Attachment C Requirements Traceability Matrix.xlsx

Test Result Import

The organization:

a. Develops, documents, and disseminates to [Assignment: organization-defined personnel or roles]:

b. Reviews and updates the current:

Supplemental Guidance:

This control addresses the establishment of policy and procedures for the effective implementation of selected security controls and control enhancements in the AC family. Policy and procedures reflect applicable federal laws, Executive Orders, directives, regulations, policies, standards, and guidance. Security program policies and procedures at the organization level may make the need for system-specific policies and procedures unnecessary. The policy can be included as part of the general information security policy for organizations or conversely, can be represented by multiple policies reflecting the complex nature of certain organizations. The procedures can be established for the security program in general and for particular information systems, if needed. The organizational risk management strategy is a key factor in establishing policy and procedures. Related control: PM-9.

Added by Privacy (Confidentiality Impact Level: Moderate) Overlay: Privacy requirements commonly use the terms "adequate security" and "confidentiality" when referring to access controls and other security safeguards for PII. Applied together, these terms signify the need to make risk-based decisions based on the magnitude of harm (to both organizations and individuals) when determining applicable restrictions for PII. For the purpose of this overlay, refer to the definitions of "adequate security" in OMB Circular A-130, Appendix III, and "confidentiality" in NIST SP 800-37, Rev. 1, Appendix B. These definitions are consistent with CNSSI No. 4009. Related Controls: AR-4; AR-7.

Potential Assessment Methods and Objectives:

The below information from the NIST SP 800-53 Revision 4 Security Catalog is intended to provide additional optional mechanisms to take into account when reviewing this Security Control. Assessments of the individual security requirements must still include a response to the specific procedures/guidance stated in the correlated Assessment Procedures.

Examine: [SELECT FROM: Access control policy and procedures; other relevant documents or records].

Interview: [SELECT FROM: Organizational personnel with access control responsibilities; organizational personnel with information security responsibilities].

Justification to Select:

Added by Privacy (Confidentiality Impact Level: Moderate) Overlay: Access Control policies and procedures form the foundation that allows privacy protections to be implemented for the identified uses of PII and PHI.

Regulatory Statutory Reference:

Added by Privacy (Confidentiality Impact Level: Moderate) Overlay: 5 U.S.C. Section: 552a(b), (e)(9)-(10); OMB M-07-16, Att. 4; OMB Circular A-130, 7.g. and Appendix III; OMB M-06-16; NIST SP 800-37, Rev. 1, Appendix B; NIST SP 800-122 Implemented Hybrid USCG security policy and procedures, as defined in the USCG Cyber Security Manual (COMDTINST M5500.13), further refine the DHS policies and procedures in the context of the USCG mission. The USCG sponsor, CG-65, is responsible for developing, disseminating, and updating the content of the manual. IAW [45 CFR 164.502(b), 164.514(d)] and the Privacy Overlay (CNSS 1253F, Attachment 6) the OSC implements the minimum necessary rule, ensuring that protected health information (PHI) should not be used or disclosed when it is not necessary to satisfy a particular purpose or carry out a function. The minimum necessary rule is implemented to limit unnecessary or inappropriate access and disclosure of PHI. The OSC Command requires all information systems to document procedures for the implementation of the access control policy in a Consolidated System Design Document (CSDD) and corresponding Application (APP) Standard Operating Procedures (SOP) and Database Administrator (DBA) Standard Operating Procedures (SOP) documents. The Information System is required to review and update the procedural documents (CSDD, APP SOP and DBA SOP) at the following times: throughout the Software Development Life Cycle (SDLC) (which is driven by changes to the risk or capabilities); during the Annual Security Assessment; when the organizational governance policy changes; and during Security Authorization utilizing the OSC Configuration Management process. The system ALM and Business System Manager are required to review policy and procedure documents at least annually. AC-1.1 002107 The organization defines the personnel or roles to be recipients of the access control policy necessary to facilitate the implementation of the access control policy and associated access controls. DoD has defined the personnel or roles as all personnel.

Recommended Compelling Evidence:

The organization:

a. Develops, documents, and disseminates to [Assignment: organization-defined personnel or roles]:

b. Reviews and updates the current:

Supplemental Guidance:

This control addresses the establishment of policy and procedures for the effective implementation of selected security controls and control enhancements in the AC family. Policy and procedures reflect applicable federal laws, Executive Orders, directives, regulations, policies, standards, and guidance. Security program policies and procedures at the organization level may make the need for system-specific policies and procedures unnecessary. The policy can be included as part of the general information security policy for organizations or conversely, can be represented by multiple policies reflecting the complex nature of certain organizations. The procedures can be established for the security program in general and for particular information systems, if needed. The organizational risk management strategy is a key factor in establishing policy and procedures. Related control: PM-9.

