Appendix III NASA-SPEC-2661.Controls_v2.0.pdf

NASA TECHNICAL SPECIFICATION

National Aeronautics and Space Administration

NASA-SPEC-2661.Controls v2.0

Approved: 2025-02-05

Superseding: NASA-SPEC-2661.Controls v1.2

CONTROL BASELINES AND CRITICAL CONTROLS FOR NASA INFORMATION SYSTEMS

SECURITY CONFIGURATION SPECIFICATION

TABLE OF CONTENTS

Document History Log Foreword

1. Scope

1.1. Purpose

1.2. Applicability

1.3. Tailoring

1.4. Authority

2. Applicable Documents

2.1. Requirements Documents

2.1.1. Government Documents

3. Acronyms, Abbreviations, and Definitions

4. Control Overlay Highlights

4.1. Federally Mandated Critical Controls

4.2. NASA Critical Controls

4.3. NASA Critical Controls for High-Value Asset Systems

4.4. NASA Critical Controls for Systems with Export-Controlled Data

4.5. NASA Baseline Requirements and Critical Controls for Systems with AI Components

5. NASA Control Baselines Appendix A: FEDERALLY MANDATED CRITICAL CONTROLS SUPPORTING DOCUMENTS

Document History Log Document Version Date Approved Description v2.0 2025-02-05 Added NASA baseline requirements and NASA critical controls for systems with artificial intelligence (AI) components; added privacy controls column to Section 5; updated document template.

v1.2 2023-02-21 Added critical controls for systems with export-controlled data; updated controls assigned to NASA baselines;

added Appendix A.

v1.1.1 2022-01-25 Updated Section 1.3, Tailoring.

v1.1 2021-08-27 Added federally mandated critical controls.

v1.0 2021-07-22 Baseline

NASA-SPEC-2661.Controls v2.0

Foreword This NASA Technical Specification is published by the National Aeronautics and Space Administration (NASA) to describe technical requirements for purchased or in-house items, services, functions, or processes for NASA programs and projects.

This NASA Technical Specification is approved for use by NASA Headquarters and NASA Centers and Facilities, and applicable technical requirements may be cited in contract, program, and other NASA documents. This Specification also applies to the Jet Propulsion Laboratory (JPL) (a Federally Funded Research and Development Center (FFRDC)), other contractors, recipients of grants and cooperative agreements, and parties to other agreements only to the extent specified or referenced in applicable contracts, grants, or agreements.

Comments, concerns, and all other feedback on this Specification can be submitted via email to nasa-dl-ascs-800- 53@mail.nasa.gov.

Refer to NASA-SPEC-2600, Enumeration of ASCS Cybersecurity Requirements for signature.

1. Scope

1.1. Purpose

The purpose of this NASA Technical Specification is to define information technology (IT) and operational technology (OT) security control baselines for NASA information systems, US Government federally mandated critical controls, NASA critical controls, NASA critical controls for High-Value Asset (HVA) systems, NASA critical controls for systems with export-controlled data, NASA requirements for systems with artificial intelligence (AI) components, and NASA critical controls for systems with AI components.

1.2. Applicability

This NASA Technical Specification is applicable to all NASA systems, projects, programs, and activities.

This NASA Technical Specification is approved for use by NASA Headquarters and NASA Centers and Facilities, and applicable technical requirements may be cited in contract, program, and other NASA documents. This Specification also applies to JPL, other contractors, recipients of grants and cooperative agreements, and parties to other agreements only to the extent specified or referenced in applicable contracts, grants, or agreements.

1.3. Tailoring

Requirements for control selection (i.e., tailoring a NASA control baseline) are defined in ITS-HBK-AASTEP2, Step 2: Select Policy.

1.4. Authority

The NASA Chief Information Officer (CIO) and Senior Agency Information Security Officer (SAISO) have authorized the Cybersecurity Standards and Engineering Team (CSET) via the Agency Security Configuration Standards (ASCS) initiative to create binding Technical Standards related to cybersecurity topics.

The NASA Technical Standards Program (NTSP), sponsored by the Office of the NASA Chief Engineer, recognizes CSET as a standards-developing organization within NASA.

In accordance with NPR 2810.1F, Security of Information and Information Systems, ISOs SHALL implement the requirements and settings defined in all applicable standards and specifications established by ASCS.

2. Applicable Documents

2.1. Requirements Documents

The documents listed in this section contain provisions that constitute requirements of this NASA Technical Specification. These documents can serve as additional support in meeting the requirements defined in this Specification.

A suffix of x on a document identifier indicates that the latest issuance of the document applies.

2.1.1. Government Documents

Table 1. White House Releases

Document Identifier Document Title

EO 14028 Executive Order on Improving the Nation’s Cybersecurity

HSPD-12 Homeland Security Presidential Directive 12: Policy for a Common Identification Standard for Federal Employees and Contractors

M-22-09 Moving the U.S. Government Toward Zero Trust Cybersecurity Principles

Table 2. National Aeronautics and Space Administration (NASA) Documents

Document Identifier Document Title

ITS-HBK-AASTEP2.x Step 2: Select Policy

ITSD-16-07 Remediating Vulnerabilities in Unsupported or End of Life Software

ITSD Memo 2810 18-01 Hypertext Transfer Protocol Secure (HTTPS) Compliance

NASA-SPEC-2600 Enumeration of ASCS Cybersecurity Requirements

NASA-SPEC-2661.ODVr5 NASA’s Organization-Defined Values for NIST SP 800- 53 Revision 5

NASA-SPEC-2661.SelfAssessment Control Self-Assessment Schedule

NPR 2810.1x Security of Information and Information Systems

NPR 2841.1x Identity, Credential, and Access Management

OCIO Memo 12-17-2012 Configuration Guidance for Computer Operating Systems

Table 3. National Institute of Standards and Technology (NIST) Documents

Document Identifier Document Title

FIPS PUB 199 Standards for Security Categorization of Federal Information and Information Systems

NIST SP 800-53 Rev. 5 Security and Privacy Controls for Information Systems and Organizations

Document Identifier Document Title

NIST SP 800-53B Control Baselines for Information Systems and Organizations

Table 4. Other Government Documents

Document Title

Federal Information Security Modernization Act of 2014

3. Acronyms, Abbreviations, and Definitions Table 5. Acronyms and Abbreviations

AI Artificial Intelligence

AO Authorizing Official

AODR Authorizing Official Designated Representative

ASCS Agency Security Configuration Standards

CDM Continuous Diagnostics and Mitigation

CIO Chief Information Officer

CSET Cybersecurity Standards and Engineering Team

EAR Export Administration Regulations

ECP Export Control Program

ECRM Enterprise Cybersecurity Risk Management

EO Executive Order

FFRDC Federally Funded Research and Development Center

FIPS Federal Information Processing Standards

FISMA Federal Information Security Modernization Act

HBK Handbook

HDBK Handbook

HSPD-12 Homeland Security Presidential Directive-12

HVA High-Value Asset

ISO Information System Owner

IT Information Technology

ITAR International Traffic in Arms Regulations

JPL Jet Propulsion Laboratory

LOR Level of Risk

NASA National Aeronautics and Space Administration

NIST National Institute of Standards and Technology

NPR NASA Procedural Requirement

NTSP NASA Technical Standards Program

OCIO Office of the Chief Information Officer

OIIR Office of International and Interagency Relations

OT Operations Technology

OTS Other Than Satisfied

PCRM Privacy & Cybersecurity Risk Management

PIV Personal Identity Verification

POA&M Plan of Action and Milestones

RBD Risk-Based Decision

SAISO Senior Agency Information Security Officer

SP Special Publication

SPEC Specification

SSP System Security Plan

The table below contains definitions for key terms used in this document. Parenthetical citations are provided at the end of definitions that are derived from another source.

