Exhibit D Offeror Questionnaire for Software RFPs.xlsx
XLSX spreadsheet 1 MB Posted
- Attached to
- MINES24027 Electronic Ticketing System RFP
- Solicitation number
- MINES24027
- Issued by
- Jefferson County, Colorado
About this file
The document is an Exhibit D Offeror Questionnaire for Software RFPs for the Colorado School of Mines (Mines), specifically for an Electronic Ticketing System. The comprehensive questionnaire is designed to evaluate potential vendors' capabilities, security protocols, data management practices, and technical specifications for a web-based ticketing software system. Mines currently sells approximately 80,000 tickets annually through an existing ticketing system and seeks to expand the system's capabilities to allow all campus departments to access and manage ticket sales for their events. The system will support in-person, phone, and web-based ticket sales.
The questionnaire covers extensive technical and security requirements, including authentication methods, data encryption, infrastructure details, compliance standards, and operational protocols. Key areas of focus include cloud/on-premise hosting options, virtualization capabilities, data privacy, security controls, authentication mechanisms, network infrastructure, incident response procedures, and compliance with standards such as FERPA, GDPR, and PCI DSS. The document seeks detailed information about the vendor's ability to protect institutional data, manage user access, provide robust authentication, ensure system availability, and maintain comprehensive security and privacy controls across the entire ticketing system infrastructure.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| MINES24027_Addendum 1.pdf | ||
| MINES24027 Electronic Ticketing RFP (Final).pdf | ||
| Exhibit C - IT Vendor Request Form.xlsx | XLSX spreadsheet | |
| Exhibit_Sample Personal Services Agreement_ITS.pdf | ||
| Exhibit_Sample Personal Services Agreement_ITS.docx | DOCX document |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
ToBeCompletedByVendor
| # | Requirement(s) | Internal Stakeholders | Vendor Response | Vendor Comments |
| Product Details | ||||
| 1 | Is your product housed on premise, cloud/SaaS offering or a hybrid (local and cloud) solution? |
| If cloud-based (SaaS, IaaS, etc.), please provide a copy of your HECVAT. The HECVAT can be accessed through EDUCAUSE's website: https://www.ren-isac.net/hecvat/cbi.html. | Privacy, Security, Network & Infrastructure | [If vendor desires to make a proposal for both self-hosted and vendor-hosted, please answer questions separately for clarity.] | |
| 2 | Can the application be installed in a virtualized desktop environment? If so, are there any distinctions for the license, cost, etc.? | Network & Infrastructure | |
| 3 | Can any server components, if required, be installed in a virtualize environment? If so, are there any distinctions for the license, cost, etc. | Network & Infrastructure | |
| 4 | Are there are any limitations on which countries this application can be run from or and limitations on use from non-US citizens? |
| If so, please provide documentation on what user profile information should be captured when virtualized? | Online, VDI, Licensing, Export Controls | ||
| 5 | Can this software be installed on virtual infrastructure (hosted by Mines or a cloud service provider such as Amazon or Azure)? | Network & Infrastructure | |
| 6 | Does your solution require a backend database, if so, please explain and list requirements. | ES | |
| 7 | Does this product have certain EXCEPTIONAL/UNUSUAL technical requirements that end-users would need to be aware of? (e.g. does the tool require a certain amount of bandwidth to work adequately and how might that impact students working from home? Are there certain OS or computer requirements to install or run this application?) Please list all operating systems supported (Windows, Mac OS, Linux). Please list all browsers supported. | Network & Infrastructure, Online | |
| 8 | Does the product require special firewall configuration? If so, please list. | Security, Network & Infrastructure | |
| 9 | Does the software have any restriction operating behind proxies? | Security, Network & Infrastructure | |
| 10 | Are there any special DNS requirements? | Security, Network & Infrastructure | |
| 11 | Does the technology/product require or perform significantly better with a discrete GPU? | Infrastructure/VDI | |
| Data | |||
| 1 | Please provide your data spec sheet as a stand-alone document for the data that will be sent to you (from Mines) and/or the data you will send to Mines. If you’d like the document to remain confidential (and not made public under CORA), please mark it as such and do not include it as part of your contract or pricing. | Privacy, ES, Data Stewards, CDO | |
| 2 | Will any of the following data types be collected/used/disclosed within this tool: biometric, race, ethnic origin, political opinions, religious or philosophical beliefs, trade union or members, genetic, health data, sexual orientation/sex life, or criminal convictions? |
| If yes, please specify the purpose and use for such. | Privacy, Data Stewards, Security, CDO | ||
| 3 | Please provide the contact information for your data point of contact/custodian. | Privacy, Data Stewards, CDO | |
| 4 | How frequent are we able to receive data? | Data Stewards, CDO, ES | |
| 5 | Is the data disclosed to any third parties for purposes beyond the primary use of the technology? If so, please explain in detail. (HECVAT - THRD-03) | Privacy, Data Stewards, CDO | |
| Data Integration | |||
| 1 | What type of file transfer process do you use? (SFTP? API?) | Security, ES | |
| 2 | If so, does the integration comply with the IMS Global or is it listed on the eduappcenter.com site? |
| If this tools is non-IMS Global certified, what user attributes does it collect? | Security | |||
| Data Reporting | ||||
| 1 | Describe how your product allows for ad-hoc and standard reports. Include example reports. | ES | ||
| Authentication Method | ||||
| 1 | Are accounts provisioned automatically (via SSO or some other mechanism) or do users need to set up their own accounts? | ES, Network & Infrastructure | ||
| 2 | How does a user authenticate? If local authentication is used, where is the authentication data stored? | ES, Network & Infrastructure | [Any active directory/LDAP integration must support a hierarchical organizational unit structure.] | |
| 3 | What authentication services does this support? (e.g. CAS, Shibboleth, InCommon, ADFS) |
And if you support an authentication service, will you match on these attributes?
