Attachment_1_-_Exhibit_1.pdf

Control Number Family Control Title

AC-2 AC ACCOUNT MANAGEMENT

AC-2 (1) AC ACCOUNT MANAGEMENT | AUTOMATED SYSTEM ACCOUNT MANAGEMENT

AC-2 (2) AC ACCOUNT MANAGEMENT | REMOVAL OF TEMPORARY / EMERGENCY ACCOUNTS

AC-2 (3) AC ACCOUNT MANAGEMENT | DISABLE INACTIVE ACCOUNTS

AC-2 (4) AC ACCOUNT MANAGEMENT | AUTOMATED AUDIT ACTIONS

AC-2 (5) AC ACCOUNT MANAGEMENT | INACTIVITY LOGOUT

AC-2 (7) AC ACCOUNT MANAGEMENT | ROLE-BASED SCHEMES

AC-2 (9) AC ACCOUNT MANAGEMENT | RESTRICTIONS ON USE OF SHARED GROUPS / ACCOUNTS

AC-2 (10) AC ACCOUNT MANAGEMENT | SHARED / GROUP ACCOUNT CREDENTIAL TERMINATION

AC-2 (12) AC ACCOUNT MANAGEMENT | ACCOUNT MONITORING / ATYPICAL USAGE

AC-2 (13) AC ACCOUNT MANAGEMENT | DISABLE ACCOUNTS FOR HIGH-RISK INDIVIDUALS

AC-3 AC ACCESS ENFORCEMENT

AC-3 (4) AC ACCESS ENFORCEMENT | DISCRETIONARY ACCESS CONTROL

AC-3 (9) AC ACCESS ENFORCEMENT | CONTROLLED RELEASE

AC-4 AC INFORMATION FLOW ENFORCEMENT

AC-4 (12) AC INFORMATION FLOW ENFORCEMENT | DATA TYPE IDENTIFIERS

AC-4 (15) AC INFORMATION FLOW ENFORCEMENT | DETECTION OF UNSANCTIONED INFORMATION

AC-4 (17) AC INFORMATION FLOW ENFORCEMENT | DOMAIN AUTHENTICATION

AC-4 (18) AC INFORMATION FLOW ENFORCEMENT | SECURITY ATTRIBUTE BINDING

AC-5 AC SEPARATION OF DUTIES

AC-6 AC LEAST PRIVILEGE

AC-6 (1) AC LEAST PRIVILEGE | AUTHORIZE ACCESS TO SECURITY FUNCTIONS

AC-6 (2) AC LEAST PRIVILEGE | NON-PRIVILEGED ACCESS FOR NONSECURITY FUNCTIONS

AC-6 (5) AC LEAST PRIVILEGE | PRIVILEGED ACCOUNTS

AC-6 (7) AC LEAST PRIVILEGE | REVIEW OF USER PRIVILEGES

AC-6 (8) AC LEAST PRIVILEGE | PRIVILEGE LEVELS FOR CODE EXECUTION

AC-6 (9) AC LEAST PRIVILEGE | AUDITING USE OF PRIVILEGED FUNCTIONS

AC-6 (10) AC LEAST PRIVILEGE | PROHIBIT NON-PRIVILEGED USERS FROM EXECUTING PRIVILEGED FUNCTIONS

AC-7 AC UNSUCCESSFUL LOGIN ATTEMPTS

AC-8 AC SYSTEM USE NOTIFICATION

AC-10 AC CONCURRENT SESSION CONTROL

AC-11 AC SESSION LOCK

AC-11 (1) AC SESSION LOCK | PATTERN-HIDING DISPLAYS

AC-12 AC SESSION TERMINATION

AC-12 (1) AC SESSION TERMINATION | USER-INITIATED LOGOUTS/ MESSAGE DISPLAYS

AC-14 AC PERMITTED ACTIONS WITHOUT IDENTIFICATION OR AUTHENTICATION

AC-16 AC SECURITY ATTRIBUTES

AC-16 (3) AC SECURITY ATTRIBUTES | MAINTENANCE OF ATTRIBUTE ASSOCIATIONS BY INFORMATION SYSTEM AC-16 (6) AC SECURITY ATTRIBUTES | MAINTENANCE OF ATTRIBUTE ASSOCIATION BY ORGANIZATION

AC-17 AC REMOTE ACCESS

AC-17 (1) AC REMOTE ACCESS | AUTOMATED MONITORING / CONTROL

AC-17 (2) AC REMOTE ACCESS | PROTECTION OF CONFIDENTIALITY / INTEGRITY USING ENCRYPTION

AC-17 (3) AC REMOTE ACCESS | MANAGED ACCESS CONTROL POINTS

AC-17 (4) AC REMOTE ACCESS | PRIVILEGED COMMANDS/ ACCESS

CNSS 1253 Security Controls Confidentiality: Moderate; Integrity: Moderate; Availability: Moderate

