The file's text, extracted by GovTribe without its formatting.
Test_2015-01-15-1052 [project acronym not provided] [Enter system number]
Requirements Traceability Matrix
(RTM)
Prepared for Department of Homeland Security
16 January 2015
CLASSIFICATION WAS NOT SELECTED
CLASSIFICATION WAS NOT SELECTED
Introduction
The Requirements Traceability Matrix (RTM) relates requirements from requirement source documents to the security certification process. It ensures that all security requirements are identified and investigated. Each row of the matrix identifies a specific requirement and provides the details of how it was tested or analyzed and the results.
The table is arranged to display the system security requirements from the applicable regulation documents, which are listed below:
· NIST 800-53 w/ DHS 4300A - Department of Homeland Security Sensitive Systems Policy Directive 4300A Version 10
The columns of the RTM are defined as follows:
| Control Ref. |
| Refers to the name (short title) of the source document and the ID or paragraph number of the listed control or requirement. |
Security Req./ Control Short title describing the security control or requirement (and the text of the control/requirement, which may be paraphrased for brevity).
| Security Category |
| Category and class associated with the security control. |
| Control Type |
| Auto populated if the requirement is identified with two security control types: common and system-specific; i.e., a part of the requirement is identified as common type and another part of it is system-specific. |
· Common. Auto populated if the requirement is designated to one or more information systems.
· Hybrid. Auto populated if the requirement is identified with two security control types: common and system-specific; i.e., a part of the requirement is identified as common type and another part of it is system-specific.
· System-Specific. Auto populated if the requirement is assigned to a specific information system.
· Inherited. Auto populated if the requirement is inherited from another system.
· Not Specified. Auto populated if the requirement does not require any security control.
| Planned Imp. |
| Auto populated if the requirement is identified with two security control types: common and system-specific; i.e., a part of the requirement is identified as common type and another part of it is system-specific. |
· Common. Auto populated if the requirement is designated to one or more information systems.
· Hybrid. Auto populated if the requirement is identified with two security control types: common and system-specific; i.e., a part of the requirement is identified as common type and another part of it is system-specific.
· System-Specific. Auto populated if the requirement is assigned to a specific information system.
· Inherited. Auto populated if the requirement is inherited from another system.
· Not Specified. Auto populated if the requirement does not require any security control.
| Actual Imp. |
| Identification whether the control is in place and how it has been implemented, or differences in how the control was implemented compared to what was planned. |
· As Planned. Auto populated if Implemented control status is selected and Planned Implementation column does not read Not Entered.
· Pending Implementation. Auto populated if Planned control status is selected and Planned Implementation column does not read Not Entered.
· Partially Implemented. Auto populated if Partial control status is selected and Planned Implementation column does not read Not Entered.
· Not Entered. Auto populated if the Planned Implementation column reads Not Entered.
· Not Assigned. Auto populated if the Control Type and/or Control Status were not selected.
| Test #(s) |
| The ID number of the specific test procedure(s) that is used to validate the requirement or control. |
· -. The control is not applicable.
| Methods |
| The evaluation method (or methods) used to assess the requirement. |
· I. Interview.
· E. Examine.
· T. Testing.
· -. The control is not applicable.
| Tailored |
| The tailored control that modifies the control set. |
· In. The control was tailored in.
· Out. The control was tailored out.
· - . The control was not affected from tailoring.
| Overlays |
| The controls included or excluded from the controls already in the baseline. |
· In. The control was added in to the controls in the baseline.
· Out. The control was removed from the controls in the baseline.
· - . The control was not affected from overlay(s).
| Result |
| The summarized result for the test procedures that cover the requirement/control. |
· Met - Requirement fully satisfied.
· Not Met - Requirement not satisfied.
· Not Applicable - Requirement not applicable.
| Notes |
| Identifies the factor, and the basis for; any tailoring of controls from the NIST 800-53 w/ DHS 4300A baseline or organizational overlay that was used for the system. |
i Requirements Traceability Matrix
| Control Ref. |
| Security Req./ |
Control
| Security Category |
| Control |
Type Planned Imp.
Actual Imp.
Test #(s)
| Methods |
| Tailored |
| Result |
| Notes |
| NIST 800-53 w/ DHS 4300A AC-1 |
| Access Control Policy and Procedures |
| Access Control Policy and Procedures (T) |
| Not Specified |
| Not Entered |
| Not Assigned |
| AC-1.1, AC-1.2 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A AC-1 (DHS-5.1.1.c) |
| Sharing of Personal Passwords |
| Access Control Policy and Procedures (T) |
| Not Specified |
| Not Entered |
| Not Assigned |
| AC-1(DHS-5.1.1.c) |
| - |
| X |
| X |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A AC-2 |
| Account Management |
| Account Management (T) |
| Not Specified |
| Not Entered |
| Not Assigned |
| AC-2.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A AC-2 (1) |
| Account Management |
| Account Management (T) |
| Not Specified |
| Not Entered |
| Not Assigned |
| AC-2(1).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A AC-2 (2) |
| Account Management |
| Account Management (T) |
| Not Specified |
| Not Entered |
| Not Assigned |
| AC-2(2).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A AC-2 (3) |
| Account Management |
| Account Management (T) |
| Not Specified |
| Not Entered |
| Not Assigned |
| AC-2(3).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A AC-2 (4) |
| Account Management |
| Account Management (T) |
| Not Specified |
| Not Entered |
| Not Assigned |
| AC-2(4).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A AC-2 (5) |
| Account Management |
| Account Management (T) |
| Not Specified |
| Not Entered |
| Not Assigned |
| AC-2(5).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A AC-2 (11) |
| Account Management |
| Account Management (T) |
| Not Specified |
| Not Entered |
| Not Assigned |
| AC-2(11).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A AC-3 |
| Access Enforcement |
| Access Enforcement (T) |
| Not Specified |
| Not Entered |
| Not Assigned |
| AC-3.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A AC-3 (DHS-5.1.1.d) |
| Access Enforcement |
| Access Enforcement (T) |
| Not Specified |
| Not Entered |
| Not Assigned |
| AC-3(DHS-5.1.1.d) |
| - |
| X |
| X |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A AC-4 |
| Information Flow Enforcement |
| Information Flow Enforcement (T) |
| Not Specified |
| Not Entered |
| Not Assigned |
| AC-4.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A AC-5 |
| Separation of Duties |
| Separation of Duties (T) |
| Not Specified |
| Not Entered |
| Not Assigned |
| AC-5.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A AC-6 |
| Least Privilege |
| Least Privilege (T) |
| Not Specified |
| Not Entered |
| Not Assigned |
| AC-6.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A AC-6 (1) |
| Least Privilege |
| Least Privilege (T) |
| Not Specified |
| Not Entered |
| Not Assigned |
