4.1, CM-4.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 CM-6 |
| Configuration Settings |
| Configuration Settings (O) |
| System-Specific |
| Not Entered |
| Not Assigned |
| CM-6.1, CM-6.1, CM-6.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 CM-6 (DHS-3.7.e) |
| USGCB Requirements |
| Configuration Settings (O) |
| System-Specific |
| Not Entered |
| Not Assigned |
| CM-6(DHS-3.7.e), CM-6(DHS-3.7.e), CM-6(DHS-3.7.e) |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 CM-6 (DHS-3.7.f) |
| USGCB Compliance |
| Configuration Settings (O) |
| System-Specific |
| Not Entered |
| Not Assigned |
| CM-6(DHS-3.7.f), CM-6(DHS-3.7.f), CM-6(DHS-3.7.f) |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 CM-6 (DHS-4.5.2.b) |
| FAX Server Configuration |
| Configuration Settings (O) |
| System-Specific |
| Not Entered |
| Not Assigned |
| CM-6(DHS-4.5.2.b), CM-6(DHS-4.5.2.b), CM-6(DHS-4.5.2.b) |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 CM-6 (DHS-4.8.4.a) |
| Hardening and Configuration Guidance |
| Configuration Settings (O) |
| System-Specific |
| Not Entered |
| Not Assigned |
| CM-6(DHS-4.8.4.a), CM-6(DHS-4.8.4.a), CM-6(DHS-4.8.4.a) |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 CM-6 (DHS-4.12.f) |
| Network Printers, Copiers, and Facsimile Administration |
| Configuration Settings (O) |
| System-Specific |
| Not Entered |
| Not Assigned |
| CM-6(DHS-4.12.f), CM-6(DHS-4.12.f), CM-6(DHS-4.12.f) |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 CM-6 (DHS-4.12.j) |
| Multifunction Device Configuration |
| Configuration Settings (O) |
| System-Specific |
| Not Entered |
| Not Assigned |
| CM-6(DHS-4.12.j), CM-6(DHS-4.12.j), CM-6(DHS-4.12.j) |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 CM-6 (DHS-5.4.5.d) |
| Use of Telnet |
| Configuration Settings (O) |
| System-Specific |
| Not Entered |
| Not Assigned |
| CM-6(DHS-5.4.5.d), CM-6(DHS-5.4.5.d), CM-6(DHS-5.4.5.d) |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 CM-6 (DHS-5.4.5.e) |
| Use of File Transfer Protocol (FTP) Services |
| Configuration Settings (O) |
| System-Specific |
| Not Entered |
| Not Assigned |
| CM-6(DHS-5.4.5.e), CM-6(DHS-5.4.5.e), CM-6(DHS-5.4.5.e) |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 CM-7 |
| Least Functionality |
| Least Functionality (O) |
| System-Specific |
| Not Entered |
| Not Assigned |
| CM-7.1, CM-7.1, CM-7.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 CM-7 (DHS-5.4.5.f) |
| Remote Desktop Connections |
| Least Functionality (O) |
| System-Specific |
| Not Entered |
| Not Assigned |
| CM-7(DHS-5.4.5.f), CM-7(DHS-5.4.5.f), CM-7(DHS-5.4.5.f) |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 CM-8 |
| Information System Component Inventory |
| Information System Component Inventory (O) |
| System-Specific |
| Not Entered |
| Not Assigned |
| CM-8.1, CM-8.1, CM-8.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 CM-8 (DHS-4.6.a) |
| Introduction of Wireless |
| Information System Component Inventory (O) |
| System-Specific |
| Not Entered |
| Not Assigned |
| CM-8(DHS-4.6.a), CM-8(DHS-4.6.a), CM-8(DHS-4.6.a) |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 CM-10 |
| Software Usage Restrictions |
| SW Usage Restrictions (O) |
| System-Specific |
| Not Entered |
| Not Assigned |
| CM-10.1, CM-10.1, CM-10.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 CM-10 (DHS-4.8.4.f) |
| System Library Management |
| SW Usage Restrictions (O) |
| System-Specific |
| Not Entered |
| Not Assigned |
| CM-10(DHS-4.8.4.f), CM-10(DHS-4.8.4.f), CM-10(DHS-4.8.4.f) |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 CM-11 |
| User-Installed Software |
| User-Installed SW (O) |
| System-Specific |
| Not Entered |
| Not Assigned |
| CM-11.1, CM-11.1, CM-11.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 CP-1 |
| Contingency Planning Policy and Procedures |
| Contingency Planning Policy and Procedures (O) |
| System-Specific |
| Not Entered |
| Not Assigned |
| CP-1.1, CP-1.1, CP-1.1, CP-1.2, CP-1.2, CP-1.2 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 CP-1 (DHS-3.5.1.a) |
| Continuity of Operations Planning |
| Contingency Planning Policy and Procedures (O) |
| System-Specific |
| Not Entered |
| Not Assigned |
| CP-1(DHS-3.5.1.a), CP-1(DHS-3.5.1.a), CP-1(DHS-3.5.1.a) |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 CP-1 (DHS-3.15.f) |
| DHS Contingency Plan for CFO |
| Contingency Planning Policy and Procedures (O) |
| System-Specific |
| Not Entered |
| Not Assigned |
| CP-1(DHS-3.15.f), CP-1(DHS-3.15.f), CP-1(DHS-3.15.f) |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 CP-2 |
| Contingency Plan |
| Contingency Plan (O) |
| System-Specific |
| Not Entered |
| Not Assigned |
| CP-2.1, CP-2.1, CP-2.1, CP-2.2, CP-2.2, CP-2.2 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 CP-2 (DHS-3.5.2.e) |
| DHS Contingency Plan |
| Contingency Plan (O) |
