Attachment 04 - NIST SP800-53.pdf

NIST Special Publication 800-53 Revision 5

Security and Privacy Controls for Information

Systems and Organizations

JOINT TASK FORCE

This publication is available free of charge from:

https://doi.org/10.6028/NIST.SP.800-53r5

Note that NIST Special Publication (SP) 800-53, Revision 5 contains additional background, scoping, and implementation guidance in addition to the controls and control enhancements.

This PDF is produced from OSCAL Source data and represents a derivative format of controls defined in NIST SP 800-53, Revision 5, Security and Privacy Controls for Information Systems and Organization. This version contains only the controls and control enhancements.

If there are any discrepancies noted in the content between this NIST SP 800-53, Revision 5 derivative data format and the latest published NIST SP 800-53, Revision 5 (normative), please contact sec-cert@nist.gov and refer to the official published documents.

https://github.com/usnistgov/oscal-content/blob/master/nist.gov/SP800-53/rev5/xml/NIST_SP-800-53_rev5_catalog.xml file://///publications/detail/sp/800-53/rev-5/final mailto:sec-cert@nist.gov

NIST SP 800-53 Revision 5.1 Security and Privacy Controls for Informaon Systems and Organizaons

This publicaon is available free of charge from : hps://doi.org/10.6028/N

IST.SP.800-53r5

Table of Contents Family: Access Control (AC)

AC-1 Policy and Procedures

AC-2 Account Management

(1) Automated System Account Management (2) Automated Temporary and Emergency Account Management (3) Disable Accounts (4) Automated Audit Acons (5) Inacvity Logout (6) Dynamic Privilege Management (7) Privileged User Accounts (8) Dynamic Account Management (9) Restricons on Use of Shared and Group Accounts (10) Shared and Group Account Credenal Change (11) Usage Condions (12) Account Monitoring for Atypical Usage (13) Disable Accounts for High-risk Individuals

AC-3 Access Enforcement

(1) Restricted Access to Privileged Funcons (2) Dual Authorizaon (3) Mandatory Access Control (4) Discreonary Access Control (5) Security-relevant Informaon (6) Protecon of User and System Informaon (7) Role-based Access Control (8) Revocaon of Access Authorizaons (9) Controlled Release (10) Audited Override of Access Control Mechanisms (11) Restrict Access to Specific Informaon Types (12) Assert and Enforce Applicaon Access (13) Aribute-based Access Control (14) Individual Access (15) Discreonary and Mandatory Access Control

AC-4 Informaon Flow Enforcement

(1) Object Security and Privacy Aributes (2) Processing Domains (3) Dynamic Informaon Flow Control (4) Flow Control of Encrypted Informaon (5) Embedded Data Types (6) Metadata (7) One-way Flow Mechanisms (8) Security and Privacy Policy Filters (9) Human Reviews (10) Enable and Disable Security or Privacy Policy Filters (11) Configuraon of Security or Privacy Policy Filters (12) Data Type Idenfiers (13) Decomposion into Policy-relevant Subcomponents

(14) Security or Privacy Policy Filter Constraints (15) Detecon of Unsanconed Informaon (16) Informaon Transfers on Interconnected Systems (17) Domain Authencaon (18) Security Aribute Binding (19) Validaon of Metadata

(20) Approved Soluons (21) Physical or Logical Separaon of Informaon Flows (22) Access Only (23) Modify Non-releasable Informaon (24) Internal Normalized Format (25) Data Sanizaon (26) Audit Filtering Acons (27) Redundant/Independent Filtering Mechanisms (28) Linear Filter Pipelines (29) Filter Orchestraon Engines (30) Filter Mechanisms Using Mulple Processes (31) Failed Content Transfer Prevenon (32) Process Requirements for Informaon Transfer

AC-5 Separaon of Dues

AC-6 Least Privilege

(1) Authorize Access to Security Funcons (2) Non-privileged Access for Nonsecurity Funcons (3) Network Access to Privileged Commands (4) Separate Processing Domains (5) Privileged Accounts (6) Privileged Access by Non-organizaonal Users (7) Review of User Privileges (8) Privilege Levels for Code Execuon (9) Log Use of Privileged Funcons (10) Prohibit Non-privileged Users from Execung Privileged Funcons

AC-7 Unsuccessful Logon Aempts

(1) Automac Account Lock (2) Purge or Wipe Mobile Device (3) Biometric Aempt Liming (4) Use of Alternate Authencaon Factor

AC-8 System Use Noficaon

AC-9 Previous Logon Noficaon

(1) Unsuccessful Logons (2) Successful and Unsuccessful Logons (3) Noficaon of Account Changes (4) Addional Logon Informaon

AC-10 Concurrent Session Control

AC-11 Device Lock

(1) Paern-hiding Displays

AC-12 Session Terminaon

(1) User-iniated Logouts (2) Terminaon Message (3) Timeout Warning Message

AC-13 Supervision and Review — Access Control

This document is produced from OSCAL source data

PAGE i https://github.com/usnistgov/oscal-content/blob/master/nist.gov/SP800-53/rev5/xml/NIST_SP-800-53_rev5_catalog.xml

: hps://doi.org/10.6028/N

IST.SP.800-53r5

AC-14 Permied Acons Without Idenficaon or Authencaon

(1) Necessary Uses

AC-15 Automated Marking

AC-16 Security and Privacy Aributes

(1) Dynamic Aribute Associaon (2) Aribute Value Changes by Authorized Individuals (3) Maintenance of Aribute Associaons by System (4) Associaon of Aributes by Authorized Individuals (5) Aribute Displays on Objects to Be Output (6) Maintenance of Aribute Associaon (7) Consistent Aribute Interpretaon (8) Associaon Techniques and Technologies (9) Aribute Reassignment — Regrading Mechanisms (10) Aribute Configuraon by Authorized Individuals

AC-17 Remote Access

(1) Monitoring and Control (2) Protecon of Confidenality and Integrity Using Encrypon (3) Managed Access Control Points (4) Privileged Commands and Access (5) Monitoring for Unauthorized Connecons (6) Protecon of Mechanism Informaon (7) Addional Protecon for Security Funcon Access (8) Disable Nonsecure Network Protocols (9) Disconnect or Disable Access (10) Authencate Remote Commands

AC-18 Wireless Access

(1) Authencaon and Encrypon (2) Monitoring Unauthorized Connecons (3) Disable Wireless Networking (4) Restrict Configuraons by Users (5) Antennas and Transmission Power Levels

AC-19 Access Control for Mobile Devices

(1) Use of Writable and Portable Storage Devices (2) Use of Personally Owned Portable Storage Devices (3) Use of Portable Storage Devices with No Idenfiable Owner (4) Restricons for Classified Informaon (5) Full Device or Container-based Encrypon

AC-20 Use of External Systems

(1) Limits on Authorized Use (2) Portable Storage Devices — Restricted Use (3) Non-organizaonally Owned Systems — Restricted Use (4) Network Accessible Storage Devices — Prohibited Use (5) Portable Storage Devices — Prohibited Use