eduPersonPrincipalName email displayName givenName commonName surname eduPersonNickname eduPersonOrgDN eduPersonAffiliation
| eduPersonScopedAffiliation | ES, Network & Infrastructure | |
| 4 | If not InCommon, please provide your metadata. |
Mines metadata details are here:
Mines metadata is located here: https://idp.mines.edu/idp/shibboleth
| Logout URI is located: https://idp.mines.edu/idp/profile/Logout | ES, Network & Infrastructure | ||
| 5 | If Shibboleth, is it SP (service provider) initiated (preferred) or IDP (identity provider)? | ES, Network & Infrastructure | |
| 6 | How are user accounts managed? (e.g. creation, modification, deletion, etc.) Who manages the user accounts (vendor or Mines)? | ES, Network & Infrastructure | |
| 7 | Can you confirm that the software allows, and that you plan on using, each user to log in under their own account and username when accessing the software and that it does not require elevated or administrative privileges to run? | Security | |
| Implementation | |||
| 1 | Who will be responsible for managing implementation setup and ongoing maintenance of software? | Network & Infrastructure & ES | |
| 2 | What if any type(s) of training is available to users and how do they obtain on-going technical support? | ES, Online | |
| 3 | Provide information on which type of access to Mines resources will be required by vendor support personnel. (Remote access to servers? Physical access?) | ES, Network & Infrastructure | |
| 4 | Is there a person/group responsible for assigning permissions and grant/revoke access to the product? | ES, Network & Infrastructure | |
| Ongoing Support and Maintenance | |||
| 1 | Are there maintenance costs associated with this technology? If so, please articulate what those are. | Network & Infrastructure, Online | |
| End of Life | |||
| 1 | Please provide a copy of your record disposal procedures for sensitive, personal (confidential) information. See HECVAT DATA-25 (Retention – CRS 24-73) | Privacy | |
| 2 | How long is data retained and how, and by whom, will it be retrieved, removed, or destroyed? See HECVAT DATA-25 (Retention – CRS 24-73) | Privacy | |
| 3 | Does the software allow data to be returned to Mines? (HECVAT - DATA-08) Is there an extra fee associated with adding this feature. | Data Stewards, CDO, ES | |
| Incident Response | |||
| 1 | Do you have a data breach response plan? Who will provide assistance for data breaches, etc.? What will that process look like? (HECVAT - PPPR-10, PPPR-11) | Privacy, Security | |
| Availability | |||
| 1 | System must be available for use virtually full-time. Vendor should provide statistics as to the actual uptime of the system, monthly for the prior year, and annually for the 5 preceding years. Vendor should specify how these numbers were measured. | ES | |
| 2 | On those rare occasions when the system has to be taken down, describe any indicator (other than no response) given to the user to notify them that the system is down and the anticipated time for its return to operability. | ES | |
| 3 | Itemize all circumstances in which the system is to be taken down for planned and scheduled work. Specify anticipated downtime for each of these circumstances. | ES | |
| 4 | Describe the system functionality during downtime or other times when network traffic is blocked between endpoints. Describe what can users and system administrators expect during the downtime. | ES | |
| Compliance - FERPA, GDPR & Other - This section only applies if student or personal data | |||
| 1 | Will you handle student data in a FERPA compliant manner (HECVAT-DATA-27)? | Privacy, Security | |
| 2 | If you will be handling FERPA-protected student data, please provide background check (HECVAT - PPPR-14) and training procedures (HECVAT - PPPR-15, PPPR-18) for your staff handling such data. | Privacy | |
| 3 | Please provide a copy your disciplinary policies to protect FERPA-protected student data, if available. | Privacy | |
| 4 | Please explain how this tool complies with General Data Protection Regulation (GDPR)? How does a data subject withdraw consent? | Privacy | |
| 5 | Does your product meet WCAG 2.1 guidelines? Please provide a copy of your VPAT (Voluntary Product Accessibility Template), if available. | DSS, Online, Privacy | |
| 6 | Are there any features/parts of this product not accessible to students with disabilities? | DSS | |
| 7 | Please provide a copy of your most recent SOC 2 report (if marked "yes" to DCTR-02). | Privacy, Security | |
| Compliance - PCI (if applicable) | |||
| 1 | Please provide a copy of your most recent PCI certification and questionnaire/attestation (if marked "yes" to PCID-02). This evidence must be provided on an annual basis. | Privacy, Security, Controller's Office | |
| 2 | Does your product allow for integration with CashNet as a payment processor for financial transactions? | Privacy, Security, Controller's Office | |
| 3 | Will point of sale (“POS”) terminals, of any kind, be utilized? If so, please provide a clear and detailed PCI compliant guide to Mines including information on installation of such in a PCI compliant manner. | Privacy, Security, Controller's Office |
Crosswalk Detail
| 5.1.1 | Policies for information security | |
| 5.1.2 | Review of the policies for information security | |
| 6.1.1 | Information security roles and responsibilities | |
| 6.1.2 | Segregation of duties | |
| 6.1.3 | Contact with authorities | |
| 6.1.4 | Contact with special interest groups | |
| 6.1.5 | Information security in project management | |
| 6.2.1 | Mobile device policy | |
| 6.2.2 | Teleworking | |
| 7.1.1 | Screening | |
| 7.1.2 | Terms and conditions of employment | |
| 7.2.1 | Management responsibilities | |
| 7.2.2 | Information security awareness, education and training | |
| 7.2.3 | Disciplinary process | |
| 7.3.1 | Termination or change of employment responsibilities | |
| 8.1.1 | Inventory of assets | |
| 8.1.2 | Ownership of assets | |
| 8.1.3 | Acceptable use of assets | |
| 8.1.4 | Return of assets | |
| 8.2.1 | Classification of information | |
| 8.2.2 | Labelling of information | |
| 8.2.3 | Handling of assets | |
| 8.3.1 | Management of removable media | |
| 8.3.2 | Disposal of media | |
| 8.3.3 | Physical media transfer | |
| 9.1.1 | Access control policy | |
| 9.1.2 | Access to networks and network services | |
| 9.2.1 | User registration and de-registration | |
| 9.2.2 | User access provisioning | |
| 9.2.3 | Management of privileged access rights | |
| 9.2.4 | Management of secret authentication information of users | |
| 9.2.5 | Review of user access rights | |
| 9.2.6 | Removal or adjustment of access rights | |
| 9.3.1 | Use of secret authentication information | |
| 9.4.1 | Information access restriction | |
| 9.4.2 | Secure log-on procedures | |
| 9.4.3 | Password management system | |
| 9.4.4 | Use of privileged utility programs | |