| AC-6(1).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A AC-6 (2) |
| Least Privilege |
| Least Privilege (T) |
| Not Specified |
| Not Entered |
| Not Assigned |
| AC-6(2).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A AC-6 (3) |
| Least Privilege |
| Least Privilege (T) |
| Not Specified |
| Not Entered |
| Not Assigned |
| AC-6(3).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A AC-6 (5) |
| Least Privilege |
| Least Privilege (T) |
| Not Specified |
| Not Entered |
| Not Assigned |
| AC-6(5).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A AC-6 (9) |
| Least Privilege |
| Least Privilege (T) |
| Not Specified |
| Not Entered |
| Not Assigned |
| AC-6(9).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A AC-6 (10) |
| Least Privilege |
| Least Privilege (T) |
| Not Specified |
| Not Entered |
| Not Assigned |
| AC-6(10).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A AC-7 |
| Unsuccessful Logon Attempts |
| Unsuccessful Logon Attempts (T) |
| Not Specified |
| Not Entered |
| Not Assigned |
| AC-7.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A AC-8 |
| System Use Notification |
| System Use Notification (T) |
| Not Specified |
| Not Entered |
| Not Assigned |
| AC-8.1, AC-8.2 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A AC-8 (DHS-4.8.5.d) |
| System Use Notification |
| System Use Notification (T) |
| Not Specified |
| Not Entered |
| Not Assigned |
| AC-8(DHS-4.8.5.d) |
| - |
| X |
| X |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A AC-10 |
| Concurrent Session Control |
| Concurrent Session Control (T) |
| Not Specified |
| Not Entered |
| Not Assigned |
| AC-10.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A AC-11 |
| Session Lock |
| Session Lock (T) |
| Not Specified |
| Not Entered |
| Not Assigned |
| AC-11.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A AC-11 (1) |
| Session Lock |
| Session Lock (T) |
| Not Specified |
| Not Entered |
| Not Assigned |
| AC-11(1).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A AC-12 |
| Session Termination |
| Session Termination (T) |
| Not Specified |
| Not Entered |
| Not Assigned |
| AC-12.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A AC-14 |
| Permitted Actions without Identification or Authentication |
| Permitted Actions without Identification or Authentication (T) |
| Not Specified |
| Not Entered |
| Not Assigned |
| AC-14.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A AC-17 |
| Remote Access |
| Remote Access (T) |
| Not Specified |
| Not Entered |
| Not Assigned |
| AC-17.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A AC-17 (1) |
| Remote Access |
| Remote Access (T) |
| Not Specified |
| Not Entered |
| Not Assigned |
| AC-17(1).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A AC-17 (2) |
| Remote Access |
| Remote Access (T) |
| Not Specified |
| Not Entered |
| Not Assigned |
| AC-17(2).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A AC-17 (3) |
| Remote Access |
| Remote Access (T) |
| Not Specified |
| Not Entered |
| Not Assigned |
| AC-17(3).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A AC-17 (4) |
| Remote Access |
| Remote Access (T) |
| Not Specified |
| Not Entered |
| Not Assigned |
| AC-17(4).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A AC-17 (DHS-5.4.1.b) |
| Remote Access |
| Remote Access (T) |
| Not Specified |
| Not Entered |
| Not Assigned |
| AC-17(DHS-5.4.1.b) |
| X |
| X |
| X |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A AC-17 (DHS-5.4.1.c) |
| Remote Access |
| Remote Access (T) |
| Not Specified |
| Not Entered |
| Not Assigned |
| AC-17(DHS-5.4.1.c) |
| - |
| X |
| X |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A AC-18 |
| Wireless Access |
| Wireless Access (T) |
| Not Specified |
| Not Entered |
| Not Assigned |
| AC-18.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A AC-18 (1) |
| Wireless Access |
| Wireless Access (T) |
| Not Specified |
| Not Entered |
| Not Assigned |
| AC-18(1).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A AC-18 (4) |
| Wireless Access |
| Wireless Access (T) |
| Not Specified |
| Not Entered |
| Not Assigned |
| AC-18(4).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A AC-18 (5) |
| Wireless Access |
| Wireless Access (T) |
| Not Specified |
| Not Entered |
| Not Assigned |
| AC-18(5).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A AC-19 |
| Access Control for Mobile Devices |
| Access Control for Mobile Devices (T) |
| Not Specified |
| Not Entered |
| Not Assigned |
| AC-19.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A AC-19 (5) |
| Access Control for Mobile Devices |
| Access Control for Mobile Devices (T) |
| Not Specified |
| Not Entered |
| Not Assigned |
| AC-19(5).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A AC-20 |
| Use of External Information Systems |
| Use of External Information Systems (T) |
| Not Specified |
| Not Entered |
| Not Assigned |
| AC-20.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A AC-20 (1) |
| Use of External Information Systems |
| Use of External Information Systems (T) |
| Not Specified |
| Not Entered |
| Not Assigned |
| AC-20(1).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A AC-20 (2) |
| Use of External Information Systems |
| Use of External Information Systems (T) |
| Not Specified |
| Not Entered |
| Not Assigned |
| AC-20(2).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A AC-21 |
| User-Based Collaboration and Information Sharing |
| Information Sharing (T) |
| Not Specified |
| Not Entered |
| Not Assigned |
| AC-21.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A AC-22 |
| Publicly Accessible Content |
| Publicly Accessible Content (T) |
| Not Specified |
| Not Entered |
| Not Assigned |
| AC-22.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A AT-1 |
| Security Awareness and Training Policy and Procedures |
| Security Awareness and Training Policy and Procedures (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| AT-1.1, AT-1.2 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A AT-2 |
| Security Awareness |
| Security Awareness Training (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| AT-2.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A AT-2 (2) |
| Security Awareness |
| Security Awareness Training (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| AT-2(2).1, AT-2(2).1, AT-2(2).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A AT-3 |
| Security Training |
| Role-Based Security Training (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| AT-3.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A AT-4 |
| Security Training Records |
| Security Training Records (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| AT-4.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A AU-1 |
| Audit and Accountability Policy and Procedures |
| Audit and Accountability Policy and Procedures (T) |
| Not Specified |
| Not Entered |
| Not Assigned |
| AU-1.1, AU-1.2 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A AU-2 |
| Audit Events |
| Audit Events (T) |
| Not Specified |
| Not Entered |
| Not Assigned |
| AU-2.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A AU-2 (3) |
| Auditable Events |
| Audit Events (T) |
| Not Specified |
| Not Entered |
| Not Assigned |
| AU-2(3).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A AU-3 |
| Content of Audit Records |
| Content of Audit Records (T) |
| Not Specified |
| Not Entered |
| Not Assigned |
| AU-3.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A AU-3 (1) |
| Content of Audit Records |
| Content of Audit Records (T) |
| Not Specified |
| Not Entered |
| Not Assigned |
| AU-3(1).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A AU-3 (2) |
| Content of Audit Records |
| Content of Audit Records (T) |
| Not Specified |
| Not Entered |
| Not Assigned |
| AU-3(2).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A AU-4 |