Added by Privacy (Confidentiality Impact Level: Moderate) Overlay: Privacy requirements commonly use the terms "adequate security" and "confidentiality" when referring to access controls and other security safeguards for PII. Applied together, these terms signify the need to make risk-based decisions based on the magnitude of harm (to both organizations and individuals) when determining applicable restrictions for PII. For the purpose of this overlay, refer to the definitions of "adequate security" in OMB Circular A-130, Appendix III, and "confidentiality" in NIST SP 800-37, Rev. 1, Appendix B. These definitions are consistent with CNSSI No. 4009. Related Controls: AR-4; AR-7.

Potential Assessment Methods and Objectives:

The below information from the NIST SP 800-53 Revision 4 Security Catalog is intended to provide additional optional mechanisms to take into account when reviewing this Security Control. Assessments of the individual security requirements must still include a response to the specific procedures/guidance stated in the correlated Assessment Procedures.

Examine: [SELECT FROM: Access control policy and procedures; other relevant documents or records].

Interview: [SELECT FROM: Organizational personnel with access control responsibilities; organizational personnel with information security responsibilities].

Justification to Select:

Added by Privacy (Confidentiality Impact Level: Moderate) Overlay: Access Control policies and procedures form the foundation that allows privacy protections to be implemented for the identified uses of PII and PHI.

Regulatory Statutory Reference:

Added by Privacy (Confidentiality Impact Level: Moderate) Overlay: 5 U.S.C. Section: 552a(b), (e)(9)-(10); OMB M-07-16, Att. 4; OMB Circular A-130, 7.g. and Appendix III; OMB M-06-16; NIST SP 800-37, Rev. 1, Appendix B; NIST SP 800-122 Implemented Hybrid USCG security policy and procedures, as defined in the USCG Cyber Security Manual (COMDTINST M5500.13), further refine the DHS policies and procedures in the context of the USCG mission. The USCG sponsor, CG-65, is responsible for developing, disseminating, and updating the content of the manual. IAW [45 CFR 164.502(b), 164.514(d)] and the Privacy Overlay (CNSS 1253F, Attachment 6) the OSC implements the minimum necessary rule, ensuring that protected health information (PHI) should not be used or disclosed when it is not necessary to satisfy a particular purpose or carry out a function. The minimum necessary rule is implemented to limit unnecessary or inappropriate access and disclosure of PHI. The OSC Command requires all information systems to document procedures for the implementation of the access control policy in a Consolidated System Design Document (CSDD) and corresponding Application (APP) Standard Operating Procedures (SOP) and Database Administrator (DBA) Standard Operating Procedures (SOP) documents. The Information System is required to review and update the procedural documents (CSDD, APP SOP and DBA SOP) at the following times: throughout the Software Development Life Cycle (SDLC) (which is driven by changes to the risk or capabilities); during the Annual Security Assessment; when the organizational governance policy changes; and during Security Authorization utilizing the OSC Configuration Management process. The system ALM and Business System Manager are required to review policy and procedure documents at least annually. AC-1.2 002108 The organization defines the personnel or roles to be recipients of the procedures necessary to facilitate the implementation of the access control policy and associated access controls. DoD has defined the personnel or roles as all personnel.

Recommended Compelling Evidence:

The organization:

a. Develops, documents, and disseminates to [Assignment: organization-defined personnel or roles]:

b. Reviews and updates the current:

Supplemental Guidance:

This control addresses the establishment of policy and procedures for the effective implementation of selected security controls and control enhancements in the AC family. Policy and procedures reflect applicable federal laws, Executive Orders, directives, regulations, policies, standards, and guidance. Security program policies and procedures at the organization level may make the need for system-specific policies and procedures unnecessary. The policy can be included as part of the general information security policy for organizations or conversely, can be represented by multiple policies reflecting the complex nature of certain organizations. The procedures can be established for the security program in general and for particular information systems, if needed. The organizational risk management strategy is a key factor in establishing policy and procedures. Related control: PM-9.

