ENCLOSURE 3B - Security and Policy NIST.pdf

NIST Special Publication 800-53 Revision 5

Security and Privacy Controls for

Information Systems and Organizations

JOINT TASK FORCE

This publication is available free of charge from:

https://doi.org/10.6028/NIST.SP.800-53r5

NIST Special Publication 800-53 Revision 5

Security and Privacy Controls for Information Systems and Organizations

JOINT TASK FORCE

September 2020

INCLUDES UPDATES AS OF 12-10-2020; SEE PAGE XVII

U.S. Department of Commerce Wilbur L. Ross, Jr., Secretary

National Institute of Standards and Technology

Walter Copan, NIST Director and Under Secretary of Commerce for Standards and Technology

NIST SP 800-53, REV. 5 SECURITY AND PRIVACY CONTROLS FOR INFORMATION SYSTEMS AND ORGANIZATIONS i

This publication is available free of charge from : https://doi.org/10.6028/N

IST.SP.800-53r5

Authority

This publication has been developed by NIST to further its statutory responsibilities under the Federal Information Security Modernization Act (FISMA), 44 U.S.C. § 3551 et seq., Public Law (P.L.) 113-283. NIST is responsible for developing information security standards and guidelines, including minimum requirements for federal information systems. Such information security standards and guidelines shall not apply to national security systems without the express approval of the appropriate federal officials exercising policy authority over such systems. This guideline is consistent with the requirements of the Office of Management and Budget (OMB) Circular A-130.

Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on federal agencies by the Secretary of Commerce under statutory authority. Nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, OMB Director, or any other federal official. This publication may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright in the United States. Attribution would, however, be appreciated by NIST.

National Institute of Standards and Technology Special Publication 800-53, Revision 5 Natl. Inst. Stand. Technol. Spec. Publ. 800-53, Rev. 5, 492 pages (September 2020)

CODEN: NSPUE2

Comments on this publication may be submitted to:

National Institute of Standards and Technology Attn: Computer Security Division, Information Technology Laboratory

100 Bureau Drive (Mail Stop 8930) Gaithersburg, MD 20899-8930 Email: sec-cert@nist.gov

All comments are subject to release under the Freedom of Information Act (FOIA) [FOIA96].

Certain commercial entities, equipment, or materials may be identified in this document to describe an experimental procedure or concept adequately. Such identification is not intended to imply recommendation or endorsement by NIST, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose.

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts, practices, and methodologies may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST.

Organizations are encouraged to review draft publications during the designated public comment periods and provide feedback to NIST. Many NIST publications, other than the ones noted above, are available at https://csrc.nist.gov/publications.

mailto:sec-cert@nist.gov https://csrc.nist.gov/publications

NIST SP 800-53, REV. 5 SECURITY AND PRIVACY CONTROLS FOR INFORMATION SYSTEMS AND ORGANIZATIONS ii

This publication is available free of charge from

Reports on Computer Systems Technology

The National Institute of Standards and Technology (NIST) Information Technology Laboratory (ITL) promotes the U.S. economy and public welfare by providing technical leadership for the Nation’s measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology (IT). ITL’s responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL’s research, guidelines, and outreach efforts in information systems security and privacy and its collaborative activities with industry, government, and academic organizations.

Abstract

This publication provides a catalog of security and privacy controls for information systems and organizations to protect organizational operations and assets, individuals, other organizations, and the Nation from a diverse set of threats and risks, including hostile attacks, human errors, natural disasters, structural failures, foreign intelligence entities, and privacy risks. The controls are flexible and customizable and implemented as part of an organization-wide process to manage risk. The controls address diverse requirements derived from mission and business needs, laws, executive orders, directives, regulations, policies, standards, and guidelines. Finally, the consolidated control catalog addresses security and privacy from a functionality perspective (i.e., the strength of functions and mechanisms provided by the controls) and from an assurance perspective (i.e., the measure of confidence in the security or privacy capability provided by the controls). Addressing functionality and assurance helps to ensure that information technology products and the systems that rely on those products are sufficiently trustworthy.

Keywords

Assurance; availability; computer security; confidentiality; control; cybersecurity; FISMA;

information security; information system; integrity; personally identifiable information; Privacy Act; privacy controls; privacy functions; privacy requirements; Risk Management Framework;

security controls; security functions; security requirements; system; system security.

NIST SP 800-53, REV. 5 SECURITY AND PRIVACY CONTROLS FOR INFORMATION SYSTEMS AND ORGANIZATIONS iii

This publication is available free of charge from

Acknowledgements

This publication was developed by the Joint Task Force Interagency Working Group. The group includes representatives from the civil, defense, and intelligence communities. The National Institute of Standards and Technology wishes to acknowledge and thank the senior leaders from the Department of Commerce, Department of Defense, the Office of the Director of National Intelligence, the Committee on National Security Systems, and the members of the interagency working group whose dedicated efforts contributed significantly to this publication.

Department of Defense Office of the Director of National Intelligence

Dana Deasy Matthew A. Kozma Chief Information Officer Chief Information Officer

John Sherman Michael E. Waschull Principal Deputy CIO Deputy Chief Information Officer

Mark Hakun Clifford M. Conner Deputy CIO for Cybersecurity and DoD SISO Cybersecurity Group and IC CISO

Kevin Dulany Vacant Director, Cybersecurity Policy and Partnerships Director, Security Coordination Center

National Institute of Standards Committee on National Security and Technology Systems Charles H. Romine Mark G. Hakun Director, Information Technology Laboratory Chair

Kevin Stine Susan Dorr Acting Cybersecurity Advisor, ITL Co-Chair

Matthew Scholl Kevin Dulany Chief, Computer Security Division Tri-Chair—Defense Community

Kevin Stine Chris Johnson Chief, Applied Cybersecurity Division Tri-Chair—Intelligence Community

Ron Ross Vicki Michetti FISMA Implementation Project Leader Tri-Chair—Civil Agencies

Joint Task Force Working Group Victoria Pillitteri McKay Tolboe Dorian Pappas Kelley Dempsey NIST, JTF Leader DoD Intelligence Community NIST