Table 6. Definitions

Term Definition

Export-Controlled Data Data that cannot be released or transferred to persons, systems, or organizations residing in, functioning in, or belonging to a country outside of the United States without first obtaining authorization from the NASA Export Control Program. Export-controlled data includes, but is not limited to, Export Administration Regulations (EAR) and International Traffic in Arms Regulations (ITAR) data.

Export Control Program The NASA Export Control Program (ECP) is a NASA-wide (Headquarters and Field Centers) system established to ensure that exports and transfers to foreign parties in international activities are consistent with the Export Administration Regulations (EAR) and the International Traffic in Arms Regulations (ITAR) and NASA international cooperative activities. (NASA Office of International and Interagency Relations (OIIR))

High-Value Asset Information or an information system that is so critical to an organization that the loss or corruption of this information or loss of access to the system would have serious impacts on the organization’s ability to perform its mission or conduct business.

Information System A discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information. (NIST)

Information System Owner Official responsible for the overall procurement, development, integration, modification, or operation and maintenance of an information system. (NIST)

Level of Risk Level of Risk (LOR) is the amount of vulnerability to NASA, based on the likelihood and consequences of an adverse action through improper access or use of a physical or information technology (IT) asset. (NPR 2841.1x, Identity, Credential, and Access Management)

4. Control Overlay Highlights The sub-sections below highlight each requirement overlay. NASA’s control baselines have a requirement overlay for federally mandated critical controls (and enhancements); NASA critical controls (and enhancements) for all systems, High-Value Asset (HVA) systems, systems with export-controlled data, and systems with artificial intelligence (AI) components; and NASA baseline requirements specifically for systems with AI components.

Each subsection contains a description of the control category that is highlighted and a table comprising only that category of controls. These subsections and tables have been included to make it easier to quickly view specific categories of controls.

Chapter 5, NASA Control Baselines, contains all of the controls highlighted in the sub-sections below, as well as all NASA baseline requirements.

4.1. Federally Mandated Critical Controls

The table below contains US Government federally mandated critical controls and control enhancements.

• The Federal mandates which establish the federally mandated critical controls and control enhancements in the table below are provided in Appendix A, FEDERALLY MANDATED CRITICAL CONTROLS SUPPORTING

DOCUMENTS.

• Federally mandated critical controls and control enhancements SHALL NOT be tailored out of a NASA System Security Plan (SSP) for any reason.

◦ Responses to "Other Than Satisfied" (OTS) control statuses, such as Risk-Based Decisions (RBDs) and Plan of Action and Milestones (POA&Ms), for federally mandated critical controls and control enhancements SHALL be submitted to the Agency Chief Information Officer (CIO) - or CIO-designee - by the system’s Authorizing Official (AO) for review and approval.

• In accordance with NASA-SPEC-2661.SelfAssessment, Self-Assessment Schedule, federally mandated critical controls and control enhancements SHALL be assessed annually.

Table 7. NASA Control Baselines

Control Identifier Control (or Control Enhancement) Name IT

Low

IT

Mod

IT

High

OT

Low

OT

Mod

OT

High

CA-05 Plan of Action and Milestones F F F F F F

CA-06 Authorization F F F F F F

CA-07 Continuous Monitoring F F F F F F

CM-06 Configuration Settings F F F F F F

IA-02 Identification and Authentication (Organizational Users) F F F F F F

IA-02(01) Multi-factor Authentication to Privileged Accounts F F F F F F

IA-02(02) Multi-factor Authentication to Non-privileged Accounts F F F F F F

IA-02(12) Acceptance of PIV Credentials F F F F F F

IR-06 Incident Reporting F F F F F F

PL-04 Rules of Behavior F F F F F F

Control Identifier Control (or Control Enhancement) Name IT

Low

IT

Mod

IT

High

OT

Low

OT

Mod

OT

High

RA-02 Security Categorization F F F F F F

RA-05 Vulnerability Monitoring and Scanning F F F F F F

RA-08 Privacy Impact Assessments F F F F F F

SA-22 Unsupported System Components F F F F F F

SC-07(03) Access Points F F F F F F

SC-08 Transmission Confidentiality and Integrity F F F F F F

SC-08(01) Cryptographic Protection F F F F F F

SC-13 Cryptographic Protection F F F F F F

SC-28 Protection of Information at Rest F F F F F F

SC-28(01) Cryptographic Protection F F F F F F

SI-02 Flaw Remediation F F F F F F

4.2. NASA Critical Controls

The table below contains NASA critical controls and control enhancements.

• NASA critical controls and control enhancements SHALL NOT be tailored out of a NASA SSP for any reason.

◦ If a NASA critical control (enhancement) is not applicable to a particular system, the control SHALL be addressed in the SSP and accompanied by documentation of an approved RBD.

• In accordance with NASA-SPEC-2661.SelfAssessment, Self-Assessment Schedule, critical controls and control enhancements SHALL be assessed annually.