Added by Privacy (Confidentiality Impact Level: Moderate) Overlay: Privacy requirements commonly use the terms "adequate security" and "confidentiality" when referring to access controls and other security safeguards for PII. Applied together, these terms signify the need to make risk-based decisions based on the magnitude of harm (to both organizations and individuals) when determining applicable restrictions for PII. For the purpose of this overlay, refer to the definitions of "adequate security" in OMB Circular A-130, Appendix III, and "confidentiality" in NIST SP 800-37, Rev. 1, Appendix B. These definitions are consistent with CNSSI No. 4009. Related Controls: AR-4; AR-7.

Potential Assessment Methods and Objectives:

The below information from the NIST SP 800-53 Revision 4 Security Catalog is intended to provide additional optional mechanisms to take into account when reviewing this Security Control. Assessments of the individual security requirements must still include a response to the specific procedures/guidance stated in the correlated Assessment Procedures.

Examine: [SELECT FROM: Access control policy and procedures; other relevant documents or records].

Interview: [SELECT FROM: Organizational personnel with access control responsibilities; organizational personnel with information security responsibilities].

Justification to Select:

Added by Privacy (Confidentiality Impact Level: Moderate) Overlay: Access Control policies and procedures form the foundation that allows privacy protections to be implemented for the identified uses of PII and PHI.

Regulatory Statutory Reference:

Added by Privacy (Confidentiality Impact Level: Moderate) Overlay: 5 U.S.C. Section: 552a(b), (e)(9)-(10); OMB M-07-16, Att. 4; OMB Circular A-130, 7.g. and Appendix III; OMB M-06-16; NIST SP 800-37, Rev. 1, Appendix B; NIST SP 800-122 Implemented Hybrid USCG security policy and procedures, as defined in the USCG Cyber Security Manual (COMDTINST M5500.13), further refine the DHS policies and procedures in the context of the USCG mission. The USCG sponsor, CG-65, is responsible for developing, disseminating, and updating the content of the manual. IAW [45 CFR 164.502(b), 164.514(d)] and the Privacy Overlay (CNSS 1253F, Attachment 6) the OSC implements the minimum necessary rule, ensuring that protected health information (PHI) should not be used or disclosed when it is not necessary to satisfy a particular purpose or carry out a function. The minimum necessary rule is implemented to limit unnecessary or inappropriate access and disclosure of PHI. The OSC Command requires all information systems to document procedures for the implementation of the access control policy in a Consolidated System Design Document (CSDD) and corresponding Application (APP) Standard Operating Procedures (SOP) and Database Administrator (DBA) Standard Operating Procedures (SOP) documents. The Information System is required to review and update the procedural documents (CSDD, APP SOP and DBA SOP) at the following times: throughout the Software Development Life Cycle (SDLC) (which is driven by changes to the risk or capabilities); during the Annual Security Assessment; when the organizational governance policy changes; and during Security Authorization utilizing the OSC Configuration Management process. The system ALM and Business System Manager are required to review policy and procedure documents at least annually. AC-1.3 000001 The organization develops and documents an access control policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance. The organization being inspected/assessed develops and documents an access control policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.

Recommended Compelling Evidence:

The organization:

a. Develops, documents, and disseminates to [Assignment: organization-defined personnel or roles]:

b. Reviews and updates the current:

Supplemental Guidance:

This control addresses the establishment of policy and procedures for the effective implementation of selected security controls and control enhancements in the AC family. Policy and procedures reflect applicable federal laws, Executive Orders, directives, regulations, policies, standards, and guidance. Security program policies and procedures at the organization level may make the need for system-specific policies and procedures unnecessary. The policy can be included as part of the general information security policy for organizations or conversely, can be represented by multiple policies reflecting the complex nature of certain organizations. The procedures can be established for the security program in general and for particular information systems, if needed. The organizational risk management strategy is a key factor in establishing policy and procedures. Related control: PM-9.

Added by Privacy (Confidentiality Impact Level: Moderate) Overlay: Privacy requirements commonly use the terms "adequate security" and "confidentiality" when referring to access controls and other security safeguards for PII. Applied together, these terms signify the need to make risk-based decisions based on the magnitude of harm (to both organizations and individuals) when determining applicable restrictions for PII. For the purpose of this overlay, refer to the definitions of "adequate security" in OMB Circular A-130, Appendix III, and "confidentiality" in NIST SP 800-37, Rev. 1, Appendix B. These definitions are consistent with CNSSI No. 4009. Related Controls: AR-4; AR-7.