Overlays Applied: PII Moderate Confidentiality Impact; Protected Health Information (PHI)

AC-17 (6) AC REMOTE ACCESS | PROTECTION OF INFORMATION

AC-17 (9) AC REMOTE ACCESS | DISCONNECT/ DISABLE ACCESS

AC-18 AC WIRELESS ACCESS

AC-18 (1) AC WIRELESS ACCESS | AUTHENTICATION AND ENCRYPTION

AC-18 (3) AC WIRELESS ACCESS | DISABLE WIRELESS NETWORKING

AC-18 (4) AC WIRELESS ACCESS | RESTRICT CONFIGURATIONS BY USERS

AC-19 AC ACCESS CONTROL FOR MOBILE DEVICES

AC-19 (5) AC ACCESS CONTROL FOR MOBILE DEVICES | FULL DEVICE/ CONTAINER-BASED ENCRYPTION

AC-20 AC USE OF EXTERNAL INFORMATION SYSTEMS

AC-20 (1) AC USE OF EXTERNAL INFORMATION SYSTEMS | LIMITS ON AUTHORIZED USE

AC-20 (2) AC USE OF EXTERNAL INFORMATION SYSTEMS | PORTABLE STORAGE DEVICES

AC-20 (3) AC USE OF EXTERNAL INFORMATION SYSTEMS | NON-ORGANIZATIONALLY OWNED SYSTEMS / COMPONENTS / DEVICES

AC-21 AC INFORMATION SHARING

AC-22 AC PUBLICLY ACCESSIBLE CONTENT

AC-23 AC DATA MINING PROTECTION

AT-2 AT SECURITY AWARENESS TRAINING

AT-2 (2) AT SECURITY AWARENESS | INSIDER THREAT

AT-3 AT ROLE-BASED SECURITY TRAINING

AT-3 (2) AT SECURITY TRAINING | PHYSICAL SECURITY CONTROLS

AT-3 (4) AT SECURITY TRAINING | SUSPICIOUS COMMUNICATIONS AND ANOMALOUS SYSTEM BEHAVIOR

AT-4 AT SECURITY TRAINING RECORDS

AU-2 AU AUDIT EVENTS

AU-2 (3) AU AUDIT EVENTS | REVIEWS AND UPDATES

AU-3 AU CONTENT OF AUDIT RECORDS

AU-3 (1) AU CONTENT OF AUDIT RECORDS | ADDITIONAL AUDIT INFORMATION

AU-4 AU AUDIT STORAGE CAPACITY

AU-4 (1) AU AUDIT STORAGE CAPACITY | TRANSFER TO ALTERNATE STORAGE

AU-5 AU RESPONSE TO AUDIT PROCESSING FAILURES

AU-5 (1) AU RESPONSE TO AUDIT PROCESSING FAILURES | AUDIT STORAGE CAPACITY

AU-6 AU AUDIT REVIEW, ANALYSIS, AND REPORTING

AU-6 (1) AU AUDIT REVIEW, ANALYSIS, AND REPORTING | PROCESS INTEGRATION

AU-6 (3) AU AUDIT REVIEW, ANALYSIS, AND REPORTING | CORRELATE AUDIT REPOSITORIES

AU-6 (4) AU AUDIT REVIEW, ANALYSIS, AND REPORTING | CENTRAL REVIEW AND ANALYSIS

AU-6 (10) AU AUDIT REVIEW, ANALYSIS, AND REPORTING | AUDIT LEVEL ADJUSTMENT

AU-7 AU AUDIT REDUCTION AND REPORT GENERATION

AU-7 (1) AU AUDIT REDUCTION AND REPORT GENERATION | AUTOMATIC PROCESSING

AU-7 (2) AU AUDIT REDUCTION AND REPORT GENERATION | AUTOMATIC SORT AND SEARCH

AU-8 AU TIME STAMPS

AU-8 (1) AU TIME STAMPS | SYNCHRONIZATION WITH AUTHORITATIVE TIME SOURCE

AU-9 AU PROTECTION OF AUDIT INFORMATION

AU-9 (3) AU PROTECTION OF AUDIT INFORMATION | CRYPTOGRAPHIC PROTECTION

AU-9 (4) AU PROTECTION OF AUDIT INFORMATION | ACCESS BY SUBSET OF PRIVILEGED USERS

AU-10 AU NON-REPUDIATION

AU-10 (1) AU NON-REPUDIATION | ASSOCIATION OF IDENTITIES

AU-11 AU AUDIT RECORD RETENTION

AU-11 (1) AU AUDIT RECORD RETENTION | LONG-TERM RETRIEVAL CAPABILITY

AU-12 AU AUDIT GENERATION

AU-12 (1) AU AUDIT GENERATION | SYSTEM-WIDE / TIME-CORRELATED AUDIT TRAIL

