43 H RTM Template 5May21.pdf

1 MB Posted

Attached to
TSA Gold+ COMMERCIAL SERVICES IDIQ CONTRACT SOLICITATION
Solicitation number
70T05026R5900N005
Issued by

About this file

Written by GovTribe AI ·

This is a Requirements Traceability Matrix (RTM) template document prepared for the Department of Homeland Security that relates security requirements from source documents to the security certification process. The RTM is designed to ensure all security requirements are identified and investigated through a structured matrix format with detailed column definitions.

The document outlines security requirements derived from NIST 800-53 with DHS 4300A Rev 4 (Department of Homeland Security Sensitive Systems Policy Directive 4300A Version 12 with NIST 800-53 Rev 4). The RTM matrix columns include Control Reference, Security Requirement/Control, Security Category, Control Type (Common, Hybrid, System-Specific, Inherited, or Not Specified), Planned Implementation status, Actual Implementation status, Test Number(s), Evaluation Methods (Interview, Examine, Testing, or Not Applicable), Tailored control status (In, Out, or Not Affected), Overlays status (In, Out, or Not Affected), Result (Met, Not Met, or Not Applicable), and Notes. The template demonstrates how each security control from the baseline is tracked through the certification process, including whether controls were added through DHS Overlay 1.0, whether the organization is pursuing an Accreditation Test Plan (ATP), and any tailoring decisions made. The matrix covers extensive security control families including Access Control (AC), Audit and Accountability (AU), Assessment and Authorization (CA), Configuration Management (CM), Contingency Planning (CP), Identification and Authentication (IA), Incident Response (IR), Maintenance (MA), Media Protection (MP), Physical and Environmental Protection (PE), Planning (PL), and Program Management (PM) controls.

View the file

Other files

File Type Posted
70T05026R5900N005 Questions and Answers Set 7.pdf PDF
70T05026R5900N005 Questions and Answers Set 5.pdf PDF
70T05026R5900N005 AMD 0003.pdf PDF
70T05026R5900N005 Questions and Answers Set 4.pdf PDF
70T05026R5900N005 AMD 0001.pdf PDF
70T05026R5900N005 Questions and Answers Set 3.pdf PDF
70T05026R5900N005 Questions and Answers Set 2.pdf PDF
70T05026R5900N005 Questions and Answers Set 1.pdf PDF
42 Airport Task Order Summary - Sample.docx DOCX document
24 Attachment G - TSA T and E Guidebook Rev 6 - Final.pdf PDF
18 Attachment C - SSI Policies and Procedures Handbook.pdf PDF
33 TSA-RTWT-Requirements_Final_2026-04-27.pdf PDF
30 TSA MD 1000.15, FINAL, 221118, 508C.pdf PDF
10 Attachment A - Radiation Survey and Radioactive Leak Test Rec.pdf PDF
3 L002 - Master Configuration Item List.pdf PDF
8 L008 - Configuration Audit Plan.pdf PDF
70T05026R5900N005.pdf PDF
22 PGDS v8.0 Appendices.pdf PDF
19 Attachment D - ITAR_Terms-Conditions GOLD.pdf PDF
17 Gold_Maintenance Req_Attachment_4.13.26.pdf PDF
31 TSA MD 1900.18, FINAL, eff 24.12.04.pdf PDF
35 SAFETY ACT BLOCK DESIGNATION NOTICE.pdf PDF
11 Attachment B - TSE Metrics Terms and Definitions and RMA Metrics.pdf PDF
25 Attachment H - TSA Handbook 1100.73-2, FINAL, 201218.pdf PDF
39 ACRONYMS AND DEFINITIONS.pdf PDF
27 OD-400-50-1-5H Reporting Customer Thruput-Wait_Times_111220_FINAL_sig.pdf PDF
28 TSA MD 200.51, FINAL, 171114.pdf PDF
5 L004 - Request for Deviation.pdf PDF
12 Attachment C - Failure Mode Indicator Codes.pdf PDF
Attachment 1 Performance Work Statement.pdf PDF
41 Gold Performance Metrics.xlsx XLSX spreadsheet
40 - DHS Form 700-23.pdf PDF
23 PGDS v8.0 Main.pdf PDF
1 Gold_CM Req_Attachment_4.13.26.pdf PDF
36 ESTIMATED CONSUMABLES LIST.pdf PDF
32 TSA MD1900.8, FINAL, 231025, eff231105.pdf PDF
38 SUITABILITY DETERMINATIONS.pdf PDF
2 L001 - Configuration Management Plan.pdf PDF
16 Attachment G - TSA Media Sanitization Certificate.pdf PDF
29 TSA MD 200.52, FINAL, 2, 160829.pdf PDF
13 Attachment D - TSE Database.pdf PDF
6 L005 - Request for Waiver.pdf PDF
21 checkpoint-requirements-and-planning-guide.pdf PDF
20.1 Attachment E - cap_acceptable_capability_list _R.pdf PDF
14 Attachment E -SLA Performance Metrics.pdf PDF
15 Attachment F - TSE RMA Metrics.pdf PDF
9 L009 - Configuration Audit Summary Report.pdf PDF
37 TRAINING REQUIREMENTS.pdf PDF
4 L003 - Engineering Change Proposal.pdf PDF
7 L007 - Configuration Status Accounting Report.pdf PDF
Show 40 more

50 files listed here. See the rest on GovTribe.

On GovTribe

Work with this file

  • Download the original file
  • Contacts named in this file
  • Similar government files
  • Ask GovTribe AI about this file
Try for free Login

Text version

The file's text, extracted by GovTribe without its formatting.

FOR OFFICIAL USE ONLY

[System Name]

Requirements Traceability Matrix

(RTM)

H-H-H

Prepared for

Department of Homeland Security

5 May 2021 i

1. Introduction

The Requirements Traceability Matrix (RTM) relates requirements from requirement source documents to the security certification process. It ensures that all security requirements are identified and investigated. Each row of the matrix identifies a specific requirement and provides the details of how it was tested or analyzed and the results.

The table is arranged to display the system security requirements from the applicable regulation documents, which are listed below:

• NIST 800-53 w/ DHS 4300A Rev 4 - Department of Homeland Security Sensitive Systems Policy Directive 4300A Version 12 (with NIST 800-53 Rev 4)

The columns of the RTM are defined as follows:

Control Ref. Refers to the name (short title) of the source document and the ID or paragraph number of the listed control or requirement.

Security Req./ Control

Short title describing the security control or requirement (and the text of the control/requirement, which may be paraphrased for brevity).

Security Category

Category and class associated with the security control.

Control Type

Auto populated if the requirement is identified with two security control types: common and system-specific; i.e., a part of the requirement is identified as common type and another part of it is system-specific.

• Common. Auto populated if the requirement is designated to one or more information systems.

• Hybrid. Auto populated if the requirement is identified with two security control types:

common and system-specific; i.e., a part of the requirement is identified as common type and another part of it is system-specific.

• System-Specific. Auto populated if the requirement is assigned to a specific information system.

• Inherited. Auto populated if the requirement is inherited from another system.

• Not Specified. Auto populated if the requirement does not require any security control.

Planned Imp.

Auto populated if the requirement is identified with two security control types: common and system-specific; i.e., a part of the requirement is identified as common type and another part of it is system-specific.

• Common. Auto populated if the requirement is designated to one or more information systems.

• Hybrid. Auto populated if the requirement is identified with two security control types:

common and system-specific; i.e., a part of the requirement is identified as common type and another part of it is system-specific.

• System-Specific. Auto populated if the requirement is assigned to a specific information system.

• Inherited. Auto populated if the requirement is inherited from another system.

• Not Specified. Auto populated if the requirement does not require any security control.

Actual Imp. Identification whether the control is in place and how it has been implemented, or differences ii in how the control was implemented compared to what was planned.

• As Planned. Auto populated if Implemented control status is selected and Planned

Implementation column does not read Not Entered.

• Pending Implementation. Auto populated if Planned control status is selected and

Planned Implementation column does not read Not Entered.

• Partially Implemented. Auto populated if Partial control status is selected and

Planned Implementation column does not read Not Entered.

• Not Entered. Auto populated if the Planned Implementation column reads Not

Entered.

• Not Assigned. Auto populated if the Control Type and/or Control Status were not selected.

Test #(s) The ID number of the specific test procedure(s) that is used to validate the requirement or control.

• -. The control is not applicable.

Methods

The evaluation method (or methods) used to assess the requirement.

• I. Interview.