Potential Assessment Methods and Objectives:

The below information from the NIST SP 800-53 Revision 4 Security Catalog is intended to provide additional optional mechanisms to take into account when reviewing this Security Control. Assessments of the individual security requirements must still include a response to the specific procedures/guidance stated in the correlated Assessment Procedures.

Examine: [SELECT FROM: Access control policy and procedures; other relevant documents or records].

Interview: [SELECT FROM: Organizational personnel with access control responsibilities; organizational personnel with information security responsibilities].

Justification to Select:

Added by Privacy (Confidentiality Impact Level: Moderate) Overlay: Access Control policies and procedures form the foundation that allows privacy protections to be implemented for the identified uses of PII and PHI.

Regulatory Statutory Reference:

Added by Privacy (Confidentiality Impact Level: Moderate) Overlay: 5 U.S.C. Section: 552a(b), (e)(9)-(10); OMB M-07-16, Att. 4; OMB Circular A-130, 7.g. and Appendix III; OMB M-06-16; NIST SP 800-37, Rev. 1, Appendix B; NIST SP 800-122 Implemented Hybrid USCG security policy and procedures, as defined in the USCG Cyber Security Manual (COMDTINST M5500.13), further refine the DHS policies and procedures in the context of the USCG mission. The USCG sponsor, CG-65, is responsible for developing, disseminating, and updating the content of the manual. IAW [45 CFR 164.502(b), 164.514(d)] and the Privacy Overlay (CNSS 1253F, Attachment 6) the OSC implements the minimum necessary rule, ensuring that protected health information (PHI) should not be used or disclosed when it is not necessary to satisfy a particular purpose or carry out a function. The minimum necessary rule is implemented to limit unnecessary or inappropriate access and disclosure of PHI. The OSC Command requires all information systems to document procedures for the implementation of the access control policy in a Consolidated System Design Document (CSDD) and corresponding Application (APP) Standard Operating Procedures (SOP) and Database Administrator (DBA) Standard Operating Procedures (SOP) documents. The Information System is required to review and update the procedural documents (CSDD, APP SOP and DBA SOP) at the following times: throughout the Software Development Life Cycle (SDLC) (which is driven by changes to the risk or capabilities); during the Annual Security Assessment; when the organizational governance policy changes; and during Security Authorization utilizing the OSC Configuration Management process. The system ALM and Business System Manager are required to review policy and procedure documents at least annually. AC-1.4 000002 The organization disseminates the access control policy to organization-defined personnel or roles. The organization being inspected/assessed disseminates via an information sharing capability to all personnel. DoD has defined the personnel or roles as all personnel.

Recommended Compelling Evidence:

1.) Signed and dated copy of access control policy.

The organization:

a. Develops, documents, and disseminates to [Assignment: organization-defined personnel or roles]:

b. Reviews and updates the current:

Supplemental Guidance:

This control addresses the establishment of policy and procedures for the effective implementation of selected security controls and control enhancements in the AC family. Policy and procedures reflect applicable federal laws, Executive Orders, directives, regulations, policies, standards, and guidance. Security program policies and procedures at the organization level may make the need for system-specific policies and procedures unnecessary. The policy can be included as part of the general information security policy for organizations or conversely, can be represented by multiple policies reflecting the complex nature of certain organizations. The procedures can be established for the security program in general and for particular information systems, if needed. The organizational risk management strategy is a key factor in establishing policy and procedures. Related control: PM-9.

Added by Privacy (Confidentiality Impact Level: Moderate) Overlay: Privacy requirements commonly use the terms "adequate security" and "confidentiality" when referring to access controls and other security safeguards for PII. Applied together, these terms signify the need to make risk-based decisions based on the magnitude of harm (to both organizations and individuals) when determining applicable restrictions for PII. For the purpose of this overlay, refer to the definitions of "adequate security" in OMB Circular A-130, Appendix III, and "confidentiality" in NIST SP 800-37, Rev. 1, Appendix B. These definitions are consistent with CNSSI No. 4009. Related Controls: AR-4; AR-7.

Potential Assessment Methods and Objectives:

The below information from the NIST SP 800-53 Revision 4 Security Catalog is intended to provide additional optional mechanisms to take into account when reviewing this Security Control. Assessments of the individual security requirements must still include a response to the specific procedures/guidance stated in the correlated Assessment Procedures.