AC-21 Informaon Sharing

(1) Automated Decision Support (2) Informaon Search and Retrieval

AC-22 Publicly Accessible Content

AC-23 Data Mining Protecon

AC-24 Access Control Decisions

(1) Transmit Access Authorizaon Informaon (2) No User or Process Identy

AC-25 Reference Monitor

Family: Awareness and Training (AT)

AT-1 Policy and Procedures

AT-2 Literacy Training and Awareness

(1) Praccal Exercises (2) Insider Threat (3) Social Engineering and Mining (4) Suspicious Communicaons and Anomalous System Behavior (5) Advanced Persistent Threat (6) Cyber Threat Environment

AT-3 Role-based Training

(1) Environmental Controls (2) Physical Security Controls (3) Praccal Exercises (4) Suspicious Communicaons and Anomalous System Behavior (5) Processing Personally Idenfiable Informaon

AT-4 Training Records

AT-5 Contacts with Security Groups and Associaons

AT-6 Training Feedback

This document is produced from OSCAL source data

PAGE ii https://github.com/usnistgov/oscal-content/blob/master/nist.gov/SP800-53/rev5/xml/NIST_SP-800-53_rev5_catalog.xml

: hps://doi.org/10.6028/N

IST.SP.800-53r5

Family: Audit and Accountability (AU)

AU-1 Policy and Procedures

AU-2 Event Logging

(1) Compilaon of Audit Records from Mulple Sources (2) Selecon of Audit Events by Component (3) Reviews and Updates (4) Privileged Funcons

AU-3 Content of Audit Records

(1) Addional Audit Informaon (2) Centralized Management of Planned Audit Record Content (3) Limit Personally Idenfiable Informaon Elements

AU-4 Audit Log Storage Capacity

(1) Transfer to Alternate Storage

AU-5 Response to Audit Logging Process Failures

(1) Storage Capacity Warning (2) Real-me Alerts (3) Configurable Traffic Volume Thresholds (4) Shutdown on Failure

(5) Alternate Audit Logging Capability

AU-6 Audit Record Review, Analysis, and Reporng

(1) Automated Process Integraon (2) Automated Security Alerts (3) Correlate Audit Record Repositories (4) Central Review and Analysis (5) Integrated Analysis of Audit Records (6) Correlaon with Physical Monitoring (7) Permied Acons (8) Full Text Analysis of Privileged Commands (9) Correlaon with Informaon from Nontechnical Sources (10) Audit Level Adjustment

AU-7 Audit Record Reducon and Report Generaon

(1) Automac Processing (2) Automac Sort and Search

AU-8 Time Stamps

(1) Synchronizaon with Authoritave Time Source (2) Secondary Authoritave Time Source

AU-9 Protecon of Audit Informaon

(1) Hardware Write-once Media (2) Store on Separate Physical Systems or Components (3) Cryptographic Protecon (4) Access by Subset of Privileged Users (5) Dual Authorizaon (6) Read-only Access (7) Store on Component with Different Operang System

AU-10 Non-repudiaon

(1) Associaon of Idenes (2) Validate Binding of Informaon Producer Identy (3) Chain of Custody (4) Validate Binding of Informaon Reviewer Identy (5) Digital Signatures

AU-11 Audit Record Retenon

(1) Long-term Retrieval Capability

AU-12 Audit Record Generaon

(1) System-wide and Time-correlated Audit Trail (2) Standardized Formats (3) Changes by Authorized Individuals (4) Query Parameter Audits of Personally Idenfiable Informaon

AU-13 Monitoring for Informaon Disclosure

(1) Use of Automated Tools (2) Review of Monitored Sites (3) Unauthorized Replicaon of Informaon

AU-14 Session Audit

(1) System Start-up (2) Capture and Record Content (3) Remote Viewing and Listening

AU-15 Alternate Audit Logging Capability

AU-16 Cross-organizaonal Audit Logging

(1) Identy Preservaon (2) Sharing of Audit Informaon (3) Disassociability

Family: Assessment, Authorizaon, and Monitoring (CA)

CA-1 Policy and Procedures

This document is produced from OSCAL source data

PAGE iii https://github.com/usnistgov/oscal-content/blob/master/nist.gov/SP800-53/rev5/xml/NIST_SP-800-53_rev5_catalog.xml

: hps://doi.org/10.6028/N

IST.SP.800-53r5

CA-2 Control Assessments

(1) Independent Assessors (2) Specialized Assessments (3) Leveraging Results from External Organizaons

CA-3 Informaon Exchange

(1) Unclassified Naonal Security System Connecons (2) Classified Naonal Security System Connecons (3) Unclassified Non-naonal Security System Connecons (4) Connecons to Public Networks (5) Restricons on External System Connecons (6) Transfer Authorizaons (7) Transive Informaon Exchanges

CA-4 Security Cerficaon

CA-5 Plan of Acon and Milestones

(1) Automaon Support for Accuracy and Currency

CA-6 Authorizaon

(1) Joint Authorizaon — Intra-organizaon (2) Joint Authorizaon — Inter-organizaon

CA-7 Connuous Monitoring

(1) Independent Assessment (2) Types of Assessments (3) Trend Analyses (4) Risk Monitoring (5) Consistency Analysis

(6) Automaon Support for Monitoring

CA-8 Penetraon Tesng

(1) Independent Penetraon Tesng Agent or Team (2) Red Team Exercises (3) Facility Penetraon Tesng

CA-9 Internal System Connecons

(1) Compliance Checks

Family: Configuraon Management (CM)

CM-1 Policy and Procedures

CM-2 Baseline Configuraon

(1) Reviews and Updates (2) Automaon Support for Accuracy and Currency (3) Retenon of Previous Configuraons

(4) Unauthorized Soware (5) Authorized Soware (6) Development and Test Environments (7) Configure Systems and Components for High-risk Areas

CM-3 Configuraon Change Control

(1) Automated Documentaon, Noficaon, and Prohibion of Changes (2) Tesng, Validaon, and Documentaon of Changes (3) Automated Change Implementaon (4) Security and Privacy Representaves (5) Automated Security Response (6) Cryptography Management (7) Review System Changes (8) Prevent or Restrict Configuraon Changes

CM-4 Impact Analyses

(1) Separate Test Environments (2) Verificaon of Controls

CM-5 Access Restricons for Change

(1) Automated Access Enforcement and Audit Records (2) Review System Changes (3) Signed Components (4) Dual Authorizaon (5) Privilege Limitaon for Producon and Operaon (6) Limit Library Privileges (7) Automac Implementaon of Security Safeguards

CM-6 Configuraon Sengs

(1) Automated Management, Applicaon, and Verificaon (2) Respond to Unauthorized Changes (3) Unauthorized Change Detecon (4) Conformance Demonstraon

CM-7 Least Funconality

(1) Periodic Review (2) Prevent Program Execuon (3) Registraon Compliance (4) Unauthorized Soware — Deny-by-excepon (5) Authorized Soware — Allow-by-excepon (6) Confined Environments with Limited Privileges (7) Code Execuon in Protected Environments (8) Binary or Machine Executable Code (9) Prohibing The Use of Unauthorized Hardware