• E. Examine.

• T. Testing.

• -. The control is not applicable.

Tailored

The tailored control that modifies the control set.

• In. The control was tailored in.

• Out. The control was tailored out.

• - . The control was not affected from tailoring.

Overlays

The controls included or excluded from the controls already in the baseline.

• In. The control was added in to the controls in the baseline.

• Out. The control was removed from the controls in the baseline.

• - . The control was not affected from overlay(s).

Result

The summarized result for the test procedures that cover the requirement/control.

• Met - Requirement fully satisfied.

• Not Met - Requirement not satisfied.

• Not Applicable - Requirement not applicable.

Notes Identifies the factor, and the basis for; any tailoring of controls from the NIST 800-53 w/ DHS 4300A Rev 4 baseline or organizational overlay that was used for the system.

2. Requirements Traceability Matrix

Control Ref.

Security Req./

Control

Security Category

Control Type

Planned Imp.

Actual Imp.

Test #(s)

Methods Tailored Result Notes

I E T IN OUT

NIST 800-

53 w/ DHS 4300A Rev

4 AC-1

Access Control

Policy and Procedures

Access Control

Policy and Procedures

(T)

System- Specific Not Entered Not Assigned

AC-1.1,

AC-1.1,

AC-1.1,

AC-1.2,

AC-1.2,

AC-1.2

X X - X - Not Met Control was added by overlay "DHS

Overlay 1.0"

NIST 800-

53 w/ DHS 4300A Rev

4 AC-1

(DHS-

5.1.1.c)

Sharing of Personal

Passwords

Access Control

Policy and Procedures

(T)

System- Specific Not Entered Not Assigned

AC-

1(DHS-

5.1.1.c), AC-

1(DHS-

5.1.1.c), AC-

1(DHS-

5.1.1.c)

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 AC-2

Account Management

Account Management

(T)

System- Specific Not Entered Not Assigned

AC-2.1,

AC-2.1,

AC-2.1

X X - X - Not Met

Not pursuing an

ATP

Control was added by overlay "DHS

Overlay 1.0"

NIST 800-

53 w/ DHS 4300A Rev

4 AC-2 (1)

Automated System Account

Management

Account Management

(T)

System- Specific Not Entered Not Assigned

AC-

2(1).1, AC-

2(1).1, AC-2(1).1

X X - - - Not Met None

NIST 800- Removal Of Account System- Not Entered Not Assigned AC- X X - - - Not Met None

Control Ref.

Security Req./

Category

Control Type

Planned Imp.

Actual Imp.

Test #(s) Methods Tailored Result Notes

53 w/ DHS 4300A Rev

4 AC-2 (2)

Temporary / Emergency Accounts

Management (T)

Specific 2(2).1, AC-

2(2).1, AC-2(2).1

NIST 800-

53 w/ DHS 4300A Rev

4 AC-2 (3)

Disable Inactive

Accounts

Account Management

(T)

System- Specific Not Entered Not Assigned

AC-

2(3).1, AC-

2(3).1, AC-2(3).1

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 AC-2 (4)

Automated Audit Actions

Account Management

(T)

System- Specific Not Entered Not Assigned

AC-

2(4).1, AC-

2(4).1, AC-2(4).1

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 AC-2 (5)

Inactivity Logout

Account Management

(T)

System- Specific Not Entered Not Assigned

AC-

2(5).1, AC-

2(5).1, AC-2(5).1

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 AC-2

(11)

Usage Conditions

Account Management

(T)

System- Specific Not Entered Not Assigned

AC-

2(11).1, AC-

2(11).1, AC-

2(11).1

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 AC-3

Access Enforcement

Access Enforcement

(T)

System- Specific Not Entered Not Assigned

AC-3.1,

AC-3.1,

AC-3.1

X X - X - Not Met

Overlay 1.0"

NIST 800-

53 w/ DHS 4300A Rev

Use of group passwords

Access Enforcement

(T)

System- Specific Not Entered Not Assigned

AC-

3(DHS-

5.1.1.d), Control Ref.

Control Type

Planned Imp.

Actual Imp.

Test #(s) Methods Tailored Result Notes

4 AC-3

(DHS-

5.1.1.d)

AC-

3(DHS-

5.1.1.d), AC-

3(DHS-

5.1.1.d)

NIST 800-

53 w/ DHS 4300A Rev

4 AC-4

Information Flow

Enforcement

Information Flow

Enforcement (T)

System- Specific Not Entered Not Assigned

AC-4.1,

AC-4.1,

AC-4.1

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 AC-5

Separation of Duties

Separation of Duties (T)

System- Specific Not Entered Not Assigned

AC-5.1,

AC-5.1,

AC-5.1

X X - X - Not Met Control was added by overlay "DHS

Overlay 1.0"

NIST 800-

53 w/ DHS 4300A Rev

4 AC-6

Least Privilege

Least Privilege (T)

System- Specific Not Entered Not Assigned

AC-6.1,

AC-6.1,

AC-6.1

X X - X - Not Met

Overlay 1.0"

NIST 800-

53 w/ DHS 4300A Rev

4 AC-6 (1)

Authorize Access To Security

Functions

Least Privilege (T)

System- Specific Not Entered Not Assigned

AC-

6(1).1, AC-

6(1).1, AC-6(1).1

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 AC-6 (2)

Non- Privileged Access For Nonsecurity Functions

Least Privilege (T)

System- Specific Not Entered Not Assigned

AC-

6(2).1, AC-

6(2).1, AC-6(2).1

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 AC-6 (3)

Network Access To Privileged Commands

Least Privilege (T)

System- Specific Not Entered Not Assigned

AC-

6(3).1, AC-

6(3).1, Control Ref.

Control Type

Planned Imp.

Actual Imp.

Test #(s) Methods Tailored Result Notes

AC-6(3).1

NIST 800-

53 w/ DHS 4300A Rev

4 AC-6 (5)

Privileged Accounts

Least Privilege (T)

System- Specific Not Entered Not Assigned

AC-

6(5).1, AC-

6(5).1, AC-6(5).1

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 AC-6 (9)

Auditing Use Of Privileged

Functions

Least Privilege (T)

System- Specific Not Entered Not Assigned

AC-

6(9).1, AC-

6(9).1, AC-6(9).1

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 AC-6

(10)

Prohibit Non- Privileged

Users From Executing Privileged Functions

Least Privilege (T)

System- Specific Not Entered Not Assigned

AC-

6(10).1, AC-

6(10).1, AC-

6(10).1

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 AC-7

Unsuccessful Logon

Attempts

Unsuccessful Logon

Attempts (T)

System- Specific Not Entered Not Assigned

AC-7.1,

AC-7.1,

AC-7.1

X X - X - Not Met Control was added by overlay "DHS

Overlay 1.0"

NIST 800-

53 w/ DHS 4300A Rev

4 AC-8

System Use Notification

System Use Notification

(T)

System- Specific Not Entered Not Assigned

AC-8.1,

AC-8.1,

AC-8.1,

AC-8.2,

AC-8.2,

AC-8.2

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 AC-8

(DHS-

4.8.5.d)

Government Funded Office

Equipment

System Use Notification

(T)

System- Specific Not Entered Not Assigned

AC-

8(DHS-

4.8.5.d), AC-

8(DHS-

4.8.5.d), AC-

8(DHS-

4.8.5.d)

X X - - - Not Met None

NIST 800-

53 w/ DHS

Concurrent Session

Concurrent Session

System- Specific Not Entered Not Assigned AC-10.1, AC-10.1, X X - - - Not Met None

Control Ref.

Control Type

Planned Imp.

Actual Imp.

Test #(s) Methods Tailored Result Notes

4300A Rev

4 AC-10

Control Control (T) AC-10.1

NIST 800-

53 w/ DHS 4300A Rev

4 AC-11

Session Lock Session Lock (T)

System- Specific Not Entered Not Assigned

AC-11.1,

AC-11.1,

AC-11.1

X X - X - Not Met

Overlay 1.0"

NIST 800-

53 w/ DHS 4300A Rev

4 AC-11

(1)

Pattern- Hiding

Displays

Session Lock (T)

System- Specific Not Entered Not Assigned

AC-

11(1).1, AC-

11(1).1, AC-

11(1).1

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 AC-11

(DHS-

4.6.2.o)

Mobile Device Idle

Lockout

Session Lock (T)

System- Specific Not Entered Not Assigned

AC-

11(DHS-

4.6.2.o), AC-

11(DHS-

4.6.2.o), AC-

11(DHS-

4.6.2.o)

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 AC-12

Session Termination

Session Termination

(T)

System- Specific Not Entered Not Assigned

AC-12.1,

AC-12.1,

AC-12.1

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 AC-14

Permitted Actions without

Identification or

Authenticatio n

Permitted Actions without

Identification or

Authenticatio n (T)

System- Specific Not Entered Not Assigned

AC-14.1,

AC-14.1,

AC-14.1

Control Ref.