| 9.4.5 | Access control to program source code | |
| 10.1.1 | Policy on the use of cryptographic controls | |
| 10.1.2 | Key management | |
| 11.1.1 | Physical security perimeter | |
| 11.1.2 | Physical entry controls | |
| 11.1.3 | Securing offices, rooms and facilities | |
| 11.1.4 | Protecting against external and environmental threats | |
| 11.1.5 | Working in secure areas | |
| 11.1.6 | Delivery and loading areas | |
| 11.2.1 | Equipment siting and protection | |
| 11.2.2 | Supporting utilities | |
| 11.2.3 | Cabling security | |
| 11.2.4 | Equipment maintenance | |
| 11.2.5 | Removal of assets | |
| 11.2.6 | Security of equipment and assets off-premises | |
| 11.2.7 | Secure disposal or re-use of equipment | |
| 11.2.8 | Unattended user equipment | |
| 11.2.9 | Clear desk and clear screen policy | |
| 12.1.1 | Documented operating procedures | |
| 12.1.2 | Change management | |
| 12.1.3 | Capacity management | |
| 12.1.4 | Separation of development, testing and operational environments | |
| 12.2.1 | Controls against malware | |
| 12.3.1 | Information backup | |
| 12.4 | Logging (all) | |
| 12.4.1 | Event logging | |
| 12.4.2 | Protection of log information | |
| 12.4.3 | Administrator and operator logs | |
| 12.4.4 | Clock synchronisation | |
| 12.5.1 | Installation of software on operational systems | |
| 12.6.1 | Management of technical vulnerabilities | |
| 12.6.2 | Restrictions on software installation | |
| 12.7.1 | Information systems audit controls | |
| 13.1.1 | Network controls | |
| 13.1.2 | Security of network services | |
| 13.1.3 | Segregation in networks | |
| 13.2 | Information transfer (all) | |
| 13.2.1 | Information transfer policies and procedures | |
| 13.2.2 | Agreements on information transfer | |
| 13.2.3 | Electronic messaging | |
| 13.2.4 | Confidentiality or non-disclosure agreements | |
| 14.1.1 | Information Security requirements analysis and specification | |
| 14.1.2 | Securing application services on public networks | |
| 14.1.3 | Protecting application services transactions | |
| 14.2.1 | Secure development policy | |
| 14.2.2 | System change control procedures | |
| 14.2.3 | Technical review of applications after operating platform changes | |
| 14.2.4 | Restrictions on changes to software packages | |
| 14.2.5 | Secure system engineering principles | |
| 14.2.6 | Secure development environment | |
| 14.2.7 | Outsourced development | |
| 14.2.8 | System security testing | |
| 14.2.9 | System acceptance testing | |
| 14.3.1 | Protection of test data | |
| 15.1.1 | Information security policy for supplier relationships | |
| 15.1.2 | Addressing security within supplier agreements | |
| 15.1.3 | Information and communication technology supply chain | |
| 15.2.1 | Monitoring and review of supplier services | |
| 15.2.2 | Managing changes to supplier services | |
| 16.1.1 | Responsibilities and procedures | |
| 16.1.2 | Reporting information security events | |
| 16.1.3 | Reporting information security weaknesses | |
| 16.1.4 | Assessment of and decision on information security events | |
| 16.1.5 | Response to information security incidents | |
| 16.1.6 | Learning from information security incidents | |
| 16.1.7 | Collection of evidence | |
| 17.1.1 | Planning information security continuity | |
| 17.1.2 | Implementing information security continuity | |
| 17.1.3 | Verify, review and evaluate information security continuity | |
| 17.2.1 | Availability of information processing facilities | |
| 18.1.1 | Identification of applicable legislation and contractual requirements | |
| 18.1.2 | Intellectual property rights | |
| 18.1.3 | Protection of records | |
| 18.1.4 | Privacy and protection of personally identifiable information | |
| 18.1.5 | Regulation of cryptographic controls | |
| 18.2.1 | Independent review of information security | |
| 18.2.2 | Compliance with security policies and standards | |
| 18.2.3 | Technical compliance review | |
| 8.2.3, 10.1.1 | Handling of assets; Policy on the use of cryptographic controls | |
| 11.1.1,11.1.2 | Physical security perimeter; Physical entry controls | |
| 9.2.3, 9.3.1, 9.4.3 | Management of privileged access rights; Use of secret authentication information; Password management system | |
| 9.2.3, 12.1.4 | Management of privileged access rights; Separation of development, testing and operational environments | |
| 9.1.1, 9.2.3, 9.3.1, 9.4.3 | Access control policy; Management of privileged access rights; Use of secret authentication information; Password management system | |
| 12.7.1, 18.2.1 | Information systems audit controls; Independent review of information security | |
| 14.2.1, 14.2.5, 14.2.8 | Secure development policy; Secure system engineering principles; System security testing | |
| 16.1.2, 16.1.5, 18.1.1 | Reporting information security events; Response to information security incidents; Identification of applicable legislation and contractual requirements | |
| CSC 1 | Inventory of Authorized and Unauthorized Devices | |
| CSC 2 | Inventory of Authorized and Unauthorized Software | |
| CSC 3 | Secure Configurations for Hardware and Software | |
| CSC 4 | Continuous Vulnerability Assessment and Remediation | |
| CSC 5 | Malware Defenses | |
| CSC 6 | Application Software Security | |
| CSC 7 | Wireless Access Control | |
| CSC 8 | Data Recovery Capability | |
| CSC 9 | Security Skills Assessment and Appropriate Training to Fill Gaps | |
| CSC 10 | Secure Configurations for Network Devices | |
| CSC 11 | Limitation and Control of Network Ports | |
| CSC 12 | Controlled Use of Administrative Privileges | |
| CSC 13 | Boundary Defense | |
| CSC 14 | Maintenance, Monitoring, and Analysis of Audit Logs | |
| CSC 15 | Controlled Access Based on the Need to Know | |
| CSC 16 | Account Monitoring and Control | |
| CSC 17 | Data Protection | |
| CSC 18 | Incident Response and Management | |
| CSC 19 | Secure Network Engineering | |
| CSC 20 | Penetration Tests and Red Team Exercises | |
| CSC 2, CSC 3 | Inventory of Authorized and Unauthorized Software; Secure Configurations for Hardware and Software | |
| CSC 3, CSC 14 | Secure Configurations for Hardware and Software; Maintenance, Monitoring, and Analysis of Audit Logs | |
| CSC 13, CSC 14 | Boundary Defense; Maintenance, Monitoring, and Analysis of Audit Logs | |
| CSC 4, CSC 17 | Continuous Vulnerability Assessment and Remediation; Data Protection | |
| ID.AM-1 | Physical devices and systems within the organization are inventoried | |
| ID.AM-2 | Software platforms and applications within the organization are inventoried | |
| ID.AM-3 | Organizational communication and data flows are mapped | |
| ID.AM-4 | External information systems are catalogued | |
| ID.AM-5 | Resources (e.g., hardware, devices, data, and software) are prioritized based on their classification, criticality, and business value | |