CM-8 System Component Inventory

(1) Updates During Installaon and Removal (2) Automated Maintenance (3) Automated Unauthorized Component Detecon (4) Accountability Informaon (5) No Duplicate Accounng of Components (6) Assessed Configuraons and

This document is produced from OSCAL source data

PAGE iv https://github.com/usnistgov/oscal-content/blob/master/nist.gov/SP800-53/rev5/xml/NIST_SP-800-53_rev5_catalog.xml

: hps://doi.org/10.6028/N

IST.SP.800-53r5

Approved Deviaons (7) Centralized Repository (8) Automated Locaon Tracking (9) Assignment of Components to Systems

CM-9 Configuraon Management Plan

(1) Assignment of Responsibility

CM-10 Soware Usage Restricons

(1) Open-source Soware

CM-11 User-installed Soware

(1) Alerts for Unauthorized Installaons (2) Soware Installaon with Privileged Status (3) Automated Enforcement and Monitoring

CM-12 Informaon Locaon

(1) Automated Tools to Support Informaon Locaon

CM-13 Data Acon Mapping

CM-14 Signed Components

Family: Conngency Planning (CP)

CP-1 Policy and Procedures

CP-2 Conngency Plan

(1) Coordinate with Related Plans (2) Capacity Planning (3) Resume Mission and Business Funcons (4) Resume All Mission and Business Funcons (5) Connue Mission and Business Funcons (6) Alternate Processing and Storage Sites

(7) Coordinate with External Service Providers (8) Idenfy Crical Assets

CP-3 Conngency Training

(1) Simulated Events (2) Mechanisms Used in Training Environments

CP-4 Conngency Plan Tesng

(1) Coordinate with Related Plans (2) Alternate Processing Site (3) Automated Tesng (4) Full Recovery and Reconstuon (5) Self-challenge

CP-5 Conngency Plan Update

CP-6 Alternate Storage Site

(1) Separaon from Primary Site (2) Recovery Time and Recovery Point Objecves (3) Accessibility

CP-7 Alternate Processing Site

(1) Separaon from Primary Site (2) Accessibility (3) Priority of Service (4) Preparaon for Use (5) Equivalent Informaon Security Safeguards (6) Inability to Return to Primary Site

CP-8 Telecommunicaons Services

(1) Priority of Service Provisions (2) Single Points of Failure (3) Separaon of Primary and Alternate Providers (4) Provider Conngency Plan (5) Alternate Telecommunicaon Service Tesng

CP-9 System Backup

(1) Tesng for Reliability and Integrity (2) Test Restoraon Using Sampling (3) Separate Storage for Crical Informaon

(4) Protecon from Unauthorized Modificaon (5) Transfer to Alternate Storage Site (6) Redundant Secondary System

(7) Dual Authorizaon for Deleon or Destrucon (8) Cryptographic Protecon

CP-10 System Recovery and Reconstuon

(1) Conngency Plan Tesng (2) Transacon Recovery (3) Compensang Security Controls (4) Restore Within Time Period (5) Failover Capability (6) Component Protecon

CP-11 Alternate Communicaons Protocols

CP-12 Safe Mode

CP-13 Alternave Security Mechanisms

This document is produced from OSCAL source data

PAGE v https://github.com/usnistgov/oscal-content/blob/master/nist.gov/SP800-53/rev5/xml/NIST_SP-800-53_rev5_catalog.xml

: hps://doi.org/10.6028/N

IST.SP.800-53r5

Family: Idenficaon and Authencaon (IA)

IA-1 Policy and Procedures

IA-2 Idenficaon and Authencaon (Organizaonal Users)

(1) Mul-factor Authencaon to Privileged Accounts (2) Mul-factor Authencaon to Non-privileged Accounts (3) Local Access to Privileged Accounts (4) Local Access to Non-privileged Accounts (5) Individual Authencaon with Group Authencaon (6) Access to Accounts —separate Device (7) Network Access to Non-privileged Accounts — Separate Device (8) Access to Accounts — Replay Resistant (9) Network Access to Non-privileged Accounts — Replay Resistant (10) Single Sign-on (11) Remote Access — Separate Device (12) Acceptance of PIV Credenals (13) Out-of-band Authencaon

IA-3 Device Idenficaon and Authencaon

(1) Cryptographic Bidireconal Authencaon (2) Cryptographic Bidireconal Network Authencaon (3) Dynamic Address Allocaon (4) Device Aestaon

IA-4 Idenfier Management

(1) Prohibit Account Idenfiers as Public Idenfiers (2) Supervisor Authorizaon (3) Mulple Forms of Cerficaon

(4) Idenfy User Status (5) Dynamic Management (6) Cross-organizaon Management (7) In-person Registraon (8) Pairwise Pseudonymous Idenfiers (9) Aribute Maintenance and Protecon

IA-5 Authencator Management

(1) Password-based Authencaon (2) Public Key-based Authencaon (3) In-person or Trusted External Party Registraon (4) Automated Support for Password Strength Determinaon (5) Change Authencators Prior to Delivery

(6) Protecon of Authencators (7) No Embedded Unencrypted Stac Authencators (8) Mulple System Accounts (9) Federated Credenal Management (10) Dynamic Credenal Binding (11) Hardware Token-based Authencaon (12) Biometric Authencaon Performance (13) Expiraon of Cached Authencators (14) Managing Content of PKI Trust Stores (15) Gsa-approved Products and Services (16) In-person or Trusted External Party Authencator Issuance (17) Presentaon Aack Detecon for Biometric Authencators (18) Password Managers

IA-6 Authencaon Feedback

IA-7 Cryptographic Module Authencaon

IA-8 Idenficaon and Authencaon (Non-organizaonal Users)

(1) Acceptance of PIV Credenals from Other Agencies (2) Acceptance of External Authencators (3) Use of Ficam-approved Products (4) Use of Defined Profiles (5) Acceptance of PIV-I Credenals (6) Disassociability

IA-9 Service Idenficaon and Authencaon

(1) Informaon Exchange (2) Transmission of Decisions

IA-10 Adapve Authencaon

IA-11 Re-authencaon

IA-12 Identy Proofing

(1) Supervisor Authorizaon (2) Identy Evidence (3) Identy Evidence Validaon and Verificaon (4) In-person Validaon and Verificaon (5) Address Confirmaon (6) Accept Externally-proofed Idenes

Family: Incident Response (IR)

IR-1 Policy and Procedures

IR-2 Incident Response Training

(1) Simulated Events (2) Automated Training Environments (3) Breach

IR-3 Incident Response Tesng

(1) Automated Tesng (2) Coordinaon with Related Plans (3) Connuous Improvement

IR-4 Incident Handling

(1) Automated Incident Handling Processes (2) Dynamic Reconfiguraon (3) Connuity of Operaons (4) Informaon Correlaon (5) Automac Disabling of System (6) Insider Threats (7) Insider Threats — Intra-organizaon Coordinaon

(8) Correlaon with External Organizaons (9) Dynamic Response Capability (10) Supply Chain Coordinaon (11)