Control Type

Planned Imp.

Actual Imp.

Test #(s) Methods Tailored Result Notes

NIST 800-

53 w/ DHS 4300A Rev

4 AC-17

Remote Access

Remote Access (T)

System- Specific Not Entered Not Assigned

AC-17.1,

AC-17.1,

AC-17.1

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 AC-17

(1)

Automated Monitoring /

Control

Remote Access (T)

System- Specific Not Entered Not Assigned

AC-

17(1).1, AC-

17(1).1, AC-

17(1).1

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 AC-17

(2)

Protection Of Confidentialit y / Integrity

Using Encryption

Remote Access (T)

System- Specific Not Entered Not Assigned

AC-

17(2).1, AC-

17(2).1, AC-

17(2).1

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 AC-17

(3)

Managed Access Control Points

Remote Access (T)

System- Specific Not Entered Not Assigned

AC-

17(3).1, AC-

17(3).1, AC-

17(3).1

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 AC-17

(4)

Privileged Commands /

Access

Remote Access (T)

System- Specific Not Entered Not Assigned

AC-

17(4).1, AC-

17(4).1, AC-

17(4).1

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 AC-17

(DHS-

5.4.1.b)

Remote Access

Connection Management

Remote Access (T)

System- Specific Not Entered Not Assigned

AC-

17(DHS-

5.4.1.b), AC-

17(DHS-

5.4.1.b), AC-

17(DHS-

5.4.1.b)

NIST 800- Remote Remote System- Not Entered Not Assigned AC- X X - - - Not Met None

Control Ref.

Control Type

Planned Imp.

Actual Imp.

Test #(s) Methods Tailored Result Notes

53 w/ DHS 4300A Rev

4 AC-17

(DHS-

5.4.1.c)

Access of PII Access (T) Specific 17(DHS- 5.4.1.c), AC-

17(DHS-

5.4.1.c), AC-

17(DHS-

5.4.1.c)

NIST 800-

53 w/ DHS 4300A Rev

4 AC-18

Wireless Access

Wireless Access (T)

System- Specific Not Entered Not Assigned

AC-18.1,

AC-18.1,

AC-18.1

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 AC-18

(1)

Authenticatio n And

Encryption

Wireless Access (T)

System- Specific Not Entered Not Assigned

AC-

18(1).1, AC-

18(1).1, AC-

18(1).1

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 AC-18

(4)

Restrict Configuration s By Users

Wireless Access (T)

System- Specific Not Entered Not Assigned

AC-

18(4).1, AC-

18(4).1, AC-

18(4).1

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 AC-18

(5)

Antennas / Transmission Power Levels

Wireless Access (T)

System- Specific Not Entered Not Assigned

AC-

18(5).1, AC-

18(5).1, AC-

18(5).1

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 AC-18

(DHS-

4.8.6.a)

Wireless Settings for Peripheral Equipment

Wireless Access (T)

System- Specific Not Entered Not Assigned

AC-

18(DHS-

4.8.6.a), AC-

18(DHS-

4.8.6.a), AC-

18(DHS-

Control Ref.

Control Type

Planned Imp.

Actual Imp.

Test #(s) Methods Tailored Result Notes

4.8.6.a)

NIST 800-

53 w/ DHS 4300A Rev

4 AC-18

(DHS-

4.8.6.b)

Disabling Wireless

Wireless Access (T)

System- Specific Not Entered Not Assigned

AC-

18(DHS-

4.8.6.b), AC-

18(DHS-

4.8.6.b), AC-

18(DHS-

4.8.6.b)

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 AC-19

Access Control for

Mobile Devices

Access Control for

Mobile Devices (T)

System- Specific Not Entered Not Assigned

AC-19.1,

AC-19.1,

AC-19.1

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 AC-19

(5)

Full Device / Container-

Based Encryption

Access Control for

Mobile Devices (T)

System- Specific Not Entered Not Assigned

AC-

19(5).1, AC-

19(5).1, AC-

19(5).1

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 AC-20

Use of External

Information Systems

Use of External

Information Systems (T)

System- Specific Not Entered Not Assigned

AC-20.1,

AC-20.1,

AC-20.1

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 AC-20

(1)

Limits On Authorized

Use

Use of External

Information Systems (T)

System- Specific Not Entered Not Assigned

AC-

20(1).1, AC-

20(1).1, AC-

20(1).1

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 AC-20

(2)

Portable Storage Devices

Use of External

Information Systems (T)

System- Specific Not Entered Not Assigned

AC-

20(2).1, AC-

20(2).1, AC-

20(2).1

X X - - - Not Met None

NIST 800-

53 w/ DHS

Information Sharing

Information Sharing (T)

System- Specific Not Entered Not Assigned AC-21.1, AC-21.1, X X - - - Not Met None

Control Ref.

Control Type

Planned Imp.

Actual Imp.

Test #(s) Methods Tailored Result Notes

4300A Rev

4 AC-21

AC-21.1

NIST 800-

53 w/ DHS 4300A Rev

4 AC-22

Publicly Accessible

Content

Publicly Accessible Content (T)

System- Specific Not Entered Not Assigned

AC-22.1,

AC-22.1,

AC-22.1

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 AT-1

Security Awareness and Training Policy and Procedures

Security Awareness and Training Policy and Procedures

(O)

System- Specific Not Entered Not Assigned

AT-1.1,

AT-1.1,

AT-1.1,

AT-1.2,

AT-1.2,

AT-1.2

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 AT-2

Security Awareness Training

Security Awareness

Training (O)

System- Specific Not Entered Not Assigned

AT-2.1,

AT-2.1,

AT-2.1

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 AT-2 (2)

Insider Threat Security

Awareness Training (O)

System- Specific Not Entered Not Assigned

AT-

2(2).1, AT-

2(2).1, AT-2(2).1

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 AT-3

Role-Based Security Training

Role-Based Security

Training (O)

System- Specific Not Entered Not Assigned

AT-3.1,

AT-3.1,

AT-3.1

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 AT-4

Security Training Records

Security Training

Records (O)

System- Specific Not Entered Not Assigned

AT-4.1,

AT-4.1,

AT-4.1

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 AU-1

Audit and Accountabilit y Policy and Procedures

Audit and Accountabilit y Policy and Procedures

(T)

System- Specific Not Entered Not Assigned

AU-1.1,

AU-1.1,

AU-1.1,

AU-1.2,

AU-1.2,

AU-1.2

X X - X - Not Met Control was added by overlay "DHS

Overlay 1.0"

NIST 800-

53 w/ DHS 4300A Rev

Audit Events Audit Events (T)

System- Specific Not Entered Not Assigned

AU-2.1,

AU-2.1,

AU-2.1

X X - X - Not Met

Control Ref.

Control Type

Planned Imp.

Actual Imp.

Test #(s) Methods Tailored Result Notes

4 AU-2

Overlay 1.0"

NIST 800-

53 w/ DHS 4300A Rev

4 AU-2 (3)

Reviews And Updates

Audit Events (T)

System- Specific Not Entered Not Assigned

AU-

2(3).1, AU-

2(3).1, AU-2(3).1

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 AU-3

Content of Audit

Records

Content of Audit

Records (T)

System- Specific Not Entered Not Assigned

AU-3.1,

AU-3.1,

AU-3.1

X X - X - Not Met Control was added by overlay "DHS

Overlay 1.0"

NIST 800-

53 w/ DHS 4300A Rev

4 AU-3 (1)

Additional Audit

Information

Content of Audit

Records (T)

System- Specific Not Entered Not Assigned

AU-

3(1).1, AU-

3(1).1, AU-3(1).1

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 AU-3 (2)

Centralized Management Of Planned

Audit Record Content

Content of Audit

Records (T)

System- Specific Not Entered Not Assigned

AU-

3(2).1, AU-

3(2).1, AU-3(2).1

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 AU-3

(DHS-

5.3.a)

DHS

Required

Contents for Audit

Records

Content of Audit

Records (T)

System- Specific Not Entered Not Assigned

AU-

3(DHS-

5.3.a), AU-

3(DHS-

5.3.a), AU-

3(DHS-

5.3.a)

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

Audit Storage Capacity

Audit Storage Capacity (T)

System- Specific Not Entered Not Assigned

AU-4.1,

AU-4.1,

AU-4.1

Control Ref.