Examine: [SELECT FROM: Access control policy and procedures; other relevant documents or records].

Interview: [SELECT FROM: Organizational personnel with access control responsibilities; organizational personnel with information security responsibilities].

Justification to Select:

Added by Privacy (Confidentiality Impact Level: Moderate) Overlay: Access Control policies and procedures form the foundation that allows privacy protections to be implemented for the identified uses of PII and PHI.

Regulatory Statutory Reference:

Added by Privacy (Confidentiality Impact Level: Moderate) Overlay: 5 U.S.C. Section: 552a(b), (e)(9)-(10); OMB M-07-16, Att. 4; OMB Circular A-130, 7.g. and Appendix III; OMB M-06-16; NIST SP 800-37, Rev. 1, Appendix B; NIST SP 800-122 Implemented Hybrid USCG security policy and procedures, as defined in the USCG Cyber Security Manual (COMDTINST M5500.13), further refine the DHS policies and procedures in the context of the USCG mission. The USCG sponsor, CG-65, is responsible for developing, disseminating, and updating the content of the manual. IAW [45 CFR 164.502(b), 164.514(d)] and the Privacy Overlay (CNSS 1253F, Attachment 6) the OSC implements the minimum necessary rule, ensuring that protected health information (PHI) should not be used or disclosed when it is not necessary to satisfy a particular purpose or carry out a function. The minimum necessary rule is implemented to limit unnecessary or inappropriate access and disclosure of PHI. The OSC Command requires all information systems to document procedures for the implementation of the access control policy in a Consolidated System Design Document (CSDD) and corresponding Application (APP) Standard Operating Procedures (SOP) and Database Administrator (DBA) Standard Operating Procedures (SOP) documents. The Information System is required to review and update the procedural documents (CSDD, APP SOP and DBA SOP) at the following times: throughout the Software Development Life Cycle (SDLC) (which is driven by changes to the risk or capabilities); during the Annual Security Assessment; when the organizational governance policy changes; and during Security Authorization utilizing the OSC Configuration Management process. The system ALM and Business System Manager are required to review policy and procedure documents at least annually. AC-1.5 000004 The organization develops and documents procedures to facilitate the implementation of the access control policy and associated access controls. The organization being inspected/assessed develops and documents procedures to facilitate the implementation of the access control policy and associated access controls.

Recommended Compelling Evidence:

1.) Signed and dated documentation that defines the procedures that implement the access control policy.

The organization:

a. Develops, documents, and disseminates to [Assignment: organization-defined personnel or roles]:

b. Reviews and updates the current:

Supplemental Guidance:

This control addresses the establishment of policy and procedures for the effective implementation of selected security controls and control enhancements in the AC family. Policy and procedures reflect applicable federal laws, Executive Orders, directives, regulations, policies, standards, and guidance. Security program policies and procedures at the organization level may make the need for system-specific policies and procedures unnecessary. The policy can be included as part of the general information security policy for organizations or conversely, can be represented by multiple policies reflecting the complex nature of certain organizations. The procedures can be established for the security program in general and for particular information systems, if needed. The organizational risk management strategy is a key factor in establishing policy and procedures. Related control: PM-9.

Added by Privacy (Confidentiality Impact Level: Moderate) Overlay: Privacy requirements commonly use the terms "adequate security" and "confidentiality" when referring to access controls and other security safeguards for PII. Applied together, these terms signify the need to make risk-based decisions based on the magnitude of harm (to both organizations and individuals) when determining applicable restrictions for PII. For the purpose of this overlay, refer to the definitions of "adequate security" in OMB Circular A-130, Appendix III, and "confidentiality" in NIST SP 800-37, Rev. 1, Appendix B. These definitions are consistent with CNSSI No. 4009. Related Controls: AR-4; AR-7.

Potential Assessment Methods and Objectives:

The below information from the NIST SP 800-53 Revision 4 Security Catalog is intended to provide additional optional mechanisms to take into account when reviewing this Security Control. Assessments of the individual security requirements must still include a response to the specific procedures/guidance stated in the correlated Assessment Procedures.

Examine: [SELECT FROM: Access control policy and procedures; other relevant documents or records].

Interview: [SELECT FROM: Organizational personnel with access control responsibilities; organizational personnel with information security responsibilities].

Justification to Select:

Added by Privacy (Confidentiality Impact Level: Moderate) Overlay: Access Control policies and procedures form the foundation that allows privacy protections to be implemented for the identified uses of PII and PHI.