| Audit Storage Capacity |
| Audit Storage Capacity (T) |
| Not Specified |
| Not Entered |
| Not Assigned |
| AU-4.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A AU-5 |
| Response to Audit Processing Failures |
| Response to Audit Processing Failures (T) |
| Not Specified |
| Not Entered |
| Not Assigned |
| AU-5.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A AU-5 (1) |
| Response to Audit Processing Failures |
| Response to Audit Processing Failures (T) |
| Not Specified |
| Not Entered |
| Not Assigned |
| AU-5(1).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A AU-5 (2) |
| Response to Audit Processing Failures |
| Response to Audit Processing Failures (T) |
| Not Specified |
| Not Entered |
| Not Assigned |
| AU-5(2).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A AU-6 |
| Audit Review, Analysis, and Reporting |
| Audit Review, Analysis, and Reporting (T) |
| Not Specified |
| Not Entered |
| Not Assigned |
| AU-6.1, AU-6.2 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A AU-6 (1) |
| Audit Review, Analysis, and Reporting |
| Audit Review, Analysis, and Reporting (T) |
| Not Specified |
| Not Entered |
| Not Assigned |
| AU-6(1).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A AU-6 (3) |
| Audit Review, Analysis, and Reporting |
| Audit Review, Analysis, and Reporting (T) |
| Not Specified |
| Not Entered |
| Not Assigned |
| AU-6(3).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A AU-6 (5) |
| Audit Review, Analysis, and Reporting |
| Audit Review, Analysis, and Reporting (T) |
| Not Specified |
| Not Entered |
| Not Assigned |
| AU-6(5).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A AU-6 (6) |
| Audit Review, Analysis, and Reporting |
| Audit Review, Analysis, and Reporting (T) |
| Not Specified |
| Not Entered |
| Not Assigned |
| AU-6(6).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A AU-6 (DHS-5.3.b) |
| Audit Review, Analysis, and Reporting |
| Audit Review, Analysis, and Reporting (T) |
| Not Specified |
| Not Entered |
| Not Assigned |
| AU-6(DHS-5.3.b) |
| X |
| X |
| X |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A AU-6 (DHS-5.4.6.f) |
| Audit Review, Analysis, and Reporting |
| Audit Review, Analysis, and Reporting (T) |
| Not Specified |
| Not Entered |
| Not Assigned |
| AU-6(DHS-5.4.6.f) |
| X |
| X |
| X |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A AU-7 |
| Audit Reduction and Report Generation |
| Audit Reduction and Report Generation (T) |
| Not Specified |
| Not Entered |
| Not Assigned |
| AU-7.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A AU-7 (1) |
| Audit Reduction and Report Generation |
| Audit Reduction and Report Generation (T) |
| Not Specified |
| Not Entered |
| Not Assigned |
| AU-7(1).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A AU-8 |
| Time Stamps |
| Time Stamps (T) |
| Not Specified |
| Not Entered |
| Not Assigned |
| AU-8.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A AU-8 (1) |
| Time Stamps |
| Time Stamps (T) |
| Not Specified |
| Not Entered |
| Not Assigned |
| AU-8(1).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A AU-9 |
| Protection of Audit Information |
| Protection of Audit Information (T) |
| Not Specified |
| Not Entered |
| Not Assigned |
| AU-9.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A AU-9 (2) |
| Protection of Audit Information |
| Protection of Audit Information (T) |
| Not Specified |
| Not Entered |
| Not Assigned |
| AU-9(2).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A AU-9 (3) |
| Protection of Audit Information |
| Protection of Audit Information (T) |
| Not Specified |
| Not Entered |
| Not Assigned |
| AU-9(3).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A AU-9 (4) |
| Protection of Audit Information |
| Protection of Audit Information (T) |
| Not Specified |
| Not Entered |
| Not Assigned |
| AU-9(4).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A AU-10 |
| Non-repudiation |
| Non-repudiation (T) |
| Not Specified |
| Not Entered |
| Not Assigned |
| AU-10.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A AU-11 |
| Audit Record Retention |
| Audit Record Retention (T) |
| Not Specified |
| Not Entered |
| Not Assigned |
| AU-11.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A AU-11 (DHS-5.3.d) |
| Audit Record Retention |
| Audit Record Retention (T) |
| Not Specified |
| Not Entered |
| Not Assigned |
| AU-11(DHS-5.3.d) |
| X |
| X |
| X |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A AU-12 |
| Audit Generation |
| Audit Generation (T) |
| Not Specified |
| Not Entered |
| Not Assigned |
| AU-12.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A AU-12 (1) |
| Audit Generation |
| Audit Generation (T) |
| Not Specified |
| Not Entered |
| Not Assigned |
| AU-12(1).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A AU-12 (3) |
| Audit Generation |
| Audit Generation (T) |
| Not Specified |
| Not Entered |
| Not Assigned |
| AU-12(3).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A CA-1 |
| Security Assessment and Authorization Policies and Procedures |
| Security Assessment and Authorization Policies and Procedures (M) |
| Not Specified |
| Not Entered |
| Not Assigned |
| CA-1.1, CA-1.2 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A CA-1 (DHS-3.9.m) |
| Security Assessment and Authorization Policies and Procedures |
| Security Assessment and Authorization Policies and Procedures (M) |
| Not Specified |
| Not Entered |
| Not Assigned |
| CA-1(DHS-3.9.m) |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A CA-1 (DHS-3.18.c) |
| Security Assessment and Authorization Policies and Procedures |
| Security Assessment and Authorization Policies and Procedures (M) |
| Not Specified |
| Not Entered |
| Not Assigned |
| CA-1(DHS-3.18.c) |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A CA-1 (DHS-3.18.d) |
| Security Assessment and Authorization Policies and Procedures |
| Security Assessment and Authorization Policies and Procedures (M) |
| Not Specified |
| Not Entered |
| Not Assigned |
| CA-1(DHS-3.18.d) |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A CA-1 (DHS-3.18.e) |
| Security Assessment and Authorization Policies and Procedures |
| Security Assessment and Authorization Policies and Procedures (M) |
| Not Specified |
| Not Entered |
| Not Assigned |
| CA-1(DHS-3.18.e) |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A CA-2 |
| Security Assessments |
| Security Assessments (M) |
| Not Specified |
| Not Entered |
| Not Assigned |
| CA-2.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A CA-2 (1) |
| Security Assessments |
| Security Assessments (M) |
| Not Specified |
| Not Entered |
| Not Assigned |
| CA-2(1).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A CA-2 (2) |
| Security Assessments |
| Security Assessments (M) |
| Not Specified |
| Not Entered |
| Not Assigned |
| CA-2(2).1, CA-2.2 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A CA-2 (DHS-3.18.b) |
| Security Assessments |
| Security Assessments (M) |
| Not Specified |
| Not Entered |
| Not Assigned |
| CA-2(DHS-3.18.b) |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A CA-3 |
| Information System Connections |
| System Interconnections (M) |
| Not Specified |
| Not Entered |
| Not Assigned |
| CA-3.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A CA-3 (5) |
| Information System Connections |
| System Interconnections (M) |
| Not Specified |
| Not Entered |
| Not Assigned |
| CA-3(5).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A CA-3 (DHS-5.4.3.b) |
| Information System Connections |
| System Interconnections (M) |
| Not Specified |
| Not Entered |
| Not Assigned |
| CA-3(DHS-5.4.3.b) |
| X |
| X |
| X |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A CA-3 (DHS-5.4.3.c) |
| Information System Connections |
| System Interconnections (M) |
| Not Specified |