| System-Specific |
| Not Entered |
| Not Assigned |
| CP-2(DHS-3.5.2.e), CP-2(DHS-3.5.2.e), CP-2(DHS-3.5.2.e) |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 CP-3 |
| Contingency Training |
| Contingency Training (O) |
| System-Specific |
| Not Entered |
| Not Assigned |
| CP-3.1, CP-3.1, CP-3.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 CP-4 |
| Contingency Plan Testing |
| Contingency Plan Testing (O) |
| System-Specific |
| Not Entered |
| Not Assigned |
| CP-4.1, CP-4.1, CP-4.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 CP-4 (DHS-3.5.2.f) |
| DHS Contingency Plan Testing |
| Contingency Plan Testing (O) |
| System-Specific |
| Not Entered |
| Not Assigned |
| CP-4(DHS-3.5.2.f), CP-4(DHS-3.5.2.f), CP-4(DHS-3.5.2.f) |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 CP-9 |
| Information System Backup |
| Information System Backup (O) |
| System-Specific |
| Not Entered |
| Not Assigned |
| CP-9.1, CP-9.1, CP-9.1, CP-9.2, CP-9.2, CP-9.2 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 CP-10 |
| Information System Recovery and Reconstitution |
| Information System Recovery and Reconstitution (O) |
| System-Specific |
| Not Entered |
| Not Assigned |
| CP-10.1, CP-10.1, CP-10.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 IA-1 |
| Identification and Authentication Policy and Procedures |
| Identification and Authentication Policy and Procedures (T) |
| System-Specific |
| Not Entered |
| Not Assigned |
| IA-1.1, IA-1.1, IA-1.1, IA-1.2, IA-1.2, IA-1.2 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 IA-1 (DHS-3.14.7.a) |
| Online Transactions |
| Identification and Authentication Policy and Procedures (T) |
| System-Specific |
| Not Entered |
| Not Assigned |
| IA-1(DHS-3.14.7.a), IA-1(DHS-3.14.7.a), IA-1(DHS-3.14.7.a) |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 IA-1 (DHS-3.14.7.c) |
| E-Authentication |
| Identification and Authentication Policy and Procedures (T) |
| System-Specific |
| Not Entered |
| Not Assigned |
| IA-1(DHS-3.14.7.c), IA-1(DHS-3.14.7.c), IA-1(DHS-3.14.7.c) |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 IA-1 (DHS-3.14.7.f) |
| PIV Credentials |
| Identification and Authentication Policy and Procedures (T) |
| System-Specific |
| Not Entered |
| Not Assigned |
| IA-1(DHS-3.14.7.f), IA-1(DHS-3.14.7.f), IA-1(DHS-3.14.7.f) |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 IA-1 (DHS-4.6.2.4.b) |
| Master Device Status Indicators |
| Identification and Authentication Policy and Procedures (T) |
| System-Specific |
| Not Entered |
| Not Assigned |
| IA-1(DHS-4.6.2.4.b), IA-1(DHS-4.6.2.4.b), IA-1(DHS-4.6.2.4.b) |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 IA-1 (DHS-4.6.2.q) |
| Biometric Logon Attempts |
| Identification and Authentication Policy and Procedures (T) |
| System-Specific |
| Not Entered |
| Not Assigned |
| IA-1(DHS-4.6.2.q), IA-1(DHS-4.6.2.q), IA-1(DHS-4.6.2.q) |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 IA-1 (DHS-5.1.1.a) |
| Password Authentication Configuration |
| Identification and Authentication Policy and Procedures (T) |
| System-Specific |
| Not Entered |
| Not Assigned |
| IA-1(DHS-5.1.1.a), IA-1(DHS-5.1.1.a), IA-1(DHS-5.1.1.a) |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 IA-2 |
| Identification and Authentication (Organizational Users) |
| Identification and Authentication (Organizational Users) (T) |
| System-Specific |
| Not Entered |
| Not Assigned |
| IA-2.1, IA-2.1, IA-2.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 IA-2 (1) |
| Network Access To Privileged Accounts |
| Identification and Authentication (Organizational Users) (T) |
| System-Specific |
| Not Entered |
| Not Assigned |
| IA-2(1).1, IA-2(1).1, IA-2(1).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 IA-2 (12) |
| Acceptance Of PIV Credentials |
| Identification and Authentication (Organizational Users) (T) |
| System-Specific |
| Not Entered |
| Not Assigned |
| IA-2(12).1, IA-2(12).1, IA-2(12).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 IA-2 (DHS-5.1.a) |
| DHS User Identification and Authentication |
| Identification and Authentication (Organizational Users) (T) |
| System-Specific |
| Not Entered |
| Not Assigned |
| IA-2(DHS-5.1.a), IA-2(DHS-5.1.a), IA-2(DHS-5.1.a) |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 IA-2 (DHS-5.1.d) |
| Usage of Identification or Authentication Materials |
| Identification and Authentication (Organizational Users) (T) |
| System-Specific |
| Not Entered |
| Not Assigned |
| IA-2(DHS-5.1.d), IA-2(DHS-5.1.d), IA-2(DHS-5.1.d) |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 IA-4 |
| Identifier Management |
| Identifier Management (T) |
| System-Specific |
| Not Entered |
| Not Assigned |
| IA-4.1, IA-4.1, IA-4.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 IA-4 (DHS-4.6.2.r) |
| Derived PIV Credentials |
| Identifier Management (T) |