Control Type

Planned Imp.

Actual Imp.

Test #(s) Methods Tailored Result Notes

4 AU-4

NIST 800-

53 w/ DHS 4300A Rev

4 AU-5

Response to Audit

Processing Failures

Response to Audit

Processing Failures (T)

System- Specific Not Entered Not Assigned

AU-5.1,

AU-5.1,

AU-5.1

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 AU-5 (1)

Audit Storage Capacity

Response to Audit

Processing Failures (T)

System- Specific Not Entered Not Assigned

AU-

5(1).1, AU-

5(1).1, AU-5(1).1

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 AU-5 (2)

Real-Time Alerts

Response to Audit

Processing Failures (T)

System- Specific Not Entered Not Assigned

AU-

5(2).1, AU-

5(2).1, AU-5(2).1

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 AU-6

Audit Review, Analysis, and Reporting

Audit Review, Analysis, and Reporting (T)

System- Specific Not Entered Not Assigned

AU-6.1,

AU-6.1,

AU-6.1,

AU-6.2,

AU-6.2,

AU-6.2

X X - X - Not Met Control was added by overlay "DHS

Overlay 1.0"

NIST 800-

53 w/ DHS 4300A Rev

4 AU-6 (1)

Process Integration

Audit Review, Analysis, and Reporting (T)

System- Specific Not Entered Not Assigned

AU-

6(1).1, AU-

6(1).1, AU-6(1).1

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 AU-6 (3)

Correlate Audit

Repositories

Audit Review, Analysis, and Reporting (T)

System- Specific Not Entered Not Assigned

AU-

6(3).1, AU-

6(3).1, AU-6(3).1

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 AU-6 (5)

Integration / Scanning

And Monitoring Capabilities

Audit Review, Analysis, and Reporting (T)

System- Specific Not Entered Not Assigned

AU-

6(5).1, AU-

6(5).1, AU-6(5).1

X X - - - Not Met None

NIST 800-

53 w/ DHS

Correlation With Physical

Audit Review, System- Specific Not Entered Not Assigned AU-

6(6).1, X X - - - Not Met None

Control Ref.

Control Type

Planned Imp.

Actual Imp.

Test #(s) Methods Tailored Result Notes

4300A Rev

4 AU-6 (6)

Monitoring Analysis, and Reporting (T)

AU-

6(6).1, AU-6(6).1

NIST 800-

53 w/ DHS 4300A Rev

4 AU-6

(DHS-

5.3.h)

Audit Reduction and Report Generation Capability

Audit Review, Analysis, and Reporting (T)

System- Specific Not Entered Not Assigned

AU-

6(DHS-

5.3.h), AU-

6(DHS-

5.3.h), AU-

6(DHS-

5.3.h)

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 AU-6

(DHS-

5.3.i)

Audit Time Stamps

Audit Review, Analysis, and Reporting (T)

System- Specific Not Entered Not Assigned

AU-

6(DHS-

5.3.i), AU-

6(DHS-

5.3.i), AU-

6(DHS-

5.3.i)

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 AU-6

(DHS-

5.4.6.f)

Mail Server Administratio n

Audit Review, Analysis, and Reporting (T)

System- Specific Not Entered Not Assigned

AU-

6(DHS-

5.4.6.f), AU-

6(DHS-

5.4.6.f), AU-

6(DHS-

5.4.6.f)

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 AU-7

Audit Reduction and Report Generation

Audit Reduction and Report Generation

(T)

System- Specific Not Entered Not Assigned

AU-7.1,

AU-7.1,

AU-7.1

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

Automatic Processing

Audit Reduction and Report

System- Specific Not Entered Not Assigned

AU-

7(1).1, AU-

Control Ref.

Control Type

Planned Imp.

Actual Imp.

Test #(s) Methods Tailored Result Notes

4 AU-7 (1) Generation (T)

7(1).1, AU-7(1).1

NIST 800-

53 w/ DHS 4300A Rev

4 AU-8

Time Stamps Time Stamps (T)

System- Specific Not Entered Not Assigned

AU-8.1,

AU-8.1,

AU-8.1

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 AU-8 (1)

Synchronizati on With

Authoritative Time Source

Time Stamps (T)

System- Specific Not Entered Not Assigned

AU-

8(1).1, AU-

8(1).1, AU-8(1).1

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 AU-9

Protection of Audit

Information

Protection of Audit

Information (T)

System- Specific Not Entered Not Assigned

AU-9.1,

AU-9.1,

AU-9.1

X X - X - Not Met Control was added by overlay "DHS

Overlay 1.0"

NIST 800-

53 w/ DHS 4300A Rev

4 AU-9 (2)

Audit Backup On Separate

Physical Systems /

Components

Protection of Audit

Information (T)

System- Specific Not Entered Not Assigned

AU-

9(2).1, AU-

9(2).1, AU-9(2).1

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 AU-9 (3)

Cryptographi c Protection

Protection of Audit

Information (T)

System- Specific Not Entered Not Assigned

AU-

9(3).1, AU-

9(3).1, AU-9(3).1

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 AU-9 (4)

Access By Subset Of Privileged

Users

Protection of Audit

Information (T)

System- Specific Not Entered Not Assigned

AU-

9(4).1, AU-

9(4).1, AU-9(4).1

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 AU-10

Non-repudiation

Non-repudiation

(T)

System- Specific Not Entered Not Assigned

AU-10.1,

AU-10.1,

AU-10.1

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 AU-11

Audit Record Retention

Audit Record Retention (T)

System- Specific Not Entered Not Assigned

AU-11.1,

AU-11.1,

AU-11.1

X X - X - Not Met Control was added

Overlay 1.0"

Control Ref.

Control Type

Planned Imp.

Actual Imp.

Test #(s) Methods Tailored Result Notes

NIST 800-

53 w/ DHS 4300A Rev

4 AU-11

(DHS-

5.3.d)

Audit Log Retention

Audit Record Retention (T)

System- Specific Not Entered Not Assigned

AU-

11(DHS-

5.3.d), AU-

11(DHS-

5.3.d), AU-

11(DHS-

5.3.d)

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 AU-12

Audit Generation

Audit Generation

(T)

System- Specific Not Entered Not Assigned

AU-12.1,

AU-12.1,

AU-12.1

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 AU-12

(1)

System-Wide / Time-

Correlated Audit Trail

Audit Generation

(T)

System- Specific Not Entered Not Assigned

AU-

12(1).1, AU-

12(1).1, AU-

12(1).1

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 AU-12

(3)

Changes By Authorized Individuals

Audit Generation

(T)

System- Specific Not Entered Not Assigned

AU-

12(3).1, AU-

12(3).1, AU-

12(3).1

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 AU-12

(DHS-

5.3.g)

Audit Coordination with Component or DHS SOC

Audit Generation

(T)

System- Specific Not Entered Not Assigned

AU-

12(DHS-

5.3.g), AU-

12(DHS-

5.3.g), AU-

12(DHS-

5.3.g)

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 CA-1

Security Assessment and Authorization

Security Assessment and Authorization

System- Specific Not Entered Not Assigned

CA-1.1,

CA-1.1,

CA-1.1,

CA-1.2,

X X - X - Not Met Control was added

Control Ref.

Control Type

Planned Imp.

Actual Imp.

Test #(s) Methods Tailored Result Notes

Policies and Procedures

Policies and Procedures

(M)

CA-1.2,

CA-1.2

NIST 800-

53 w/ DHS 4300A Rev

4 CA-1

(DHS-

3.18.c)

Cloud Environment

Usage

Security Assessment and Authorization Policies and Procedures

(M)

System- Specific Not Entered Not Assigned

CA-

1(DHS-

3.18.c), CA-

1(DHS-

3.18.c), CA-

1(DHS-

3.18.c)

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 CA-1

(DHS-

3.18.d)

Usage of FedRAMP for Cloud Systems

Security Assessment and Authorization Policies and Procedures

(M)

System- Specific Not Entered Not Assigned

CA-

1(DHS-

3.18.d), CA-

1(DHS-

3.18.d), CA-

1(DHS-

3.18.d)

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 CA-1

(DHS-

3.18.e)

Usage of Public Cloud

Service Provider

Security Assessment and Authorization Policies and Procedures

(M)

System- Specific Not Entered Not Assigned

CA-

1(DHS-

3.18.e), CA-

1(DHS-

3.18.e), CA-

1(DHS-

3.18.e)

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 CA-2

Security Assessments

Security Assessments

(M)

System- Specific Not Entered Not Assigned

CA-2.1,

CA-2.1,

CA-2.1,

CA-2.2,

CA-2.2,

CA-2.2

X X - X - Not Met Control was added by overlay "DHS

Overlay 1.0"

NIST 800-

53 w/ DHS

Independent Assessors

Security Assessments

System- Specific Not Entered Not Assigned CA-

2(1).1, X X - - - Not Met None

Control Ref.