This document is produced from OSCAL source data

PAGE vi https://github.com/usnistgov/oscal-content/blob/master/nist.gov/SP800-53/rev5/xml/NIST_SP-800-53_rev5_catalog.xml

: hps://doi.org/10.6028/N

IST.SP.800-53r5

Integrated Incident Response Team (12) Malicious Code and Forensic Analysis (13) Behavior Analysis (14) Security Operaons Center (15) Public Relaons and Reputaon Repair

IR-5 Incident Monitoring

(1) Automated Tracking, Data Collecon, and Analysis

IR-6 Incident Reporng

(1) Automated Reporng (2) Vulnerabilies Related to Incidents (3) Supply Chain Coordinaon

IR-7 Incident Response Assistance

(1) Automaon Support for Availability of Informaon and Support (2) Coordinaon with External Providers

IR-8 Incident Response Plan

(1) Breaches

IR-9 Informaon Spillage Response

(1) Responsible Personnel (2) Training (3) Post-spill Operaons (4) Exposure to Unauthorized Personnel

IR-10 Integrated Informaon Security Analysis Team

Family: Maintenance (MA)

MA-1 Policy and Procedures

MA-2 Controlled Maintenance

(1) Record Content (2) Automated Maintenance Acvies

MA-3 Maintenance Tools

(1) Inspect Tools (2) Inspect Media (3) Prevent Unauthorized Removal (4) Restricted Tool Use (5) Execuon with Privilege (6) Soware Updates and Patches

MA-4 Nonlocal Maintenance

(1) Logging and Review (2) Document Nonlocal Maintenance (3) Comparable Security and Sanizaon (4) Authencaon and Separaon of Maintenance Sessions (5) Approvals and Noficaons (6) Cryptographic Protecon

(7) Disconnect Verificaon

MA-5 Maintenance Personnel

(1) Individuals Without Appropriate Access (2) Security Clearances for Classified Systems (3) Cizenship Requirements for Classified Systems (4) Foreign Naonals (5) Non-system Maintenance

MA-6 Timely Maintenance

(1) Prevenve Maintenance (2) Predicve Maintenance (3) Automated Support for Predicve Maintenance

MA-7 Field Maintenance

Family: Media Protecon (MP)

MP-1 Policy and Procedures

MP-2 Media Access

(1) Automated Restricted Access (2) Cryptographic Protecon

MP-3 Media Marking

MP-4 Media Storage

(1) Cryptographic Protecon (2) Automated Restricted Access

MP-5 Media Transport

(1) Protecon Outside of Controlled Areas (2) Documentaon of Acvies (3) Custodians (4) Cryptographic Protecon

This document is produced from OSCAL source data

PAGE vii https://github.com/usnistgov/oscal-content/blob/master/nist.gov/SP800-53/rev5/xml/NIST_SP-800-53_rev5_catalog.xml

: hps://doi.org/10.6028/N

IST.SP.800-53r5

MP-6 Media Sanizaon

(1) Review, Approve, Track, Document, and Verify (2) Equipment Tesng (3) Nondestrucve Techniques (4) Controlled Unclassified Informaon (5) Classified Informaon (6) Media Destrucon (7) Dual Authorizaon (8) Remote Purging or Wiping of Informaon

MP-7 Media Use

(1) Prohibit Use Without Owner (2) Prohibit Use of Sanizaon-resistant Media

MP-8 Media Downgrading

(1) Documentaon of Process (2) Equipment Tesng (3) Controlled Unclassified Informaon (4) Classified Informaon

Family: Physical and Environmental Protecon (PE)

PE-1 Policy and Procedures

PE-2 Physical Access Authorizaons

(1) Access by Posion or Role (2) Two Forms of Idenficaon (3) Restrict Unescorted Access

PE-3 Physical Access Control

(1) System Access (2) Facility and Systems (3) Connuous Guards (4) Lockable Casings (5) Tamper Protecon (6) Facility Penetraon Tesng (7) Physical Barriers (8) Access Control Vesbules

PE-4 Access Control for Transmission

PE-5 Access Control for Output Devices

(1) Access to Output by Authorized Individuals (2) Link to Individual Identy (3) Marking Output Devices

PE-6 Monitoring Physical Access

(1) Intrusion Alarms and Surveillance Equipment (2) Automated Intrusion Recognion and Responses (3) Video Surveillance (4) Monitoring Physical Access to Systems

PE-7 Visitor Control

PE-8 Visitor Access Records

(1) Automated Records Maintenance and Review (2) Physical Access Records (3) Limit Personally Idenfiable Informaon Elements

PE-9 Power Equipment and Cabling

(1) Redundant Cabling (2) Automac Voltage Controls

PE-10 Emergency Shutoff

(1) Accidental and Unauthorized Acvaon

PE-11 Emergency Power

(1) Alternate Power Supply — Minimal Operaonal Capability (2) Alternate Power Supply — Self-contained

PE-12 Emergency Lighng

(1) Essenal Mission and Business Funcons

PE-13 Fire Protecon

(1) Detecon Systems — Automac Acvaon and Noficaon (2) Suppression Systems — Automac Acvaon and Noficaon (3) Automac Fire Suppression (4) Inspecons

PE-14 Environmental Controls

(1) Automac Controls (2) Monitoring with Alarms and Noficaons

PE-15 Water Damage Protecon

(1) Automaon Support

PE-16 Delivery and Removal

This document is produced from OSCAL source data

PAGE viii https://github.com/usnistgov/oscal-content/blob/master/nist.gov/SP800-53/rev5/xml/NIST_SP-800-53_rev5_catalog.xml

: hps://doi.org/10.6028/N

IST.SP.800-53r5

PE-17 Alternate Work Site

PE-18 Locaon of System Components

(1) Facility Site

PE-19 Informaon Leakage

(1) Naonal Emissions Policies and Procedures

PE-20 Asset Monitoring and Tracking

PE-21 Electromagnec Pulse Protecon

PE-22 Component Marking

PE-23 Facility Locaon

Family: Planning (PL)

PL-1 Policy and Procedures

PL-2 System Security and Privacy Plans

(1) Concept of Operaons (2) Funconal Architecture (3) Plan and Coordinate with Other Organizaonal Enes

PL-3 System Security Plan Update

PL-4 Rules of Behavior

(1) Social Media and External Site/Applicaon Usage Restricons

PL-5 Privacy Impact Assessment

PL-6 Security-related Acvity Planning

PL-7 Concept of Operaons

PL-8 Security and Privacy Architectures

(1) Defense in Depth (2) Supplier Diversity

PL-9 Central Management

PL-10 Baseline Selecon

PL-11 Baseline Tailoring

Family: Program Management (PM)

PM-1 Informaon Security Program Plan

PM-2 Informaon Security Program Leadership Role

PM-3 Informaon Security and Privacy Resources

PM-4 Plan of Acon and Milestones Process

PM-5 System Inventory

(1) Inventory of Personally Idenfiable Informaon

PM-6 Measures of Performance

PM-7 Enterprise Architecture

(1) Offloading

PM-8 Crical Infrastructure Plan

PM-9 Risk Management Strategy

PM-10 Authorizaon Process

This document is produced from OSCAL source data

PAGE ix https://github.com/usnistgov/oscal-content/blob/master/nist.gov/SP800-53/rev5/xml/NIST_SP-800-53_rev5_catalog.xml