AU-12 (3) AU AUDIT GENERATION | CHANGES BY AUTHORIZED INDIVIDUALS

AU-14 AU SESSION AUDIT

AU-14 (1) AU SESSION AUDIT | SYSTEM START-UP

AU-14 (2) AU SESSION AUDIT | CAPTURE/RECORD AND LOG CONTENT

AU-14 (3) AU SESSION AUDIT | REMOTE VIEWING / LISTENING

AU-16 (2) AU CROSS-ORGANIZATIONAL AUDITING | SHARING OF AUDIT INFORMATION

CA-2 CA SECURITY ASSESSMENTS

CA-2 (1) CA SECURITY ASSESSMENTS | INDEPENDENT ASSESSORS

CA-3 CA SYSTEM INTERCONNECTIONS

CA-3 (1) CA SYSTEM INTERCONNECTIONS | UNCLASSIFIED NATIONAL SECURITY SYSTEM CONNECTIONS CA-3 (3) CA SYSTEM INTERCONNECTIONS | UNCLASSIFIED NON-NATIONAL SECURITY SYSTEM CONNECTIONS CA-3 (5) CA SYSTEM INTERCONNECTIONS | RESTRICTIONS ON EXTERNAL SYSTEM CONNECTIONS

CA-5 CA PLAN OF ACTION AND MILESTONES

CA-6 CA SECURITY AUTHORIZATION

CA-7 CA CONTINUOUS MONITORING

CA-7 (1) CA CONTINUOUS MONITORING | INDEPENDENT ASSESSMENT

CA-9 CA INTERNAL SYSTEM CONNECTIONS

CA-9 (1) CA INTERNAL SYSTEM CONNECTIONS | SECURITY COMPLIANCE CHECKS

CM-2 CM BASELINE CONFIGURATION

CM-2 (1) CM BASELINE CONFIGURATION | REVIEWS AND UPDATES

CM-2 (3) CM BASELINE CONFIGURATION | RETENTION OF PREVIOUS CONFIGURATIONS

CM-2 (7) CM BASELINE CONFIGURATION | CONFIGURE SYSTEMS, COMPONENTS, OR DEVICES FOR HIGH-RISK AREAS

CM-3 CM CONFIGURATION CHANGE CONTROL

CM-3 (2) CM CONFIGURATION CHANGE CONTROL | TEST / VALIDATE / DOCUMENT CHANGES

CM-3 (4) CM CONFIGURATION CHANGE CONTROL | SECURITY REPRESENTATIVE

CM-3 (6) CM CONFIGURATION CHANGE CONTROL | CRYPTOGRAPHY MANAGEMENT

CM-4 CM SECURITY IMPACT ANALYSIS

CM-4 (1) CM SECURITY IMPACT ANALYSIS | SEPARATE TEST ENVIRONMENTS

CM-4 (2) CM SECURITY IMPACT ANALYSIS | VERIFICATION OF SECURITY FUNCTIONS

CM-5 CM ACCESS RESTRICTIONS FOR CHANGE

CM-5 (1) CM ACCESS RESTRICTIONS FOR CHANGE | AUTOMATED ACCESS ENFORCEMENT / AUDITING

CM-5 (2) CM ACCESS RESTRICTIONS FOR CHANGE | REVIEW SYSTEM CHANGES

CM-5 (5) CM ACCESS RESTRICTIONS FOR CHANGE | LIMIT PRODUCTION / OPERATIONAL PRIVILEGES

CM-5 (6) CM ACCESS RESTRICTIONS FOR CHANGE | LIMIT LIBRARY PRIVILEGES

CM-6 CM CONFIGURATION SETTINGS

CM-6 (1) CM CONFIGURATION SETTINGS | AUTOMATED CENTRAL MANAGEMENT / APPLICATION / VERIFICATION

CM-7 CM LEAST FUNCTIONALITY

CM-7 (1) CM LEAST FUNCTIONALITY | PERIODIC REVIEW

CM-7 (2) CM LEAST FUNCTIONALITY | PREVENT PROGRAM EXECUTION

CM-7 (3) CM LEAST FUNCTIONALITY | REGISTRATION COMPLIANCE

CM-7 (5) CM LEAST FUNCTIONALITY | AUTHORIZED SOFTWARE / WHITELISTING

CM-8 CM INFORMATION SYSTEM COMPONENT INVENTORY

CM-8 (1) CM INFORMATION SYSTEM COMPONENT INVENTORY | UPDATES DURING INSTALLATIONS / REMOVALS

CM-8 (2) CM INFORMATION SYSTEM COMPONENT INVENTORY | AUTOMATED MAINTENANCE

CM-8 (3) CM INFORMATION SYSTEM COMPONENT INVENTORY | AUTOMATED UNAUTHORIZED COMPONENT DETECTION CM-8 (5) CM INFORMATION SYSTEM COMPONENT INVENTORY | NO DUPLICATE ACCOUNTING OF COMPONENTS