Ehijele Olumese Lydia Humphries Daniel Faigin Naomi Lefkovitz The MITRE Corporation Booz Allen Hamilton Aerospace Corporation NIST

Esten Porter Julie Nethery Snyder Christina Sames Christian Enloe The MITRE Corporation The MITRE Corporation The MITRE Corporation NIST

David Black Rich Graubart Peter Duspiva Kaitlin Boeckl The MITRE Corporation The MITRE Corporation Intelligence Community NIST

Eduardo Takamura Ned Goren Andrew Regenscheid Jon Boyens

NIST NIST NIST NIST

NIST SP 800-53, REV. 5 SECURITY AND PRIVACY CONTROLS FOR INFORMATION SYSTEMS AND ORGANIZATIONS iv

This publication is available free of charge from

In addition to the above acknowledgments, a special note of thanks goes to Jeff Brewer, Jim Foti, and the NIST web team for their outstanding administrative support. The authors also wish to recognize Kristen Baldwin, Carol Bales, John Bazile, Jennifer Besceglie, Sean Brooks, Ruth Cannatti, Kathleen Coupe, Keesha Crosby, Charles Cutshall, Ja’Nelle DeVore, Jennifer Fabius, Jim Fenton, Hildy Ferraiolo, Ryan Galluzzo, Robin Gandhi, Mike Garcia, Paul Grassi, Marc Groman, Matthew Halstead, Kevin Herms, Scott Hill, Ralph Jones, Martin Kihiko, Raquel Leone, Jason Marsico, Kirsten Moncada, Ellen Nadeau, Elaine Newton, Michael Nieles, Michael Nussdorfer, Taylor Roberts, Jasmeet Seehra, Joe Stuntz, Jeff Williams, the professional staff from the NIST Computer Security Division and Applied Cybersecurity Division, and the representatives from the Federal CIO Council, Federal CISO Council, Federal Privacy Council, Control Baseline Interagency Working Group, Security and Privacy Collaboration Working Group, and Federal Privacy Council Risk Management Subcommittee for their ongoing contributions in helping to improve the content of the publication. Finally, the authors gratefully acknowledge the contributions from individuals and organizations in the public and private sectors, both nationally and internationally, whose insightful and constructive comments improved the overall quality, thoroughness, and usefulness of this publication.

HISTORICAL CONTRIBUTIONS TO NIST SPECIAL PUBLICATION 800-53

The authors wanted to acknowledge the many individuals who contributed to previous versions of Special Publication 800-53 since its inception in 2005. They include Marshall Abrams, Dennis Bailey, Lee Badger, Curt Barker, Matthew Barrett, Nadya Bartol, Frank Belz, Paul Bicknell, Deb Bodeau, Paul Brusil, Brett Burley, Bill Burr, Dawn Cappelli, Roger Caslow, Corinne Castanza, Mike Cooper, Matt Coose, Dominic Cussatt, George Dinolt, Randy Easter, Kurt Eleam, Denise Farrar, Dave Ferraiolo, Cita Furlani, Harriett Goldman, Peter Gouldmann, Tim Grance, Jennifer Guild, Gary Guissanie, Sarbari Gupta, Priscilla Guthrie, Richard Hale, Peggy Himes, Bennett Hodge, William Hunteman, Cynthia Irvine, Arnold Johnson, Roger Johnson, Donald Jones, Lisa Kaiser, Stuart Katzke, Sharon Keller, Tom Kellermann, Cass Kelly, Eustace King, Daniel Klemm, Steve LaFountain, Annabelle Lee, Robert Lentz, Steven Lipner, William MacGregor, Thomas Macklin, Thomas Madden, Robert Martin, Erika McCallister, Tim McChesney, Michael McEvilley, Rosalie McQuaid, Peter Mell, John Mildner, Pam Miller, Sandra Miravalle, Joji Montelibano, Douglas Montgomery, George Moore, Rama Moorthy, Mark Morrison, Harvey Newstrom, Sherrill Nicely, Robert Niemeyer, LouAnna Notargiacomo, Pat O’Reilly, Tim Polk, Karen Quigg, Steve Quinn, Mark Riddle, Ed Roback, Cheryl Roby, George Rogers, Scott Rose, Mike Rubin, Karen Scarfone, Roger Schell, Jackie Snouffer, Ray Snouffer, Murugiah Souppaya, Gary Stoneburner, Keith Stouffer, Marianne Swanson, Pat Toth, Glenda Turner, Patrick Viscuso, Joe Weiss, Richard Wilsher, Mark Wilson, John Woodward, and Carol Woody.

NIST SP 800-53, REV. 5 SECURITY AND PRIVACY CONTROLS FOR INFORMATION SYSTEMS AND ORGANIZATIONS v

This publication is available free of charge from

Patent Disclosure Notice

NOTICE: The Information Technology Laboratory (ITL) has requested that holders of patent claims whose use may be required for compliance with the guidance or requirements of this publication disclose such patent claims to ITL. However, holders of patents are not obligated to respond to ITL calls for patents and ITL has not undertaken a patent search in order to identify which, if any, patents may apply to this publication.

As of the date of publication and following call(s) for the identification of patent claims whose use may be required for compliance with the guidance or requirements of this publication, no such patent claims have been identified to ITL.

No representation is made or implied by ITL that licenses are not required to avoid patent infringement in the use of this publication.

NIST SP 800-53, REV. 5 SECURITY AND PRIVACY CONTROLS FOR INFORMATION SYSTEMS AND ORGANIZATIONS vi

This publication is available free of charge from

RISK MANAGEMENT

Organizations must exercise due diligence in managing information security and privacy risk. This is accomplished, in part, by establishing a comprehensive risk management program that uses the flexibility inherent in NIST publications to categorize systems, select and implement security and privacy controls that meet mission and business needs, assess the effectiveness of the controls, authorize the systems for operation, and continuously monitor the systems. Exercising due diligence and implementing robust and comprehensive information security and privacy risk management programs can facilitate compliance with applicable laws, regulations, executive orders, and governmentwide policies. Risk management frameworks and risk management processes are essential in developing, implementing, and maintaining the protection measures necessary to address stakeholder needs and the current threats to organizational operations and assets, individuals, other organizations, and the Nation. Employing effective risk-based processes, procedures, methods, and technologies ensures that information systems and organizations have the necessary trustworthiness and resiliency to support essential mission and business functions, the U.S. critical infrastructure, and continuity of government.