Regulatory Statutory Reference:

Added by Privacy (Confidentiality Impact Level: Moderate) Overlay: 5 U.S.C. Section: 552a(b), (e)(9)-(10); OMB M-07-16, Att. 4; OMB Circular A-130, 7.g. and Appendix III; OMB M-06-16; NIST SP 800-37, Rev. 1, Appendix B; NIST SP 800-122 Implemented Hybrid USCG security policy and procedures, as defined in the USCG Cyber Security Manual (COMDTINST M5500.13), further refine the DHS policies and procedures in the context of the USCG mission. The USCG sponsor, CG-65, is responsible for developing, disseminating, and updating the content of the manual. IAW [45 CFR 164.502(b), 164.514(d)] and the Privacy Overlay (CNSS 1253F, Attachment 6) the OSC implements the minimum necessary rule, ensuring that protected health information (PHI) should not be used or disclosed when it is not necessary to satisfy a particular purpose or carry out a function. The minimum necessary rule is implemented to limit unnecessary or inappropriate access and disclosure of PHI. The OSC Command requires all information systems to document procedures for the implementation of the access control policy in a Consolidated System Design Document (CSDD) and corresponding Application (APP) Standard Operating Procedures (SOP) and Database Administrator (DBA) Standard Operating Procedures (SOP) documents. The Information System is required to review and update the procedural documents (CSDD, APP SOP and DBA SOP) at the following times: throughout the Software Development Life Cycle (SDLC) (which is driven by changes to the risk or capabilities); during the Annual Security Assessment; when the organizational governance policy changes; and during Security Authorization utilizing the OSC Configuration Management process. The system ALM and Business System Manager are required to review policy and procedure documents at least annually. AC-1.6 000005 The organization disseminates the procedures to facilitate access control policy and associated access controls to the organization-defined personnel or roles . The organization being inspected/assessed disseminates via an information sharing capability to all personnel the procedures to facilitate access control policy and associated access controls. DoD has defined the personnel or roles as all personnel.

Recommended Compelling Evidence:

1.) Signed and dated access control policy.

2.) Signed and dated documentation that defines the procedures to disseminate the access control policy.

The organization:

a. Develops, documents, and disseminates to [Assignment: organization-defined personnel or roles]:

b. Reviews and updates the current:

Supplemental Guidance:

This control addresses the establishment of policy and procedures for the effective implementation of selected security controls and control enhancements in the AC family. Policy and procedures reflect applicable federal laws, Executive Orders, directives, regulations, policies, standards, and guidance. Security program policies and procedures at the organization level may make the need for system-specific policies and procedures unnecessary. The policy can be included as part of the general information security policy for organizations or conversely, can be represented by multiple policies reflecting the complex nature of certain organizations. The procedures can be established for the security program in general and for particular information systems, if needed. The organizational risk management strategy is a key factor in establishing policy and procedures. Related control: PM-9.

Added by Privacy (Confidentiality Impact Level: Moderate) Overlay: Privacy requirements commonly use the terms "adequate security" and "confidentiality" when referring to access controls and other security safeguards for PII. Applied together, these terms signify the need to make risk-based decisions based on the magnitude of harm (to both organizations and individuals) when determining applicable restrictions for PII. For the purpose of this overlay, refer to the definitions of "adequate security" in OMB Circular A-130, Appendix III, and "confidentiality" in NIST SP 800-37, Rev. 1, Appendix B. These definitions are consistent with CNSSI No. 4009. Related Controls: AR-4; AR-7.

Potential Assessment Methods and Objectives:

The below information from the NIST SP 800-53 Revision 4 Security Catalog is intended to provide additional optional mechanisms to take into account when reviewing this Security Control. Assessments of the individual security requirements must still include a response to the specific procedures/guidance stated in the correlated Assessment Procedures.

Examine: [SELECT FROM: Access control policy and procedures; other relevant documents or records].

Interview: [SELECT FROM: Organizational personnel with access control responsibilities; organizational personnel with information security responsibilities].

Justification to Select:

Added by Privacy (Confidentiality Impact Level: Moderate) Overlay: Access Control policies and procedures form the foundation that allows privacy protections to be implemented for the identified uses of PII and PHI.