: hps://doi.org/10.6028/N

IST.SP.800-53r5

PM-11 Mission and Business Process Definion

PM-12 Insider Threat Program

PM-13 Security and Privacy Workforce

PM-14 Tesng, Training, and Monitoring

PM-15 Security and Privacy Groups and Associaons

PM-16 Threat Awareness Program

(1) Automated Means for Sharing Threat Intelligence

PM-17 Protecng Controlled Unclassified Informaon on External Systems

PM-18 Privacy Program Plan

PM-19 Privacy Program Leadership Role

PM-20 Disseminaon of Privacy Program Informaon

(1) Privacy Policies on Websites, Applicaons, and Digital Services

PM-21 Accounng of Disclosures

PM-22 Personally Idenfiable Informaon Quality Management

PM-23 Data Governance Body

PM-24 Data Integrity Board

PM-25 Minimizaon of Personally Idenfiable Informaon Used in Tesng, Training, and Research

PM-26 Complaint Management

PM-27 Privacy Reporng

PM-28 Risk Framing

PM-29 Risk Management Program Leadership Roles

PM-30 Supply Chain Risk Management Strategy

(1) Suppliers of Crical or Mission-essenal Items

PM-31 Connuous Monitoring Strategy

PM-32 Purposing

Family: Personnel Security (PS)

PS-1 Policy and Procedures

PS-2 Posion Risk Designaon

PS-3 Personnel Screening

(1) Classified Informaon (2) Formal Indoctrinaon (3) Informaon Requiring Special Protecve Measures (4) Cizenship Requirements

PS-4 Personnel Terminaon

(1) Post-employment Requirements (2) Automated Acons

PS-5 Personnel Transfer

PS-6 Access Agreements

(1) Informaon Requiring Special Protecon (2) Classified Informaon Requiring Special Protecon (3) Post-employment Requirements

PS-7 External Personnel Security

This document is produced from OSCAL source data

PAGE x https://github.com/usnistgov/oscal-content/blob/master/nist.gov/SP800-53/rev5/xml/NIST_SP-800-53_rev5_catalog.xml

: hps://doi.org/10.6028/N

IST.SP.800-53r5

PS-8 Personnel Sancons

PS-9 Posion Descripons

Family: Personally Idenfiable Informaon Processing and Transparency (PT)

PT-1 Policy and Procedures

PT-2 Authority to Process Personally Idenfiable Informaon

(1) Data Tagging (2) Automaon

PT-3 Personally Idenfiable Informaon Processing Purposes

(1) Data Tagging (2) Automaon

PT-4 Consent

(1) Tailored Consent (2) Just-in-me Consent (3) Revocaon

PT-5 Privacy Noce

(1) Just-in-me Noce (2) Privacy Act Statements

PT-6 System of Records Noce

(1) Roune Uses (2) Exempon Rules

PT-7 Specific Categories of Personally Idenfiable Informaon

(1) Social Security Numbers (2) First Amendment Informaon

PT-8 Computer Matching Requirements

Family: Risk Assessment (RA)

RA-1 Policy and Procedures

RA-2 Security Categorizaon

(1) Impact-level Priorizaon

RA-3 Risk Assessment

(1) Supply Chain Risk Assessment (2) Use of All-source Intelligence (3) Dynamic Threat Awareness (4) Predicve Cyber Analycs

RA-4 Risk Assessment Update

RA-5 Vulnerability Monitoring and Scanning

(1) Update Tool Capability (2) Update Vulnerabilies to Be Scanned (3) Breadth and Depth of Coverage (4) Discoverable Informaon (5) Privileged Access (6) Automated Trend Analyses (7) Automated Detecon and Noficaon of Unauthorized Components (8) Review Historic Audit Logs (9) Penetraon Tesng and Analyses (10) Correlate Scanning Informaon (11) Public Disclosure Program

RA-6 Technical Surveillance Countermeasures Survey

RA-7 Risk Response

RA-8 Privacy Impact Assessments

RA-9 Cricality Analysis

RA-10 Threat Hunng

Family: System and Services Acquision (SA)

SA-1 Policy and Procedures

SA-2 Allocaon of Resources

SA-3 System Development Life Cycle

(1) Manage Preproducon Environment (2) Use of Live or Operaonal Data (3) Technology Refresh

This document is produced from OSCAL source data

PAGE xi https://github.com/usnistgov/oscal-content/blob/master/nist.gov/SP800-53/rev5/xml/NIST_SP-800-53_rev5_catalog.xml

: hps://doi.org/10.6028/N

IST.SP.800-53r5

SA-4 Acquision Process

(1) Funconal Properes of Controls (2) Design and Implementaon Informaon for Controls (3) Development Methods, Techniques, and Pracces (4) Assignment of Components to Systems (5) System, Component, and Service Configuraons (6) Use of Informaon Assurance Products (7) Niap-approved Protecon Profiles (8) Connuous Monitoring Plan for Controls (9) Funcons, Ports, Protocols, and Services in Use (10) Use of Approved PIV Products (11) System of Records (12) Data Ownership

SA-5 System Documentaon

(1) Funconal Properes of Security Controls (2) Security-relevant External System Interfaces (3) High-level Design (4) Low-level Design (5) Source Code

SA-6 Soware Usage Restricons

SA-7 User-installed Soware

SA-8 Security and Privacy Engineering Principles

(1) Clear Abstracons (2) Least Common Mechanism (3) Modularity and Layering (4) Parally Ordered Dependencies

(5) Efficiently Mediated Access (6) Minimized Sharing (7) Reduced Complexity (8) Secure Evolvability (9) Trusted Components (10) Hierarchical Trust (11) Inverse Modificaon Threshold (12) Hierarchical Protecon (13) Minimized Security Elements (14) Least Privilege (15) Predicate Permission (16) Self-reliant Trustworthiness (17) Secure Distributed Composion (18) Trusted Communicaons Channels (19) Connuous Protecon (20) Secure Metadata Management (21) Self-analysis (22) Accountability and Traceability (23) Secure Defaults (24) Secure Failure and Recovery (25) Economic Security (26) Performance Security (27) Human Factored Security (28) Acceptable Security

(29) Repeatable and Documented Procedures (30) Procedural Rigor (31) Secure System Modificaon (32) Sufficient Documentaon (33) Minimizaon

SA-9 External System Services

(1) Risk Assessments and Organizaonal Approvals (2) Idenficaon of Funcons, Ports, Protocols, and Services (3) Establish and Maintain Trust Relaonship with Providers (4) Consistent Interests of Consumers and Providers (5) Processing, Storage, and Service Locaon (6) Organizaon-controlled Cryptographic Keys (7) Organizaon-controlled Integrity Checking (8) Processing and Storage Locaon — U.s. Jurisdicon