| ID.AM-6 | Cybersecurity roles and responsibilities for the entire workforce and third-party stakeholders (e.g., suppliers, customers, partners) are established | |
| ID.BE-1 | The organization’s role in the supply chain is identified and communicated | |
| ID.BE-2 | The organization’s place in critical infrastructure and its industry sector is identified and communicated | |
| ID.BE-3 | Priorities for organizational mission, objectives, and activities are established and communicated | |
| ID.BE-4 | Dependencies and critical functions for delivery of critical services are established | |
| ID.BE-5 | Resilience requirements to support delivery of critical services are established | |
| ID.GV-1 | Organizational information security policy is established | |
| ID.GV-2 | Information security roles & responsibilities are coordinated and aligned with internal roles and external partners | |
| ID.GV-3 | Legal and regulatory requirements regarding cybersecurity, including privacy and civil liberties obligations, are understood and managed | |
| ID.GV-4 | Governance and risk management processes address cybersecurity risks | |
| ID.RA-1 | Asset vulnerabilities are identified and documented | |
| ID.RA-2 | Threat and vulnerability information is received from information sharing forums and sources | |
| ID.RA-3 | Threats, both internal and external, are identified and documented | |
| ID.RA-4 | Potential business impacts and likelihoods are identified | |
| ID.RA-5 | Threats, vulnerabilities, likelihoods, and impacts are used to determine risk | |
| ID.RA-6 | Risk responses are identified and prioritized | |
| ID.RM-1 | Risk management processes are established, managed, and agreed to by organizational stakeholders | |
| ID.RM-2 | Organizational risk tolerance is determined and clearly expressed | |
| ID.RM-3 | The organization’s determination of risk tolerance is informed by its role in critical infrastructure and sector specific risk analysis | |
| PR.AC-1 | Identities and credentials are managed for authorized devices and users | |
| PR.AC-2 | Physical access to assets is managed and protected | |
| PR.AC-3 | Remote access is managed | |
| PR.AC-4 | Access permissions are managed, incorporating the principles of least privilege and separation of duties | |
| PR.AC-5 | Network integrity is protected, incorporating network segregation where appropriate | |
| PR.AT-1 | All users are informed and trained | |
| PR.AT-2 | Privileged users understand roles & responsibilities | |
| PR.AT-3 | Third-party stakeholders (e.g., suppliers, customers, partners) understand roles & responsibilities | |
| PR.AT-4 | Senior executives understand roles & responsibilities | |
| PR.AT-5 | Physical and information security personnel understand roles & responsibilities | |
| PR.DS-1 | Data-at-rest is protected | |
| PR.DS-2 | Data-in-transit is protected | |
| PR.DS-3 | Assets are formally managed throughout removal, transfers, and disposition | |
| PR.DS-4 | Adequate capacity to ensure availability is maintained | |
| PR.DS-5 | Protections against data leaks are implemented | |
| PR.DS-6 | Integrity checking mechanisms are used to verify software, firmware, and information integrity | |
| PR.DS-7 | The development and testing environment(s) are separate from the production environment | |
| PR.IP-1 | A baseline configuration of information technology/industrial control systems is created and maintained | |
| PR.IP-2 | A System Development Life Cycle to manage systems is implemented | |
| PR.IP-3 | Configuration change control processes are in place | |
| PR.IP-4 | Backups of information are conducted, maintained, and tested periodically | |
| PR.IP-5 | Policy and regulations regarding the physical operating environment for organizational assets are met | |
| PR.IP-6 | Data is destroyed according to policy | |
| PR.IP-7 | Protection processes are continuously improved | |
| PR.IP-8 | Effectiveness of protection technologies is shared with appropriate parties | |
| PR.IP-9 | Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed | |
| PR.IP-10 | Response and recovery plans are tested | |
| PR.IP-11 | Cybersecurity is included in human resources practices (e.g., deprovisioning, personnel screening) | |
| PR.IP-12 | A vulnerability management plan is developed and implemented | |
| PR.MA-1 | Maintenance and repair of organizational assets is performed and logged in a timely manner, with approved and controlled tools | |
| PR.MA-2 | Remote maintenance of organizational assets is approved, logged, and performed in a manner that prevents unauthorized access | |
| PR.PT-1 | Audit/log records are determined, documented, implemented, and reviewed in accordance with policy | |
| PR.PT-2 | Removable media is protected and its use restricted according to policy | |
| PR.PT-3 | Access to systems and assets is controlled, incorporating the principle of least functionality | |
| PR.PT-4 | Communications and control networks are protected | |
| DE.AE-1 | A baseline of network operations and expected data flows for users and systems is established and managed | |
| DE.AE-2 | Detected events are analyzed to understand attack targets and methods | |
| DE.AE-3 | Event data are aggregated and correlated from multiple sources and sensors | |
| DE.AE-4 | Impact of events is determined | |
| DE.AE-5 | Incident alert thresholds are established | |
| DE.CM-1 | The network is monitored to detect potential cybersecurity events | |
| DE.CM-2 | The physical environment is monitored to detect potential cybersecurity events | |
| DE.CM-3 | Personnel activity is monitored to detect potential cybersecurity events | |
| DE.CM-4 | Malicious code is detected | |
| DE.CM-5 | Unauthorized mobile code is detected | |
| DE.CM-6 | External service provider activity is monitored to detect potential cybersecurity events | |
| DE.CM-7 | Monitoring for unauthorized personnel, connections, devices, and software is performed | |
| DE.CM-8 | Vulnerability scans are performed | |
| DE.DP-1 | Roles and responsibilities for detection are well defined to ensure accountability | |
| DE.DP-2 | Detection activities comply with all applicable requirements | |
| DE.DP-3 | Detection processes are tested | |
| DE.DP-4 | Event detection information is communicated to appropriate parties | |
| DE.DP-5 | Detection processes are continuously improved | |
| RS.RP-1 | Response plan is executed during or after an event | |
| RS.CO-1 | Personnel know their roles and order of operations when a response is needed | |
| RS.CO-2 | Events are reported consistent with established criteria | |
| RS.CO-3 | Information is shared consistent with response plans | |
| RS.CO-4 | Coordination with stakeholders occurs consistent with response plans | |
| RS.CO-5 | Voluntary information sharing occurs with external stakeholders to achieve broader cybersecurity situational awareness | |
| RS.AN-1 | Notifications from detection systems are investigated | |
| RS.AN-2 | The impact of the incident is understood | |