Regulatory Statutory Reference:

Added by Privacy (Confidentiality Impact Level: Moderate) Overlay: 5 U.S.C. Section: 552a(b), (e)(9)-(10); OMB M-07-16, Att. 4; OMB Circular A-130, 7.g. and Appendix III; OMB M-06-16; NIST SP 800-37, Rev. 1, Appendix B; NIST SP 800-122 Implemented Hybrid USCG security policy and procedures, as defined in the USCG Cyber Security Manual (COMDTINST M5500.13), further refine the DHS policies and procedures in the context of the USCG mission. The USCG sponsor, CG-65, is responsible for developing, disseminating, and updating the content of the manual. IAW [45 CFR 164.502(b), 164.514(d)] and the Privacy Overlay (CNSS 1253F, Attachment 6) the OSC implements the minimum necessary rule, ensuring that protected health information (PHI) should not be used or disclosed when it is not necessary to satisfy a particular purpose or carry out a function. The minimum necessary rule is implemented to limit unnecessary or inappropriate access and disclosure of PHI. The OSC Command requires all information systems to document procedures for the implementation of the access control policy in a Consolidated System Design Document (CSDD) and corresponding Application (APP) Standard Operating Procedures (SOP) and Database Administrator (DBA) Standard Operating Procedures (SOP) documents. The Information System is required to review and update the procedural documents (CSDD, APP SOP and DBA SOP) at the following times: throughout the Software Development Life Cycle (SDLC) (which is driven by changes to the risk or capabilities); during the Annual Security Assessment; when the organizational governance policy changes; and during Security Authorization utilizing the OSC Configuration Management process. The system ALM and Business System Manager are required to review policy and procedure documents at least annually. AC-1.7 000003 The organization reviews and updates the access control policy in accordance with organization-defined frequency. The organization being inspected/assessed annually reviews and updates the access control policy. The organization must maintain review and update activity as an audit trail. DoD has defined the frequency as annually.

Recommended Compelling Evidence:

1.) Signed and dated access control policy.

2.) Documentation/policy that dictates review of documentations/policies at least annually.

The organization:

a. Develops, documents, and disseminates to [Assignment: organization-defined personnel or roles]:

b. Reviews and updates the current:

Supplemental Guidance:

This control addresses the establishment of policy and procedures for the effective implementation of selected security controls and control enhancements in the AC family. Policy and procedures reflect applicable federal laws, Executive Orders, directives, regulations, policies, standards, and guidance. Security program policies and procedures at the organization level may make the need for system-specific policies and procedures unnecessary. The policy can be included as part of the general information security policy for organizations or conversely, can be represented by multiple policies reflecting the complex nature of certain organizations. The procedures can be established for the security program in general and for particular information systems, if needed. The organizational risk management strategy is a key factor in establishing policy and procedures. Related control: PM-9.

Added by Privacy (Confidentiality Impact Level: Moderate) Overlay: Privacy requirements commonly use the terms "adequate security" and "confidentiality" when referring to access controls and other security safeguards for PII. Applied together, these terms signify the need to make risk-based decisions based on the magnitude of harm (to both organizations and individuals) when determining applicable restrictions for PII. For the purpose of this overlay, refer to the definitions of "adequate security" in OMB Circular A-130, Appendix III, and "confidentiality" in NIST SP 800-37, Rev. 1, Appendix B. These definitions are consistent with CNSSI No. 4009. Related Controls: AR-4; AR-7.

Potential Assessment Methods and Objectives:

The below information from the NIST SP 800-53 Revision 4 Security Catalog is intended to provide additional optional mechanisms to take into account when reviewing this Security Control. Assessments of the individual security requirements must still include a response to the specific procedures/guidance stated in the correlated Assessment Procedures.

Examine: [SELECT FROM: Access control policy and procedures; other relevant documents or records].

Interview: [SELECT FROM: Organizational personnel with access control responsibilities; organizational personnel with information security responsibilities].

Justification to Select:

Added by Privacy (Confidentiality Impact Level: Moderate) Overlay: Access Control policies and procedures form the foundation that allows privacy protections to be implemented for the identified uses of PII and PHI.