Table 8. NASA Control Baselines

Control Identifier Control (or Control Enhancement) Name IT

Low

IT

Mod

IT

High

OT

Low

OT

Mod

OT

High

AC-01 Policy and Procedures C C C C C C

AT-01 Policy and Procedures C C C C C C

AT-02 Literacy Training and Awareness C C C C C C

AT-03 Role-based Training C C C C C C

AU-01 Policy and Procedures C C C C C C

AU-06 Audit Record Review, Analysis, and Reporting C C C C C C

CA-01 Policy and Procedures C C C C C C

CA-02 Control Assessments C C C C C C

CA-03 Information Exchange C C C C C C

CA-07(06) Automation Support for Monitoring C C C C C C

CM-01 Policy and Procedures C C C C C C

Low

IT

Mod

IT

High

OT

Low

OT

Mod

OT

High

CM-04 Impact Analyses C C C C C C

CM-07 Least Functionality C C C C C C

CM-08 System Component Inventory C C C C C C

CP-01 Policy and Procedures C C C C C C

CP-02 Contingency Plan C C C C C C

CP-02(03) Resume Mission and Business Functions C C C C C C

CP-02(08) Identify Critical Assets C C C C C C

CP-04 Contingency Plan Testing C C C C C C

IA-01 Policy and Procedures C C C C C C

IR-01 Policy and Procedures C C C C C C

MA-01 Policy and Procedures C C C C C C

MP-01 Policy and Procedures C C C C C C

PE-01 Policy and Procedures C C C C C C

PL-01 Policy and Procedures C C C C C C

PL-02 System Security and Privacy Plans C C C C C C

PS-01 Policy and Procedures C C C C C C

PT-01 Policy and Procedures C C C C C C

RA-01 Policy and Procedures C C C C C C

RA-03 Risk Assessment C C C C C C

RA-05(05) Privileged Access C C C C C C

SA-01 Policy and Procedures C C C C C C

SA-02 Allocation of Resources C C C C C C

SA-05 System Documentation C C C C C C

SC-01 Policy and Procedures C C C C C C

SI-01 Policy and Procedures C C C C C C

SR-01 Policy and Procedures C C C C C C

4.3. NASA Critical Controls for High-Value Asset Systems

The table below contains NASA critical controls and control enhancements for High-Value Asset (HVA) systems.

• NASA critical controls and control enhancements for HVA systems SHALL NOT be tailored out of a NASA HVA SSP for any reason.

◦ If a NASA critical control (enhancement) for HVA systems is not applicable to a particular HVA system, the control SHALL be addressed in the SSP and accompanied by documentation of an approved RBD.

• In accordance with NASA-SPEC-2661.SelfAssessment, Self-Assessment Schedule, NASA critical controls and control enhancements for HVA systems SHALL be assessed annually.

Table 9. NASA Control Baselines

Control Identifier Control (or Control Enhancement) Name IT

Low

IT

Mod

IT

High

OT

Low

OT

Mod

OT

High

CA-08 Penetration Testing H H H H H H

CA-08(02) Red Team Exercises H H H H H H

CP-02(01) Coordinate with Related Plans H H H H H H

CP-07(04) Preparation for Use H H H H H H

IR-04(02) Dynamic Reconfiguration H H H H H H

IR-04(05) Automatic Disabling of System H H H H H H

PL-09 Central Management H H H H H H

SI-02(02) Automated Flaw Remediation Status H H H H H H

4.4. NASA Critical Controls for Systems with Export-Controlled Data The table below contains NASA critical controls and control enhancements for systems with export-controlled data.

• NASA critical controls and control enhancements for systems with export-controlled data SHALL NOT be tailored out of an SSP for a NASA system with export-controlled data for any reason.

◦ If a NASA critical control (enhancement) for systems with export-controlled data is not applicable to a particular system, the control SHALL be addressed in the SSP and accompanied by documentation of an approved RBD.

Any NASA critical control or enhancement for systems with export-controlled data that is also a Federally mandated critical control or enhancement SHALL adhere to the process defined in Section 4.1, _Federally Mandated Critical Controls for obtaining approval for responses to "Other Than Satisfied" (OTS) control statuses.

• In accordance with NASA-SPEC-2661.SelfAssessment, Self-Assessment Schedule, NASA critical controls and control enhancements for systems with export-controlled data SHALL be assessed annually.

Table 10. NASA Control Baselines

Control Identifier Control (or Control Enhancement) Name IT

Low

IT

Mod

IT

High

OT

Low

OT

Mod

OT

High

AC-02 Account Management E E E E

AC-02(09) Restrictions on Use of Shared and Group Accounts E E E E

AC-03 Access Enforcement E E E E

AC-03(09) Controlled Release E E E E

AC-04 Information Flow Enforcement E E E E

AC-20 Use of External Systems E E E E

Low

IT

Mod

IT

High

OT

Low

OT

Mod

OT

High

AC-21 Information Sharing E E E E

AT-02 Literacy Training and Awareness E E E E

CM-12 Information Location E E E E

IA-12 Identity Proofing E E E E

IA-12(02) Identity Evidence E E E E

IA-12(03) Identity Evidence Validation and Verification E E E E

IA-12(04) In-person Validation and Verification E E E E

IA-12(05) Address Confirmation E E E E

PS-03 Personnel Screening E E E E

SA-09 External System Services E E E E

SA-09(08) Processing and Storage Location — U.S. Jurisdiction E E E E

SC-08 Transmission Confidentiality and Integrity E E E E

4.5. NASA Baseline Requirements and Critical Controls for

Systems with AI Components The table below contains NASA baseline requirements and NASA critical controls for systems with artificial intelligence (AI) components.

• NASA baseline requirements are indicated by the lowercase letters "ai" in the table below.

• NASA critical controls for systems with AI components are indicated by the uppercase letters "AI" in the table below.

• NASA critical controls for systems with AI components SHALL NOT be tailored out of an SSP for a NASA system with AI components for any reason

◦ If a NASA critical control (enhancement) for systems with AI components is not applicable to a particular system, the control SHALL be addressed in the SSP and accompanied by documentation of an approved

RBD.

• In accordance with NASA-SPEC-2661.SelfAssessment, Self-Assessment Schedule, NASA critical controls and control enhancements for systems with AI components SHALL be assessed annually.

Table 11. NASA Control Baselines

Control Identifier Control (or Control Enhancement) Name IT

Low

IT

Mod

IT

High

OT

Low

OT

Mod

OT

High

AC-03 Access Enforcement AI AI AI AI

CM-03 Configuration Change Control ai AI AI ai AI AI

SA-09 External System Services AI AI AI AI AI AI

SI-15 Information Output Filtering AI AI AI AI AI AI

SI-22 Information Diversity ai ai ai ai ai ai

5. NASA Control Baselines NASA’s control baselines for information systems are derived from NIST SP 800-53B, Control Baselines for Information Systems and Organizations.

In accordance with guidance for organizations provided in NIST SP 800-53B, NASA has added and removed controls and control enhancements defined in the corresponding NIST SP 800-53B baselines in order to customize control baselines for NASA information systems. NASA information systems SHALL adhere to the baseline requirements defined in this Specification.

Table 13, NASA Control Baselines, contains a comprehensive list of information technology (IT) and operational technology (OT) control baselines for all NASA information systems. The table contains six baselines. Each baseline is defined by a combination of system type (IT or OT) and Federal Information Processing Standards Publication 199 (FIPS 199) security categorization (low-, moderate-, or high-impact).

NIST SP 800-53 Rev 5 integrates privacy controls (collectively referred to as a "Privacy baseline profile") across control families; in Table 13, the letter "p" is used in the “Privacy" column to highlight these controls.