| System-Specific |
| Not Entered |
| Not Assigned |
| IA-4(DHS-4.6.2.r), IA-4(DHS-4.6.2.r), IA-4(DHS-4.6.2.r) |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 IA-5 |
| Authenticator Management |
| Authenticator Management (T) |
| System-Specific |
| Not Entered |
| Not Assigned |
| IA-5.1, IA-5.1, IA-5.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 IA-5 (1) |
| Password-Based Authentication |
| Authenticator Management (T) |
| System-Specific |
| Not Entered |
| Not Assigned |
| IA-5(1).1, IA-5(1).1, IA-5(1).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 IA-5 (11) |
| Hardware Token-Based Authentication |
| Authenticator Management (T) |
| System-Specific |
| Not Entered |
| Not Assigned |
| IA-5(11).1, IA-5(11).1, IA-5(11).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 IA-5 (DHS-5.1.e) |
| User Authentication Materials |
| Authenticator Management (T) |
| System-Specific |
| Not Entered |
| Not Assigned |
| IA-5(DHS-5.1.e), IA-5(DHS-5.1.e), IA-5(DHS-5.1.e) |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 IA-5 (DHS-5.1.k) |
| PIV Usage for Privileged Users |
| Authenticator Management (T) |
| System-Specific |
| Not Entered |
| Not Assigned |
| IA-5(DHS-5.1.k), IA-5(DHS-5.1.k), IA-5(DHS-5.1.k) |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 IA-5 (DHS-5.1.m) |
| PIV Card Usage |
| Authenticator Management (T) |
| System-Specific |
| Not Entered |
| Not Assigned |
| IA-5(DHS-5.1.m), IA-5(DHS-5.1.m), IA-5(DHS-5.1.m) |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 IA-6 |
| Authenticator Feedback |
| Authenticator Feedback (T) |
| System-Specific |
| Not Entered |
| Not Assigned |
| IA-6.1, IA-6.1, IA-6.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 IA-7 |
| Cryptographic Module Authentication |
| Cryptographic Module Authentication (T) |
| System-Specific |
| Not Entered |
| Not Assigned |
| IA-7.1, IA-7.1, IA-7.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 IA-8 |
| Identification and Authentication (Non-Organizational Users) |
| Identification and Authentication (Non-Organizational Users) (T) |
| System-Specific |
| Not Entered |
| Not Assigned |
| IA-8.1, IA-8.1, IA-8.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 IA-8 (1) |
| Acceptance Of PIV Credentials From Other Agencies |
| Identification and Authentication (Non-Organizational Users) (T) |
| System-Specific |
| Not Entered |
| Not Assigned |
| IA-8(1).1, IA-8(1).1, IA-8(1).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 IA-8 (2) |
| Acceptance Of Third-Party Credentials |
| Identification and Authentication (Non-Organizational Users) (T) |
| System-Specific |
| Not Entered |
| Not Assigned |
| IA-8(2).1, IA-8(2).1, IA-8(2).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 IA-8 (3) |
| Use Of FICAM-Approved Products |
| Identification and Authentication (Non-Organizational Users) (T) |
| System-Specific |
| Not Entered |
| Not Assigned |
| IA-8(3).1, IA-8(3).1, IA-8(3).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 IA-8 (4) |
| Use Of Ficam-Issued Profiles |
| Identification and Authentication (Non-Organizational Users) (T) |
| System-Specific |
| Not Entered |
| Not Assigned |
| IA-8(4).1, IA-8(4).1, IA-8(4).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 IR-1 |
| Incident Response Policy and Procedures |
| Incident Response Policy and Procedures (O) |
| System-Specific |
| Not Entered |
| Not Assigned |
| IR-1.1, IR-1.1, IR-1.1, IR-1.2, IR-1.2, IR-1.2 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 IR-1 (DHS-3.15.g) |
| Weekly Incident Reporting |
| Incident Response Policy and Procedures (O) |
| System-Specific |
| Not Entered |
| Not Assigned |
| IR-1(DHS-3.15.g), IR-1(DHS-3.15.g), IR-1(DHS-3.15.g) |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 IR-2 |
| Incident Response Training |
| Incident Response Training (O) |
| System-Specific |
| Not Entered |
| Not Assigned |
| IR-2.1, IR-2.1, IR-2.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 IR-4 |
| Incident Handling |
| Incident Handling (O) |
| System-Specific |
| Not Entered |
| Not Assigned |
| IR-4.1, IR-4.1, IR-4.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 IR-5 |
| Incident Monitoring |
| Incident Monitoring (O) |
| System-Specific |
| Not Entered |
| Not Assigned |
| IR-5.1, IR-5.1, IR-5.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 IR-6 |
| Incident Reporting |
| Incident Reporting (O) |
| System-Specific |
| Not Entered |
| Not Assigned |
| IR-6.1, IR-6.1, IR-6.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 IR-6 (DHS-3.15.h) |
| Incident Reporting to CFO |
| Incident Reporting (O) |
| System-Specific |
| Not Entered |
| Not Assigned |
| IR-6(DHS-3.15.h), IR-6(DHS-3.15.h), IR-6(DHS-3.15.h) |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 IR-7 |
| Incident Response Assistance |
| Incident Response Assistance (O) |
| System-Specific |
| Not Entered |
| Not Assigned |