| RS.AN-3 | Forensics are performed | |
| RS.AN-4 | Incidents are categorized consistent with response plans | |
| RS.MI-1 | Incidents are contained | |
| RS.MI-2 | Incidents are mitigated | |
| RS.MI-3 | Newly identified vulnerabilities are mitigated or documented as accepted risks | |
| RS.IM-1 | Response plans incorporate lessons learned | |
| RS.IM-2 | Response strategies are updated | |
| RC.RP-1 | Recovery plan is executed during or after an event | |
| RC.IM-1 | Recovery plans incorporate lessons learned | |
| RC.IM-2 | Recovery strategies are updated | |
| RC.CO-1 | Public relations are managed | |
| RC.CO-2 | Reputation after an event is repaired | |
| RC.CO-3 | Recovery activities are communicated to internal stakeholders and executive and management teams | |
| PR.AC-4, PR.PT-3 | Access permissions are managed, incorporating the principles of least privilege and separation of duties; Access to systems and assets is controlled, incorporating the principle of least functionality | |
| ID.AM-1, ID.AM-2, ID.AM-4 | Physical devices and systems within the organization are inventoried; Software platforms and applications within the organization are inventoried; Organizational communication and data flows are mapped | |
| PR.AC-1, PR.AC-4 | Identities and credentials are managed for authorized devices and users; Access permissions are managed, incorporating the principles of least privilege and separation of duties | |
| PR.AC-2, PR.IP-5 | Physical access to assets is managed and protected; Policy and regulations regarding the physical operating environment for organizational assets are met | |
| PR.DS-1, PR.DS-2 | Data-at-rest is protected; Data-in-transit is protected | |
| DE.CM-1, DE.CM-2, DE.CM-7 | The network is monitored to detect potential cybersecurity events; The physical environment is monitored to detect potential cybersecurity events; Monitoring for unauthorized personnel, connections, devices, and software is performed | |
| PR.AC-2, PR.AT-5, PR.IP-5, DE.CM-2 | Physical access to assets is managed and protected; Physical and information security personnel understand roles & responsibilities ; Policy and regulations regarding the physical operating environment for organizational assets are met; The physical environment is monitored to detect potential cybersecurity events | |
| PR.AC-2, PR.AC-4, PR.DS-1, PR.DS-3, PR.DS-5 | Physical access to assets is managed and protected, Access permissions are managed, incorporating the principles of least privilege and separation of duties; Data-at-rest is protected; Assets are formally managed throughout removal, transfers, and disposition; Protections against data leaks are implemented | |
| PR.IP-1, PR.IP-2 | A baseline configuration of information technology/industrial control systems is created and maintained; A System Development Life Cycle to manage systems is implemented | |
| ID.AM-6, PR.AT-3 | Cybersecurity roles and responsibilities for the entire workforce and third-party stakeholders (e.g., suppliers, customers, partners) are established; Third-party stakeholders (e.g., suppliers, customers, partners) understand roles & responsibilities | |
| PR.DS-1, PR.IP-4 | Data-at-rest is protected; Backups of information are conducted, maintained, and tested periodically | |
| DE.AE-1, DE.CM-1, PR.PT-4 | A baseline of network operations and expected data flows for users and systems is established and managed; The network is monitored to detect potential cybersecurity events; Communications and control networks are protected | |
| DE.CM-7, PR.DS-1 | Monitoring for unauthorized personnel, connections, devices, and software is performed; Data-at-rest is protected | |
| DE.CM-7, PR.DS-2 | Monitoring for unauthorized personnel, connections, devices, and software is performed; Data-in-transit is protected | |
| DE.CM-7, DE.CM-8, ID.RA-1 | Monitoring for unauthorized personnel, connections, devices, and software is performed; Vulnerability scans are performed; Asset vulnerabilities are identified and documented | |
| DE.CM-8, RS.MI-3 | Vulnerability scans are performed; Newly identified vulnerabilities are mitigated or documented as accepted risks | |
| 3.1.1 | Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems). | |
| 3.1.2 | Limit system access to the types of transactions and functions that authorized users are permitted to execute. | |
| 3.1.3 | Control the flow of CUI in accordance with approved authorizations. | |
| 3.1.4 | Separate the duties of individuals to reduce the risk of malevolent activity without collusion. | |
| 3.1.5 | Employ the principle of least privilege, including for specific security functions and privileged accounts. | |
| 3.1.6 | Use non-privileged accounts or roles when accessing nonsecurity functions. | |
| 3.1.7 | Prevent non-privileged users from executing privileged functions and capture the execution of such functions in audit logs. | |
| 3.1.8 | Limit unsuccessful logon attempts. | |
| 3.1.9 | Provide privacy and security notices consistent with applicable CUI rules. | |
| 3.1.10 | Use session lock with pattern-hiding displays to prevent access and viewing of data after a period of inactivity. | |
| 3.1.11 | Terminate (automatically) a user session after a defined condition. | |
| 3.1.12 | Monitor and control remote access sessions. | |
| 3.1.13 | Employ cryptographic mechanisms to protect the confidentiality of remote access sessions. | |
| 3.1.14 | Route remote access via managed access control points. | |
| 3.1.15 | Authorize remote execution of privileged commands and remote access to security-relevant information | |
| 3.1.16 | Authorize wireless access prior to allowing such connections. | |
| 3.1.17 | Protect wireless access using authentication and encryption. | |
| 3.1.18 | Control connection of mobile devices. | |
| 3.1.19 | Encrypt CUI on mobile devices and mobile computing platforms.21 | |
| 3.1.20 | Verify and control/limit connections to and use of external systems. | |
| 3.1.21 | Limit use of portable storage devices on external systems. | |
| 3.1.22 | Control CUI posted or processed on publicly accessible systems. | |
| 3.2.1 | Ensure that managers, systems administrators, and users of organizational systems are made aware of the security risks associated with their activities and of the applicable policies, standards, and procedures related to the security of those systems. | |
| 3.2.2 | Ensure that personnel are trained to carry out their assigned information security-related duties and responsibilities. | |
| 3.2.3 | Provide security awareness training on recognizing and reporting potential indicators of insider reat. | |
| 3.3.1 | Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity. | |
| 3.3.2 | Ensure that the actions of individual system users can be uniquely traced to those users so they can be held accountable for their actions. | |
| 3.3.3 | Review and update logged events. | |