| Not Entered |
| Not Assigned |
| CA-3(DHS-5.4.3.c) |
| X |
| X |
| X |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A CA-3 (DHS-5.4.3.d) |
| Information System Connections |
| System Interconnections (M) |
| Not Specified |
| Not Entered |
| Not Assigned |
| CA-3(DHS-5.4.3.d) |
| X |
| X |
| X |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A CA-3 (DHS-5.4.3.f) |
| Information System Connections |
| System Interconnections (M) |
| Not Specified |
| Not Entered |
| Not Assigned |
| CA-3(DHS-5.4.3.f) |
| X |
| X |
| X |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A CA-3 (DHS-5.4.3.m) |
| Information System Connections |
| System Interconnections (M) |
| Not Specified |
| Not Entered |
| Not Assigned |
| CA-3(DHS-5.4.3.m) |
| X |
| X |
| X |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A CA-3 (DHS-5.4.3.n) |
| Information System Connections |
| System Interconnections (M) |
| Not Specified |
| Not Entered |
| Not Assigned |
| CA-3(DHS-5.4.3.n) |
| X |
| X |
| X |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A CA-5 |
| Plan of Action and Milestones |
| Plan of Action and Milestones (M) |
| Not Specified |
| Not Entered |
| Not Assigned |
| CA-5.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A CA-5 (DHS-2.2.8.d) |
| Plan of Action and Milestones |
| Plan of Action and Milestones (M) |
| Not Specified |
| Not Entered |
| Not Assigned |
| CA-5(DHS-2.2.8.d) |
| X |
| X |
| X |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A CA-6 |
| Security Authorization |
| Security Authorization (M) |
| Not Specified |
| Not Entered |
| Not Assigned |
| CA-6.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A CA-6 (DHS-3.9.h) |
| Security Authorization |
| Security Authorization (M) |
| Not Specified |
| Not Entered |
| Not Assigned |
| CA-6(DHS-3.9.h) |
| X |
| X |
| X |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A CA-7 |
| Continuous Monitoring |
| Continuous Monitoring (M) |
| Not Specified |
| Not Entered |
| Not Assigned |
| CA-7.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A CA-7 (1) |
| Continuous Monitoring |
| Continuous Monitoring (M) |
| Not Specified |
| Not Entered |
| Not Assigned |
| CA-7(1).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A CA-7 (DHS-4.6.3.a) |
| Continuous Monitoring |
| Continuous Monitoring (M) |
| Not Specified |
| Not Entered |
| Not Assigned |
| CA-7(DHS-4.6.3.a) |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A CA-8 |
| Penetration Testing |
| Penetration Testing (M) |
| Not Specified |
| Not Entered |
| Not Assigned |
| CA-8.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A CA-9 |
| Internal System Connections |
| Internal System Connections (M) |
| Not Specified |
| Not Entered |
| Not Assigned |
| CA-9.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A CM-1 |
| Configuration Management Policy and Procedures |
| Configuration Management Policy and Procedures (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| CM-1.1, CM-1.2 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A CM-2 |
| Baseline Configuration |
| Baseline Configuration (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| CM-2.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A CM-2 (1) |
| Baseline Configuration |
| Baseline Configuration (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| CM-2(1).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A CM-2 (2) |
| Baseline Configuration |
| Baseline Configuration (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| CM-2(2).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A CM-2 (3) |
| Baseline Configuration |
| Baseline Configuration (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| CM-2(3).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A CM-2 (7) |
| Baseline Configuration |
| Baseline Configuration (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| CM-2(7).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A CM-2 (DHS-3.9.b) |
| Baseline Configuration |
| Baseline Configuration (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| CM-2(DHS-3.9.b) |
| - |
| X |
| X |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A CM-2 (DHS-4.12.b) |
| Baseline Configuration |
| Baseline Configuration (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| CM-2(DHS-4.12.b) |
| X |
| X |
| X |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A CM-3 |
| Configuration Change Control |
| Configuration Change Control (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| CM-3.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A CM-3 (1) |
| Configuration Change Control |
| Configuration Change Control (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| CM-3(1).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A CM-3 (2) |
| Configuration Change Control |
| Configuration Change Control (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| CM-3(2).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A CM-3 (DHS-2.1.8.g) |
| Configuration Change Control |
| Configuration Change Control (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| CM-3(DHS-2.1.8.g) |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A CM-3 (DHS-5.4.3.l) |
| Configuration Change Control |
| Configuration Change Control (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| CM-3(DHS-5.4.3.l) |
| X |
| X |
| X |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A CM-4 |
| Security Impact Analysis |
| Security Impact Analysis (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| CM-4.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A CM-4 (1) |
| Security Impact Analysis |
| Security Impact Analysis (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| CM-4(1).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A CM-5 |
| Access Restrictions for Change |
| Access Restrictions for Change (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| CM-5.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A CM-5 (1) |
| Access Restrictions for Change |
| Access Restrictions for Change (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| CM-5(1).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A CM-5 (2) |
| Access Restrictions for Change |
| Access Restrictions for Change (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| CM-5(2).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A CM-5 (3) |
| Access Restrictions for Change |
| Access Restrictions for Change (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| CM-5(3).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A CM-6 |
| Configuration Settings |
| Configuration Settings (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| CM-6.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A CM-6 (1) |
| Configuration Settings |
| Configuration Settings (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| CM-6(1).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A CM-6 (2) |
| Configuration Settings |
| Configuration Settings (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| CM-6(2).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A CM-6 (DHS-3.7.e) |
| Configuration Settings |
| Configuration Settings (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| CM-6(DHS-3.7.e) |
| X |
| X |
| X |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A CM-6 (DHS-3.7.f) |
| Configuration Settings |
| Configuration Settings (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| CM-6(DHS-3.7.f) |
| X |
| X |
| X |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A CM-6 (DHS-3.7.g) |
| Configuration Settings |
| Configuration Settings (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| CM-6(DHS-3.7.g) |
| X |
| X |
| X |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A CM-6 (DHS-4.5.2.b) |
| Configuration Settings |
| Configuration Settings (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| CM-6(DHS-4.5.2.b) |
| X |
| X |