| IR-7.1, IR-7.1, IR-7.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 IR-8 |
| Incident Response Plan |
| Incident Response Plan (O) |
| System-Specific |
| Not Entered |
| Not Assigned |
| IR-8.1, IR-8.1, IR-8.1, IR-8.2, IR-8.2, IR-8.2 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 MA-1 |
| System Maintenance Policy and Procedures |
| System Maintenance Policy and Procedures (O) |
| System-Specific |
| Not Entered |
| Not Assigned |
| MA-1.1, MA-1.1, MA-1.1, MA-1.2, MA-1.2, MA-1.2 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 MA-1 (DHS-4.8.4.e) |
| Maintenance Ports |
| System Maintenance Policy and Procedures (O) |
| System-Specific |
| Not Entered |
| Not Assigned |
| MA-1(DHS-4.8.4.e), MA-1(DHS-4.8.4.e), MA-1(DHS-4.8.4.e) |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 MA-1 (DHS-4.8.4.i) |
| Maintenance User Identity |
| System Maintenance Policy and Procedures (O) |
| System-Specific |
| Not Entered |
| Not Assigned |
| MA-1(DHS-4.8.4.i), MA-1(DHS-4.8.4.i), MA-1(DHS-4.8.4.i) |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 MA-1 (DHS-4.12.g) |
| Maintenance of Network Printers, Copiers, and Facsimiles |
| System Maintenance Policy and Procedures (O) |
| System-Specific |
| Not Entered |
| Not Assigned |
| MA-1(DHS-4.12.g), MA-1(DHS-4.12.g), MA-1(DHS-4.12.g) |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 MA-2 |
| Controlled Maintenance |
| Controlled Maintenance (O) |
| System-Specific |
| Not Entered |
| Not Assigned |
| MA-2.1, MA-2.1, MA-2.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 MA-4 |
| Nonlocal Maintenance |
| Nonlocal Maintenance (O) |
| System-Specific |
| Not Entered |
| Not Assigned |
| MA-4.1, MA-4.1, MA-4.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 MA-4 (DHS-4.12.e) |
| Remote Maintenance Restrictions |
| Nonlocal Maintenance (O) |
| System-Specific |
| Not Entered |
| Not Assigned |
| MA-4(DHS-4.12.e), MA-4(DHS-4.12.e), MA-4(DHS-4.12.e) |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 MA-4 (DHS-5.4.4.c) |
| Remote Maintenance Paths |
| Nonlocal Maintenance (O) |
| System-Specific |
| Not Entered |
| Not Assigned |
| MA-4(DHS-5.4.4.c), MA-4(DHS-5.4.4.c), MA-4(DHS-5.4.4.c) |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 MA-5 |
| Maintenance Personnel |
| Maintenance Personnel (O) |
| System-Specific |
| Not Entered |
| Not Assigned |
| MA-5.1, MA-5.1, MA-5.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 MP-1 |
| Media Protection Policy and Procedures |
| Media Protection Policy and Procedures (O) |
| System-Specific |
| Not Entered |
| Not Assigned |
| MP-1.1, MP-1.1, MP-1.1, MP-1.2, MP-1.2, MP-1.2 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 MP-1 (DHS-4.3.1.g) |
| Protection of Printed Output |
| Media Protection Policy and Procedures (O) |
| System-Specific |
| Not Entered |
| Not Assigned |
| MP-1(DHS-4.3.1.g), MP-1(DHS-4.3.1.g), MP-1(DHS-4.3.1.g) |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 MP-1 (DHS-4.11.d) |
| Portable Backup Media |
| Media Protection Policy and Procedures (O) |
| System-Specific |
| Not Entered |
| Not Assigned |
| MP-1(DHS-4.11.d), MP-1(DHS-4.11.d), MP-1(DHS-4.11.d) |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 MP-1 (DHS-5.4.1.d) |
| PII Remote Access |
| Media Protection Policy and Procedures (O) |
| System-Specific |
| Not Entered |
| Not Assigned |
| MP-1(DHS-5.4.1.d), MP-1(DHS-5.4.1.d), MP-1(DHS-5.4.1.d) |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 MP-2 |
| Media Access |
| Media Access (O) |
| System-Specific |
| Not Entered |
| Not Assigned |
| MP-2.1, MP-2.1, MP-2.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 MP-6 |
| Media Sanitization |
| Media Sanitization (O) |
| System-Specific |
| Not Entered |
| Not Assigned |
| MP-6.1, MP-6.1, MP-6.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 MP-6 (DHS-4.3.3.b) |
| Sanitization and Disposition Records |
| Media Sanitization (O) |
| System-Specific |
| Not Entered |
| Not Assigned |
| MP-6(DHS-4.3.3.b), MP-6(DHS-4.3.3.b), MP-6(DHS-4.3.3.b) |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 MP-6 (DHS-4.3.3.c) |
| Degaussing Equipment Testing |
| Media Sanitization (O) |
| System-Specific |
| Not Entered |
| Not Assigned |
| MP-6(DHS-4.3.3.c), MP-6(DHS-4.3.3.c), MP-6(DHS-4.3.3.c) |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 MP-6 (DHS-4.12.h) |
| Storage and Destruction of Memory and Hard Drives |
| Media Sanitization (O) |
| System-Specific |
| Not Entered |
| Not Assigned |
| MP-6(DHS-4.12.h), MP-6(DHS-4.12.h), MP-6(DHS-4.12.h) |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 MP-7 |
| Media Use |
| Media Use (O) |
| System-Specific |
| Not Entered |
| Not Assigned |
| MP-7.1, MP-7.1, MP-7.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 MP-7 (DHS-4.3.1.d) |
| USB Drive encryption |
| Media Use (O) |
| System-Specific |
| Not Entered |
| Not Assigned |