CM-9 CM CONFIGURATION MANAGEMENT PLAN

CM-10 CM SOFTWARE USAGE RESTRICTIONS

CM-10 (1) CM SOFTWARE USAGE RESTRICTIONS | OPEN SOURCE SOFTWARE

CM-11 CM USER-INSTALLED SOFTWARE

CM-11 (2) CM USER-INSTALLED SOFTWARE | PROHIBIT INSTALLATION WITHOUT PRIVILEGED STATUS

IA-2 IA IDENTIFICATION AND AUTHENTICATION (ORGANIZATIONAL USERS)

IA-2 (1) IA IDENTIFICATION AND AUTHENTICATION | NETWORK ACCESS TO PRIVILEGED ACCOUNTS IA-2 (2) IA IDENTIFICATION AND AUTHENTICATION | NETWORK ACCESS TO NON-PRIVILEGED ACCOUNTS IA-2 (3) IA IDENTIFICATION AND AUTHENTICATION | LOCAL ACCESS TO PRIVILEGED ACCOUNTS IA-2 (4) IA IDENTIFICATION AND AUTHENTICATION | LOCAL ACCESS TO NON-PRIVILEGED ACCOUNTS

IA-2 (5) IA IDENTIFICATION AND AUTHENTICATION | GROUP AUTHENTICATION

IA-2 (6) IA IDENTIFICATION AND AUTHENTICATION | NETWORK ACCESS TO PRIVILEGED ACCOUNTS - SEPARATE DEVICE IA-2 (7) IA IDENTIFICATION AND AUTHENTICATION | NETWORK ACCESS TO NON-PRIVILEGED ACCOUNTS - SEPARATE DEVICE IA-2 (8) IA IDENTIFICATION AND AUTHENTICATION | NETWORK ACCESS TO PRIVILEGED ACCOUNTS - REPLAY RESISTANT IA-2 (9) IA IDENTIFICATION AND AUTHENTICATION | NETWORK ACCESS TO NON-PRIVILEGED ACCOUNTS - REPLAY RESISTANT

IA-2 (11) IA IDENTIFICATION AND AUTHENTICATION | REMOTE ACCESS - SEPARATE DEVICE

IA-2 (12) IA IDENTIFICATION AND AUTHENTICATION | ACCEPTANCE OF PIV CREDENTIALS

IA-3 IA DEVICE IDENTIFICATION AND AUTHENTICATION

IA-3 (1) IA DEVICE IDENTIFICATION AND AUTHENTICATION | CRYPTOGRAPHIC BIDIRECTIONAL AUTHENTICATION

IA-4 IA IDENTIFIER MANAGEMENT

IA-4 (3) IA IDENTIFIER MANAGEMENT | MULTIPLE FORMS OF CERTIFICATION

IA-4 (4) IA IDENTIFIER MANAGEMENT | IDENTIFY USER STATUS

IA-5 IA AUTHENTICATOR MANAGEMENT

IA-5 (1) IA AUTHENTICATOR MANAGEMENT | PASSWORD-BASED AUTHENTICATION

IA-5 (2) IA AUTHENTICATOR MANAGEMENT | PKI-BASED AUTHENTICATION

IA-5 (3) IA AUTHENTICATOR MANAGEMENT | IN-PERSON OR TRUSTED THIRD-PARTY REGISTRATION IA-5 (4) IA AUTHENTICATOR MANAGEMENT | AUTOMATED SUPPORT FOR PASSWORD STRENGTH DETERMINATION IA-5 (7) IA AUTHENTICATOR MANAGEMENT | NO EMBEDDED UNENCRYPTED STATIC AUTHENTICATORS

IA-5 (8) IA AUTHENTICATOR MANAGEMENT | MULTIPLE INFORMATION SYSTEM ACCOUNTS

IA-5 (11) IA AUTHENTICATOR MANAGEMENT | HARDWARE TOKEN-BASED AUTHENTICATION

IA-5 (13) IA AUTHENTICATOR MANAGEMENT | EXPIRATION OF CACHED AUTHENTICATORS

IA-5 (14) IA AUTHENTICATOR MANAGEMENT | MANAGING CONTENT OF PKI TRUST STORES

IA-6 IA AUTHENTICATOR FEEDBACK

IA-7 IA CRYPTOGRAPHIC MODULE AUTHENTICATION

IA-8 IA IDENTIFICATION AND AUTHENTICATION (NON-ORGANIZATIONAL USERS)