Control Type

Planned Imp.

Actual Imp.

Test #(s) Methods Tailored Result Notes

4300A Rev

4 CA-2 (1)

(M) CA-

2(1).1, CA-2(1).1

NIST 800-

53 w/ DHS 4300A Rev

4 CA-2 (2)

Specialized Assessments

Security Assessments

(M)

System- Specific Not Entered Not Assigned

CA-

2(2).1, CA-

2(2).1, CA-2(2).1

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 CA-2

(DHS-

3.3.h)

Configuration Management

Security Assessments

(M)

System- Specific Not Entered Not Assigned

CA-

2(DHS-

3.3.h), CA-

2(DHS-

3.3.h), CA-

2(DHS-

3.3.h)

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 CA-2

(DHS-

3.3.i)

Security Assessment

Plan

Security Assessments

(M)

System- Specific Not Entered Not Assigned

CA-

2(DHS-

3.3.i), CA-

2(DHS-

3.3.i), CA-

2(DHS-

3.3.i)

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 CA-2

(DHS-

3.15.h)

Key Security Control

Assessments

Security Assessments

(M)

System- Specific Not Entered Not Assigned

CA-

2(DHS-

3.15.h), CA-

2(DHS-

3.15.h), CA-

2(DHS-

3.15.h)

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

Cloud Systems

Provided to

Security Assessments

(M)

System- Specific Not Entered Not Assigned

CA-

2(DHS-

3.18.b), Control Ref.

Control Type

Planned Imp.

Actual Imp.

Test #(s) Methods Tailored Result Notes

4 CA-2

(DHS-

3.18.b)

External Departments

CA-

2(DHS-

3.18.b), CA-

2(DHS-

3.18.b)

NIST 800-

53 w/ DHS 4300A Rev

4 CA-3

System Interconnecti ons

System Interconnecti ons (M)

System- Specific Not Entered Not Assigned

CA-3.1,

CA-3.1,

CA-3.1

X X - X - Not Met

Overlay 1.0"

NIST 800-

53 w/ DHS 4300A Rev

4 CA-3 (5)

Restrictions On External

System Connections

System Interconnecti ons (M)

System- Specific Not Entered Not Assigned

CA-

3(5).1, CA-

3(5).1, CA-3(5).1

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 CA-3

(DHS-

5.4.3.b)

Interconnecti on

Establishmen t Procedures

System Interconnecti ons (M)

System- Specific Not Entered Not Assigned

CA-

3(DHS-

5.4.3.b), CA-

3(DHS-

5.4.3.b), CA-

3(DHS-

5.4.3.b)

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 CA-3

(DHS-

5.4.3.c)

DHS OneNet Interconnecti ons

System Interconnecti ons (M)

System- Specific Not Entered Not Assigned

CA-

3(DHS-

5.4.3.c), CA-

3(DHS-

5.4.3.c), CA-

3(DHS-

Control Ref.

Control Type

Planned Imp.

Actual Imp.

Test #(s) Methods Tailored Result Notes

5.4.3.c)

NIST 800-

53 w/ DHS 4300A Rev

4 CA-3

(DHS-

5.4.3.f)

Interconnecti on Security Agreements

System Interconnecti ons (M)

System- Specific Not Entered Not Assigned

CA-

3(DHS-

5.4.3.f), CA-

3(DHS-

5.4.3.f), CA-

3(DHS-

5.4.3.f)

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 CA-3

(DHS-

5.4.3.m)

Interconnecti on Security Agreements

System Interconnecti ons (M)

System- Specific Not Entered Not Assigned

CA-

3(DHS-

5.4.3.m), CA-

3(DHS-

5.4.3.m), CA-

3(DHS-

5.4.3.m)

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 CA-3

(DHS-

5.4.3.n)

DHS

Interconnecti ons

System Interconnecti ons (M)

System- Specific Not Entered Not Assigned

CA-

3(DHS-

5.4.3.n), CA-

3(DHS-

5.4.3.n), CA-

3(DHS-

5.4.3.n)

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 CA-5

Plan of Action and Milestones

Plan of Action and Milestones

(M)

System- Specific Not Entered Not Assigned

CA-5.1,

CA-5.1,

CA-5.1

X X - X - Not Met

Control Ref.

Control Type

Planned Imp.

Actual Imp.

Test #(s) Methods Tailored Result Notes

NIST 800-

53 w/ DHS 4300A Rev

4 CA-5

(DHS-

2.2.8.d)

DHS

POA&M

Requirements

Plan of Action and Milestones

(M)

System- Specific Not Entered Not Assigned

CA-

5(DHS-

2.2.8.d), CA-

5(DHS-

2.2.8.d), CA-

5(DHS-

2.2.8.d)

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 CA-6

Security Authorization

Security Authorization

(M)

System- Specific Not Entered Not Assigned

CA-6.1,

CA-6.1,

CA-6.1

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 CA-6

(DHS-

4.12.d)

Network Printers and Facsimile Machines

Security Authorization

(M)

System- Specific Not Entered Not Assigned

CA-

6(DHS-

4.12.d), CA-

6(DHS-

4.12.d), CA-

6(DHS-

4.12.d)

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 CA-7

Continuous Monitoring

Continuous Monitoring

(M)

System- Specific Not Entered Not Assigned

CA-7.1,

CA-7.1,

CA-7.1

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 CA-7 (1)

Independent Assessment

Continuous Monitoring

(M)

System- Specific Not Entered Not Assigned

CA-

7(1).1, CA-

7(1).1, CA-7(1).1

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 CA-7

(DHS-

4.6.2.4.a)

Bluetooth Continuous Monitoring

(M)

System- Specific Not Entered Not Assigned

CA-

7(DHS-

4.6.2.4.a), CA-

7(DHS-

4.6.2.4.a), CA-

Control Ref.

Control Type

Planned Imp.

Actual Imp.

Test #(s) Methods Tailored Result Notes

7(DHS-

4.6.2.4.a)

NIST 800-

53 w/ DHS 4300A Rev

4 CA-7

(DHS-

4.6.3.a)

AO

Notification on Disabling

Security Features

Continuous Monitoring

(M)

System- Specific Not Entered Not Assigned

CA-

7(DHS-

4.6.3.a), CA-

7(DHS-

4.6.3.a), CA-

7(DHS-

4.6.3.a)

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 CA-8

Penetration Testing

Penetration Testing (M)

System- Specific Not Entered Not Assigned

CA-8.1,

CA-8.1,

CA-8.1

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 CA-9

Internal System

Connections

Internal System

Connections (M)

System- Specific Not Entered Not Assigned

CA-9.1,

CA-9.1,

CA-9.1

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 CM-1

Configuration Management Policy and Procedures

Configuration Management Policy and Procedures

(O)

System- Specific Not Entered Not Assigned

CM-1.1,

CM-1.1,

CM-1.1,

CM-1.2,

CM-1.2,

CM-1.2

X X - X - Not Met Control was added by overlay "DHS

Overlay 1.0"

NIST 800-

53 w/ DHS 4300A Rev

4 CM-2

Baseline Configuration

Baseline Configuration

(O)

System- Specific Not Entered Not Assigned

CM-2.1,

CM-2.1,

CM-2.1

X X - X - Not Met

Overlay 1.0"

NIST 800-

53 w/ DHS 4300A Rev

Reviews And Updates

Baseline Configuration

(O)

System- Specific Not Entered Not Assigned

CM-

2(1).1, CM-

Control Ref.

Control Type

Planned Imp.

Actual Imp.