| MP-7(DHS-4.3.1.d), MP-7(DHS-4.3.1.d), MP-7(DHS-4.3.1.d) |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 MP-7 (DHS-4.3.1.e) |
| DHS owned Removable Media |
| Media Use (O) |
| System-Specific |
| Not Entered |
| Not Assigned |
| MP-7(DHS-4.3.1.e), MP-7(DHS-4.3.1.e), MP-7(DHS-4.3.1.e) |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 MP-7 (DHS-4.3.1.f) |
| Protection of Sensitive Paper and Electronic Outputs |
| Media Use (O) |
| System-Specific |
| Not Entered |
| Not Assigned |
| MP-7(DHS-4.3.1.f), MP-7(DHS-4.3.1.f), MP-7(DHS-4.3.1.f) |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 PE-1 |
| Physical and Environmental Protection Policy and Procedures |
| Physical and Environmental Protection Policy and Procedures (O) |
| System-Specific |
| Not Entered |
| Not Assigned |
| PE-1.1, PE-1.1, PE-1.1, PE-1.2, PE-1.2, PE-1.2 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 PE-1 (DHS-3.3.c) |
| Sensitive Information at Contractor Sites |
| Physical and Environmental Protection Policy and Procedures (O) |
| System-Specific |
| Not Entered |
| Not Assigned |
| PE-1(DHS-3.3.c), PE-1(DHS-3.3.c), PE-1(DHS-3.3.c) |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 PE-1 (DHS-4.6.2.3.b) |
| Video, IR, and RF Signals |
| Physical and Environmental Protection Policy and Procedures (O) |
| System-Specific |
| Not Entered |
| Not Assigned |
| PE-1(DHS-4.6.2.3.b), PE-1(DHS-4.6.2.3.b), PE-1(DHS-4.6.2.3.b) |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 PE-1 (DHS-4.8.1.c) |
| Workstation Lock and Logoff |
| Physical and Environmental Protection Policy and Procedures (O) |
| System-Specific |
| Not Entered |
| Not Assigned |
| PE-1(DHS-4.8.1.c), PE-1(DHS-4.8.1.c), PE-1(DHS-4.8.1.c) |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 PE-2 |
| Physical Access Authorizations |
| Physical Access Authorizations (O) |
| System-Specific |
| Not Entered |
| Not Assigned |
| PE-2.1, PE-2.1, PE-2.1, PE-2.2, PE-2.2, PE-2.2 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 PE-3 |
| Physical Access Control |
| Physical Access Control (O) |
| System-Specific |
| Not Entered |
| Not Assigned |
| PE-3.1, PE-3.1, PE-3.1, PE-3.2, PE-3.2, PE-3.2 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 PE-6 |
| Monitoring Physical Access |
| Monitoring Physical Access (O) |
| System-Specific |
| Not Entered |
| Not Assigned |
| PE-6.1, PE-6.1, PE-6.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 PE-8 |
| Visitor Access Records |
| Visitor Access Records (O) |
| System-Specific |
| Not Entered |
| Not Assigned |
| PE-8.1, PE-8.1, PE-8.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 PE-12 |
| Emergency Lighting |
| Emergency Lighting (O) |
| System-Specific |
| Not Entered |
| Not Assigned |
| PE-12.1, PE-12.1, PE-12.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 PE-13 |
| Fire Protection |
| Fire Protection (O) |
| System-Specific |
| Not Entered |
| Not Assigned |
| PE-13.1, PE-13.1, PE-13.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 PE-14 |
| Temperature and Humidity Controls |
| Temperature and Humidity Controls (O) |
| System-Specific |
| Not Entered |
| Not Assigned |
| PE-14.1, PE-14.1, PE-14.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 PE-15 |
| Water Damage Protection |
| Water Damage Protection (O) |
| System-Specific |
| Not Entered |
| Not Assigned |
| PE-15.1, PE-15.1, PE-15.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 PE-16 |
| Delivery and Removal |
| Delivery and Removal (O) |
| System-Specific |
| Not Entered |
| Not Assigned |
| PE-16.1, PE-16.1, PE-16.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 PL-1 |
| Security Planning Policy and Procedures |
| Security Planning Policy and Procedures (M) |
| System-Specific |
| Not Entered |
| Not Assigned |
| PL-1.1, PL-1.1, PL-1.1, PL-1.2, PL-1.2, PL-1.2 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 PL-1 (DHS-4.6.1.d) |
| DHS SP Requirements |
| Security Planning Policy and Procedures (M) |
| System-Specific |
| Not Entered |
| Not Assigned |
| PL-1(DHS-4.6.1.d), PL-1(DHS-4.6.1.d), PL-1(DHS-4.6.1.d) |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 PL-1 (DHS-4.6.1.e) |
| Legacy Wireless Migration Plan |
| Security Planning Policy and Procedures (M) |
| System-Specific |
| Not Entered |
| Not Assigned |
| PL-1(DHS-4.6.1.e), PL-1(DHS-4.6.1.e), PL-1(DHS-4.6.1.e) |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 PL-2 |
| System Security Plan |
| System Security Plan (M) |
| System-Specific |
| Not Entered |
| Not Assigned |
| PL-2.1, PL-2.1, PL-2.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 PL-2 (DHS-3.15.i) |
| SP Annual Update |
| System Security Plan (M) |
| System-Specific |
| Not Entered |
| Not Assigned |
| PL-2(DHS-3.15.i), PL-2(DHS-3.15.i), PL-2(DHS-3.15.i) |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 PL-4 |
| Rules of Behavior |
| Rules of Behavior (M) |
| System-Specific |
| Not Entered |