NIST SP 800-53, REV. 5 SECURITY AND PRIVACY CONTROLS FOR INFORMATION SYSTEMS AND ORGANIZATIONS vii

This publication is available free of charge from

COMMON SECURITY AND PRIVACY FOUNDATIONS

In working with the Office of Management and Budget to develop standards and guidelines required by FISMA, NIST consults with federal agencies, state, local, and tribal governments, and private sector organizations to improve information security and privacy, avoid unnecessary and costly duplication of effort, and help ensure that its publications are complementary with the standards and guidelines used for the protection of national security systems. In addition to a comprehensive and transparent public review and comment process, NIST is engaged in a collaborative partnership with the Office of Management and Budget, Office of the Director of National Intelligence, Department of Defense, Committee on National Security Systems, Federal CIO Council, and Federal Privacy Council to establish a Risk Management Framework (RMF) for information security and privacy for the Federal Government. This common foundation provides the Federal Government and their contractors with cost-effective, flexible, and consistent ways to manage security and privacy risks to organizational operations and assets, individuals, other organizations, and the Nation. The framework provides a basis for the reciprocal acceptance of security and privacy control assessment evidence and authorization decisions and facilitates information sharing and collaboration. NIST continues to work with public and private sector entities to establish mappings and relationships between the standards and guidelines developed by NIST and those developed by other organizations. NIST anticipates using these mappings and the gaps they identify to improve the control catalog.

NIST SP 800-53, REV. 5 SECURITY AND PRIVACY CONTROLS FOR INFORMATION SYSTEMS AND ORGANIZATIONS viii

This publication is available free of charge from

DEVELOPMENT OF INFORMATION SYSTEMS, COMPONENTS, AND SERVICES

With a renewed emphasis on the use of trustworthy, secure information systems and supply chain security, it is essential that organizations express their security and privacy requirements with clarity and specificity in order to obtain the systems, components, and services necessary for mission and business success. Accordingly, this publication provides controls in the System and Services Acquisition (SA) and Supply Chain Risk Management (SR) families that are directed at developers. The scope of the controls in those families includes information system, system component, and system service development and the associated developers whether the development is conducted internally by organizations or externally through the contracting and acquisition processes. The affected controls in the control catalog include SA-8, SA-10, SA-11, SA-15, SA-16, SA-17, SA-20, SA-21, SR-3, SR-4, SR-5, SR-6, SR-7, SR-8, SR-9, and SR-11.

NIST SP 800-53, REV. 5 SECURITY AND PRIVACY CONTROLS FOR INFORMATION SYSTEMS AND ORGANIZATIONS ix

This publication is available free of charge from

INFORMATION SYSTEMS — A BROAD-BASED PERSPECTIVE

As we push computers to “the edge,” building an increasingly complex world of interconnected systems and devices, security and privacy continue to dominate the national dialogue. There is an urgent need to further strengthen the underlying systems, products, and services that we depend on in every sector of the critical infrastructure to ensure that those systems, products, and services are sufficiently trustworthy and provide the necessary resilience to support the economic and national security interests of the United States. NIST Special Publication 800-53, Revision 5, responds to this need by embarking on a proactive and systemic approach to develop and make available to a broad base of public and private sector organizations a comprehensive set of security and privacy safeguarding measures for all types of computing platforms, including general purpose computing systems, cyber-physical systems, cloud systems, mobile systems, industrial control systems, and Internet of Things (IoT) devices. Safeguarding measures include both security and privacy controls to protect the critical and essential operations and assets of organizations and the privacy of individuals. The objective is to make the systems we depend on more penetration resistant to attacks, limit the damage from those attacks when they occur, and make the systems resilient, survivable, and protective of individuals’ privacy.

NIST SP 800-53, REV. 5 SECURITY AND PRIVACY CONTROLS FOR INFORMATION SYSTEMS AND ORGANIZATIONS x

This publication is available free of charge from

CONTROL BASELINES

The control baselines that have previously been included in NIST Special Publication 800-53 have been relocated to NIST Special Publication 800-53B. SP 800-53B contains security and privacy control baselines for federal information systems and organizations. It provides guidance for tailoring control baselines and for developing overlays to support the security and privacy requirements of stakeholders and their organizations. CNSS Instruction 1253 provides control baselines and guidance for security categorization and security control selection for national security systems.

NIST SP 800-53, REV. 5 SECURITY AND PRIVACY CONTROLS FOR INFORMATION SYSTEMS AND ORGANIZATIONS xi

This publication is available free of charge from

USE OF EXAMPLES IN THIS PUBLICATION

Throughout this publication, examples are used to illustrate, clarify, or explain certain items in chapter sections, controls, and control enhancements. These examples are illustrative in nature and are not intended to limit or constrain the application of controls or control enhancements by organizations.

NIST SP 800-53, REV. 5 SECURITY AND PRIVACY CONTROLS FOR INFORMATION SYSTEMS AND ORGANIZATIONS xii

This publication is available free of charge from

FEDERAL RECORDS MANAGEMENT COLLABORATION

Federal records management processes have a nexus with certain information security and privacy requirements and controls. For example, records officers may be managing records retention, including when records will be deleted. Collaborating with records officers on the selection and implementation of security and privacy controls related to records management can support consistency and efficiency and ultimately strengthen the organization’s security and privacy posture.