| 3.3.4 | Alert in the event of an audit logging process failure. | |
| 3.3.5 | Correlate audit record review, analysis, and reporting processes for investigation and response to indications of unlawful, unauthorized, suspicious, or unusual activity. | |
| 3.3.6 | Provide audit record reduction and report generation to support on-demand analysis and reporting. | |
| 3.3.7 | Provide a system capability that compares and synchronizes internal system clocks with an authoritative source to generate time stamps for audit records. | |
| 3.3.8 | Protect audit information and audit logging tools from unauthorized access, modification, and deletion. | |
| 3.3.9 | Limit management of audit logging functionality to a subset of privileged users. | |
| 3.4.1 | Establish and maintain baseline configurations and inventories of organizational systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles. | |
| 3.4.2 | Establish and enforce security configuration settings for information technology products employed in organizational systems. | |
| 3.4.3 | Track, review, approve or disapprove, and log changes to organizational systems. | |
| 3.4.4 | Analyze the security impact of changes prior to implementation. | |
| 3.4.5 | Define, document, approve, and enforce physical and logical access restrictions associated with changes to organizational systems. | |
| 3.4.6 | Employ the principle of least functionality by configuring organizational systems to provide only essential capabilities. | |
| 3.4.7 | Restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services. | |
| 3.4.8 | Apply deny-by-exception (blacklisting) policy to prevent the use of unauthorized software or deny-all, permit-by-exception (whitelisting) policy to allow the execution of authorized software. | |
| 3.4.9 | Control and monitor user-installed software. | |
| 3.5.1 | Identify system users, processes acting on behalf of users, and devices. | |
| 3.5.2 | Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems. | |
| 3.5.3 | Use multifactor authentication 22 for local and network access 23 to privileged accounts and for network access to non-privileged accounts. | |
| 3.5.4 | Employ replay-resistant authentication mechanisms for network access to privileged and non- privileged accounts. | |
| 3.5.5 | Prevent reuse of identifiers for a defined period. | |
| 3.5.6 | Disable identifiers after a defined period of inactivity. | |
| 3.5.7 | Enforce a minimum password complexity and change of characters when new passwords are created. | |
| 3.5.8 | Prohibit password reuse for a specified number of generations. | |
| 3.5.9 | Allow temporary password use for system logons with an immediate change to a permanent password. | |
| 3.5.10 | Store and transmit only cryptographically-protected passwords. | |
| 3.5.11 | Obscure feedback of authentication information. | |
| 3.6.1 | Establish an operational incident-handling capability for organizational systems that includes preparation, detection, analysis, containment, recovery, and user response activities. | |
| 3.6.2 | Track, document, and report incidents to designated officials and/or authorities both internal and external to the organization. | |
| 3.6.3 | Test the organizational incident response capability. | |
| 3.7.1 | Perform maintenance on organizational systems. | |
| 3.7.2 | Provide controls on the tools, techniques, mechanisms, and personnel used to conduct system maintenance. | |
| 3.7.3 | Ensure equipment removed for off-site maintenance is sanitized of any CUI. | |
| 3.7.4 | Check media containing diagnostic and test programs for malicious code before the media are used in organizational systems. | |
| 3.7.5 | Require multifactor authentication to establish nonlocal maintenance sessions via external netw connections and terminate such connections when nonlocal maintenance is complete. | |
| 3.7.6 | Supervise the maintenance activities of maintenance personnel without required access authorization. | |
| 3.8.1 | Protect (i.e., physically control and securely store) system media containing CUI, both paper and digital. | |
| 3.8.2 | Limit access to CUI on system media to authorized users. | |
| 3.8.3 | Sanitize or destroy system media containing CUI before disposal or release for reuse. | |
| 3.8.4 | Mark media with necessary CUI markings and distribution limitations. | |
| 3.8.5 | Control access to media containing CUI and maintain accountability for media during transport outside of controlled areas. | |
| 3.8.6 | Implement cryptographic mechanisms to protect the confidentiality of CUI stored on digital media during transport unless otherwise protected by alternative physical safeguards. | |
| 3.8.7 | Control the use of removable media on system components. | |
| 3.8.8 | Prohibit the use of portable storage devices when such devices have no identifiable owner. | |
| 3.8.9 | Protect the confidentiality of backup CUI at storage locations. | |
| 3.9.1 | Screen individuals prior to authorizing access to organizational systems containing CUI. | |
| 3.9.2 | Ensure that organizational systems containing CUI are protected during and after personnel actions such as terminations and transfers. | |
| 3.10.1 | Limit physical access to organizational systems, equipment, and the respective operating environments to authorized individuals. | |
| 3.10.2 | Protect and monitor the physical facility and support infrastructure for organizational systems. | |
| 3.10.3 | Escort visitors and monitor visitor activity. | |
| 3.10.4 | Maintain audit logs of physical access. | |
| 3.10.5 | Control and manage physical access devices. | |
| 3.10.6 | Enforce safeguarding measures for CUI at alternate work sites. | |
| 3.11.1 | Periodically assess the risk to organizational operations (including mission, functions, image, or reputation), organizational assets, and individuals, resulting from the operation of organizational systems and the associated processing, storage, or transmission of CUI. | |
| 3.11.2 | Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified. | |
| 3.11.3 | Remediate vulnerabilities in accordance with risk assessments. | |
| 3.12.1 | Periodically assess the security controls in organizational systems to determine if the controls are effective in their application. | |
| 3.12.2 | Develop and implement plans of action designed to correct deficiencies and reduce or eliminate vulnerabilities in organizational systems. | |
| 3.12.3 | Monitor security controls on an ongoing basis to ensure the continued effectiveness of the controls. | |
| 3.12.4 | Develop, document, and periodically update system security plans that describe system boundaries, system environments of operation, how security requirements are implemented, and the relationships with or connections to other systems. | |
| 3.13.1 | Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems. | |
| 3.13.2 | Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems. | |