| Not Assigned |
| PL-4.1, PL-4.1, PL-4.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 PL-4 (DHS-4.1.2.a) |
| DHS Rules of Behavior |
| Rules of Behavior (M) |
| System-Specific |
| Not Entered |
| Not Assigned |
| PL-4(DHS-4.1.2.a), PL-4(DHS-4.1.2.a), PL-4(DHS-4.1.2.a) |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 PL-4 (DHS-4.1.2.b) |
| DHS Rules of Behavior |
| Rules of Behavior (M) |
| System-Specific |
| Not Entered |
| Not Assigned |
| PL-4(DHS-4.1.2.b), PL-4(DHS-4.1.2.b), PL-4(DHS-4.1.2.b) |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 PL-4 (DHS-4.8.2.b) |
| Laptop Power Down |
| Rules of Behavior (M) |
| System-Specific |
| Not Entered |
| Not Assigned |
| PL-4(DHS-4.8.2.b), PL-4(DHS-4.8.2.b), PL-4(DHS-4.8.2.b) |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 PL-4 (DHS-4.8.2.c) |
| Laptop Storage |
| Rules of Behavior (M) |
| System-Specific |
| Not Entered |
| Not Assigned |
| PL-4(DHS-4.8.2.c), PL-4(DHS-4.8.2.c), PL-4(DHS-4.8.2.c) |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 PL-4 (DHS-4.8.3.a) |
| Personally Owned Equipment |
| Rules of Behavior (M) |
| System-Specific |
| Not Entered |
| Not Assigned |
| PL-4(DHS-4.8.3.a), PL-4(DHS-4.8.3.a), PL-4(DHS-4.8.3.a) |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 PL-4 (DHS-4.8.5.e) |
| Signed Rules of Behavior |
| Rules of Behavior (M) |
| System-Specific |
| Not Entered |
| Not Assigned |
| PL-4(DHS-4.8.5.e), PL-4(DHS-4.8.5.e), PL-4(DHS-4.8.5.e) |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 PM-1 |
| Information Security Program Plan |
| Information Security Program Plan (M) |
| System-Specific |
| Not Entered |
| Not Assigned |
| PM-1.1, PM-1.1, PM-1.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 PM-2 |
| Senior Information Security Officer |
| Senior Information Security Officer (M) |
| System-Specific |
| Not Entered |
| Not Assigned |
| PM-2.1, PM-2.1, PM-2.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 PM-3 |
| Information Security Resources |
| Information Security Resources (M) |
| System-Specific |
| Not Entered |
| Not Assigned |
| PM-3.1, PM-3.1, PM-3.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 PM-4 |
| Plan of Action and Milestones Process |
| Plan of Action and Milestones Process (M) |
| System-Specific |
| Not Entered |
| Not Assigned |
| PM-4.1, PM-4.1, PM-4.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 PM-5 |
| Information System Inventory |
| Information System Inventory (M) |
| System-Specific |
| Not Entered |
| Not Assigned |
| PM-5.1, PM-5.1, PM-5.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 PM-6 |
| Information Security Measures of Performance |
| Information Security Measures of Performance (M) |
| System-Specific |
| Not Entered |
| Not Assigned |
| PM-6.1, PM-6.1, PM-6.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 PM-7 |
| Enterprise Architecture |
| Enterprise Architecture (M) |
| System-Specific |
| Not Entered |
| Not Assigned |
| PM-7.1, PM-7.1, PM-7.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 PM-8 |
| Critical Infrastructure Plan |
| Critical Infrastructure Plan (M) |
| System-Specific |
| Not Entered |
| Not Assigned |
| PM-8.1, PM-8.1, PM-8.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 PM-9 |
| Risk Management Strategy |
| Risk Management Strategy (M) |
| System-Specific |
| Not Entered |
| Not Assigned |
| PM-9.1, PM-9.1, PM-9.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 PM-10 |
| Security Authorization Process |
| Security Authorization Process (M) |
| System-Specific |
| Not Entered |
| Not Assigned |
| PM-10.1, PM-10.1, PM-10.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 PM-11 |
| Mission/Business Process Definition |
| Mission/Business Process Definition (M) |
| System-Specific |
| Not Entered |
| Not Assigned |
| PM-11.1, PM-11.1, PM-11.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 PM-12 |
| Insider Threat Program |
| Insider Threat Program (M) |
| System-Specific |
| Not Entered |
| Not Assigned |
| PM-12.1, PM-12.1, PM-12.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 PM-13 |
| Information Security Workforce |
| Information Security Workforce (M) |
| System-Specific |
| Not Entered |
| Not Assigned |
| PM-13.1, PM-13.1, PM-13.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 PM-14 |
| Testing, Training, and Monitoring |
| Testing, Training, and Monitoring (M) |
| System-Specific |
| Not Entered |
| Not Assigned |
| PM-14.1, PM-14.1, PM-14.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 PM-15 |
| Contacts with Security Groups and Associations |
| Contacts with Security and Associations (M) |
| System-Specific |
| Not Entered |
| Not Assigned |
| PM-15.1, PM-15.1, PM-15.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 PM-16 |
| Threat Awareness Program |
| Threat Awareness Program (M) |
| System-Specific |
| Not Entered |
| Not Assigned |