NIST SP 800-53, REV. 5 SECURITY AND PRIVACY CONTROLS FOR INFORMATION SYSTEMS AND ORGANIZATIONS xiii

This publication is available free of charge from

Table of Contents

CHAPTER ONE INTRODUCTION

1.1 PURPOSE AND APPLICABILITY

1.2 TARGET AUDIENCE

1.3 ORGANIZATIONAL RESPONSIBILITIES

1.4 RELATIONSHIP TO OTHER PUBLICATIONS

1.5 REVISIONS AND EXTENSIONS

1.6 PUBLICATION ORGANIZATION

CHAPTER TWO THE FUNDAMENTALS

2.1 REQUIREMENTS AND CONTROLS

2.2 CONTROL STRUCTURE AND ORGANIZATION

2.3 CONTROL IMPLEMENTATION APPROACHES

2.4 SECURITY AND PRIVACY CONTROLS

2.5 TRUSTWORTHINESS AND ASSURANCE

CHAPTER THREE THE CONTROLS

3.1 ACCESS CONTROL

3.2 AWARENESS AND TRAINING

3.3 AUDIT AND ACCOUNTABILITY

3.4 ASSESSMENT, AUTHORIZATION, AND MONITORING

3.5 CONFIGURATION MANAGEMENT

3.6 CONTINGENCY PLANNING

3.7 IDENTIFICATION AND AUTHENTICATION

3.8 INCIDENT RESPONSE

3.9 MAINTENANCE

3.10 MEDIA PROTECTION

3.11 PHYSICAL AND ENVIRONMENTAL PROTECTION

3.12 PLANNING

3.13 PROGRAM MANAGEMENT

3.14 PERSONNEL SECURITY

3.15 PERSONALLY IDENTIFIABLE INFORMATION PROCESSING AND TRANSPARENCY

3.16 RISK ASSESSMENT

3.17 SYSTEM AND SERVICES ACQUISITION

3.18 SYSTEM AND COMMUNICATIONS PROTECTION

3.19 SYSTEM AND INFORMATION INTEGRITY

3.20 SUPPLY CHAIN RISK MANAGEMENT

REFERENCES

APPENDIX A GLOSSARY

APPENDIX B ACRONYMS

APPENDIX C CONTROL SUMMARIES

NIST SP 800-53, REV. 5 SECURITY AND PRIVACY CONTROLS FOR INFORMATION SYSTEMS AND ORGANIZATIONS xiv

This publication is available free of charge from

Executive Summary

As we push computers to “the edge,” building an increasingly complex world of connected information systems and devices, security and privacy will continue to dominate the national dialogue. In its 2017 report, Task Force on Cyber Deterrence [DSB 2017], the Defense Science Board (DSB) provides a sobering assessment of the current vulnerabilities in the U.S. critical infrastructure and the information systems that support mission-essential operations and assets in the public and private sectors.

“…The Task Force notes that the cyber threat to U.S. critical infrastructure is outpacing efforts to reduce pervasive vulnerabilities, so that for the next decade at least the United States must lean significantly on deterrence to address the cyber threat posed by the most capable U.S. adversaries. It is clear that a more proactive and systematic approach to U.S. cyber deterrence is urgently needed…”

There is an urgent need to further strengthen the underlying information systems, component products, and services that the Nation depends on in every sector of the critical infrastructure— ensuring that those systems, components, and services are sufficiently trustworthy and provide the necessary resilience to support the economic and national security interests of the United States. This update to NIST Special Publication (SP) 800-53 responds to the call by the DSB by embarking on a proactive and systemic approach to develop and make available to a broad base of public and private sector organizations a comprehensive set of safeguarding measures for all types of computing platforms, including general purpose computing systems, cyber-physical systems, cloud-based systems, mobile devices, Internet of Things (IoT) devices, weapons systems, space systems, communications systems, environmental control systems, super computers, and industrial control systems. Those safeguarding measures include implementing security and privacy controls to protect the critical and essential operations and assets of organizations and the privacy of individuals. The objectives are to make the information systems we depend on more penetration-resistant, limit the damage from attacks when they occur, make the systems cyber-resilient and survivable, and protect individuals’ privacy.

Revision 5 of this foundational NIST publication represents a multi-year effort to develop the next generation of security and privacy controls that will be needed to accomplish the above objectives. It includes changes to make the controls more usable by diverse consumer groups (e.g., enterprises conducting mission and business functions; engineering organizations developing information systems, IoT devices, and systems-of-systems; and industry partners building system components, products, and services). The most significant changes to this publication include:

• Making the controls more outcome-based by removing the entity responsible for satisfying the control (i.e., information system, organization) from the control statement;

• Integrating information security and privacy controls into a seamless, consolidated control catalog for information systems and organizations;

• Establishing a new supply chain risk management control family;

• Separating control selection processes from the controls, thereby allowing the controls to be used by different communities of interest, including systems engineers, security architects, software developers, enterprise architects, systems security and privacy engineers, and mission or business owners;

NIST SP 800-53, REV. 5 SECURITY AND PRIVACY CONTROLS FOR INFORMATION SYSTEMS AND ORGANIZATIONS xv

This publication is available free of charge from

• Removing control baselines and tailoring guidance from the publication and transferring the content to NIST SP 800-53B, Control Baselines for Information Systems and Organizations;

• Clarifying the relationship between requirements and controls and the relationship between security and privacy controls; and

• Incorporating new, state-of-the-practice controls (e.g., controls to support cyber resiliency, support secure systems design, and strengthen security and privacy governance and accountability) based on the latest threat intelligence and cyber-attack data.

In separating the process of control selection from the controls and removing the control baselines, a significant amount of guidance and other informative material previously contained in SP 800-53 was eliminated. That content will be moved to other NIST publications such as SP 800-37 (Risk Management Framework) and SP 800-53B during the next update cycle. In the near future, NIST also plans to offer the content of SP 800-53, SP 800-53A, and SP 800-53B to a web-based portal to provide its customers interactive, online access to all control, control baseline, overlay, and assessment information.