IA-8 (1) IA IDENTIFICATION AND AUTHENTICATION | ACCEPTANCE OF PIV CREDENTIALS FROM OTHER AGENCIES IA-8 (2) IA IDENTIFICATION AND AUTHENTICATION | ACCEPTANCE OF THIRD-PARTY CREDENTIALS

IA-8 (3) IA IDENTIFICATION AND AUTHENTICATION | USE OF FICAM-APPROVED PRODUCTS

IA-8 (4) IA IDENTIFICATION AND AUTHENTICATION | USE OF FICAM-ISSUED PROFILES

IR-4 IR INCIDENT HANDLING

IR-4 (1) IR INCIDENT HANDLING | AUTOMATED INCIDENT HANDLING PROCESSES

IR-4 (3) IR INCIDENT HANDLING | CONTINUITY OF OPERATIONS

IR-4 (4) IR INCIDENT HANDLING | INFORMATION CORRELATION

IR-4 (6) IR INCIDENT HANDLING | INSIDER THREATS - SPECIFIC CAPABILITIES

IR-4 (7) IR INCIDENT HANDLING | INSIDER THREATS - INTRA-ORGANIZATION COORDINATION

IR-4 (8) IR INCIDENT HANDLING | CORRELATION WITH EXTERNAL ORGANIZATIONS

IR-5 IR INCIDENTMONITORING

IR-6 IR INCIDENT REPORTING

IR-6 (1) IR INCIDENT REPORTING | AUTOMATED REPORTING

IR-6 (2) IR INCIDENT REPORTING | VULNERABILITIES RELATED TO INCIDENTS

IR-7 IR INCIDENT RESPONSE ASSISTANCE

IR-7 (1) IR INCIDENT RESPONSE ASSISTANCE | AUTOMATION SUPPORT FOR AVAILABILITY OF INFORMATION / SUPPORT

IR-7 (2) IR INCIDENT RESPONSE ASSISTANCE | COORDINATION WITH EXTERNAL PROVIDERS

IR-8 IR INCIDENT RESPONSE PLAN

IR-9 IR INFORMATION SPILLAGE RESPONSE

IR-9 (1) IR INFORMATION SPILLAGE RESPONSE | RESPONSIBLE PERSONNEL

IR-9 (2) IR INFORMATION SPILLAGE RESPONSE | TRAINING

IR-9 (3) IR INFORMATION SPILLAGE RESPONSE | POST-SPILL OPERATIONS

IR-9 (4) IR INFORMATION SPILLAGE RESPONSE | EXPOSURE TO UNAUTHORIZED PERSONNEL

IR-10 IR INTEGRATED INFORMATION SECURITY ANALYSIS TEAM

MA-2 MA CONTROLLED MAINTENANCE

MA-3 MA MAINTENANCE TOOLS

MA-3 (1) MA MAINTENANCE TOOLS | INSPECT TOOLS

MA-3 (2) MA MAINTENANCE TOOLS | INSPECT MEDIA

MA-3 (3) MA MAINTENANCE TOOLS | PREVENT UNAUTHORIZED REMOVAL

MA-4 MA NONLOCAL MAINTENANCE

MA-4 (1) MA NONLOCAL MAINTENANCE | AUDITING AND REVIEW

MA-4 (2) MA NONLOCAL MAINTENANCE | DOCUMENT NONLOCAL MAINTENANCE

MA-4 (3) MA NONLOCAL MAINTENANCE | COMPARABLE SECURITY / SANITIZATION

MA-4 (6) MA NONLOCAL MAINTENANCE | CRYPTOGRAPHIC PROTECTION

MA-4 (7) MA NONLOCAL MAINTENANCE | REMOTE DISCONNECT VERIFICATION

MA-5 MA MAINTENANCE PERSONNEL

MA-6 MA TIMELY MAINTENANCE

MP-2 MP MEDIA ACCESS

MP-3 MP MEDIA MARKING

MP-4 MP MEDIA STORAGE

MP-5 MP MEDIA TRANSPORT

MP-5 (4) MP MEDIA TRANSPORT | CRYPTOGRAPHIC PROTECTION

MP-6 MP MEDIA SANITIZATION

MP-6 (1) MP MEDIA SANITIZATION | REVIEW / APPROVE / TRACK / DOCUMENT / VERIFY

MP-6 (8) MP MEDIA SANITIZATION | REMOTE PURGING / WIPING OF INFORMATION

MP-7 MP MEDIA USE