Test #(s) Methods Tailored Result Notes

4 CM-2 (1) 2(1).1,

CM-2(1).1

NIST 800-

53 w/ DHS 4300A Rev

4 CM-2 (2)

Automation Support For Accuracy / Currency

Baseline Configuration

(O)

System- Specific Not Entered Not Assigned

CM-

2(2).1, CM-

2(2).1, CM-2(2).1

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 CM-2 (3)

Retention Of Previous

Configuration s

Baseline Configuration

(O)

System- Specific Not Entered Not Assigned

CM-

2(3).1, CM-

2(3).1, CM-2(3).1

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 CM-2 (7)

Configure Systems, Components, Or Devices For High- Risk Areas

Baseline Configuration

(O)

System- Specific Not Entered Not Assigned

CM-

2(7).1, CM-

2(7).1, CM-2(7).1

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 CM-2

(DHS-

4.12.b)

Network Printers and Facsimile Machines

Baseline Configuration

(O)

System- Specific Not Entered Not Assigned

CM-

2(DHS-

4.12.b), CM-

2(DHS-

4.12.b), CM-

2(DHS-

4.12.b)

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 CM-3

Configuration Change Control

Configuration Change

Control (O)

System- Specific Not Entered Not Assigned

CM-3.1,

CM-3.1,

CM-3.1

X X - X - Not Met Control was added by overlay "DHS

Overlay 1.0"

NIST 800-

53 w/ DHS 4300A Rev

4 CM-3 (1)

Automated Document /

Notification / Prohibition Of Changes

Configuration Change

Control (O)

System- Specific Not Entered Not Assigned

CM-

3(1).1, CM-

3(1).1, CM-3(1).1

X X - - - Not Met None

NIST 800-

53 w/ DHS

Test / Validate /

Configuration Change

System- Specific Not Entered Not Assigned CM-

3(2).1, X X - - - Not Met None

Control Ref.

Control Type

Planned Imp.

Actual Imp.

Test #(s) Methods Tailored Result Notes

4300A Rev

4 CM-3 (2)

Document Changes

Control (O) CM- 3(2).1, CM-3(2).1

NIST 800-

53 w/ DHS 4300A Rev

4 CM-3

(DHS-

2.1.8.g)

Timely Response to

ICCB

Configuration Change

Control (O)

System- Specific Not Entered Not Assigned

CM-

3(DHS-

2.1.8.g), CM-

3(DHS-

2.1.8.g), CM-

3(DHS-

2.1.8.g)

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 CM-3

(DHS-

5.4.3.l)

DHS Change Control Boards

(CCB)

Configuration Change

Control (O)

System- Specific Not Entered Not Assigned

CM-

3(DHS-

5.4.3.l), CM-

3(DHS-

5.4.3.l), CM-

3(DHS-

5.4.3.l)

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 CM-4

Security Impact

Analysis

Security Impact

Analysis (O)

System- Specific Not Entered Not Assigned

CM-4.1,

CM-4.1,

CM-4.1

X X - X - Not Met Control was added by overlay "DHS

Overlay 1.0"

NIST 800-

53 w/ DHS 4300A Rev

4 CM-4 (1)

Separate Test Environments

Security Impact

Analysis (O)

System- Specific Not Entered Not Assigned

CM-

4(1).1, CM-

4(1).1, CM-4(1).1

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 CM-5

Access Restrictions for Change

Access Restrictions for Change

(O)

System- Specific Not Entered Not Assigned

CM-5.1,

CM-5.1,

CM-5.1

X X - X - Not Met Control was added by overlay "DHS

Overlay 1.0"

NIST 800-

53 w/ DHS 4300A Rev

4 CM-5 (1)

Automated Access

Enforcement / Auditing

Access Restrictions for Change

(O)

System- Specific Not Entered Not Assigned

CM-

5(1).1, CM-

5(1).1, Control Ref.

Control Type

Planned Imp.

Actual Imp.

Test #(s) Methods Tailored Result Notes

CM-5(1).1

NIST 800-

53 w/ DHS 4300A Rev

4 CM-5 (2)

Review System

Changes

Access Restrictions for Change

(O)

System- Specific Not Entered Not Assigned

CM-

5(2).1, CM-

5(2).1, CM-5(2).1

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 CM-5 (3)

Signed Components

Access Restrictions for Change

(O)

System- Specific Not Entered Not Assigned

CM-

5(3).1, CM-

5(3).1, CM-5(3).1

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 CM-6

Configuration Settings

Configuration Settings (O)

System- Specific Not Entered Not Assigned

CM-6.1,

CM-6.1,

CM-6.1

X X - X - Not Met Control was added by overlay "DHS

Overlay 1.0"

NIST 800-

53 w/ DHS 4300A Rev

4 CM-6 (1)

Automated Central

Management / Application / Verification

Configuration Settings (O)

System- Specific Not Entered Not Assigned

CM-

6(1).1, CM-

6(1).1, CM-6(1).1

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 CM-6 (2)

Respond To Unauthorized

Changes

Configuration Settings (O)

System- Specific Not Entered Not Assigned

CM-

6(2).1, CM-

6(2).1, CM-6(2).1

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 CM-6

(DHS-

3.7.e)

USGCB

Requirements

Configuration Settings (O)

System- Specific Not Entered Not Assigned

CM-

6(DHS-

3.7.e), CM-

6(DHS-

3.7.e), CM-

6(DHS-

3.7.e)

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 CM-6

USGCB

Compliance

Configuration Settings (O)

System- Specific Not Entered Not Assigned

CM-

6(DHS-

3.7.f), Control Ref.

Control Type

Planned Imp.

Actual Imp.

Test #(s) Methods Tailored Result Notes

(DHS-

3.7.f)

6(DHS-

3.7.f), CM-

6(DHS-

3.7.f)

NIST 800-

53 w/ DHS 4300A Rev

4 CM-6

(DHS-

4.5.2.b)

FAX Server Configuration

Configuration Settings (O)

System- Specific Not Entered Not Assigned

CM-

6(DHS-

4.5.2.b), CM-

6(DHS-

4.5.2.b), CM-

6(DHS-

4.5.2.b)

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 CM-6

(DHS-

4.8.4.a)

Hardening and

Configuration Guidance

Configuration Settings (O)

System- Specific Not Entered Not Assigned

CM-

6(DHS-

4.8.4.a), CM-

6(DHS-

4.8.4.a), CM-

6(DHS-

4.8.4.a)

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 CM-6

(DHS-

4.12.f)

Network Printers, Copiers, and Facsimile

Administratio n

Configuration Settings (O)

System- Specific Not Entered Not Assigned

CM-

6(DHS-

4.12.f), CM-

6(DHS-

4.12.f), CM-

6(DHS-

4.12.f)

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 CM-6

(DHS-

4.12.j)

Multifunction Device

Configuration

Configuration Settings (O)

System- Specific Not Entered Not Assigned

CM-

6(DHS-

4.12.j), CM-

6(DHS-

4.12.j), Control Ref.

Control Type

Planned Imp.

Actual Imp.

Test #(s) Methods Tailored Result Notes

CM-

6(DHS-

4.12.j)

NIST 800-

53 w/ DHS 4300A Rev

4 CM-6

(DHS-

5.4.5.d)

Use of Telnet Configuration Settings (O)

System- Specific Not Entered Not Assigned

CM-

6(DHS-

5.4.5.d), CM-

6(DHS-

5.4.5.d), CM-

6(DHS-

5.4.5.d)

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 CM-6

(DHS-

5.4.5.e)

Use of File Transfer Protocol

(FTP)

Services

Configuration Settings (O)

System- Specific Not Entered Not Assigned

CM-

6(DHS-

5.4.5.e), CM-

6(DHS-

5.4.5.e), CM-

6(DHS-

5.4.5.e)

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 CM-7

Least Functionality

Least Functionality

(O)

System- Specific Not Entered Not Assigned

CM-7.1,

CM-7.1,

CM-7.1

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 CM-7 (1)

Periodic Review

Least Functionality

(O)

System- Specific Not Entered Not Assigned

CM-

7(1).1, CM-

7(1).1, CM-7(1).1

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 CM-7 (2)

Prevent Program

Execution

Least Functionality

(O)

System- Specific Not Entered Not Assigned

CM-

7(2).1, CM-

7(2).1, CM-7(2).1

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

Authorized Software /

Whitelisting

Least Functionality

(O)

System- Specific Not Entered Not Assigned

CM-

7(5).1, Control Ref.

Control Type

Planned Imp.

Actual Imp.