| PM-16.1, PM-16.1, PM-16.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 PRIV-AP-1 |
| Authority to Collect |
| Authority to Collect () |
| System-Specific |
| Not Entered |
| Not Assigned |
| AP-1.1, AP-1.1, AP-1.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 PRIV-AP-2 |
| Purpose Specification |
| Purpose Specification () |
| System-Specific |
| Not Entered |
| Not Assigned |
| AP-2.1, AP-2.1, AP-2.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 PRIV-AR-1 |
| Governance and Privacy Program |
| Governance and Privacy Program () |
| System-Specific |
| Not Entered |
| Not Assigned |
| AR-1.1, AR-1.1, AR-1.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 PRIV-AR-2 |
| Privacy Impact and Risk Assessment |
| Privacy Impact and Risk Assessment () |
| System-Specific |
| Not Entered |
| Not Assigned |
| AR-2.1, AR-2.1, AR-2.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 PRIV-AR-3 |
| Privacy Requirements for Contractors and Service Providers |
| Privacy Requirements for Contractors and Service Providers () |
| System-Specific |
| Not Entered |
| Not Assigned |
| AR-3.1, AR-3.1, AR-3.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 PRIV-AR-4 |
| Privacy Monitoring and Auditing |
| Privacy Monitoring and Auditing () |
| System-Specific |
| Not Entered |
| Not Assigned |
| AR-4.1, AR-4.1, AR-4.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 PRIV-AR-5 |
| Privacy Awareness and Training |
| Privacy Awareness and Training () |
| System-Specific |
| Not Entered |
| Not Assigned |
| AR-5.1, AR-5.1, AR-5.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 PRIV-AR-6 |
| Privacy Reporting |
| Privacy Reporting () |
| System-Specific |
| Not Entered |
| Not Assigned |
| AR-6.1, AR-6.1, AR-6.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 PRIV-AR-7 |
| Privacy-Enhanced System Design and Development |
| Privacy-Enhanced System Design and Development () |
| System-Specific |
| Not Entered |
| Not Assigned |
| AR-7.1, AR-7.1, AR-7.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 PRIV-AR-8 |
| Accounting of Disclosures |
| Accounting of Disclosures () |
| System-Specific |
| Not Entered |
| Not Assigned |
| AR-8.1, AR-8.1, AR-8.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 PRIV-DI-1 |
| Data Quality |
| Data Quality () |
| System-Specific |
| Not Entered |
| Not Assigned |
| DI-1.1, DI-1.1, DI-1.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 PRIV-DI-2 |
| Data Integrity and Data Integrity Board |
| Data Integrity and Data Integrity Board () |
| System-Specific |
| Not Entered |
| Not Assigned |
| DI-2.1, DI-2.1, DI-2.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 PRIV-DM-1 |
| Minimization of Personally Identifiable Information |
| Minimization of Personally Identifiable Information () |
| System-Specific |
| Not Entered |
| Not Assigned |
| DM-1.1, DM-1.1, DM-1.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 PRIV-DM-2 |
| Data Retention and Disposal |
| Data Retention and Disposal () |
| System-Specific |
| Not Entered |
| Not Assigned |
| DM-2.1, DM-2.1, DM-2.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 PRIV-DM-3 |
| Minimization of PII Used in Testing, Training, and Research |
| Minimization of PII Used in Testing, Training, and Research () |
| System-Specific |
| Not Entered |
| Not Assigned |
| DM-3.1, DM-3.1, DM-3.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 PRIV-IP-1 |
| Consent |
| Consent () |
| System-Specific |
| Not Entered |
| Not Assigned |
| IP-1.1, IP-1.1, IP-1.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 PRIV-IP-2 |
| Individual Access |
| Individual Access () |
| System-Specific |
| Not Entered |
| Not Assigned |
| IP-2.1, IP-2.1, IP-2.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 PRIV-IP-3 |
| Redress |
| Redress () |
| System-Specific |
| Not Entered |
| Not Assigned |
| IP-3.1, IP-3.1, IP-3.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 PRIV-IP-4 |
| Complaint Management |
| Complaint Management () |
| System-Specific |
| Not Entered |
| Not Assigned |
| IP-4.1, IP-4.1, IP-4.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 PRIV-SE-1 |
| Inventory of Personally Identifiable Information |
| Inventory of Personally Identifiable Information () |
| System-Specific |
| Not Entered |
| Not Assigned |
| SE-1.1, SE-1.1, SE-1.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 PRIV-SE-2 |
| Privacy Incident Response |
| Privacy Incident Response () |
| System-Specific |
| Not Entered |
| Not Assigned |
| SE-2.1, SE-2.1, SE-2.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 PRIV-TR-1 |
| Privacy Notice |
| Privacy Notice () |
| System-Specific |
| Not Entered |
| Not Assigned |
| TR-1.1, TR-1.1, TR-1.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 PRIV-TR-2 |
| System of Records Notices and Privacy Act Statements |
| System of Records Notices and Privacy Act Statements () |
| System-Specific |
| Not Entered |