SA-10 Developer Configuraon Management

(1) Soware and Firmware Integrity Verificaon (2) Alternave Configuraon Management Processes (3) Hardware Integrity Verificaon (4) Trusted Generaon (5) Mapping Integrity for Version Control (6) Trusted Distribuon (7) Security and Privacy Representaves

SA-11 Developer Tesng and Evaluaon

(1) Stac Code Analysis (2) Threat Modeling and Vulnerability Analyses (3) Independent Verificaon of Assessment Plans and Evidence (4) Manual Code Reviews (5) Penetraon Tesng (6) Aack Surface Reviews (7) Verify Scope of Tesng and Evaluaon (8) Dynamic Code Analysis (9) Interacve Applicaon Security Tesng

SA-12 Supply Chain Protecon

(1) Acquision Strategies Tools Methods (2) Supplier Reviews (3) Trusted Shipping and Warehousing (4) Diversity of Suppliers (5) Limitaon of Harm (6) Minimizing Procurement Time (7) Assessments Prior to Selecon Acceptance Update (8) Use of All-source Intelligence (9) Operaons Security (10) Validate as Genuine and Not Altered (11) Penetraon Tesng Analysis of Elements, Processes, and Actors (12) Inter-organizaonal Agreements (13) Crical Informaon System Components (14) Identy and Traceability (15) Processes to Address Weaknesses or Deficiencies

SA-13 Trustworthiness

SA-14 Cricality Analysis

(1) Crical Components with No Viable Alternave Sourcing

SA-15 Development Process, Standards, and Tools

(1) Quality Metrics (2) Security and Privacy Tracking Tools (3) Cricality Analysis (4) Threat Modeling and Vulnerability Analysis (5) Aack Surface Reducon (6) Connuous Improvement (7) Automated Vulnerability Analysis (8) Reuse of Threat and Vulnerability Informaon (9) Use of Live Data (10) Incident Response Plan (11) Archive System or Component (12) Minimize Personally Idenfiable Informaon

SA-16 Developer-provided Training

This document is produced from OSCAL source data

PAGE xii https://github.com/usnistgov/oscal-content/blob/master/nist.gov/SP800-53/rev5/xml/NIST_SP-800-53_rev5_catalog.xml

: hps://doi.org/10.6028/N

IST.SP.800-53r5

SA-17 Developer Security and Privacy Architecture and Design

(1) Formal Policy Model (2) Security-relevant Components (3) Formal Correspondence (4) Informal Correspondence

(5) Conceptually Simple Design (6) Structure for Tesng (7) Structure for Least Privilege (8) Orchestraon (9) Design Diversity

SA-18 Tamper Resistance and Detecon

(1) Mulple Phases of System Development Life Cycle (2) Inspecon of Systems or Components

SA-19 Component Authencity

(1) An-counterfeit Training (2) Configuraon Control for Component Service and Repair (3) Component Disposal (4) An-counterfeit Scanning

SA-20 Customized Development of Crical Components

SA-21 Developer Screening

(1) Validaon of Screening

SA-22 Unsupported System Components

(1) Alternave Sources for Connued Support

SA-23 Specializaon

Family: System and Communicaons Protecon (SC)

SC-1 Policy and Procedures

SC-2 Separaon of System and User Funconality

(1) Interfaces for Non-privileged Users (2) Disassociability

SC-3 Security Funcon Isolaon

(1) Hardware Separaon (2) Access and Flow Control Funcons (3) Minimize Nonsecurity Funconality (4) Module Coupling and Cohesiveness (5) Layered Structures

SC-4 Informaon in Shared System Resources

(1) Security Levels (2) Mullevel or Periods Processing

SC-5 Denial-of-service Protecon

(1) Restrict Ability to Aack Other Systems (2) Capacity, Bandwidth, and Redundancy (3) Detecon and Monitoring

SC-6 Resource Availability

SC-7 Boundary Protecon

(1) Physically Separated Subnetworks (2) Public Access (3) Access Points (4) External Telecommunicaons Services (5) Deny by Default — Allow by Excepon (6) Response to Recognized Failures (7) Split Tunneling for Remote Devices (8) Route Traffic to Authencated Proxy Servers (9) Restrict Threatening Outgoing Communicaons Traffic (10) Prevent Exfiltraon (11) Restrict Incoming Communicaons Traffic (12) Host-based Protecon (13) Isolaon of Security Tools, Mechanisms, and Support Components (14) Protect Against Unauthorized Physical Connecons (15) Networked Privileged Accesses (16) Prevent Discovery of System Components (17) Automated Enforcement of Protocol Formats

(18) Fail Secure (19) Block Communicaon from Non-organizaonally Configured Hosts (20) Dynamic Isolaon and Segregaon (21) Isolaon of System Components (22) Separate Subnets for Connecng to Different Security Domains

(23) Disable Sender Feedback on Protocol Validaon Failure (24) Personally Idenfiable Informaon (25) Unclassified Naonal Security System Connecons (26) Classified Naonal Security System Connecons (27) Unclassified Non-naonal Security System Connecons (28) Connecons to Public Networks (29) Separate Subnets to Isolate Funcons

SC-8 Transmission Confidenality and Integrity

(1) Cryptographic Protecon (2) Pre- and Post-transmission Handling (3) Cryptographic Protecon for Message Externals (4) Conceal or Randomize Communicaons (5) Protected Distribuon System

SC-9 Transmission Confidenality

SC-10 Network Disconnect

This document is produced from OSCAL source data

PAGE xiii https://github.com/usnistgov/oscal-content/blob/master/nist.gov/SP800-53/rev5/xml/NIST_SP-800-53_rev5_catalog.xml

: hps://doi.org/10.6028/N

IST.SP.800-53r5

SC-11 Trusted Path

(1) Irrefutable Communicaons Path

SC-12 Cryptographic Key Establishment and Management

(1) Availability (2) Symmetric Keys (3) Asymmetric Keys (4) PKI Cerficates (5) PKI Cerficates Hardware Tokens (6) Physical Control of Keys

SC-13 Cryptographic Protecon

(1) Fips-validated Cryptography (2) Nsa-approved Cryptography (3) Individuals Without Formal Access Approvals (4) Digital Signatures

SC-14 Public Access Protecons

SC-15 Collaborave Compung Devices and Applicaons

(1) Physical or Logical Disconnect (2) Blocking Inbound and Outbound Communicaons Traffic (3) Disabling and Removal in Secure Work Areas (4) Explicitly Indicate Current Parcipants

SC-16 Transmission of Security and Privacy Aributes

(1) Integrity Verificaon (2) An-spoofing Mechanisms (3) Cryptographic Binding

SC-17 Public Key Infrastructure Cerficates

SC-18 Mobile Code

(1) Idenfy Unacceptable Code and Take Correcve Acons (2) Acquision, Development, and Use (3) Prevent Downloading and Execuon (4) Prevent Automac Execuon (5) Allow Execuon Only in Confined Environments

SC-19 Voice Over Internet Protocol

SC-20 Secure Name/Address Resoluon Service (Authoritave Source)