| X |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A CM-6 (DHS-4.8.4.a) |
| Configuration Settings |
| Configuration Settings (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| CM-6(DHS-4.8.4.a) |
| X |
| X |
| X |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A CM-6 (DHS-4.12.f) |
| Configuration Settings |
| Configuration Settings (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| CM-6(DHS-4.12.f) |
| X |
| X |
| X |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A CM-6 (DHS-4.12.j) |
| Configuration Settings |
| Configuration Settings (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| CM-6(DHS-4.12.j) |
| X |
| X |
| X |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A CM-6 (DHS-5.4.5.d) |
| Configuration Settings |
| Configuration Settings (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| CM-6(DHS-5.4.5.d) |
| X |
| X |
| X |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A CM-6 (DHS-5.4.5.e) |
| Configuration Settings |
| Configuration Settings (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| CM-6(DHS-5.4.5.e) |
| X |
| X |
| X |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A CM-7 |
| Least Functionality |
| Least Functionality (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| CM-7.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A CM-7 (1) |
| Least Functionality |
| Least Functionality (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| CM-7(1).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A CM-7 (2) |
| Least Functionality |
| Least Functionality (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| CM-7(2).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A CM-7 (5) |
| Least Functionality |
| Least Functionality (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| CM-7(5).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A CM-7 (DHS-4.8.6.a) |
| Least Functionality |
| Least Functionality (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| CM-7(DHS-4.8.6.a) |
| - |
| X |
| X |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A CM-7 (DHS-5.4.5.f) |
| Least Functionality |
| Least Functionality (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| CM-7(DHS-5.4.5.f) |
| X |
| X |
| X |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A CM-8 |
| Information System Component Inventory |
| Information System Component Inventory (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| CM-8.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A CM-8 (1) |
| Information System Component Inventory |
| Information System Component Inventory (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| CM-8(1).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A CM-8 (2) |
| Information System Component Inventory |
| Information System Component Inventory (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| CM-8(2).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A CM-8 (3) |
| Information System Component Inventory |
| Information System Component Inventory (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| CM-8(3).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A CM-8 (4) |
| Information System Component Inventory |
| Information System Component Inventory (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| CM-8(4).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A CM-8 (5) |
| Information System Component Inventory |
| Information System Component Inventory (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| CM-8(5).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A CM-9 |
| Configuration Management Plan |
| Configuration Management Plan (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| CM-9.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A CM-10 |
| Software Usage Restrictions |
| SW Usage Restrictions (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| CM-10.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A CM-11 |
| User-Installed Software |
| User-Installed SW (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| CM-11.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A CP-1 |
| Contingency Planning Policy and Procedures |
| Contingency Planning Policy and Procedures (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| CP-1.1, CP-1.2 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A CP-1 (DHS-3.5.1.a) |
| Contingency Planning Policy and Procedures |
| Contingency Planning Policy and Procedures (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| CP-1(DHS-3.5.1.a) |
| X |
| X |
| X |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A CP-1 (DHS-3.5.2.d) |
| Contingency Planning Policy and Procedures |
| Contingency Planning Policy and Procedures (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| CP-1(DHS-3.5.2.d) |
| X |
| X |
| X |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A CP-2 |
| Contingency Plan |
| Contingency Plan (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| CP-2.1, CP-2.2 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A CP-2 (1) |
| Contingency Plan |
| Contingency Plan (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| CP-2(1).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A CP-2 (2) |
| Contingency Plan |
| Contingency Plan (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| CP-2(2).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A CP-2 (3) |
| Contingency Plan |
| Contingency Plan (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| CP-2(3).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A CP-2 (4) |
| Contingency Plan |
| Contingency Plan (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| CP-2(4).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A CP-2 (5) |
| Contingency Plan |
| Contingency Plan (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| CP-2(5).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A CP-2 (8) |
| Contingency Plan |
| Contingency Plan (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| CP-2(8).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A CP-2 (DHS-3.5.2.e) |
| Contingency Plan |
| Contingency Plan (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| CP-2(DHS-3.5.2.e) |
| X |
| X |
| X |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A CP-3 |
| Contingency Training |
| Contingency Training (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| CP-3.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A CP-3 (1) |
| Contingency Training |
| Contingency Training (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| CP-3(1).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A CP-4 |
| Contingency Plan Testing and Exercises |
| Contingency Plan Testing (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| CP-4.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A CP-4 (1) |
| Contingency Plan Testing and Exercises |
| Contingency Plan Testing (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| CP-4(1).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A CP-4 (2) |
| Contingency Plan Testing and Exercises |
| Contingency Plan Testing (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| CP-4(2).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A CP-4 (DHS-3.5.2.f) |
| Contingency Plan Testing and Exercises |
| Contingency Plan Testing (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| CP-4(DHS-3.5.2.f) |
| X |
| X |
| X |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A CP-6 |
| Alternate Storage Site |
| Alternate Storage Site (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| CP-6.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A CP-6 (1) |
| Alternate Storage Site |
| Alternate Storage Site (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| CP-6(1).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A CP-6 (2) |
| Alternate Storage Site |
| Alternate Storage Site (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| CP-6(2).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A CP-6 (3) |