Test #(s) Methods Tailored Result Notes

4 CM-7 (5) 7(5).1,

CM-7(5).1

NIST 800-

53 w/ DHS 4300A Rev

4 CM-7

(DHS-

5.4.5.f)

Remote Desktop

Connections

Least Functionality

(O)

System- Specific Not Entered Not Assigned

CM-

7(DHS-

5.4.5.f), CM-

7(DHS-

5.4.5.f), CM-

7(DHS-

5.4.5.f)

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 CM-8

Information System

Component Inventory

Information System

Component Inventory (O)

System- Specific Not Entered Not Assigned

CM-8.1,

CM-8.1,

CM-8.1

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 CM-8 (1)

Updates During

Installations / Removals

Information System

Component Inventory (O)

System- Specific Not Entered Not Assigned

CM-

8(1).1, CM-

8(1).1, CM-8(1).1

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 CM-8 (2)

Automated Maintenance

Information System

Component Inventory (O)

System- Specific Not Entered Not Assigned

CM-

8(2).1, CM-

8(2).1, CM-8(2).1

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 CM-8 (3)

Automated Unauthorized Component Detection

Information System

Component Inventory (O)

System- Specific Not Entered Not Assigned

CM-

8(3).1, CM-

8(3).1, CM-8(3).1

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 CM-8 (4)

Accountabilit y Information

Information System

Component Inventory (O)

System- Specific Not Entered Not Assigned

CM-

8(4).1, CM-

8(4).1, CM-8(4).1

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

No Duplicate Accounting

Of

Information System

Component

System- Specific Not Entered Not Assigned

CM-

8(5).1, Control Ref.

Control Type

Planned Imp.

Actual Imp.

Test #(s) Methods Tailored Result Notes

4 CM-8 (5) Components Inventory (O) 8(5).1, CM-8(5).1

NIST 800-

53 w/ DHS 4300A Rev

4 CM-8

(DHS-

4.6.a)

Introduction of Wireless

Information System

Component Inventory (O)

System- Specific Not Entered Not Assigned

CM-

8(DHS-

4.6.a), CM-

8(DHS-

4.6.a), CM-

8(DHS-

4.6.a)

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 CM-9

Configuration Management

Plan

Configuration Management

Plan (O)

System- Specific Not Entered Not Assigned

CM-9.1,

CM-9.1,

CM-9.1

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 CM-9

(DHS-

3.7.c)

Patching and Configuration Management

Configuration Management

Plan (O)

System- Specific Not Entered Not Assigned

CM-

9(DHS-

3.7.c), CM-

9(DHS-

3.7.c), CM-

9(DHS-

3.7.c)

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 CM-10

Software Usage

Restrictions

SW Usage Restrictions

(O)

System- Specific Not Entered Not Assigned

CM-10.1,

CM-10.1,

CM-10.1

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 CM-10

(DHS-

4.8.4.f)

System Library

Management

SW Usage Restrictions

(O)

System- Specific Not Entered Not Assigned

CM-

10(DHS-

4.8.4.f), CM-

10(DHS-

4.8.4.f), CM-

10(DHS-

4.8.4.f)

NIST 800- User-Installed User-Installed System- Not Entered Not Assigned CM-11.1, X X - - - Not Met None

Control Ref.

Control Type

Planned Imp.

Actual Imp.

Test #(s) Methods Tailored Result Notes

53 w/ DHS 4300A Rev

4 CM-11

Software SW (O) Specific CM-11.1, CM-11.1

NIST 800-

53 w/ DHS 4300A Rev

4 CP-1

Contingency Planning

Policy and Procedures

Contingency Planning

Policy and Procedures

(O)

System- Specific Not Entered Not Assigned

CP-1.1,

CP-1.1,

CP-1.1,

CP-1.2,

CP-1.2,

CP-1.2

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 CP-1

(DHS-

3.5.1.a)

Continuity of Operations Planning

Contingency Planning

Policy and Procedures

(O)

System- Specific Not Entered Not Assigned

CP-

1(DHS-

3.5.1.a), CP-

1(DHS-

3.5.1.a), CP-

1(DHS-

3.5.1.a)

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 CP-1

(DHS-

3.15.f)

DHS

Contingency Plan for CFO

Contingency Planning

Policy and Procedures

(O)

System- Specific Not Entered Not Assigned

CP-

1(DHS-

3.15.f), CP-

1(DHS-

3.15.f), CP-

1(DHS-

3.15.f)

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 CP-2

Contingency Plan

Contingency Plan (O)

System- Specific Not Entered Not Assigned

CP-2.1,

CP-2.1,

CP-2.1,

CP-2.2,

CP-2.2,

CP-2.2

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 CP-2 (1)

Coordinate With Related

Plans

Contingency Plan (O)

System- Specific Not Entered Not Assigned

CP-2(1).1,

CP-2(1).1,

CP-2(1).1

NIST 800- Capacity Contingency System- Not Entered Not Assigned CP-2(2).1, X X - - - Not Met None

Control Ref.

Control Type

Planned Imp.

Actual Imp.

Test #(s) Methods Tailored Result Notes

53 w/ DHS 4300A Rev

4 CP-2 (2)

Planning Plan (O) Specific CP-2(2).1, CP-2(2).1

NIST 800-

53 w/ DHS 4300A Rev

4 CP-2 (3)

Resume Essential

Missions / Business Functions

Contingency Plan (O)

System- Specific Not Entered Not Assigned

CP-2(3).1,

CP-2(3).1,

CP-2(3).1

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 CP-2 (4)

Resume All Missions / Business Functions

Contingency Plan (O)

System- Specific Not Entered Not Assigned

CP-2(4).1,

CP-2(4).1,

CP-2(4).1

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 CP-2 (5)

Continue Essential

Missions / Business Functions

Contingency Plan (O)

System- Specific Not Entered Not Assigned

CP-2(5).1,

CP-2(5).1,

CP-2(5).1

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 CP-2 (8)

Identify Critical Assets

Contingency Plan (O)

System- Specific Not Entered Not Assigned

CP-2(8).1,

CP-2(8).1,

CP-2(8).1

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 CP-2

(DHS-

3.5.2.e)

DHS

Contingency

Plan

Contingency Plan (O)

System- Specific Not Entered Not Assigned

CP-

2(DHS-

3.5.2.e), CP-

2(DHS-

3.5.2.e), CP-

2(DHS-

3.5.2.e)

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 CP-3

Contingency Training

Contingency Training (O)

System- Specific Not Entered Not Assigned

CP-3.1,

CP-3.1,

CP-3.1

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 CP-3 (1)

Simulated Events

Contingency Training (O)

System- Specific Not Entered Not Assigned

CP-3(1).1,

CP-3(1).1,

CP-3(1).1

Control Ref.

Control Type

Planned Imp.

Actual Imp.

Test #(s) Methods Tailored Result Notes

NIST 800-

53 w/ DHS 4300A Rev

4 CP-4

Contingency Plan Testing

Contingency Plan Testing

(O)

System- Specific Not Entered Not Assigned

CP-4.1,

CP-4.1,

CP-4.1

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 CP-4 (1)

Coordinate With Related

Plans

Contingency Plan Testing

(O)

System- Specific Not Entered Not Assigned

CP-4(1).1,

CP-4(1).1,

CP-4(1).1

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 CP-4 (2)

Alternate Processing

Site

Contingency Plan Testing

(O)

System- Specific Not Entered Not Assigned

CP-4(2).1,

CP-4(2).1,

CP-4(2).1

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 CP-4

(DHS-

3.5.2.f)

DHS

Contingency Plan Testing

Contingency Plan Testing

(O)

System- Specific Not Entered Not Assigned

CP-

4(DHS-

3.5.2.f), CP-

4(DHS-

3.5.2.f), CP-

4(DHS-

3.5.2.f)

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 CP-6

Alternate Storage Site

Alternate Storage Site

(O)

System- Specific Not Entered Not Assigned

CP-6.1,

CP-6.1,

CP-6.1

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 CP-6 (1)

Separation From Primary

Site

Alternate Storage Site

(O)

System- Specific Not Entered Not Assigned

CP-6(1).1,

CP-6(1).1,

CP-6(1).1

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 CP-6 (2)

Recovery Time / Point Objectives

Alternate Storage Site

(O)

System- Specific Not Entered Not Assigned

CP-6(2).1,

CP-6(2).1,

CP-6(2).1

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 CP-6 (3)

Accessibility Alternate

Storage Site (O)

System- Specific Not Entered Not Assigned

CP-6(3).1,

CP-6(3).1,

CP-6(3).1

NIST 800- Alternate Alternate System- Not Entered Not Assigned CP-7.1, X X - - - Not Met None

Control Ref.