| Not Assigned |
| TR-2.1, TR-2.1, TR-2.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 PRIV-TR-3 |
| Dissemination of Privacy Program Information |
| Dissemination of Privacy Program Information () |
| System-Specific |
| Not Entered |
| Not Assigned |
| TR-3.1, TR-3.1, TR-3.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 PRIV-UL-1 |
| Internal Use |
| Internal Use () |
| System-Specific |
| Not Entered |
| Not Assigned |
| UL-1.1, UL-1.1, UL-1.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 PRIV-UL-2 |
| Information Sharing with Third Parties |
| Information Sharing with Third Parties () |
| System-Specific |
| Not Entered |
| Not Assigned |
| UL-2.1, UL-2.1, UL-2.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 PS-1 |
| Personnel Security Policy and Procedures |
| Personnel Security Policy and Procedures (O) |
| System-Specific |
| Not Entered |
| Not Assigned |
| PS-1.1, PS-1.1, PS-1.1, PS-1.2, PS-1.2, PS-1.2 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 PS-2 |
| Position Risk Designation |
| Position Risk Designation (O) |
| System-Specific |
| Not Entered |
| Not Assigned |
| PS-2.1, PS-2.1, PS-2.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 PS-3 |
| Personnel Screening |
| Personnel Screening (O) |
| System-Specific |
| Not Entered |
| Not Assigned |
| PS-3.1, PS-3.1, PS-3.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 PS-4 |
| Personnel Termination |
| Personnel Termination (O) |
| System-Specific |
| Not Entered |
| Not Assigned |
| PS-4.1, PS-4.1, PS-4.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 PS-5 |
| Personnel Transfer |
| Personnel Transfer (O) |
| System-Specific |
| Not Entered |
| Not Assigned |
| PS-5.1, PS-5.1, PS-5.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 PS-6 |
| Access Agreements |
| Access Agreements (O) |
| System-Specific |
| Not Entered |
| Not Assigned |
| PS-6.1, PS-6.1, PS-6.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 PS-7 |
| Third-Party Personnel Security |
| Third-Party Personnel Security (O) |
| System-Specific |
| Not Entered |
| Not Assigned |
| PS-7.1, PS-7.1, PS-7.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 PS-8 |
| Personnel Sanctions |
| Personnel Sanctions (O) |
| System-Specific |
| Not Entered |
| Not Assigned |
| PS-8.1, PS-8.1, PS-8.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 RA-1 |
| Risk Assessment Policy and Procedures |
| Risk Assessment Policy and Procedures (M) |
| System-Specific |
| Not Entered |
| Not Assigned |
| RA-1.1, RA-1.1, RA-1.1, RA-1.2, RA-1.2, RA-1.2 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 RA-2 |
| Security Categorization |
| Security Categorization (M) |
| System-Specific |
| Not Entered |
| Not Assigned |
| RA-2.1, RA-2.1, RA-2.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 RA-3 |
| Risk Assessment |
| Risk Assessment (M) |
| System-Specific |
| Not Entered |
| Not Assigned |
| RA-3.1, RA-3.1, RA-3.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 RA-3 (DHS-4.5.4.a) |
| VOIP |
| Risk Assessment (M) |
| System-Specific |
| Not Entered |
| Not Assigned |
| RA-3(DHS-4.5.4.a), RA-3(DHS-4.5.4.a), RA-3(DHS-4.5.4.a) |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 RA-3 (DHS-5.3.e) |
| Risk Determination of PII |
| Risk Assessment (M) |
| System-Specific |
| Not Entered |
| Not Assigned |
| RA-3(DHS-5.3.e), RA-3(DHS-5.3.e), RA-3(DHS-5.3.e) |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 RA-5 |
| Vulnerability Scanning |
| Vulnerability Scanning (M) |
| System-Specific |
| Not Entered |
| Not Assigned |
| RA-5.1, RA-5.1, RA-5.1, RA-5.2, RA-5.2, RA-5.2 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 RA-5 (DHS-3.15.c) |
| Vulnerability Assessments |
| Vulnerability Scanning (M) |
| System-Specific |
| Not Entered |
| Not Assigned |
| RA-5(DHS-3.15.c), RA-5(DHS-3.15.c), RA-5(DHS-3.15.c) |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 RA-5 (DHS-4.8.4.d) |
| ISVM Compliance |
| Vulnerability Scanning (M) |
| System-Specific |
| Not Entered |
| Not Assigned |
| RA-5(DHS-4.8.4.d), RA-5(DHS-4.8.4.d), RA-5(DHS-4.8.4.d) |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 SA-1 |
| System and Services Acquisition Policy and Procedures |
| System and Services Acquisition Policy and Procedures (M) |
| System-Specific |
| Not Entered |
| Not Assigned |
| SA-1.1, SA-1.1, SA-1.1, SA-1.2, SA-1.2, SA-1.2 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 SA-1 (DHS-3.1.g) |
| DHS Enterprise Architecture and Security Architecture |
| System and Services Acquisition Policy and Procedures (M) |
| System-Specific |
| Not Entered |
| Not Assigned |
| SA-1(DHS-3.1.g), SA-1(DHS-3.1.g), SA-1(DHS-3.1.g) |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A Rev 4 SA-1 (DHS-3.2.g) |
| Procurements Regarding HSPD-12 |
| System and Services Acquisition Policy and Procedures (M) |
This is the start of the file's text. The full file is on GovTribe.