Table 12. NASA Control Baseline Key

Character Meaning x NASA baseline requirement

F US Government federally mandated critical

C NASA critical

H NASA critical for HVA systems

E NASA critical for systems with export-controlled data

AI NASA critical for systems with AI components ai NASA baseline requirement for systems with AI components p Privacy baseline policy

Table 13. NASA Control Baselines

Control Identifier Control (or Control Enhancement) Name IT Low IT Mod IT High OT Low OT Mod OT High Privacy

AC-01 Policy and Procedures x C x C x C x C x C x C p

AC-02 Account Management x x E x E x x E x E

AC-02(01) Automated System Account Management x x x x

AC-02(02) Automated Temporary and Emergency Account Management x x x x

AC-02(03) Disable Accounts x x x x

AC-02(04) Automated Audit Actions x x x x

AC-02(05) Inactivity Logout x x x x

AC-02(06) Dynamic Privilege Management

AC-02(07) Privileged User Accounts

AC-02(08) Dynamic Account Management

AC-02(09) Restrictions on Use of Shared and Group Accounts x E x E x E x E

AC-02(11) Usage Conditions x x

AC-02(12) Account Monitoring for Atypical Usage x x x x x x

AC-02(13) Disable Accounts for High-risk Individuals x x x x x x

AC-03 Access Enforcement x x E AI x E AI x x E AI x E AI

AC-03(02) Dual Authorization

AC-03(03) Mandatory Access Control

AC-03(04) Discretionary Access Control

AC-03(05) Security-relevant Information

AC-03(07) Role-based Access Control x x x x

AC-03(08) Revocation of Access Authorizations

AC-03(09) Controlled Release E E E E

AC-03(10) Audited Override of Access Control Mechanisms

AC-03(11) Restrict Access to Specific Information Types

Control Identifier Control (or Control Enhancement) Name IT Low IT Mod IT High OT Low OT Mod OT High Privacy

AC-03(12) Assert and Enforce Application Access

AC-03(13) Attribute-based Access Control

AC-03(14) Individual Access x x p

AC-03(15) Discretionary and Mandatory Access Control

AC-04 Information Flow Enforcement x E x E x E x E

AC-04(01) Object Security and Privacy Attributes

AC-04(02) Processing Domains

AC-04(03) Dynamic Information Flow Control

AC-04(04) Flow Control of Encrypted Information x x

AC-04(05) Embedded Data Types

AC-04(06) Metadata

AC-04(07) One-way Flow Mechanisms

AC-04(08) Security and Privacy Policy Filters

AC-04(09) Human Reviews

AC-04(10) Enable and Disable Security or Privacy Policy Filters

AC-04(11) Configuration of Security or Privacy Policy Filters

AC-04(12) Data Type Identifiers

AC-04(13) Decomposition into Policy-relevant Subcomponents

AC-04(14) Security or Privacy Policy Filter Constraints

AC-04(15) Detection of Unsanctioned Information

AC-04(17) Domain Authentication

AC-04(19) Validation of Metadata

AC-04(20) Approved Solutions

AC-04(21) Physical or Logical Separation of Information Flows

Control Identifier Control (or Control Enhancement) Name IT Low IT Mod IT High OT Low OT Mod OT High Privacy

AC-04(22) Access Only

AC-04(23) Modify Non-releasable Information

AC-04(24) Internal Normalized Format

AC-04(25) Data Sanitization

AC-04(26) Audit Filtering Actions

AC-04(27) Redundant/Independent Filtering Mechanisms

AC-04(28) Linear Filter Pipelines

AC-04(29) Filter Orchestration Engines

AC-04(30) Filter Mechanisms Using Multiple Processes

AC-04(31) Failed Content Transfer Prevention

AC-04(32) Process Requirements for Information Transfer

AC-05 Separation of Duties x x x x

AC-06 Least Privilege x x x x

AC-06(01) Authorize Access to Security Functions x x x x

AC-06(02) Non-privileged Access for Nonsecurity Functions x x x x

AC-06(03) Network Access to Privileged Commands x x

AC-06(04) Separate Processing Domains

AC-06(05) Privileged Accounts x x x x

AC-06(06) Privileged Access by Non-organizational Users

AC-06(07) Review of User Privileges x x x x

AC-06(08) Privilege Levels for Code Execution

AC-06(09) Log Use of Privileged Functions x x x x

AC-06(10) Prohibit Non-privileged Users from Executing Privileged Functions x x x x

AC-07 Unsuccessful Logon Attempts x x x x x x

Control Identifier Control (or Control Enhancement) Name IT Low IT Mod IT High OT Low OT Mod OT High Privacy

AC-07(02) Purge or Wipe Mobile Device

AC-07(03) Biometric Attempt Limiting

AC-07(04) Use of Alternate Authentication Factor

AC-08 System Use Notification x x x x x x

AC-09 Previous Logon Notification

AC-09(01) Unsuccessful Logons

AC-09(02) Successful and Unsuccessful Logons

AC-09(03) Notification of Account Changes

AC-09(04) Additional Logon Information

AC-10 Concurrent Session Control x x

AC-11 Device Lock x x x x

AC-11(01) Pattern-hiding Displays x x x x

AC-12 Session Termination x x x x x

AC-12(01) User-initiated Logouts

AC-12(02) Termination Message

AC-12(03) Timeout Warning Message

AC-14 Permitted Actions Without Identification or Authentication x x x x x x

AC-16 Security and Privacy Attributes

AC-16(01) Dynamic Attribute Association

AC-16(02) Attribute Value Changes by Authorized Individuals

AC-16(03) Maintenance of Attribute Associations by System

AC-16(04) Association of Attributes by Authorized Individuals

AC-16(05) Attribute Displays on Objects to Be Output

AC-16(06) Maintenance of Attribute Association

Control Identifier Control (or Control Enhancement) Name IT Low IT Mod IT High OT Low OT Mod OT High Privacy

AC-16(07) Consistent Attribute Interpretation

AC-16(08) Association Techniques and Technologies

AC-16(09) Attribute Reassignment — Regrading Mechanisms

AC-16(10) Attribute Configuration by Authorized Individuals

AC-17 Remote Access x x x x x x

AC-17(01) Monitoring and Control x x x x

AC-17(02) Protection of Confidentiality and Integrity Using Encryption x x x x x

AC-17(03) Managed Access Control Points x x x x

AC-17(04) Privileged Commands and Access x x x x x

AC-17(06) Protection of Mechanism Information

AC-17(09) Disconnect or Disable Access

AC-17(10) Authenticate Remote Commands

AC-18 Wireless Access x x x x x x

AC-18(01) Authentication and Encryption x x x x x

AC-18(03) Disable Wireless Networking x x

AC-18(04) Restrict Configurations by Users x x

AC-18(05) Antennas and Transmission Power Levels x x

AC-19 Access Control for Mobile Devices x x x x x x

AC-19(04) Restrictions for Classified Information

AC-19(05) Full Device or Container-based Encryption x x x x x

AC-20 Use of External Systems x x E x E x x E x E

AC-20(01) Limits on Authorized Use x x x x

AC-20(02) Portable Storage Devices — Restricted Use x x x x

AC-20(03) Non-organizationally Owned Systems — Restricted Use

Control Identifier Control (or Control Enhancement) Name IT Low IT Mod IT High OT Low OT Mod OT High Privacy