NIST SP 800-53, REV. 5 SECURITY AND PRIVACY CONTROLS FOR INFORMATION SYSTEMS AND ORGANIZATIONS xvi

This publication is available free of charge from

Prologue

“…Through the process of risk management, leaders must consider risk to US interests from adversaries using cyberspace to their advantage and from our own efforts to employ the global nature of cyberspace to achieve objectives in military, intelligence, and business operations… “

“…For operational plans development, the combination of threats, vulnerabilities, and impacts must be evaluated in order to identify important trends and decide where effort should be applied to eliminate or reduce threat capabilities; eliminate or reduce vulnerabilities; and assess, coordinate, and deconflict all cyberspace operations…”

“…Leaders at all levels are accountable for ensuring readiness and security to the same degree as in any other domain…"

THE NATIONAL STRATEGY FOR CYBERSPACE OPERATIONS

OFFICE OF THE CHAIRMAN, JOINT CHIEFS OF STAFF, U.S. DEPARTMENT OF DEFENSE

“Networking and information technology [are] transforming life in the 21st century, changing the way people, businesses, and government interact. Vast improvements in computing, storage, and communications are creating new opportunities for enhancing our social wellbeing;

improving health and health care; eliminating barriers to education and employment; and increasing efficiencies in many sectors such as manufacturing, transportation, and agriculture.

The promise of these new applications often stems from their ability to create, collect, transmit, process, and archive information on a massive scale. However, the vast increase in the quantity of personal information that is being collected and retained, combined with the increased ability to analyze it and combine it with other information, is creating valid concerns about privacy and about the ability of entities to manage these unprecedented volumes of data responsibly…. A key challenge of this era is to assure that growing capabilities to create, capture, store, and process vast quantities of information will not damage the core values of the country….”

“…When systems process personal information, whether by collecting, analyzing, generating, disclosing, retaining, or otherwise using the information, they can impact privacy of individuals.

System designers need to account for individuals as stakeholders in the overall development of the solution.…Designing for privacy must connect individuals’ privacy desires with system requirements and controls in a way that effectively bridges the aspirations with development….”

THE NATIONAL PRIVACY RESEARCH STRATEGY

NATIONAL SCIENCE AND TECHNOLOGY COUNCIL, NETWORKING AND INFORMATION TECHNOLOGY RESEARCH AND DEVELOPMENT PROGRAM

NIST SP 800-53, REV. 5 SECURITY AND PRIVACY CONTROLS FOR INFORMATION SYSTEMS AND ORGANIZATIONS xvii

This publication is available free of charge from

Errata

This table contains changes that have been incorporated into SP 800-53, Revision 5. Errata updates can include corrections, clarifications, or other minor changes in the publication that are either editorial or substantive in nature. Any potential updates for this document that are not yet published in an errata update or revision—including additional issues and potential corrections—will be posted as they are identified; see the SP 800-53, Revision 5 publication details.

DATE TYPE REVISION PAGE

12-10-2020 Editorial Acknowledgements (ODNI): Add “Matthew A. Kozma, Chief Information Officer” iii

12-10-2020 Editorial Acknowledgements (ODNI): Add “Michael E. Waschull, Deputy Chief Information Officer” iii

12-10-2020 Editorial Acknowledgements (ODNI): Add “Clifford M. Conner, Cybersecurity Group and IC CISO” iii

12-10-2020 Editorial Call Out Box: Change “Special Publication 800-53B contains control baselines” to “SP 800-53B contains security and privacy control baselines” x

12-10-2020 Editorial Chapter One (Footnote 7): Add “[SP 800-53A]” 1

12-10-2020 Editorial Section 1.4: Delete “The controls have also been mapped to the requirements for federal information systems included in [OMB A- 130].”

12-10-2020 Editorial

Section 1.4 (Footnote 23): Delete “[OMB A-130] establishes policy for the planning, budgeting, governance, acquisition, and management of federal information, personnel, equipment, funds, IT resources, and supporting infrastructure and services.”

12-10-2020 Editorial Section 2.4 (first paragraph): Change “personally identifiable information (PII)” to “PII” 13

12-10-2020 Editorial Control AC-1a.1.: Change “organization-level; mission/business process-level; system-level” to “Organization-level; Mission/business process-level; System-level”

12-10-2020 Editorial Control AC-1 Discussion: Change “security or privacy incidents” to “security incidents or breaches” 18

12-10-2020 Editorial Control Enhancement AC-3(2) Discussion: Change “authorization duties to other individuals” to “authorization duties” 23

12-10-2020 Editorial Control Enhancement AC-3(9) Discussion: Change “mitigating control” to “mitigation measure” 26

12-10-2020 Editorial Control Enhancement AC-3(14) Related Controls: Add “, PT-6” 28

12-10-2020 Editorial Control Enhancement AC-4(17): Change “organization, system, application, service, individual” to “organization; system;

application; service; individual”

12-10-2020 Editorial Control Enhancement AC-4(25): Change “Selection (one or more:” to “Selection (one or more):” 34

12-10-2020 Editorial Control AC-12: Change “conditions,” to “conditions” 43

12-10-2020 Editorial Control AC-14 Discussion: Change “assignment” to “assignment operation” 44

12-10-2020 Editorial Control AC-19 Discussion: Change “the organizational network” to “its network” 52 https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final

NIST SP 800-53, REV. 5 SECURITY AND PRIVACY CONTROLS FOR INFORMATION SYSTEMS AND ORGANIZATIONS xviii

This publication is available free of charge from

DATE TYPE REVISION PAGE

12-10-2020 Editorial

Control AC-19 Discussion: Change “Many controls for mobile devices are reflected in other controls allocated to the initial control baselines as starting points for the development of security plans and overlays using the tailoring process. There may also be some overlap by the security controls within the different families of controls.” to “Many safeguards for mobile devices are reflected in other controls.”