| Alternate Storage Site |
| Alternate Storage Site (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| CP-6(3).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A CP-7 |
| Alternate Processing Site |
| Alternate Processing Site (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| CP-7.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A CP-7 (1) |
| Alternate Processing Site |
| Alternate Processing Site (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| CP-7(1).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A CP-7 (2) |
| Alternate Processing Site |
| Alternate Processing Site (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| CP-7(2).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A CP-7 (3) |
| Alternate Processing Site |
| Alternate Processing Site (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| CP-7(3).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A CP-7 (4) |
| Alternate Processing Site |
| Alternate Processing Site (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| CP-7(4).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A CP-8 |
| Telecommunications Services |
| Telecommunications Services (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| CP-8.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A CP-8 (1) |
| Telecommunications Services |
| Telecommunications Services (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| CP-8(1).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A CP-8 (2) |
| Telecommunications Services |
| Telecommunications Services (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| CP-8(2).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A CP-8 (3) |
| Telecommunications Services |
| Telecommunications Services (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| CP-8(3).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A CP-8 (4) |
| Telecommunications Services |
| Telecommunications Services (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| CP-8(4).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A CP-9 |
| Information System Backup |
| Information System Backup (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| CP-9.1, CP-9.2 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A CP-9 (1) |
| Information System Backup |
| Information System Backup (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| CP-9(1).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A CP-9 (2) |
| Information System Backup |
| Information System Backup (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| CP-9(2).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A CP-9 (3) |
| Information System Backup |
| Information System Backup (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| CP-9(3).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A CP-9 (5) |
| Information System Backup |
| Information System Backup (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| CP-9(5).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A CP-10 |
| Information System Recovery and Reconstitution |
| Information System Recovery and Reconstitution (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| CP-10.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A CP-10 (2) |
| Information System Recovery and Reconstitution |
| Information System Recovery and Reconstitution (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| CP-10(2).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A CP-10 (4) |
| Information System Recovery and Reconstitution |
| Information System Recovery and Reconstitution (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| CP-10(4).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A IA-1 |
| Identification and Authentication Policy and Procedures |
| Identification and Authentication Policy and Procedures (T) |
| Not Specified |
| Not Entered |
| Not Assigned |
| IA-1.1, IA-1.2 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A IA-1 (DHS-1.6.d) |
| Identification and Authentication Policy and Procedures |
| Identification and Authentication Policy and Procedures (T) |
| Not Specified |
| Not Entered |
| Not Assigned |
| IA-1(DHS-1.6.d) |
| X |
| X |
| X |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A IA-1 (DHS-3.14.7.a) |
| Identification and Authentication Policy and Procedures |
| Identification and Authentication Policy and Procedures (T) |
| Not Specified |
| Not Entered |
| Not Assigned |
| IA-1(DHS-3.14.7.a) |
| X |
| X |
| X |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A IA-1 (DHS-3.14.7.c) |
| Identification and Authentication Policy and Procedures |
| Identification and Authentication Policy and Procedures (T) |
| Not Specified |
| Not Entered |
| Not Assigned |
| IA-1(DHS-3.14.7.c) |
| X |
| X |
| X |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A IA-1 (DHS-3.14.7.f) |
| Identification and Authentication Policy and Procedures |
| Identification and Authentication Policy and Procedures (T) |
| Not Specified |
| Not Entered |
| Not Assigned |
| IA-1(DHS-3.14.7.f) |
| X |
| X |
| X |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A IA-2 |
| Identification and Authentication (Organizational Users) |
| Identification and Authentication (Organizational Users) (T) |
| Not Specified |
| Not Entered |
| Not Assigned |
| IA-2.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A IA-2 (1) |
| Identification and Authentication (Organizational Users) |
| Identification and Authentication (Organizational Users) (T) |
| Not Specified |
| Not Entered |
| Not Assigned |
| IA-2(1).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A IA-2 (2) |
| Identification and Authentication (Organizational Users) |
| Identification and Authentication (Organizational Users) (T) |
| Not Specified |
| Not Entered |
| Not Assigned |
| IA-2(2).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A IA-2 (3) |
| Identification and Authentication (Organizational Users) |
| Identification and Authentication (Organizational Users) (T) |
| Not Specified |
| Not Entered |
| Not Assigned |
| IA-2(3).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A IA-2 (4) |
| Identification and Authentication (Organizational Users) |
| Identification and Authentication (Organizational Users) (T) |
| Not Specified |
| Not Entered |
| Not Assigned |
| IA-2(4).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A IA-2 (8) |
| Identification and Authentication (Organizational Users) |
| Identification and Authentication (Organizational Users) (T) |
| Not Specified |
| Not Entered |
| Not Assigned |
| IA-2(8).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A IA-2 (9) |
| Identification and Authentication (Organizational Users) |
| Identification and Authentication (Organizational Users) (T) |
| Not Specified |
| Not Entered |
| Not Assigned |
| IA-2(9).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A IA-2 (11) |
| Identification and Authentication (Organizational Users) |
| Identification and Authentication (Organizational Users) (T) |
| Not Specified |
| Not Entered |
| Not Assigned |
| IA-2(11).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A IA-2 (12) |
| Identification and Authentication (Organizational Users) |
| Identification and Authentication (Organizational Users) (T) |
| Not Specified |
| Not Entered |
| Not Assigned |
| IA-2(12).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A IA-2 (DHS-5.1.d) |
| Identification and Authentication (Organizational Users) |
| Identification and Authentication (Organizational Users) (T) |
| Not Specified |
| Not Entered |
| Not Assigned |
| IA-2(DHS-5.1.d) |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A IA-3 |
| Device Identification and Authentication |
| Device Identification and Authentication (T) |
| Not Specified |
| Not Entered |
| Not Assigned |