AC-20(04) Network Accessible Storage Devices — Prohibited Use

AC-20(05) Portable Storage Devices — Prohibited Use

AC-21 Information Sharing x E x E x x E x E

AC-21(01) Automated Decision Support

AC-21(02) Information Search and Retrieval

AC-22 Publicly Accessible Content x x x x x x

AC-23 Data Mining Protection

AC-24 Access Control Decisions

AC-24(01) Transmit Access Authorization Information

AC-24(02) No User or Process Identity

AC-25 Reference Monitor

AT-01 Policy and Procedures x C x C x C x C x C x C p

AT-02 Literacy Training and Awareness x C x C E x C E x C x C E x C E p

AT-02(01) Practical Exercises

AT-02(02) Insider Threat x x x x x

AT-02(03) Social Engineering and Mining x x

AT-02(04) Suspicious Communications and Anomalous System Behavior

AT-02(05) Advanced Persistent Threat

AT-02(06) Cyber Threat Environment

AT-03 Role-based Training x C x C x C x C x C x C p

AT-03(01) Environmental Controls

AT-03(02) Physical Security Controls

AT-03(03) Practical Exercises

AT-03(05) Processing Personally Identifiable Information x x p

Control Identifier Control (or Control Enhancement) Name IT Low IT Mod IT High OT Low OT Mod OT High Privacy

AT-04 Training Records x x x x x x p

AT-06 Training Feedback

AU-01 Policy and Procedures x C x C x C x C x C x C p

AU-02 Event Logging x x x x x x p

AU-03 Content of Audit Records x x x x x x

AU-03(01) Additional Audit Information x x x x

AU-03(03) Limit Personally Identifiable Information Elements x x p

AU-04 Audit Log Storage Capacity x x x x x x

AU-04(01) Transfer to Alternate Storage x x x

AU-05 Response to Audit Logging Process Failures x x x x x x

AU-05(01) Storage Capacity Warning x x

AU-05(02) Real-time Alerts x x

AU-05(03) Configurable Traffic Volume Thresholds

AU-05(04) Shutdown on Failure

AU-05(05) Alternate Audit Logging Capability

AU-06 Audit Record Review, Analysis, and Reporting x C x C x C x C x C x C

AU-06(01) Automated Process Integration x x x x

AU-06(03) Correlate Audit Record Repositories x x x x

AU-06(04) Central Review and Analysis

AU-06(05) Integrated Analysis of Audit Records x x

AU-06(06) Correlation with Physical Monitoring x x

AU-06(07) Permitted Actions

AU-06(08) Full Text Analysis of Privileged Commands

AU-06(09) Correlation with Information from Nontechnical Sources

Control Identifier Control (or Control Enhancement) Name IT Low IT Mod IT High OT Low OT Mod OT High Privacy

AU-07 Audit Record Reduction and Report Generation x x x x

AU-07(01) Automatic Processing x x x x

AU-08 Time Stamps x x x x x x

AU-09 Protection of Audit Information x x x x x x

AU-09(01) Hardware Write-once Media

AU-09(02) Store on Separate Physical Systems or Components x x x

AU-09(03) Cryptographic Protection x x

AU-09(04) Access by Subset of Privileged Users x x x x

AU-09(05) Dual Authorization

AU-09(06) Read-only Access x x x x

AU-09(07) Store on Component with Different Operating System

AU-10 Non-repudiation x x x x

AU-10(01) Association of Identities

AU-10(02) Validate Binding of Information Producer Identity

AU-10(03) Chain of Custody

AU-10(04) Validate Binding of Information Reviewer Identity

AU-11 Audit Record Retention x x x x x x p

AU-11(01) Long-term Retrieval Capability

AU-12 Audit Record Generation x x x x x x

AU-12(01) System-wide and Time-correlated Audit Trail x x

AU-12(02) Standardized Formats

AU-12(03) Changes by Authorized Individuals x x x

AU-12(04) Query Parameter Audits of Personally Identifiable Information

AU-13 Monitoring for Information Disclosure

Control Identifier Control (or Control Enhancement) Name IT Low IT Mod IT High OT Low OT Mod OT High Privacy

AU-13(01) Use of Automated Tools

AU-13(02) Review of Monitored Sites

AU-13(03) Unauthorized Replication of Information

AU-14 Session Audit

AU-14(01) System Start-up

AU-14(03) Remote Viewing and Listening

AU-16 Cross-organizational Audit Logging

AU-16(01) Identity Preservation

AU-16(02) Sharing of Audit Information

AU-16(03) Disassociability

CA-01 Policy and Procedures x C x C x C x C x C x C p

CA-02 Control Assessments x C x C x C x C x C x C p

CA-02(01) Independent Assessors x x x x x

CA-02(02) Specialized Assessments x x x x

CA-02(03) Leveraging Results from External Organizations x x x x

CA-03 Information Exchange x C x C x C x C x C x C

CA-03(06) Transfer Authorizations x

CA-03(07) Transitive Information Exchanges x

CA-05 Plan of Action and Milestones x F x F x F x F x F x F p

CA-05(01) Automation Support for Accuracy and Currency x x x x x x

CA-06 Authorization x F x F x F x F x F x F p

CA-06(01) Joint Authorization — Intra-organization x

CA-06(02) Joint Authorization — Inter-organization x

CA-07 Continuous Monitoring x F x F x F x F x F x F p

Control Identifier Control (or Control Enhancement) Name IT Low IT Mod IT High OT Low OT Mod OT High Privacy

CA-07(01) Independent Assessment x x x x x

CA-07(03) Trend Analyses x x

CA-07(04) Risk Monitoring x x x p

CA-07(05) Consistency Analysis x x

CA-07(06) Automation Support for Monitoring x C x C x C x C x C x C

CA-08 Penetration Testing H H x H H H x H

CA-08(01) Independent Penetration Testing Agent or Team x

CA-08(02) Red Team Exercises H H x H H H H

CA-08(03) Facility Penetration Testing x x

CA-09 Internal System Connections x x x x x x

CA-09(01) Compliance Checks x x x

CM-01 Policy and Procedures x C x C x C x C x C x C p

CM-02 Baseline Configuration x x x x x x

CM-02(02) Automation Support for Accuracy and Currency x x x

CM-02(03) Retention of Previous Configurations x x x x

CM-02(06) Development and Test Environments

CM-02(07) Configure Systems and Components for High-risk Areas x x x x

CM-03 Configuration Change Control ai x AI x AI ai x AI x AI

CM-03(01) Automated Documentation, Notification, and Prohibition of Changes x x

CM-03(02) Testing, Validation, and Documentation of Changes x x x x

CM-03(03) Automated Change Implementation

CM-03(04) Security and Privacy Representatives x x x x

CM-03(05) Automated Security Response

CM-03(06) Cryptography Management x x

Control Identifier Control (or Control Enhancement) Name IT Low IT Mod IT High OT Low OT Mod OT High Privacy