12-10-2020 Editorial Control AC-20 Discussion: Change “organizational systems” to “organizational systems,” 53

12-10-2020 Editorial Control Enhancement AC-20(3) Discussion: Change “AC-20(6)” to “AC-20 b.” 54

12-10-2020 Editorial Control AT-1a.1.: Change “organization-level; mission/business process-level; system-level” to “Organization-level; Mission/business process-level; System-level”

12-10-2020 Editorial Control AT-1 Discussion: Change “security or privacy incidents” to “security incidents or breaches” 59

12-10-2020 Editorial Control AT-2d.: Change “security or privacy incidents” to “security incidents or breaches” 60

12-10-2020 Editorial Control AT-2 Discussion: Change “security or privacy incidents” to “security incidents or breaches” 60

12-10-2020 Editorial Control AT-3c.: Change “security or privacy incidents” to “security incidents or breaches” 62

12-10-2020 Editorial Control AT-3 Discussion: Change “security or privacy incidents” to “security incidents or breaches” 63

12-10-2020 Editorial Control AT-3 Related Controls: Change “IR-10” to “IR-4” 63

12-10-2020 Editorial Control AT-6 Discussion: Change “assessment and update” to “evaluation and update” 64

12-10-2020 Editorial Control AT-6 Discussion: Change “organization training” to “organizational training” 64

12-10-2020 Editorial Control AU-1a.1.: Change “organization-level; mission/business process-level; system-level” to “Organization-level; Mission/business process-level; System-level”

12-10-2020 Editorial Control AU-1 Discussion: Change “security or privacy incidents” to “security incidents or breaches” 65

12-10-2020 Editorial Control CA-1a.1.: Change “organization-level; mission/business process-level; system-level” to “Organization-level; Mission/business process-level; System-level”

12-10-2020 Editorial Control CA-1 Discussion: Change “security or privacy incidents” to “security incidents or breaches” 83

12-10-2020 Editorial Control CA-1 References: Change “[OMB A-130, Appendix II]” to

“[OMB A-130]” 84

12-10-2020 Editorial Control CA-1 References: Add “[SP 800-137A],” 84

12-10-2020 Editorial Control Enhancement CA-2(2): Change “data loss assessment” to “data loss assessment;” 86

12-10-2020 Editorial Control CA-3 References: Change “[OMB A-130, Appendix II]” to

“[OMB A-130]” 88

12-10-2020 Editorial Control CA-7 Discussion: Change “SC-18c” to “SC-18b” 91

12-10-2020 Editorial Control CM-1a.1.: Change “organization-level; mission/business process-level; system-level” to “Organization-level; Mission/business process-level; System-level”

12-10-2020 Editorial Control CM-1 Discussion: Change “security or privacy incidents” to “security incidents or breaches” 96

12-10-2020 Editorial Control CM-2b.2.: Change “Assignment” to “Assignment:” 97

12-10-2020 Editorial Control Enhancement CM-7(4) Title: Change “UNAUTHORIZED SOFTWARE” to “UNAUTHORIZED SOFTWARE – DENY-BY-

EXCEPTION”

NIST SP 800-53, REV. 5 SECURITY AND PRIVACY CONTROLS FOR INFORMATION SYSTEMS AND ORGANIZATIONS xix

This publication is available free of charge from

12-10-2020 Editorial Control Enhancement CM-7(5) Title: Change “AUTHORIZED SOFTWARE” to “AUTHORIZED SOFTWARE – ALLOW-BY-EXCEPTION” 106

12-10-2020 Editorial Control CM-8 Related Controls: Add “CP-9,” 108

12-10-2020 Editorial Control CP-1a.1.: Change “organization-level; mission/business process-level; system-level” to “Organization-level; Mission/business process-level; System-level”

12-10-2020 Editorial Control CP-1 Discussion: Change “security or privacy incidents” to “security incidents or breaches” 115

12-10-2020 Editorial Control CP-3 Discussion: Change “security or privacy incidents” to “security incidents or breaches” 119

12-10-2020 Editorial Control Enhancement CP-9(7) Title: Change “DUAL AUTHORIZATION” to “DUAL AUTHORIZATION FOR DELETION OR

DESTRUCTION”

12-10-2020 Editorial Control Enhancement CP-10(3): Change “tailoring procedures” to “tailoring” 128

12-10-2020 Editorial Control IA-1a.1.: Change “organization-level; mission/business process-level; system-level” to “Organization-level; Mission/business process-level; System-level”

12-10-2020 Editorial Control IA-1 Discussion: Change “security or privacy incidents” to “security incidents or breaches” 131

12-10-2020 Editorial Control Enhancement IA-2(1) Discussion: Change “Common Access Card” to “Common Access Card (CAC)” 132

12-10-2020 Editorial Control Enhancement IA-2(7) Title: Change “ACCESS” to “NETWORK

ACCESS” 134

12-10-2020 Editorial Control Enhancement IA-8(5) Discussion: Change “Personal Identity Verification (PIV)” to “PIV” 145

12-10-2020 Editorial Control IR-1a.1.: Change “organization-level; mission/business process-level; system-level” to “Organization-level; Mission/business process-level; System-level”

12-10-2020 Editorial Control IR-1 Discussion: Change “security or privacy incidents” to “security incidents or breaches” 149

12-10-2020 Editorial Control Enhancement IR-2(1) Discussion: Delete “Incident response training includes tabletop exercises that simulate a breach. See IR- 2(3).”

12-10-2020 Editorial Control IR-4 Related Controls: Add “IR-5,” 152 12-10-2020 Editorial Control IR-5 Related Controls: Add “IR-4, IR-6,” 156

12-10-2020 Editorial Control Enhancement IR-5(1) Related Controls: Change “AU-7, IR-4” to “None” 156

12-10-2020 Editorial Control IR-10: Change “Incident Analysis” to “Integrated Information Security Analysis Team” 161

12-10-2020 Editorial Control IR-10: Change “Incorporated into” to “Moved to” 161

12-10-2020 Editorial Control MA-1a.1.: Change “organization-level; mission/business process-level; system-level” to “Organization-level; Mission/business process-level; System-level”

12-10-2020 Editorial Control MA-1 Discussion: Change “security or privacy incidents” to “security incidents or breaches” 162

12-10-2020 Editorial Control Enhancement MA-4(2): Change “MA-1, MA-4” to “MA-1 and

MA-4” 166

12-10-2020 Editorial Control MP-1a.1.: Change “organization-level; mission/business process-level; system-level” to “Organization-level; Mission/business process-level; System-level”