MP-7 (1) MP MEDIA USE | PROHIBIT USE WITHOUT OWNER

MP-8 (3) MP MEDIA DOWNGRADING | CONTROLLED UNCLASSIFIED INFORMATION

PL-2 PL SYSTEM SECURITY PLAN

PL-2 (3) PL SYSTEM SECURITY PLAN | PLAN / COORDINATE WITH OTHER ORGANIZATIONAL ENTITIES

PL-4 PL RULES OF BEHAVIOR

PL-4 (1) PL RULES OF BEHAVIOR | SOCIAL MEDIA AND NETWORKING RESTRICTIONS

PL-8 PL INFORMATION SECURITY ARCHITECTURE

PL-8 (1) PL INFORMATION SECURITY ARCHITECTURE | DEFENSE-IN-DEPTH

PL-8 (2) PL INFORMATION SECURITY ARCHITECTURE | SUPPLIER DIVERSITY

PM-1 PM INFORMATION SECURITY PROGRAM PLAN

PM-2 PM SENIOR INFORMATION SECURITY OFFICER

PM-3 PM INFORMATION SECURITY RESOURCES

PM-4 PM PLAN OF ACTION AND MILESTONES PROCESS

PM-5 PM INFORMATION SYSTEM INVENTORY

PM-6 PM INFORMATION SECURITY MEASURES OF PERFORMANCE

PM-7 PM ENTERPRISE ARCHITECTURE

PM-8 PM CRITICAL INFRASTRUCTURE PLAN

PM-9 PM RISK MANAGEMENT STRATEGY

PM-10 PM SECURITY AUTHORIZATION PROCESS

PM-11 PM MISSION/BUSINESS PROCESS DEFINITION

PM-12 PM INSIDER THREAT PROGRAM

PM-13 PM INFORMATION SECURITY WORKFORCE

PM-14 PM TESTING, TRAINING, AND MONITORING

PM-15 PM CONTACTS WITH SECURITY GROUPS AND ASSOCIATIONS

PM-16 PM THREAT AWARENESS PROGRAM

RA-1 RA RISK ASSESSMENT POLICY AND PROCEDURES

RA-2 RA SECURITY CATEGORIZATION

RA-3 RA RISK ASSESSMENT

RA-5 RA VULNERABILITY SCANNING

RA-5 (1) RA VULNERABILITY SCANNING | UPDATE TOOL CAPABILITY

RA-5 (2) RA VULNERABILITY SCANNING | UPDATE BY FREQUENCY / PRIOR TO NEW SCAN / WHEN IDENTIFIED

RA-5 (4) RA VULNERABILITY SCANNING | DISCOVERABLE INFORMATION

RA-5 (5) RA VULNERABILITY SCANNING | PRIVILEGED ACCESS

SA-1 SA SYSTEM AND SERVICES ACQUISITION POLICY AND PROCEDURES

SA-2 SA ALLOCATION OF RESOURCES

SA-3 SA SYSTEM DEVELOPMENT LIFE CYCLE

SA-4 SA ACQUISITION PROCESS

SA-4 (1) SA ACQUISITION PROCESS | FUNCTIONAL PROPERTIES OF SECURITY CONTROLS

SA-4 (2) SA ACQUISITION PROCESS | DESIGN / IMPLEMENTATION INFORMATION FOR SECURITY CONTROLS

SA-4 (7) SA ACQUISITION PROCESS | NIAP-APPROVED PROTECTION PROFILES

SA-4 (9) SA ACQUISITION PROCESS | FUNCTIONS / PORTS / PROTOCOLS / SERVICES IN USE

SA-4 (10) SA ACQUISITION PROCESS | USE OF APPROVED PIV PRODUCTS

SA-5 SA INFORMATION SYSTEM DOCUMENTATION

SA-8 SA SECURITY ENGINEERING PRINCIPLES

SA-9 SA EXTERNAL INFORMATION SYSTEM SERVICES

SA-9 (1) SA EXTERNAL INFORMATION SYSTEMS | RISK ASSESSMENTS / ORGANIZATIONAL APPROVALS SA-9 (2) SA EXTERNAL INFORMATION SYSTEMS | IDENTIFICATION OF FUNCTIONS / PORTS / PROTOCOLS / SERVICES SA-9 (5) SA EXTERNAL INFORMATION SYSTEMS | PROCESSING, STORAGE, AND SERVICE LOCATION