CM-03(07) Review System Changes

CM-03(08) Prevent or Restrict Configuration Changes

CM-04 Impact Analyses x C x C x C x C x C x C p

CM-04(01) Separate Test Environments x x

CM-04(02) Verification of Controls x x

CM-05 Access Restrictions for Change x x x x x

CM-05(01) Automated Access Enforcement and Audit Records x x

CM-05(04) Dual Authorization

CM-05(05) Privilege Limitation for Production and Operation

CM-05(06) Limit Library Privileges

CM-06 Configuration Settings x F x F x F x F x F x F

CM-06(01) Automated Management, Application, and Verification x x x x

CM-06(02) Respond to Unauthorized Changes x x x x

CM-07 Least Functionality x C x C x C x C x C x C

CM-07(01) Periodic Review x x x x x

CM-07(02) Prevent Program Execution x x x x

CM-07(03) Registration Compliance

CM-07(04) Unauthorized Software — Deny-by-exception x

CM-07(05) Authorized Software — Allow-by-exception x x x

CM-07(06) Confined Environments with Limited Privileges

CM-07(07) Code Execution in Protected Environments

CM-07(08) Binary or Machine Executable Code

CM-07(09) Prohibiting The Use of Unauthorized Hardware

CM-08 System Component Inventory x C x C x C x C x C x C

Control Identifier Control (or Control Enhancement) Name IT Low IT Mod IT High OT Low OT Mod OT High Privacy

CM-08(01) Updates During Installation and Removal x x x x

CM-08(02) Automated Maintenance x x

CM-08(03) Automated Unauthorized Component Detection x x x x

CM-08(04) Accountability Information x x

CM-08(06) Assessed Configurations and Approved Deviations

CM-08(07) Centralized Repository x x x

CM-08(08) Automated Location Tracking

CM-08(09) Assignment of Components to Systems

CM-09 Configuration Management Plan x x x x

CM-09(01) Assignment of Responsibility

CM-10 Software Usage Restrictions x x x x x x

CM-10(01) Open-source Software

CM-11 User-installed Software x x x x x x

CM-11(02) Software Installation with Privileged Status

CM-11(03) Automated Enforcement and Monitoring

CM-12 Information Location x E x E E x E

CM-12(01) Automated Tools to Support Information Location x x x

CM-13 Data Action Mapping

CM-14 Signed Components

CP-01 Policy and Procedures x C x C x C x C x C x C

CP-02 Contingency Plan x C x C x C x C x C x C

CP-02(01) Coordinate with Related Plans H x H x H H x H x H

CP-02(02) Capacity Planning x x

CP-02(03) Resume Mission and Business Functions x C x C x C x C x C x C

Control Identifier Control (or Control Enhancement) Name IT Low IT Mod IT High OT Low OT Mod OT High Privacy

CP-02(05) Continue Mission and Business Functions x x

CP-02(06) Alternate Processing and Storage Sites

CP-02(07) Coordinate with External Service Providers

CP-02(08) Identify Critical Assets x C x C x C x C x C x C

CP-03 Contingency Training x x x x x x

CP-03(01) Simulated Events x x

CP-03(02) Mechanisms Used in Training Environments

CP-04 Contingency Plan Testing x C x C x C x C x C x C

CP-04(01) Coordinate with Related Plans x x x x

CP-04(02) Alternate Processing Site x x

CP-04(03) Automated Testing

CP-04(04) Full Recovery and Reconstitution

CP-04(05) Self-challenge

CP-06 Alternate Storage Site x x x x

CP-06(01) Separation from Primary Site x x x x

CP-06(02) Recovery Time and Recovery Point Objectives x x

CP-06(03) Accessibility x x x x

CP-07 Alternate Processing Site x x x x

CP-07(01) Separation from Primary Site x x x x

CP-07(02) Accessibility x x x x

CP-07(03) Priority of Service x x x x

CP-07(04) Preparation for Use H H x H H H x H

CP-07(06) Inability to Return to Primary Site

CP-08 Telecommunications Services x x x x

Control Identifier Control (or Control Enhancement) Name IT Low IT Mod IT High OT Low OT Mod OT High Privacy

CP-08(01) Priority of Service Provisions x x x x

CP-08(02) Single Points of Failure x x x x

CP-08(03) Separation of Primary and Alternate Providers x x

CP-08(04) Provider Contingency Plan x x

CP-08(05) Alternate Telecommunication Service Testing

CP-09 System Backup x x x x x x

CP-09(01) Testing for Reliability and Integrity x x x x

CP-09(02) Test Restoration Using Sampling x x

CP-09(03) Separate Storage for Critical Information x x

CP-09(05) Transfer to Alternate Storage Site x x

CP-09(06) Redundant Secondary System

CP-09(07) Dual Authorization for Deletion or Destruction

CP-09(08) Cryptographic Protection x x x x

CP-10 System Recovery and Reconstitution x x x x x x

CP-10(02) Transaction Recovery x x x x

CP-10(04) Restore Within Time Period x x

CP-10(06) Component Protection

CP-11 Alternate Communications Protocols

CP-12 Safe Mode x x x

CP-13 Alternative Security Mechanisms

IA-01 Policy and Procedures x C x C x C x C x C x C

IA-02 Identification and Authentication (Organizational Users) x F x F x F x F x F x F

IA-02(01) Multi-factor Authentication to Privileged Accounts x F x F x F x F x F x F

IA-02(02) Multi-factor Authentication to Non-privileged Accounts x F x F x F x F x F x F

Control Identifier Control (or Control Enhancement) Name IT Low IT Mod IT High OT Low OT Mod OT High Privacy

IA-02(05) Individual Authentication with Group Authentication x

IA-02(06) Access to Accounts —separate Device

IA-02(08) Access to Accounts — Replay Resistant x x x x x

IA-02(10) Single Sign-on

IA-02(12) Acceptance of PIV Credentials x F x F x F x F x F x F

IA-02(13) Out-of-band Authentication

IA-03 Device Identification and Authentication x x x x x

IA-03(01) Cryptographic Bidirectional Authentication x x

IA-03(03) Dynamic Address Allocation

IA-03(04) Device Attestation

IA-04 Identifier Management x x x x x x

IA-04(01) Prohibit Account Identifiers as Public Identifiers

IA-04(04) Identify User Status x x x x

IA-04(05) Dynamic Management

IA-04(06) Cross-organization Management

IA-04(08) Pairwise Pseudonymous Identifiers

IA-04(09) Attribute Maintenance and Protection

IA-05 Authenticator Management x x x x x x

IA-05(01) Password-based Authentication x x x x x x

IA-05(02) Public Key-based Authentication x x x x

IA-05(05) Change Authenticators Prior to Delivery

IA-05(06) Protection of Authenticators x x

IA-05(07) No Embedded Unencrypted Static Authenticators

IA-05(08) Multiple System Accounts

Control Identifier Control (or Control Enhancement) Name IT Low IT Mod IT High OT Low OT Mod OT High Privacy