| IA-3.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A IA-4 |
| Identifier Management |
| Identifier Management (T) |
| Not Specified |
| Not Entered |
| Not Assigned |
| IA-4.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A IA-5 |
| Authenticator Management |
| Authenticator Management (T) |
| Not Specified |
| Not Entered |
| Not Assigned |
| IA-5.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A IA-5 (1) |
| Authenticator Management |
| Authenticator Management (T) |
| Not Specified |
| Not Entered |
| Not Assigned |
| IA-5(1).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A IA-5 (2) |
| Authenticator Management |
| Authenticator Management (T) |
| Not Specified |
| Not Entered |
| Not Assigned |
| IA-5(2).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A IA-5 (3) |
| Authenticator Management |
| Authenticator Management (T) |
| Not Specified |
| Not Entered |
| Not Assigned |
| IA-5(3).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A IA-5 (11) |
| Authenticator Management |
| Authenticator Management (T) |
| Not Specified |
| Not Entered |
| Not Assigned |
| IA-5(11).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A IA-5 (DHS-5.1.e) |
| Authenticator Management |
| Authenticator Management (T) |
| Not Specified |
| Not Entered |
| Not Assigned |
| IA-5(DHS-5.1.e) |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A IA-6 |
| Authenticator Feedback |
| Authenticator Feedback (T) |
| Not Specified |
| Not Entered |
| Not Assigned |
| IA-6.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A IA-7 |
| Cryptographic Module Authentication |
| Cryptographic Module Authentication (T) |
| Not Specified |
| Not Entered |
| Not Assigned |
| IA-7.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A IA-8 |
| Identification and Authentication (Non-Organizational Users) |
| Identification and Authentication (Non-Organizational Users) (T) |
| Not Specified |
| Not Entered |
| Not Assigned |
| IA-8.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A IA-8 (1) |
| Identification and Authentication (Non-Organizational Users) |
| Identification and Authentication (Non-Organizational Users) (T) |
| Not Specified |
| Not Entered |
| Not Assigned |
| IA-8(1).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A IA-8 (2) |
| Identification and Authentication (Non-Organizational Users) |
| Identification and Authentication (Non-Organizational Users) (T) |
| Not Specified |
| Not Entered |
| Not Assigned |
| IA-8(2).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A IA-8 (3) |
| Identification and Authentication (Non-Organizational Users) |
| Identification and Authentication (Non-Organizational Users) (T) |
| Not Specified |
| Not Entered |
| Not Assigned |
| IA-8(3).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A IA-8 (4) |
| Identification and Authentication (Non-Organizational Users) |
| Identification and Authentication (Non-Organizational Users) (T) |
| Not Specified |
| Not Entered |
| Not Assigned |
| IA-8(4).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A IA-8 (DHS-1.5.4.c) |
| Identification and Authentication (Non-Organizational Users) |
| Identification and Authentication (Non-Organizational Users) (T) |
| Not Specified |
| Not Entered |
| Not Assigned |
| IA-8(DHS-1.5.4.c) |
| X |
| X |
| X |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A IR-1 |
| Incident Response Policy and Procedures |
| Incident Response Policy and Procedures (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| IR-1.1, IR-1.2 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A IR-2 |
| Incident Response Training |
| Incident Response Training (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| IR-2.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A IR-2 (1) |
| Incident Response Training |
| Incident Response Training (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| IR-2(1).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A IR-2 (2) |
| Incident Response Training |
| Incident Response Training (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| IR-2(2).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A IR-3 |
| Incident Response Testing and Exercises |
| Incident Response Testing (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| IR-3.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A IR-3 (2) |
| Incident Response Testing and Exercises |
| Incident Response Testing (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| IR-3(2).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A IR-4 |
| Incident Handling |
| Incident Handling (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| IR-4.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A IR-4 (1) |
| Incident Handling |
| Incident Handling (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| IR-4(1).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A IR-4 (4) |
| Incident Handling |
| Incident Handling (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| IR-4(4).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A IR-5 |
| Incident Monitoring |
| Incident Monitoring (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| IR-5.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A IR-5 (1) |
| Incident Monitoring |
| Incident Monitoring (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| IR-5(1).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A IR-6 |
| Incident Reporting |
| Incident Reporting (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| IR-6.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A IR-6 (1) |
| Incident Reporting |
| Incident Reporting (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| IR-6(1).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A IR-7 |
| Incident Response Assistance |
| Incident Response Assistance (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| IR-7.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A IR-7 (1) |
| Incident Response Assistance |
| Incident Response Assistance (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| IR-7(1).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A IR-8 |
| Incident Response Plan |
| Incident Response Plan (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| IR-8.1, IR-8.2 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A MA-1 |
| System Maintenance Policy and Procedures |
| System Maintenance Policy and Procedures (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| MA-1.1, MA-1.2 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A MA-2 |
| Controlled Maintenance |
| Controlled Maintenance (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| MA-2.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A MA-2 (2) |
| Controlled Maintenance |
| Controlled Maintenance (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| MA-2(2).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A MA-3 |
| Maintenance Tools |
| Maintenance Tools (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| MA-3.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A MA-3 (1) |
| Maintenance Tools |
| Maintenance Tools (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| MA-3(1).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A MA-3 (2) |
| Maintenance Tools |
| Maintenance Tools (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| MA-3(2).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A MA-3 (3) |
| Maintenance Tools |
| Maintenance Tools (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| MA-3(3).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A MA-4 |
| Non-Local Maintenance |
| Nonlocal Maintenance (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| MA-4.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A MA-4 (2) |
| Non-Local Maintenance |
| Nonlocal Maintenance (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| MA-4(2).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A MA-4 (3) |
| Non-Local Maintenance |