| 3.13.3 | Separate user functionality from system management functionality. | |
| 3.13.4 | Prevent unauthorized and unintended information transfer via shared system resources. | |
| 3.13.5 | Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks. | |
| 3.13.6 | Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception). | |
| 3.13.7 | Prevent remote devices from simultaneously establishing non-remote connections with organizational systems and communicating via some other connection to resources in external networks (i.e., split tunneling). | |
| 3.13.8 | Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards. | |
| 3.13.9 | Terminate network connections associated with communications sessions at the end of the sessions or after a defined period of inactivity. | |
| 3.13.10 | Establish and manage cryptographic keys for cryptography employed in organizational systems. | |
| 3.13.11 | Employ FIPS-validated cryptography when used to protect the confidentiality of CUI. | |
| 3.13.12 | Prohibit remote activation 27 of collaborative computing devices and provide indication of devices in use to users present at the device. | |
| 3.13.13 | Control and monitor the use of mobile code. | |
| 3.13.14 | Control and monitor the use of Voice over Internet Protocol (VoIP) technologies. | |
| 3.13.15 | Protect the authenticity of communications sessions. | |
| 3.13.16 | Protect the confidentiality of CUI at rest. | |
| 3.14.1 | Identify, report, and correct system flaws in a timely manner. | |
| 3.14.2 | Provide protection from malicious code at designated locations within organizational systems. | |
| 3.14.3 | Monitor system security alerts and advisories and take action in response. | |
| 3.14.4 | Update malicious code protection mechanisms when new releases are available. | |
| 3.14.5 | Perform periodic scans of organizational systems and real-time scans of files from external sources as files are downloaded, opened, or executed. | |
| 3.14.6 | Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks. | |
| 3.14.7 | Identify unauthorized use of organizational systems. | |
| 3.1.1, 3.1.2, 3.1.7 | Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems).; Limit system access to the types of transactions and functions that authorized users are permitted to execute.; Prevent non-privileged users from executing privileged functions and capture the execution of such functions in audit logs. | |
| 3.1.12, 3.1.13, 3.1.14, 3.1.14, 3.1.15, 3.1.8, 3.1.20, 3.7.5, 3.8.2, 3.13.7 | Monitor and control remote access sessions.; Employ cryptographic mechanisms to protect the confidentiality of remote access sessions.; Route remote access via managed access control points.; Authorize remote execution of privileged commands and remote access to security-relevant information; Limit unsuccessful logon attempts.; Require multifactor authentication to establish nonlocal maintenance sessions via external netw connections and terminate such connections when nonlocal maintenance is complete.; Limit access to CUI on system media to authorized users.; Prevent remote devices from simultaneously establishing non-remote connections with organizational systems and communicating via some other connection to resources in external networks (i.e., split tunneling). | |
| 3.1.7, 3.3.2, 3.3.3, 3.3.4, 3.3.5, 3.4.3, 3.7.1, 3.7.6, 3.10.4, 3.10.5 | Prevent non-privileged users from executing privileged functions and capture the execution of such functions in audit logs.; Ensure that the actions of individual system users can be uniquely traced to those users so they can be held accountable for their actions.; Review and update logged events.; Alert in the event of an audit logging process failure.; Correlate audit record review, analysis, and reporting processes for investigation and response to indications of unlawful, unauthorized, suspicious, or unusual activity.; Track, review, approve or disapprove, and log changes to organizational systems.; Perform maintenance on organizational systems.; Supervise the maintenance activities of maintenance personnel without required access authorization.;Maintain audit logs of physical access.;Control and manage physical access devices. | |
| 3.4.3, 3.4.4 | Track, review, approve or disapprove, and log changes to organizational systems.; Analyze the security impact of changes prior to implementation. | |
| 3.1.3, 3.8.1 | Control the flow of CUI in accordance with approved authorizations.;Protect (i.e., physically control and securely store) system media containing CUI, both paper and digital. | |
| 3.1.19, 3.8.1 | Encrypt CUI on mobile devices and mobile computing platforms.21;Protect (i.e., physically control and securely store) system media containing CUI, both paper and digital. | |
| 3.7.1, 3.7.2, 3.8.3 | Perform maintenance on organizational systems.;Provide controls on the tools, techniques, mechanisms, and personnel used to conduct system maintenance.;Sanitize or destroy system media containing CUI before disposal or release for reuse. | |
| 3.8.1, 3.8.2 | Protect (i.e., physically control and securely store) system media containing CUI, both paper and digital.;Limit access to CUI on system media to authorized users. | |
| 3.6.1, 3.14.6, 3.14.7 | Establish an operational incident-handling capability for organizational systems that includes preparation, detection, analysis, containment, recovery, and user response activities.;Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks.;Identify unauthorized use of organizational systems. | |
| 3.8.2, 3.10.1, 3.10.2, 3.10.5, 3.10.6, 3.12.1 | Limit access to CUI on system media to authorized users.; Limit physical access to organizational systems, equipment, and the respective operating environments to authorized individuals.; Protect and monitor the physical facility and support infrastructure for organizational systems.; Control and manage physical access devices.; Enforce safeguarding measures for CUI at alternate work sites.; Periodically assess the security controls in organizational systems to determine if the controls are effective in their application. | |
| 3.8.1, 3.8.5, 3.8.7 | Protect (i.e., physically control and securely store) system media containing CUI, both paper and digital.;Control access to media containing CUI and maintain accountability for media during transport outside of controlled areas.;Control the use of removable media on system components. | |
| 3.9.1, 3.9.2 | Screen individuals prior to authorizing access to organizational systems containing CUI.;Ensure that organizational systems containing CUI are protected during and after personnel actions such as terminations and transfers. | |
| 3.6.1, 3.12.2 | Establish an operational incident-handling capability for organizational systems that includes preparation, detection, analysis, containment, recovery, and user response activities.;Develop and implement plans of action designed to correct deficiencies and reduce or eliminate vulnerabilities in organizational systems. | |