Control Type

Planned Imp.

Actual Imp.

Test #(s) Methods Tailored Result Notes

53 w/ DHS 4300A Rev

4 CP-7

Processing Site

Processing Site (O)

Specific CP-7.1, CP-7.1

NIST 800-

53 w/ DHS 4300A Rev

4 CP-7 (1)

Separation From Primary

Site

Alternate Processing

Site (O)

System- Specific Not Entered Not Assigned

CP-7(1).1,

CP-7(1).1,

CP-7(1).1

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 CP-7 (2)

Accessibility Alternate

Processing Site (O)

System- Specific Not Entered Not Assigned

CP-7(2).1,

CP-7(2).1,

CP-7(2).1

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 CP-7 (3)

Priority Of Service

Alternate Processing

Site (O)

System- Specific Not Entered Not Assigned

CP-7(3).1,

CP-7(3).1,

CP-7(3).1

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 CP-7 (4)

Preparation For Use

Alternate Processing

Site (O)

System- Specific Not Entered Not Assigned

CP-7(4).1,

CP-7(4).1,

CP-7(4).1

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 CP-8

Telecommuni cations

Services

Telecommuni cations

Services (O)

System- Specific Not Entered Not Assigned

CP-8.1,

CP-8.1,

CP-8.1

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 CP-8 (1)

Priority Of Service

Provisions

Telecommuni cations

Services (O)

System- Specific Not Entered Not Assigned

CP-8(1).1,

CP-8(1).1,

CP-8(1).1

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 CP-8 (2)

Single Points Of Failure

Telecommuni cations

Services (O)

System- Specific Not Entered Not Assigned

CP-8(2).1,

CP-8(2).1,

CP-8(2).1

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 CP-8 (3)

Separation Of Primary / Alternate Providers

Telecommuni cations

Services (O)

System- Specific Not Entered Not Assigned

CP-8(3).1,

CP-8(3).1,

CP-8(3).1

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

Provider Contingency

Plan

Telecommuni cations

Services (O)

System- Specific Not Entered Not Assigned

CP-8(4).1,

CP-8(4).1,

CP-8(4).1

Control Ref.

Control Type

Planned Imp.

Actual Imp.

Test #(s) Methods Tailored Result Notes

4 CP-8 (4)

NIST 800-

53 w/ DHS 4300A Rev

4 CP-9

Information System Backup

Information System

Backup (O)

System- Specific Not Entered Not Assigned

CP-9.1,

CP-9.1,

CP-9.1,

CP-9.2,

CP-9.2,

CP-9.2

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 CP-9 (1)

Testing For Reliability /

Integrity

Information System

Backup (O)

System- Specific Not Entered Not Assigned

CP-9(1).1,

CP-9(1).1,

CP-9(1).1

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 CP-9 (2)

Test Restoration

Using Sampling

Information System

Backup (O)

System- Specific Not Entered Not Assigned

CP-9(2).1,

CP-9(2).1,

CP-9(2).1

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 CP-9 (3)

Separate Storage For

Critical Information

Information System

Backup (O)

System- Specific Not Entered Not Assigned

CP-9(3).1,

CP-9(3).1,

CP-9(3).1

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 CP-9 (5)

Transfer To Alternate

Storage Site

Information System

Backup (O)

System- Specific Not Entered Not Assigned

CP-9(5).1,

CP-9(5).1,

CP-9(5).1

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 CP-10

Information System

Recovery and Reconstitutio n

Information System

Recovery and Reconstitutio n (O)

System- Specific Not Entered Not Assigned

CP-10.1,

CP-10.1,

CP-10.1

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 CP-10 (2)

Transaction Recovery

Information System

Recovery and Reconstitutio n (O)

System- Specific Not Entered Not Assigned

CP-

10(2).1, CP-

10(2).1, CP-

10(2).1

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 CP-10 (4)

Restore Within Time

Period

Information System

Recovery and Reconstitutio

System- Specific Not Entered Not Assigned

CP-

10(4).1, CP-

10(4).1, Control Ref.

Control Type

Planned Imp.

Actual Imp.

Test #(s) Methods Tailored Result Notes n (O) CP- 10(4).1

NIST 800-

53 w/ DHS 4300A Rev

4 IA-1

Identification and

Authenticatio n Policy and Procedures

Identification and

Authenticatio n Policy and Procedures

(T)

System- Specific Not Entered Not Assigned

IA-1.1,

IA-1.1,

IA-1.1,

IA-1.2,

IA-1.2,

IA-1.2

X X - X - Not Met Control was added by overlay "DHS

Overlay 1.0"

NIST 800-

53 w/ DHS 4300A Rev

4 IA-1

(DHS-

3.14.7.a)

Online Transactions

Identification and

Authenticatio n Policy and Procedures

(T)

System- Specific Not Entered Not Assigned

IA-

1(DHS-

3.14.7.a), IA-

1(DHS-

3.14.7.a), IA-

1(DHS-

3.14.7.a)

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 IA-1

(DHS-

3.14.7.c)

E- Authenticatio n

Identification and

Authenticatio n Policy and Procedures

(T)

System- Specific Not Entered Not Assigned

IA-

1(DHS-

3.14.7.c), IA-

1(DHS-

3.14.7.c), IA-

1(DHS-

3.14.7.c)

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 IA-1

(DHS-

3.14.7.f)

PIV

Credentials

Identification and

Authenticatio n Policy and Procedures

(T)

System- Specific Not Entered Not Assigned

IA-

1(DHS-

3.14.7.f), IA-

1(DHS-

3.14.7.f), IA-

1(DHS-

3.14.7.f)

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

Identifying Network Devices

Identification and

Authenticatio

System- Specific Not Entered Not Assigned

IA-

1(DHS-

3.14.7.i), Control Ref.

Control Type

Planned Imp.

Actual Imp.

Test #(s) Methods Tailored Result Notes

4 IA-1

(DHS-

3.14.7.i) n Policy and Procedures

(T)

IA-

1(DHS-

3.14.7.i), IA-

1(DHS-

3.14.7.i)

NIST 800-

53 w/ DHS 4300A Rev

4 IA-1

(DHS-

4.6.2.4.b)

Master Device Status

Indicators

Identification and

Authenticatio n Policy and Procedures

(T)

System- Specific Not Entered Not Assigned

IA-

1(DHS-

4.6.2.4.b), IA-

1(DHS-

4.6.2.4.b), IA-

1(DHS-

4.6.2.4.b)

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 IA-1

(DHS-

4.6.2.q)

Biometric Logon

Attempts

Identification and

Authenticatio n Policy and Procedures

(T)

System- Specific Not Entered Not Assigned

IA-

1(DHS-

4.6.2.q), IA-

1(DHS-

4.6.2.q), IA-

1(DHS-

4.6.2.q)

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 IA-1

(DHS-

5.1.1.a)

Password Authenticatio n Configuration

Identification and

Authenticatio n Policy and Procedures

(T)

System- Specific Not Entered Not Assigned

IA-

1(DHS-

5.1.1.a), IA-

1(DHS-

5.1.1.a), IA-

1(DHS-

5.1.1.a)

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 IA-2

Identification and

Authenticatio n

(Organization

Identification and

Authenticatio n

(Organization

System- Specific Not Entered Not Assigned

IA-2.1,

IA-2.1,

IA-2.1

X X - X - Not Met

Control Ref.

Control Type

Planned Imp.

Actual Imp.

Test #(s) Methods Tailored Result Notes al Users) al Users) (T)

Overlay 1.0"

NIST 800-

53 w/ DHS 4300A Rev

4 IA-2 (1)

Network Access To Privileged Accounts

Identification and

Authenticatio n

(Organization al Users) (T)

System- Specific Not Entered Not Assigned

IA-2(1).1,

IA-2(1).1,

IA-2(1).1

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 IA-2 (2)

Network Access To

Non- Privileged Accounts

Identification and

Authenticatio n

(Organization al Users) (T)

System- Specific Not Entered Not Assigned

IA-2(2).1,

IA-2(2).1,

IA-2(2).1

X X - - - Not Met None

NIST 800-

53 w/ DHS 4300A Rev

4 IA-2 (3)

Local Access To Privileged

Accounts

Identification and

Authenticatio n

(Organization al Users) (T)

System- Specific Not Entered Not Assigned

IA-2(3).1,

IA-2(3).1,

IA-2(3).1

X X - - -…

This is the start of the file's text. The full file is on GovTribe.

File details come from the government source that posted it. Updated .