SA-10 SA DEVELOPER CONFIGURATION MANAGEMENT

SA-10 (1) SA DEVELOPER CONFIGURATION MANAGEMENT | SOFTWARE / FIRMWARE INTEGRITY VERIFICATION

SA-11 SA DEVELOPER SECURITY TESTING AND EVALUATION

SA-12 SA SUPPLY CHAIN PROTECTION

SA-15 SA DEVELOPMENT PROCESS, STANDARDS, AND TOOLS

SA-15 (9) SA DEVELOPMENT PROCESS, STANDARDS, AND TOOLS | USE OF LIVE DATA

SA-17 SA DEVELOPER SECURITY ARCHITECTURE AND DESIGN

SA-19 SA COMPONENT AUTHENTICITY

SA-21 SA DEVELOPER SCREENING

SC-2 SC APPLICATION PARTITIONING

SC-4 SC INFORMATION IN SHARED RESOURCES

SC-5 SC DENIAL OF SERVICE PROTECTION

SC-5 (1) SC DENIAL OF SERVICE PROTECTION | RESTRICT INTERNAL USERS

SC-5 (2) SC DENIAL OF SERVICE PROTECTION | EXCESS CAPACITY / BANDWIDTH / REDUNDANCY

SC-5 (3) SC DENIAL OF SERVICE PROTECTION | DETECTION / MONITORING

SC-7 SC BOUNDARY PROTECTION

SC-7 (3) SC BOUNDARY PROTECTION | ACCESS POINTS

SC-7 (4) SC BOUNDARY PROTECTION | EXTERNAL TELECOMMUNICATIONS SERVICES

SC-7 (5) SC BOUNDARY PROTECTION | DENY BY DEFAULT / ALLOW BY EXCEPTION

SC-7 (7) SC BOUNDARY PROTECTION | PREVENT SPLIT TUNNELING FOR REMOTE DEVICES

SC-7 (8) SC BOUNDARY PROTECTION | ROUTE TRAFFIC TO AUTHENTICATED PROXY SERVERS

SC-7 (9) SC BOUNDARY PROTECTION | RESTRICT THREATENING OUTGOING COMMUNICATIONS TRAFFIC

SC-7 (10) SC BOUNDARY PROTECTION | PREVENT UNAUTHORIZED EXFILTRATION

SC-7 (11) SC BOUNDARY PROTECTION | RESTRICT INCOMING COMMUNICATIONS TRAFFIC

SC-7 (12) SC BOUNDARY PROTECTION | HOST-BASED PROTECTION

SC-7 (13) SC BOUNDARY PROTECTION | ISOLATION OF SECURITY TOOLS / MECHANISMS / SUPPORT COMPONENTS

SC-7 (14) SC BOUNDARY PROTECTION | PROTECTS AGAINST UNAUTHORIZED PHYSICAL CONNECTION

SC-8 SC TRANSMISSION CONFIDENTIALITY AND INTEGRITY

SC-8 (1) SC TRANSMISSION CONFIDENTIALITY AND INTEGRITY | CRYPTOGRAPHIC OR ALTERNATE PHYSICAL PROTECTION SC-8 (2) SC TRANSMISSION CONFIDENTIALITY AND INTEGRITY | PRE / POST TRANSMISSION HANDLING

SC-10 SC NETWORK DISCONNECT

SC-12 SC CRYPTOGRAPHIC KEY ESTABLISHMENT AND MANAGEMENT

SC-13 SC CRYPTOGRAPHIC PROTECTION

SC-15 SC COLLABORATIVE COMPUTING DEVICES

SC-17 SC PUBLIC KEY INFRASTRUCTURE CERTIFICATES

SC-18 SC MOBILE CODE

SC-18 (1) SC MOBILE CODE | IDENTIFY UNACCEPTABLE CODE / TAKE CORRECTIVE ACTIONS

SC-18 (2) SC MOBILE CODE | ACQUISITION / DEVELOPMENT / USE

SC-18 (3) SC MOBILE CODE | PREVENT DOWNLOADING / EXECUTION

SC-18 (4) SC MOBILE CODE | PREVENT AUTOMATIC EXECUTION

SC-19 SC VOICE OVER INTERNET PROTOCOL

SC-20 SC SECURE NAME / ADDRESS RESOLUTION SERVICE (AUTHORITATIVE SOURCE)

SC-21 SC SECURE NAME / ADDRESS RESOLUTION SERVICE (RECURSIVE OR CACHING RESOLVER)