IA-05(09) Federated Credential Management

IA-05(10) Dynamic Credential Binding

IA-05(12) Biometric Authentication Performance

IA-05(13) Expiration of Cached Authenticators x x x

IA-05(14) Managing Content of PKI Trust Stores

IA-05(15) GSA-approved Products and Services

IA-05(16) In-person or Trusted External Party Authenticator Issuance

IA-05(17) Presentation Attack Detection for Biometric Authenticators

IA-05(18) Password Managers

IA-06 Authentication Feedback x x x x x x

IA-07 Cryptographic Module Authentication x x x x x x

IA-08 Identification and Authentication (Non-organizational Users) x x x x x x

IA-08(01) Acceptance of PIV Credentials from Other Agencies x x x x x x

IA-08(02) Acceptance of External Authenticators x x x x x x

IA-08(04) Use of Defined Profiles x x x x x x

IA-08(05) Acceptance of PIV-I Credentials

IA-08(06) Disassociability

IA-09 Service Identification and Authentication

IA-10 Adaptive Authentication

IA-11 Re-authentication x x x x x x

IA-12 Identity Proofing x E x E E E

IA-12(01) Supervisor Authorization x x

IA-12(02) Identity Evidence x E x E E E

IA-12(03) Identity Evidence Validation and Verification x E x E x E x E

Control Identifier Control (or Control Enhancement) Name IT Low IT Mod IT High OT Low OT Mod OT High Privacy

IA-12(04) In-person Validation and Verification x E x E E E

IA-12(05) Address Confirmation x E x E x E x E

IA-12(06) Accept Externally-proofed Identities

IR-01 Policy and Procedures x C x C x C x C x C x C p

IR-02 Incident Response Training x x x x x x p

IR-02(01) Simulated Events x x

IR-02(02) Automated Training Environments x x

IR-02(03) Breach x x p

IR-03 Incident Response Testing x x x x p

IR-03(01) Automated Testing

IR-03(02) Coordination with Related Plans x x x x

IR-03(03) Continuous Improvement

IR-04 Incident Handling x x x x x x p

IR-04(01) Automated Incident Handling Processes x x x x

IR-04(02) Dynamic Reconfiguration H H H H H H

IR-04(03) Continuity of Operations

IR-04(04) Information Correlation x x

IR-04(05) Automatic Disabling of System H H H H H H

IR-04(06) Insider Threats

IR-04(07) Insider Threats — Intra-organization Coordination

IR-04(08) Correlation with External Organizations

IR-04(09) Dynamic Response Capability

IR-04(10) Supply Chain Coordination

IR-04(11) Integrated Incident Response Team x x

Control Identifier Control (or Control Enhancement) Name IT Low IT Mod IT High OT Low OT Mod OT High Privacy

IR-04(12) Malicious Code and Forensic Analysis

IR-04(13) Behavior Analysis

IR-04(14) Security Operations Center

IR-04(15) Public Relations and Reputation Repair

IR-05 Incident Monitoring x x x x x x p

IR-05(01) Automated Tracking, Data Collection, and Analysis x x

IR-06 Incident Reporting x F x F x F x F x F x F p

IR-06(01) Automated Reporting x x x x

IR-06(02) Vulnerabilities Related to Incidents

IR-06(03) Supply Chain Coordination x x

IR-07 Incident Response Assistance x x x x x x p

IR-07(01) Automation Support for Availability of Information and Support x x x x

IR-07(02) Coordination with External Providers

IR-08 Incident Response Plan x x x x x x p

IR-08(01) Breaches x x p

IR-09 Information Spillage Response x x x x

IR-09(02) Training

IR-09(03) Post-spill Operations

IR-09(04) Exposure to Unauthorized Personnel

MA-01 Policy and Procedures x C x C x C x C x C x C

MA-02 Controlled Maintenance x x x x x x

MA-02(02) Automated Maintenance Activities x x

MA-03 Maintenance Tools x x x x

MA-03(01) Inspect Tools x x x x

Control Identifier Control (or Control Enhancement) Name IT Low IT Mod IT High OT Low OT Mod OT High Privacy

MA-03(02) Inspect Media x x x x

MA-03(03) Prevent Unauthorized Removal x x x

MA-03(04) Restricted Tool Use

MA-03(05) Execution with Privilege

MA-03(06) Software Updates and Patches

MA-04 Nonlocal Maintenance x x x x x x

MA-04(01) Logging and Review

MA-04(03) Comparable Security and Sanitization x x

MA-04(04) Authentication and Separation of Maintenance Sessions

MA-04(05) Approvals and Notifications

MA-04(06) Cryptographic Protection

MA-04(07) Disconnect Verification

MA-05 Maintenance Personnel x x x x x x

MA-05(01) Individuals Without Appropriate Access x x

MA-05(02) Security Clearances for Classified Systems

MA-05(03) Citizenship Requirements for Classified Systems

MA-05(04) Foreign Nationals

MA-05(05) Non-system Maintenance

MA-06 Timely Maintenance x x x x

MA-06(01) Preventive Maintenance

MA-06(02) Predictive Maintenance

MA-06(03) Automated Support for Predictive Maintenance

MA-07 Field Maintenance

MP-01 Policy and Procedures x C x C x C x C x C x C p

Control Identifier Control (or Control Enhancement) Name IT Low IT Mod IT High OT Low OT Mod OT High Privacy

MP-02 Media Access x x x x x x

MP-03 Media Marking x x x x

MP-04 Media Storage x x x x

MP-04(02) Automated Restricted Access

MP-05 Media Transport x x x x

MP-05(03) Custodians

MP-06 Media Sanitization x x x x x x p

MP-06(01) Review, Approve, Track, Document, and Verify x x

MP-06(02) Equipment Testing x x

MP-06(03) Nondestructive Techniques x x

MP-06(07) Dual Authorization

MP-06(08) Remote Purging or Wiping of Information

MP-07 Media Use x x x x x x

MP-07(02) Prohibit Use of Sanitization-resistant Media

MP-08 Media Downgrading

MP-08(01) Documentation of Process

MP-08(02) Equipment Testing

MP-08(03) Controlled Unclassified Information

MP-08(04) Classified Information

PE-01 Policy and Procedures x C x C x C x C x C x C

PE-02 Physical Access Authorizations x x x x x x

PE-02(01) Access by Position or Role

PE-02(02) Two Forms of Identification

PE-02(03) Restrict Unescorted Access

Control Identifier Control (or Control Enhancement) Name IT Low IT Mod IT High OT Low OT Mod OT High Privacy