| 3.1.18, 3.7.1, 3.13.13 | Control connection of mobile devices.;Perform maintenance on organizational systems.;Separate user functionality from system management functionality. | |
| 3.11.1, 3.11.2, 3.11.3 | Periodically assess the risk to organizational operations (including mission, functions, image, or reputation), organizational assets, and individuals, resulting from the operation of organizational systems and the associated processing, storage, or transmission of CUI.;Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified.;Remediate vulnerabilities in accordance with risk assessments. | |
| 3.1.1, 3.1.5, 3.1.6, 3.7.1, 3.7.2 | Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems).; Employ the principle of least privilege, including for specific security functions and privileged accounts.; Use non-privileged accounts or roles when accessing nonsecurity functions.; Perform maintenance on organizational systems.; Provide controls on the tools, techniques, mechanisms, and personnel used to conduct system maintenance. | |
| 3.1.7, 3.3.1 | Prevent non-privileged users from executing privileged functions and capture the execution of such functions in audit logs.; Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity. | |
| 3.8.6, 3.13.11 | Implement cryptographic mechanisms to protect the confidentiality of CUI stored on digital media during transport unless otherwise protected by alternative physical safeguards.; Employ FIPS-validated cryptography when used to protect the confidentiality of CUI. | |
| 3.6.2, 3.12.2 | Track, document, and report incidents to designated officials and/or authorities both internal and external to the organization.; Develop and implement plans of action designed to correct deficiencies and reduce or eliminate vulnerabilities in organizational systems. | |
| AC-1 | Access Control Policy and Procedures | |
| AC-2 | Account Management | |
| AC-3 | Access Enforcement | |
| AC-4 | Information Flow Enforcement | |
| AC-5 | Separation of Duties | |
| AC-6 | Least Privilege | |
| AC-6(9) | Access Control: Auditing use of privileged functions | |
| AC-7 | Unsuccessful Logon Attempts | |
| AC-8 | System Use Notification | |
| AC-9 | Previous Logon (Access) Notification | |
| AC-10 | Concurrent Session Control | |
| AC-11 | Session Lock | |
| AC-12 | Session Termination | |
| AC-13 | Withdrawn | |
| AC-14 | Permitted Actions without Identification or Authentication | |
| AC-15 | Withdrawn | |
| AC-16 | Security Attributes | |
| AC-17 | Remote Access | |
| AC-18 | Wireless Access | |
| AC-19 | Access Control for Mobile Devices | |
| AC-19(5) | Access Control: Full device / container based encryption | |
| AC-20 | Use of External Information Systems | |
| AC-21 | Information Sharing | |
| AC-22 | Publicly Accessible Content | |
| AC-23 | Data Mining Protection | |
| AC-24 | Access Control Decisions | |
| AC-25 | Reference Monitor | |
| AT-1 | Security Awareness and Training Policy and Procedures | |
| AT-2 | Security Awareness Training | |
| AT-3 | Role-Based Security Training | |
| AT-4 | Security Training Records | |
| AT-5 | Withdrawn | |
| AU-1 | Audit and Accountability Policy and Procedures | |
| AU-2 | Audit Events | |
| AU-2(3) | Audit and Accountability: reviews and updates | |
| AU-3 | Content of Audit Records | |
| AU-4 | Audit Storage Capacity | |
| AU-5 | Response to Audit Processing Failures | |
| AU-6 | Audit Review, Analysis, and Reporting | |
| AU-7 | Audit Reduction and Report Generation | |
| AU-8 | Time Stamps | |
| AU-9 | Protection of Audit Information | |
| AU-10 | Non-repudiation | |
| AU-11 | Audit Record Retention | |
| AU-12 | Audit Generation | |
| AU-13 | Monitoring for Information Disclosure | |
| AU-14 | Session Audit | |
| AU-15 | Alternate Audit Capability | |
| AU-16 | Cross-Organizational Auditing | |
| CA-1 | Security Assessment and Authorization Policies and Procedures | |
| CA-2 | Security Assessments | |
| CA-3 | System Interconnections | |
| CA-4 | Withdrawn | |
| CA-5 | Plan of Action and Milestones | |
| CA-6 | Security Authorization | |
| CA-7 | Continuous Monitoring | |
| CA-8 | Penetration Testing | |
| CA-9 | Internal System Connections | |
| CM-1 | Configuration Management Policy and Procedures | |
| CM-2 | Baseline Configuration | |
| CM-3 | Configuration Change Control | |
| CM-4 | Security Impact Analysis | |
| CM-5 | Access Restrictions for Change | |
| CM-6 | Configuration Settings | |
| CM-7 | Least Functionality | |
| CM-8 | Information System Component Inventory | |
| CM-9 | Configuration Management Plan | |
| CM-10 | Software Usage Restrictions | |
| CM-11 | User-Installed Software | |
| CP-1 | Contingency Planning Policy and Procedures | |
| CP-2 | Contingency Plan | |
| CP-3 | Contingency Training | |
| CP-4 | Contingency Plan Testing | |
| CP-5 | Withdrawn | |
| CP-6 | Alternate Storage Site | |
| CP-7 | Alternate Processing Site | |
| CP-8 | Telecommunications Services | |
| CP-9 | Information System Backup | |
| CP-10 | Information System Recovery and Reconstitution | |
| CP-11 | Alternate Communications Protocols | |
| CP-12 | Safe Mode | |
| CP-13 | Alternative Security Mechanisms | |
| IA-1 | Identification and Authentication Policy and Procedures | |
| IA-2 | Identification and Authentication (Organizational Users) | |
| IA-3 | Device Identification and Authentication | |
| IA-4 | Identifier Management | |
| IA-5 | Authenticator Management | |
| IA-5(1) | Password -Based Authentication: Enforces minimum complexity | |
| IA-6 | Authenticator Feedback | |
| IA-7 | Cryptographic Module Authentication | |
| IA-8 | Identification and Authentication (Non- Organizational Users) | |
| IA-9 | Service Identification and Authentication | |
| IA-10 | Adaptive Identification and Authentication | |
| IA-11 | Re-authentication | |
| IR-1 | Incident Response Policy and Procedures | |
| IR-2 | Incident Response Training | |
| IR-3 | Incident Response Testing | |
| IR-4 | Incident Handling | |
| IR-5 | Incident Monitoring | |
| IR-6 | Incident Reporting | |
| IR-7 | Incident Response Assistance | |
| IR-8 | Incident Response Plan | |
| IR-9 | Information Spillage Response | |
| IR-10 | Integrated Information Security Analysis Team | |
| MA-1 | System Maintenance Policy and Procedures | |
| MA-2 | Controlled Maintenance | |
| MA-3 | Maintenance Tools | |
| MA-4 | Nonlocal Maintenance | |
| MA-5 | Maintenance Personnel | |
| MA-6 | Timely Maintenance | |
| MP-1 | Media Protection Policy and Procedures | |
| MP-2 | Media Access | |
| MP-3 | Media Marking | |
| MP-4 | Media Storage | |
| MP-5 | Media Transport | |
| MP-6 | Media Sanitization | |
| MP-7 | Media Use | |
| MP-8 | Media Downgrading |
This is the start of the file's text. The full file is on GovTribe.
File details come from the government source that posted it. Updated .