12-10-2020 Editorial Control MP-1 Discussion: Change “security or privacy incidents” to “security incidents or breaches” 171

12-10-2020 Editorial Control MP-3 References: Add “[EO 13556],” 172

NIST SP 800-53, REV. 5 SECURITY AND PRIVACY CONTROLS FOR INFORMATION SYSTEMS AND ORGANIZATIONS xx

This publication is available free of charge from

Control PE-1a.1.: Change “organization-level; mission/business process-level; system-level” to “Organization-level; Mission/business process-level; System-level”

12-10-2020 Editorial Control PE-1 Discussion: Change “security or privacy incidents” to “security incidents or breaches” 179

12-10-2020 Editorial Control Enhancement PE-3(8) Discussion: Delete “, or mantrap,” 183

12-10-2020 Editorial Control Enhancement PE-3(8) Discussion: Change “Mantraps” to “Vestibules” 183

12-10-2020 Editorial Control Enhancement PE-19(1) Title: Delete ”AND TEMPEST” 192

12-10-2020 Editorial Control PL-1a.1.: Change “organization-level; mission/business process-level; system-level” to “Organization-level; Mission/business process-level; System-level”

12-10-2020 Editorial Control PL-1 Discussion: Change “security or privacy incidents” to “security incidents or breaches” 194

12-10-2020 Editorial Control PL-2 References: Change “[OMB A-130, Appendix II]” to

“[OMB A-130]” 196

12-10-2020 Editorial Control PL-7 References: Change “[OMB A-130, Appendix II]” to

“[OMB A-130]” 198

12-10-2020 Editorial Control PL-11 Discussion: Change “[FISMA] and [PRIVACT]” to “[FISMA], [PRIVACT], and [OMB A-130]” 201

12-10-2020 Editorial Control PM-1 Discussion: Change “security or privacy incidents” to “security incidents or breaches” 204

12-10-2020 Editorial Control PM-2 References: Add “, [SP 800-181]” 204 12-10-2020 Editorial Control PM-5 References: Add “[OMB A-130],” 206 12-10-2020 Editorial Control PM-8 References: Add “[EO 13636],” 207 12-10-2020 Editorial Control PM-10 References: Add “, [SP 800-181]” 208 12-10-2020 Editorial Control PM-11 Related Controls: Add “RA-9,” 209 12-10-2020 Editorial Control PM-12 References: Add “[NITP12],” 210 12-10-2020 Editorial Control PM-17 References: Add “[SP 800-172],” 212 12-10-2020 Editorial Control PM-19 Related Controls: Add “, PM-27” 213 12-10-2020 Editorial Control PM-22 References: Add “[OMB M-19-15],” 216 12-10-2020 Editorial Control PM-24 Related Controls: Add “PT-2,” 216

12-10-2020 Editorial Control PM-24 References: Change “[OMB A-130, Appendix II]” to

“[OMB A-130]” 217

12-10-2020 Editorial Control PM-25 Related Controls: Add “, SI-12” 217

12-10-2020 Editorial Control PM-25 References: Change “[OMB A-130, Appendix II]” to

“[OMB A-130]” 217

12-10-2020 Editorial Control PM-29 References: Add “, [SP 800-181]” 219 12-10-2020 Editorial Control PM-30 References: Add “[CNSSD 505],” 220 12-10-2020 Editorial Control PM-31 Discussion: Change “SC-18c” to “SC-18b” 220 12-10-2020 Editorial Control PM-31 References: Add “, [SP 800-137A]” 221

12-10-2020 Editorial Control PM-32 References: Change “[SP 800-137]” to “[SP 800-160-

1], [SP 800-160-2]” 221

12-10-2020 Editorial Control PS-1a.1.: Change “organization-level; mission/business process-level; system-level” to “Organization-level; Mission/business process-level; System-level”

12-10-2020 Editorial Control PS-1 Discussion: Change “security or privacy incidents” to “security incidents or breaches” 222

12-10-2020 Editorial Control Enhancement PS-3(3) Title: Change “WITH” to “REQUIRING” 224

12-10-2020 Editorial Control PT-1a.1.: Change “organization-level; mission/business process-level; system-level” to “Organization-level; Mission/business process-level; System-level”

12-10-2020 Editorial Control PT-1 Discussion: Change “privacy breaches” to “breaches” 229

NIST SP 800-53, REV. 5 SECURITY AND PRIVACY CONTROLS FOR INFORMATION SYSTEMS AND ORGANIZATIONS xxi

This publication is available free of charge from

12-10-2020 Editorial Control Enhancement PT-2(1): Change “permissible” to “authorized” 230

12-10-2020 Editorial Control PT-2 References: Change “[OMB A-130, Appendix II]” to

“[OMB A-130]” 231

12-10-2020 Editorial Control PT-3a.: Change “[Assignment organization-defined purpose(s)]” to “[Assignment: organization-defined purpose(s)]” 231

12-10-2020 Editorial Control PT-3 References: Change “[OMB A-130, Appendix II]” to

“[OMB A-130]” 232

12-10-2020 Editorial Control PT-5 Related Controls: Add “SC-42,” 234

12-10-2020 Editorial Control Enhancement PT-6(2): Change “[Assignment: organization-defined frequency]” to “[Assignment: organization-defined frequency]”

12-10-2020 Editorial Control PT-7 References: Add “, [NARA CUI]” 236 12-10-2020 Editorial Control PT-8 References: Add “[CMPPA],” 237

12-10-2020 Editorial Control RA-1a.1.: Change “organization-level; mission/business process-level; system-level” to “Organization-level; Mission/business process-level; System-level”

12-10-2020 Editorial Control RA-1 Discussion: Change “security or privacy incidents” to “security incidents or breaches” 238

12-10-2020 Editorial Control RA-2 References: Add “, [NARA CUI]” 240 12-10-2020 Editorial Control RA-3 Related Controls: Add “PT-2,” 240

12-10-2020 Editorial Control RA-8 References: Change “[OMB A-130, Appendix II]” to