PE-03 Physical Access Control x x x x x x

PE-03(01) System Access x x x x

PE-03(02) Facility and Systems

PE-03(03) Continuous Guards

PE-03(04) Lockable Casings

PE-03(05) Tamper Protection

PE-03(07) Physical Barriers

PE-03(08) Access Control Vestibules

PE-04 Access Control for Transmission x x x x x

PE-05 Access Control for Output Devices x x x x

PE-05(02) Link to Individual Identity

PE-06 Monitoring Physical Access x x x x x x

PE-06(01) Intrusion Alarms and Surveillance Equipment x x x x

PE-06(02) Automated Intrusion Recognition and Responses

PE-06(03) Video Surveillance

PE-06(04) Monitoring Physical Access to Systems x x x x

PE-08 Visitor Access Records x x x x x x

PE-08(01) Automated Records Maintenance and Review x x

PE-08(03) Limit Personally Identifiable Information Elements x x x x p

PE-09 Power Equipment and Cabling x x x x

PE-09(01) Redundant Cabling

PE-09(02) Automatic Voltage Controls

PE-10 Emergency Shutoff x x x x

PE-11 Emergency Power x x x x x

Control Identifier Control (or Control Enhancement) Name IT Low IT Mod IT High OT Low OT Mod OT High Privacy

PE-11(01) Alternate Power Supply — Minimal Operational Capability x x x x

PE-11(02) Alternate Power Supply — Self-contained x

PE-12 Emergency Lighting x x x x x x

PE-12(01) Essential Mission and Business Functions

PE-13 Fire Protection x x x x x x

PE-13(01) Detection Systems — Automatic Activation and Notification x x x

PE-13(02) Suppression Systems — Automatic Activation and Notification x x

PE-13(04) Inspections

PE-14 Environmental Controls x x x x x x

PE-14(01) Automatic Controls

PE-14(02) Monitoring with Alarms and Notifications

PE-15 Water Damage Protection x x x x x x

PE-15(01) Automation Support x x

PE-16 Delivery and Removal x x x x x x

PE-17 Alternate Work Site x x x x x

PE-18 Location of System Components x x

PE-19 Information Leakage

PE-19(01) National Emissions Policies and Procedures

PE-20 Asset Monitoring and Tracking

PE-21 Electromagnetic Pulse Protection

PE-22 Component Marking

PE-23 Facility Location

PL-01 Policy and Procedures x C x C x C x C x C x C p

PL-02 System Security and Privacy Plans x C x C x C x C x C x C p

Control Identifier Control (or Control Enhancement) Name IT Low IT Mod IT High OT Low OT Mod OT High Privacy

PL-04 Rules of Behavior x F x F x F x F x F x F p

PL-04(01) Social Media and External Site/Application Usage Restrictions x x x x x p

PL-07 Concept of Operations x x

PL-08 Security and Privacy Architectures x x x x p

PL-08(01) Defense in Depth

PL-08(02) Supplier Diversity

PL-09 Central Management x H x H x H H H H p

PL-10 Baseline Selection x x x

PL-11 Baseline Tailoring x x x

PM-01 Information Security Program Plan x x x x x x

PM-02 Information Security Program Leadership Role x x x

PM-03 Information Security and Privacy Resources x x p

PM-04 Plan of Action and Milestones Process x x p

PM-05 System Inventory x x x

PM-05(01) Inventory of Personally Identifiable Information x x p

PM-06 Measures of Performance x x p

PM-07 Enterprise Architecture x x p

PM-07(01) Offloading

PM-08 Critical Infrastructure Plan x x p

PM-09 Risk Management Strategy x x x x p

PM-10 Authorization Process x x p

PM-11 Mission and Business Process Definition x x x x p

PM-12 Insider Threat Program

PM-13 Security and Privacy Workforce x x p

Control Identifier Control (or Control Enhancement) Name IT Low IT Mod IT High OT Low OT Mod OT High Privacy

PM-14 Testing, Training, and Monitoring x x p

PM-15 Security and Privacy Groups and Associations

PM-16 Threat Awareness Program

PM-16(01) Automated Means for Sharing Threat Intelligence

PM-17 Protecting Controlled Unclassified Information on External Systems x x x x p

PM-18 Privacy Program Plan x x p

PM-19 Privacy Program Leadership Role x x p

PM-20 Dissemination of Privacy Program Information x x p

PM-20(01) Privacy Policies on Websites, Applications, and Digital Services x x p

PM-21 Accounting of Disclosures x x p

PM-22 Personally Identifiable Information Quality Management x x p

PM-23 Data Governance Body

PM-24 Data Integrity Board x x p

PM-25 Minimization of Personally Identifiable Information Used in Testing, Training, and Research x x x x p

PM-26 Complaint Management x x x x p

PM-27 Privacy Reporting x x x x p

PM-28 Risk Framing x x x x p

PM-29 Risk Management Program Leadership Roles

PM-30 Supply Chain Risk Management Strategy x x x x x x

PM-30(01) Suppliers of Critical or Mission-essential Items x x x x x x

PM-31 Continuous Monitoring Strategy x x x x p

PM-32 Purposing

PS-01 Policy and Procedures x C x C x C x C x C x C

Control Identifier Control (or Control Enhancement) Name IT Low IT Mod IT High OT Low OT Mod OT High Privacy

PS-02 Position Risk Designation x x x x x x

PS-03 Personnel Screening x x E x E x x E x E

PS-03(01) Classified Information

PS-03(02) Formal Indoctrination

PS-03(03) Information Requiring Special Protective Measures

PS-03(04) Citizenship Requirements

PS-04 Personnel Termination x x x x x x

PS-04(01) Post-employment Requirements

PS-04(02) Automated Actions x x

PS-05 Personnel Transfer x x x x x x

PS-06 Access Agreements x x x x x x p

PS-06(02) Classified Information Requiring Special Protection

PS-06(03) Post-employment Requirements

PS-07 External Personnel Security x x x x x x

PS-08 Personnel Sanctions x x x x x x

PS-09 Position Descriptions x x x

PT-01 Policy and Procedures x C x C x C x C x C x C p

PT-02 Authority to Process Personally Identifiable Information x x x x p

PT-02(01) Data Tagging

PT-02(02) Automation

PT-03 Personally Identifiable Information Processing Purposes x x x x p

PT-03(01) Data Tagging

PT-03(02) Automation

PT-04 Consent x x x x p

Control Identifier Control (or Control Enhancement) Name IT…