(1) Child Subspaces (2) Data Origin and Integrity

SC-21 Secure Name/Address Resoluon Service (Recursive or Caching Resolver)

(1) Data Origin and Integrity

SC-22 Architecture and Provisioning for Name/Address Resoluon Service

SC-23 Session Authencity

(1) Invalidate Session Idenfiers at Logout (2) User-iniated Logouts and Message Displays (3) Unique System-generated Session Idenfiers (4) Unique Session Idenfiers with Randomizaon (5) Allowed Cerficate Authories

SC-24 Fail in Known State

SC-25 Thin Nodes

SC-26 Decoys

(1) Detecon of Malicious Code

SC-27 Plaorm-independent Applicaons

SC-28 Protecon of Informaon at Rest

(1) Cryptographic Protecon (2) Offline Storage (3) Cryptographic Keys

SC-29 Heterogeneity

(1) Virtualizaon Techniques

SC-30 Concealment and Misdirecon

(1) Virtualizaon Techniques (2) Randomness (3) Change Processing and Storage Locaons (4) Misleading Informaon

(5) Concealment of System Components

SC-31 Covert Channel Analysis

(1) Test Covert Channels for Exploitability (2) Maximum Bandwidth (3) Measure Bandwidth in Operaonal Environments

This document is produced from OSCAL source data

PAGE xiv https://github.com/usnistgov/oscal-content/blob/master/nist.gov/SP800-53/rev5/xml/NIST_SP-800-53_rev5_catalog.xml

: hps://doi.org/10.6028/N

IST.SP.800-53r5

SC-32 System Paroning

(1) Separate Physical Domains for Privileged Funcons

SC-33 Transmission Preparaon Integrity

SC-34 Non-modifiable Executable Programs

(1) No Writable Storage (2) Integrity Protecon on Read-only Media (3) Hardware-based Protecon

SC-35 External Malicious Code Idenficaon

SC-36 Distributed Processing and Storage

(1) Polling Techniques (2) Synchronizaon

SC-37 Out-of-band Channels

(1) Ensure Delivery and Transmission

SC-38 Operaons Security

SC-39 Process Isolaon

(1) Hardware Separaon (2) Separate Execuon Domain Per Thread

SC-40 Wireless Link Protecon

(1) Electromagnec Interference (2) Reduce Detecon Potenal (3) Imitave or Manipulave Communicaons Decepon (4) Signal Parameter Idenficaon

SC-41 Port and I/O Device Access

SC-42 Sensor Capability and Data

(1) Reporng to Authorized Individuals or Roles (2) Authorized Use (3) Prohibit Use of Devices (4) Noce of Collecon

(5) Collecon Minimizaon

SC-43 Usage Restricons

SC-44 Detonaon Chambers

SC-45 System Time Synchronizaon

(1) Synchronizaon with Authoritave Time Source (2) Secondary Authoritave Time Source

SC-46 Cross Domain Policy Enforcement

SC-47 Alternate Communicaons Paths

SC-48 Sensor Relocaon

(1) Dynamic Relocaon of Sensors or Monitoring Capabilies

SC-49 Hardware-enforced Separaon and Policy Enforcement

SC-50 Soware-enforced Separaon and Policy Enforcement

SC-51 Hardware-based Protecon

Family: System and Informaon Integrity (SI)

SI-1 Policy and Procedures

SI-2 Flaw Remediaon

(1) Central Management (2) Automated Flaw Remediaon Status (3) Time to Remediate Flaws and Benchmarks for Correcve Acons (4) Automated Patch Management Tools (5) Automac Soware and Firmware Updates (6) Removal of Previous Versions of Soware and Firmware

SI-3 Malicious Code Protecon

(1) Central Management (2) Automac Updates (3) Non-privileged Users (4) Updates Only by Privileged Users (5) Portable Storage Devices (6) Tesng and Verificaon (7) Nonsignature-based Detecon (8) Detect Unauthorized Commands (9) Authencate Remote Commands (10) Malicious Code Analysis

This document is produced from OSCAL source data

PAGE xv https://github.com/usnistgov/oscal-content/blob/master/nist.gov/SP800-53/rev5/xml/NIST_SP-800-53_rev5_catalog.xml

: hps://doi.org/10.6028/N

IST.SP.800-53r5

SI-4 System Monitoring

(1) System-wide Intrusion Detecon System (2) Automated Tools and Mechanisms for Real-me Analysis (3) Automated Tool and Mechanism Integraon (4) Inbound and Outbound Communicaons Traffic (5) System-generated Alerts (6) Restrict Non-privileged Users (7) Automated Response to Suspicious Events (8) Protecon of Monitoring Informaon (9) Tesng of Monitoring Tools and Mechanisms (10) Visibility of Encrypted Communicaons (11) Analyze Communicaons Traffic Anomalies (12) Automated Organizaon-generated Alerts (13) Analyze Traffic and Event Paerns (14) Wireless Intrusion Detecon (15) Wireless to Wireline Communicaons (16) Correlate Monitoring Informaon (17) Integrated Situaonal Awareness (18) Analyze Traffic and Covert Exfiltraon (19) Risk for Individuals

(20) Privileged Users (21) Probaonary Periods (22) Unauthorized Network Services (23) Host-based Devices (24) Indicators of Compromise (25) Opmize Network Traffic Analysis

SI-5 Security Alerts, Advisories, and Direcves

(1) Automated Alerts and Advisories

SI-6 Security and Privacy Funcon Verificaon

(1) Noficaon of Failed Security Tests (2) Automaon Support for Distributed Tesng (3) Report Verificaon Results

SI-7 Soware, Firmware, and Informaon Integrity

(1) Integrity Checks (2) Automated Noficaons of Integrity Violaons (3) Centrally Managed Integrity Tools (4) Tamper-evident Packaging (5) Automated Response to Integrity Violaons (6) Cryptographic Protecon (7) Integraon of Detecon and Response (8) Auding Capability for Significant Events (9) Verify Boot Process (10) Protecon of Boot Firmware (11) Confined Environments with Limited Privileges (12) Integrity Verificaon (13) Code Execuon in Protected Environments (14) Binary or Machine Executable Code (15) Code Authencaon (16) Time Limit on Process Execuon Without Supervision (17) Runme Applicaon Self-protecon

SI-8 Spam Protecon

(1) Central Management (2) Automac Updates (3) Connuous Learning Capability

SI-9 Informaon Input Restricons

SI-10 Informaon Input Validaon

(1) Manual Override Capability (2) Review and Resolve Errors (3) Predictable Behavior (4) Timing Interacons (5) Restrict Inputs to Trusted Sources and Approved Formats (6) Injecon Prevenon

SI-11 Error Handling

SI-12 Informaon Management and Retenon

(1) Limit Personally Idenfiable Informaon Elements (2) Minimize Personally Idenfiable Informaon in Tesng, Training, and Research (3) Informaon Disposal

SI-13 Predictable Failure Prevenon

(1) Transferring Component Responsibilies (2) Time Limit on Process Execuon Without Supervision (3) Manual Transfer Between Components (4) Standby Component Installaon and Noficaon (5) Failover Capability