“[OMB A-130]” 247

12-10-2020 Editorial Control RA-9 Related Controls: Add “PM-11,” 247

12-10-2020 Editorial Control SA-1a.1.: Change “organization-level; mission/business process-level; system-level” to “Organization-level; Mission/business process-level; System-level”

12-10-2020 Editorial Control SA-1 Discussion: Change “security or privacy incidents” to “security incidents or breaches” 249

12-10-2020 Editorial Control SA-2 References: Add “[SP 800-37], ” 250 12-10-2020 Editorial Control SA-4 References: Add “[ISO 29148], ” 255

12-10-2020 Editorial Control Enhancement SA-9(5) Discussion: Change “security or privacy incidents” to “security incidents or breaches” 273

12-10-2020 Editorial Control Enhancement SA-10(2) Title: Change “ALTERNATIVE CONFIGURATION MANAGEMENT” to “ALTERNATIVE

CONFIGURATION MANAGEMENT PROCESSES”

12-10-2020 Editorial Control SA-11a.: Change “assessments” to “control assessments” 276

12-10-2020 Editorial Control Enhancement SA-12(13): Change “MA-6, RA-9” to “MA-6 and RA-9” 280

12-10-2020 Editorial Control Enhancement SA-12(14): Change “SR-4(1), SR-4(2)” to “SR- 4(1) and SR-4(2)” 280

12-10-2020 Editorial Control Enhancement SA-17(4)(b): Change “informal demonstration,” to “informal demonstration;” 286

12-10-2020 Editorial Control SA-23: Change “design modification, augmentation, reconfiguration” to “design; modification; augmentation;

reconfiguration”

12-10-2020 Editorial Control SC-1a.1.: Change “organization-level; mission/business process-level; system-level” to “Organization-level; Mission/business process-level; System-level”

12-10-2020 Editorial Control SC-1 Discussion: Change “security or privacy incidents” to “security incidents or breaches” 292

12-10-2020 Editorial Control SC-6: Change “Selection (one or more);” to “Selection (one or more):” 297

NIST SP 800-53, REV. 5 SECURITY AND PRIVACY CONTROLS FOR INFORMATION SYSTEMS AND ORGANIZATIONS xxii

This publication is available free of charge from

12-10-2020 Substantive Control SC-7 Discussion: Add “[SP 800-189] provides additional information on source address validation techniques to prevent ingress and egress of traffic with spoofed addresses.”

12-10-2020 Substantive Control Enhancement SC-7(4) Discussion: Delete “Unauthorized control plane traffic can occur through a technique known as spoofing.”

12-10-2020 Substantive Control Enhancement SC-7(4) Discussion: Change “routing” to “Border Gateway Protocol (BGP) routing“ 298

12-10-2020 Substantive Control Enhancement SC-7(4) Discussion: Change “management” to “management protocols“ 298

12-10-2020 Substantive

Control Enhancement SC-7(4) Discussion: Add “See [SP 800-189] for additional information on the use of the resource public key infrastructure (RPKI) to protect BGP routes and detect unauthorized BGP announcements.”

12-10-2020 Editorial Control Enhancement SC-7(4) Related Controls: Add “, SC-20, SC-21, SC-22” 298

12-10-2020 Editorial Control Enhancement SC-7(5): Change “Selection (one or more);” to “Selection (one or more):” 298

12-10-2020 Editorial Control SC-14: Change “SI-7,” to “SI-7, and” 309

12-10-2020 Editorial Control SC-17 Discussion: Change “Public Key Infrastructure” to “Public Key Infrastructure (PKI)” 311

12-10-2020 Editorial Control SC-19: Change “addressed by other controls for protocols” to “addressed as any other technology or protocol” 313

12-10-2020 Editorial Control Enhancement SC-30(4) Related Controls: Change “SC-26” to “None” 319

12-10-2020 Editorial Control Enhancement SC-31(2): Change “Selection (one or more);”

to “Selection (one or more):” 320

12-10-2020 Editorial Control SC-42b.: Change “class of users” to “group of users” 326

12-10-2020 Editorial Control SI-1a.1.: Change “organization-level; mission/business process-level; system-level” to “Organization-level; Mission/business process-level; System-level”

12-10-2020 Editorial Control SI-1 Discussion: Change “security or privacy incidents” to “security incidents or breaches” 332

12-10-2020 Editorial Control SI-3c.1.: Change “Selection (one or more);” to “Selection (one or more):” 334

12-10-2020 Editorial Control SI-9: Change “AC-5,” to “AC-5, and” 349

12-10-2020 Editorial Control SI-10 References: Change “[OMB A-130, Appendix II]” to

“[OMB A-130]” 351

12-10-2020 Editorial Control Enhancement SI-12(1): Change “PII” to “personally identifiable information” 352

12-10-2020 Editorial Control Enhancement SI-12(1) Related Controls: Delete “PT-2, PT-3, RA-3” 352

12-10-2020 Editorial Control Enhancement SI-12(3) Related Controls: Change “MP-6” to “None” 353

12-10-2020 Editorial Control SI-12 References: Change “[OMB A-130, Appendix II]” to

“[OMB A-130]” 353

12-10-2020 Editorial Control SI-18 Related Controls: Add “PT-2,” 356 12-10-2020 Editorial Control Enhancement SI-18(1) Related Controls: Delete “PM-22,” 357

12-10-2020 Editorial Control Enhancement SI-18(4) Related Controls: Change “PM-22” to “None” 358

12-10-2020 Editorial Control SI-18 References: Add “[OMB M-19-15],” 358

12-10-2020 Editorial Control SI-19 References: Change “[OMB A-130, Appendix II]” to

“[OMB A-130]” 360

12-10-2020 Editorial Control SI-20 References: Change “[OMB A-130, Appendix II]” to

“[OMB A-130]” 361

NIST SP 800-53, REV. 5 SECURITY AND PRIVACY CONTROLS FOR INFORMATION SYSTEMS AND ORGANIZATIONS xxiii

This publication is available free of charge from

Control SR-1a.1.: Change “organization-level; mission/business process-level; system-level” to “Organization-level; Mission/business process-level; System-level”

12-10-2020…