Regulatory Statutory Reference:

Added by Privacy (Confidentiality Impact Level: Moderate) Overlay: 5 U.S.C. Section: 552a(b), (e)(9)-(10); OMB M-07-16, Att. 4; OMB Circular A-130, 7.g. and Appendix III; OMB M-06-16; NIST SP 800-37, Rev. 1, Appendix B; NIST SP 800-122 Implemented Hybrid USCG security policy and procedures, as defined in the USCG Cyber Security Manual (COMDTINST M5500.13), further refine the DHS policies and procedures in the context of the USCG mission. The USCG sponsor, CG-65, is responsible for developing, disseminating, and updating the content of the manual. IAW [45 CFR 164.502(b), 164.514(d)] and the Privacy Overlay (CNSS 1253F, Attachment 6) the OSC implements the minimum necessary rule, ensuring that protected health information (PHI) should not be used or disclosed when it is not necessary to satisfy a particular purpose or carry out a function. The minimum necessary rule is implemented to limit unnecessary or inappropriate access and disclosure of PHI. The OSC Command requires all information systems to document procedures for the implementation of the access control policy in a Consolidated System Design Document (CSDD) and corresponding Application (APP) Standard Operating Procedures (SOP) and Database Administrator (DBA) Standard Operating Procedures (SOP) documents. The Information System is required to review and update the procedural documents (CSDD, APP SOP and DBA SOP) at the following times: throughout the Software Development Life Cycle (SDLC) (which is driven by changes to the risk or capabilities); during the Annual Security Assessment; when the organizational governance policy changes; and during Security Authorization utilizing the OSC Configuration Management process. The system ALM and Business System Manager are required to review policy and procedure documents at least annually. AC-1.8 001545 The organization defines a frequency for reviewing and updating the access control policy. DoD has defined the frequency as annually.

Recommended Compelling Evidence:

The organization:

a. Develops, documents, and disseminates to [Assignment: organization-defined personnel or roles]:

b. Reviews and updates the current:

Supplemental Guidance:

This control addresses the establishment of policy and procedures for the effective implementation of selected security controls and control enhancements in the AC family. Policy and procedures reflect applicable federal laws, Executive Orders, directives, regulations, policies, standards, and guidance. Security program policies and procedures at the organization level may make the need for system-specific policies and procedures unnecessary. The policy can be included as part of the general information security policy for organizations or conversely, can be represented by multiple policies reflecting the complex nature of certain organizations. The procedures can be established for the security program in general and for particular information systems, if needed. The organizational risk management strategy is a key factor in establishing policy and procedures. Related control: PM-9.

Added by Privacy (Confidentiality Impact Level: Moderate) Overlay: Privacy requirements commonly use the terms "adequate security" and "confidentiality" when referring to access controls and other security safeguards for PII. Applied together, these terms signify the need to make risk-based decisions based on the magnitude of harm (to both organizations and individuals) when determining applicable restrictions for PII. For the purpose of this overlay, refer to the definitions of "adequate security" in OMB Circular A-130, Appendix III, and "confidentiality" in NIST SP 800-37, Rev. 1, Appendix B. These definitions are consistent with CNSSI No. 4009. Related Controls: AR-4; AR-7.

Potential Assessment Methods and Objectives:

The below information from the NIST SP 800-53 Revision 4 Security Catalog is intended to provide additional optional mechanisms to take into account when reviewing this Security Control. Assessments of the individual security requirements must still include a response to the specific procedures/guidance stated in the correlated Assessment Procedures.

Examine: [SELECT FROM: Access control policy and procedures; other relevant documents or records].

Interview: [SELECT FROM: Organizational personnel with access control responsibilities; organizational personnel with information security responsibilities].

Justification to Select:

Added by Privacy (Confidentiality Impact Level: Moderate) Overlay: Access Control policies and procedures form the foundation that allows privacy protections to be implemented for the identified uses of PII and PHI.

Regulatory Statutory Reference:

Added by Privacy (Confidentiality Impact Level: Moderate) Overlay: 5 U.S.C. Section: 552a(b), (e)(9)-(10); OMB M-07-16, Att. 4; OMB Circular A-130, 7.g. and Appendix III; OMB M-06-16; NIST SP 800-37, Rev. 1, Appendix B; NIST SP 800-122 Implemented Hybrid USCG security policy and procedures, as defined in the USCG Cyber Security Manual (COMDTINST M5500.13), further refine the DHS policies and procedures in the context of the USCG mission. The USCG sponsor, CG-65, is responsible for developing, disseminating, and updating the content of the manual. IAW [45 CFR 164.502(b), 164.514(d)] and the Privacy Overlay (CNSS 1253F, Attachment 6) the OSC implements the minimum necessary rule, ensuring that protected health information (PHI) should not be used or disclosed when it is not necessary to satisfy a particular purpose or carry out a function.