| Nonlocal Maintenance (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| MA-4(3).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A MA-4 (DHS-5.4.4.c) |
| Non-Local Maintenance |
| Nonlocal Maintenance (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| MA-4(DHS-5.4.4.c) |
| X |
| X |
| X |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A MA-5 |
| Maintenance Personnel |
| Maintenance Personnel (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| MA-5.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A MA-5 (1) |
| Maintenance Personnel |
| Maintenance Personnel (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| MA-5(1).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A MA-6 |
| Timely Maintenance |
| Timely Maintenance (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| MA-6.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A MP-1 |
| Media Protection Policy and Procedures |
| Media Protection Policy and Procedures (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| MP-1.1, MP-1.2 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A MP-1 (DHS-3.14.5.b) |
| Media Protection Policy and Procedures |
| Media Protection Policy and Procedures (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| MP-1(DHS-3.14.5.b) |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A MP-1 (DHS-4.3.1.g) |
| Media Protection Policy and Procedures |
| Media Protection Policy and Procedures (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| MP-1(DHS-4.3.1.g) |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A MP-1 (DHS-5.4.1.d) |
| Media Protection Policy and Procedures |
| Media Protection Policy and Procedures (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| MP-1(DHS-5.4.1.d) |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A MP-1 (DHS-5.6.c) |
| Media Protection Policy and Procedures |
| Media Protection Policy and Procedures (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| MP-1(DHS-5.6.c) |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A MP-2 |
| Media Access |
| Media Access (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| MP-2.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A MP-3 |
| Media Marking |
| Media Marking (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| MP-3.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A MP-4 |
| Media Storage |
| Media Storage (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| MP-4.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A MP-4 (DHS-3.14.5.f) |
| Media Storage |
| Media Protection Policy and Procedures (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| MP-4(DHS-3.14.5.f) |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A MP-5 |
| Media Transport |
| Media Transport (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| MP-5.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A MP-5 (4) |
| Media Transport |
| Media Transport (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| MP-5(4).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A MP-5 (DHS-4.11.f) |
| Media Transport |
| Media Transport (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| MP-5(DHS-4.11.f) |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A MP-6 |
| Media Sanitization |
| Media Sanitization (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| MP-6.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A MP-6 (1) |
| Media Sanitization |
| Media Sanitization (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| MP-6(1).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A MP-6 (2) |
| Media Sanitization |
| Media Sanitization (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| MP-6(2).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A MP-6 (3) |
| Media Sanitization |
| Media Sanitization (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| MP-6(3).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A MP-7 |
| Media Use |
| Media Use (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| MP-7.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A MP-7 (1) |
| Prohibit Use Without Owner |
| Media Use (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| MP-7(1).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A MP-7 (DHS-4.3.1.d) |
| USB Drive encryption |
| Media Use (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| MP-7(DHS-4.3.1.d) |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A MP-7 (DHS-4.3.1.e) |
| DHS owned Removable Media |
| Media Use (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| MP-7(DHS-4.3.1.e) |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A MP-7 (DHS-4.3.1.f) |
| Protection of Sensitive Paper and Electronic Outputs |
| Media Use (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| MP-7(DHS-4.3.1.f) |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A PE-1 |
| Physical and Environmental Protection Policy and Procedures |
| Physical and Environmental Protection Policy and Procedures (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| PE-1.1, PE-1.2 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A PE-1 (DHS-3.3.c) |
| Physical and Environmental Protection Policy and Procedures |
| Physical and Environmental Protection Policy and Procedures (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| PE-1(DHS-3.3.c) |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A PE-1 (DHS-4.6.2.3.b) |
| Physical and Environmental Protection Policy and Procedures |
| Physical and Environmental Protection Policy and Procedures (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| PE-1(DHS-4.6.2.3.b) |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A PE-2 |
| Physical Access Authorizations |
| Physical Access Authorizations (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| PE-2.1, PE-2.2 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A PE-3 |
| Physical Access Control |
| Physical Access Control (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| PE-3.1, PE-3.2 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A PE-3 (1) |
| Physical Access Control |
| Physical Access Control (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| PE-3(1).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A PE-4 |
| Access Control for Transmission Medium |
| Access Control for Transmission Medium (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| PE-4.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A PE-5 |
| Access Control for Output Devices |
| Access Control for Output Devices (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| PE-5.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A PE-6 |
| Monitoring Physical Access |
| Monitoring Physical Access (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| PE-6.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A PE-6 (1) |
| Monitoring Physical Access |
| Monitoring Physical Access (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| PE-6(1).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A PE-6 (4) |
| Monitoring Physical Access |
| Monitoring Physical Access (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| PE-6(4).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A PE-8 |
| Access Records |
| Visitor Access Records (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| PE-8.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A PE-8 (1) |
| Access Records |
| Visitor Access Records (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| PE-8(1).1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A PE-9 |
| Power Equipment and Power Cabling |
| Power Equipment and Cabling (O) |
| Not Specified |
| Not Entered |
| Not Assigned |
| PE-9.1 |
| X |
| X |
| - |
| - |
| - |
| Not Met |
| None |
| NIST 800-53 w/ DHS 4300A PE-10 |
| Emergency Shutoff |
| Emergency Shutoff (O) |
| Not Specified |
This is the start of the file's text. The full file is on GovTribe.