SI-14 Non-persistence

(1) Refresh from Trusted Sources (2) Non-persistent Informaon (3) Non-persistent Connecvity

SI-15 Informaon Output Filtering

SI-16 Memory Protecon

SI-17 Fail-safe Procedures

SI-18 Personally Idenfiable Informaon Quality Operaons

(1) Automaon Support (2) Data Tags (3) Collecon (4) Individual Requests (5) Noce of Correcon or Deleon

SI-19 De-idenficaon

(1) Collecon (2) Archiving (3) Release (4) Removal, Masking, Encrypon, Hashing, or Replacement of Direct Idenfiers

(5) Stascal Disclosure Control (6) Differenal Privacy (7) Validated Algorithms and Soware (8) Movated Intruder

SI-20 Tainng

This document is produced from OSCAL source data

PAGE xvi https://github.com/usnistgov/oscal-content/blob/master/nist.gov/SP800-53/rev5/xml/NIST_SP-800-53_rev5_catalog.xml

: hps://doi.org/10.6028/N

IST.SP.800-53r5

SI-21 Informaon Refresh

SI-22 Informaon Diversity

SI-23 Informaon Fragmentaon

Family: Supply Chain Risk Management (SR)

SR-1 Policy and Procedures

SR-2 Supply Chain Risk Management Plan

(1) Establish Scrm Team

SR-3 Supply Chain Controls and Processes

(1) Diverse Supply Base (2) Limitaon of Harm (3) Sub-er Flow Down

SR-4 Provenance

(1) Identy (2) Track and Trace (3) Validate as Genuine and Not Altered (4) Supply Chain Integrity — Pedigree

SR-5 Acquision Strategies, Tools, and Methods

(1) Adequate Supply (2) Assessments Prior to Selecon, Acceptance, Modificaon, or Update

SR-6 Supplier Assessments and Reviews

(1) Tesng and Analysis

SR-7 Supply Chain Operaons Security

SR-8 Noficaon Agreements

SR-9 Tamper Resistance and Detecon

(1) Mulple Stages of System Development Life Cycle

SR-10 Inspecon of Systems or Components

SR-11 Component Authencity

(1) An-counterfeit Training (2) Configuraon Control for Component Service and Repair (3) An-counterfeit Scanning

SR-12 Component Disposal

References

This document is produced from OSCAL source data

PAGE xvii https://github.com/usnistgov/oscal-content/blob/master/nist.gov/SP800-53/rev5/xml/NIST_SP-800-53_rev5_catalog.xml

: hps://doi.org/10.6028/N

IST.SP.800-53r5

FAMILY: ACCESS CONTROL

AC-1 POLICY AND PROCEDURES

Control:

a. Develop, document, and disseminate to [Assignment: organizaon-defined personnel or roles]:

1. [Selecon (one or more): Organizaon-level; Mission/business process-level; System-level] access control policy that:

(a) Addresses purpose, scope, roles, responsibilies, management commitment, coordinaon among organizaonal enes, and compliance; and

(b) Is consistent with applicable laws, execuve orders, direcves, regulaons, policies, standards, and guidelines; and

2. Procedures to facilitate the implementaon of the access control policy and the associated access controls;

b. Designate an [Assignment: organizaon-defined official] to manage the development, documentaon, and disseminaon of the access control policy and procedures; and

c. Review and update the current access control:

1. Policy [Assignment: organizaon-defined frequency] and following [Assignment:

organizaon-defined events]; and

2. Procedures [Assignment: organizaon-defined frequency] and following [Assignment:

organizaon-defined events].

Discussion: Access control policy and procedures address the controls in the AC family that are implemented within systems and organizaons. The risk management strategy is an important factor in establishing such policies and procedures. Policies and procedures contribute to security and privacy assurance. Therefore, it is important that security and privacy programs collaborate on the development of access control policy and procedures. Security and privacy program policies and procedures at the organizaon level are preferable, in general, and may obviate the need for mission- or system-specific policies and procedures. The policy can be included as part of the general security and privacy policy or be represented by mulple policies reflecng the complex nature of organizaons. Procedures can be established for security and privacy programs, for mission or business processes, and for systems, if needed. Procedures describe how the policies or controls are implemented and can be directed at the individual or role that is the object of the procedure.

Procedures can be documented in system security and privacy plans or in one or more separate documents. Events that may precipitate an update to access control policy and procedures include assessment or audit findings, security incidents or breaches, or changes in laws, execuve orders, direcves, regulaons, policies, standards, and guidelines. Simply restang controls does not constute an organizaonal policy or procedure.

Related controls: IA-1, PM-9, PM-24, PS-8, SI-12.

References: [IR 7874], [OMB A-130], [SP 800-100], [SP 800-12], [SP 800-30], [SP 800-39]

AC-2 ACCOUNT MANAGEMENT

Control:

a. Define and document the types of accounts allowed and specifically prohibited for use within the system;

b. Assign account managers;

This document is produced from OSCAL source data

FAMILY: AC PAGE 1

https://doi.org/10.6028/NIST.SP.800-53r5 https://doi.org/10.6028/NIST.IR.7874 https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/circulars/A130/a130revised.pdf https://doi.org/10.6028/NIST.SP.800-100 https://doi.org/10.6028/NIST.SP.800-12r1 https://doi.org/10.6028/NIST.SP.800-30r1 https://doi.org/10.6028/NIST.SP.800-39 https://github.com/usnistgov/oscal-content/blob/master/nist.gov/SP800-53/rev5/xml/NIST_SP-800-53_rev5_catalog.xml

: hps://doi.org/10.6028/N

IST.SP.800-53r5

c. Require [Assignment: organizaon-defined prerequisites and criteria] for group and role membership;

d. Specify:

1. Authorized users of the system;

2. Group and role membership; and

3. Access authorizaons (i.e., privileges) and [Assignment: organizaon-defined aributes (as required)] for each account;

e. Require approvals by [Assignment: organizaon-defined personnel or roles] for requests to create accounts;

f. Create, enable, modify, disable, and remove accounts in accordance with [Assignment:

organizaon-defined policy, procedures, prerequisites, and criteria];

g. Monitor the use of accounts;

h. Nofy account managers and [Assignment: organizaon-defined personnel or roles] within:

1. [Assignment: organizaon-defined me period] when accounts are no longer required;

2. [Assignment: organizaon-defined me period] when users are terminated or transferred;

and

3. [Assignment: organizaon-defined me period] when system usage or need-to-know changes for an individual;

i. Authorize access to the system based on:

1. A valid access authorizaon;

2. Intended system usage; and

3. [Assignment: organizaon-defined aributes (as required)];

j. Review accounts for compliance with account management requirements [Assignment:

organizaon-defined frequency];

k. Establish and implement a process for changing shared or group account authencators (if deployed) when individuals are removed from the group; and

l. Align account management processes with personnel terminaon and transfer processes.

Discussion: Examples of system account types include individual, shared, group, system, guest, anonymous, emergency, developer, temporary, and service.