SC-22 SC ARCHITECTURE AND PROVISIONING FOR NAME / ADDRESS RESOLUTION SERVICE

SC-23 SC SESSION AUTHENTICITY

SC-23 (1) SC SESSION AUTHENTICITY | INVALIDATE SESSION IDENTIFIERS AT LOGOUT

SC-23 (3) SC SESSION AUTHENTICITY | UNIQUE SESSION IDENTIFIERS WITH RANDOMIZATION

SC-23 (5) SC SESSION AUTHENTICITY | ALLOWED CERTIFICATE AUTHORITIES

SC-28 SC PROTECTION OF INFORMATION AT REST

SC-28 (1) SC PROTECTION OF INFORMATION AT REST | CRYPTOGRAPHIC PROTECTION

SC-38 SC OPERATIONS SECURITY

SC-39 SC PROCESS ISOLATION

SI-2 SI FLAW REMEDIATION

SI-2 (1) SI FLAW REMEDIATION | CENTRAL MANAGEMENT

SI-2 (2) SI FLAW REMEDIATION | AUTOMATED FLAW REMEDIATION STATUS

SI-2 (3) SI FLAW REMEDIATION | TIME TO REMEDIATE FLAWS / BENCHMARKS FOR CORRECTIVE ACTIONS SI-2 (6) SI FLAW REMEDIATION | REMOVAL OF PREVIOUS VERSIONS OF SOFTWARE / FIRMWARE

SI-3 SI MALICIOUS CODE PROTECTION

SI-3 (1) SI MALICIOUS CODE PROTECTION | CENTRAL MANAGEMENT

SI-3 (2) SI MALICIOUS CODE PROTECTION | AUTOMATIC UPDATES

SI-3 (10) SI MALICIOUS CODE PROTECTION | MALICIOUS CODE ANALYSIS

SI-4 SI INFORMATION SYSTEM MONITORING

SI-4 (1) SI INFORMATION SYSTEM MONITORING | SYSTEM-WIDE INTRUSION DETECTION SYSTEM SI-4 (2) SI INFORMATION SYSTEM MONITORING | AUTOMATED TOOLS FOR REAL-TIME ANALYSIS SI-4 (4) SI INFORMATION SYSTEM MONITORING | INBOUND AND OUTBOUND COMMUNICATIONS TRAFFIC

SI-4 (5) SI INFORMATION SYSTEM MONITORING | SYSTEM-GENERATED ALERTS

SI-4 (10) SI INFORMATION SYSTEM MONITORING | VISIBILITY OF ENCRYPTED COMMUNICATIONS SI-4 (11) SI INFORMATION SYSTEM MONITORING | ANALYZE COMMUNICATIONS TRAFFIC ANOMALIES

SI-4 (12) SI INFORMATION SYSTEM MONITORING | AUTOMATED ALERTS

SI-4 (14) SI INFORMATION SYSTEM MONITORING | WIRELESS INTRUSION DETECTION

SI-4 (15) SI INFORMATION SYSTEM MONITORING | WIRELESS TO WIRELINE COMMUNICATIONS

SI-4 (16) SI INFORMATION SYSTEM MONITORING | CORRELATE MONITORING INFORMATION

SI-4 (19) SI INFORMATION SYSTEM MONITORING | INDIVIDUALS POSING GREATER RISK

SI-4 (20) SI INFORMATION SYSTEM MONITORING | PRIVILEGED USER

SI-4 (22) SI INFORMATION SYSTEM MONITORING | UNAUTHORIZED NETWORK SERVICES

SI-4 (23) SI INFORMATION SYSTEM MONITORING | HOST-BASED DEVICES

SI-5 SI SECURITY ALERTS, ADVISORIES, AND DIRECTIVES

SI-7 SI SOFTWARE, FIRMWARE, AND INFORMATION INTEGRITY

SI-7 (1) SI SOFTWARE, FIRMWARE, AND INFORMATION INTEGRITY | INTEGRITY CHECKS

SI-7 (6) SI SOFTWARE, FIRMWARE, AND INFORMATION INTEGRITY | CRYPTOGRAPHIC PROTECTION SI-7 (7) SI SOFTWARE, FIRMWARE, AND INFORMATION INTEGRITY | INTEGRATION OF DETECTION AND RESPONSE SI-7 (8) SI SOFTWARE, FIRMWARE, AND INFORMATION INTEGRITY | AUDITING CAPABILITY FOR SIGNIFICANT EVENTS SI-7 (14) SI SOFTWARE, FIRMWARE, AND INFORMATION INTEGRITY | BINARY OR MACHINE EXECUTABLE CODE

SI-8 SI SPAM PROTECTION

SI-8 (1) SI SPAM PROTECTION | CENTRAL MANAGEMENT

SI-8 (2) SI SPAM PROTECTION | AUTOMATIC UPDATES

SI-10 SI INFORMATION INPUT VALIDATION

SI-10 (3) SI INFORMATION INPUT VALIDATION | PREDICTABLE BEHAVIOR

SI-11 SI ERROR HANDLING

SI-12 SI INFORMATION HANDLING AND RETENTION

SI-16 SI MEMORY PROTECTION