Attachment_L-1_Security_Controls.pdf

Attachment L-1. Minimum Security Controls

A description of the security controls is in the NIST SP 800-53, “Security and Privacy Controls for Federal Information

Systems and Organizations” (http://csrc.nist.gov/publications/PubsSPs.html).)

Access Control

Audit &

Accountability

Identification and

Authentication Media Protection

System & Comm

Protection

AC-2 AU-2 IA-2 MP-4 SC-2

AC-3(4) AU-3 IA-4 MP-6 SC-4

AC-4 AU-6(1) IA-5(1) SC-7

AC-6 AU-7

Physical and

Environmental

Protection SC-8(1)

AC-7 AU-8 Incident Response PE-2 SC-13

AC-11(1) AU-9 IR-2 PE-3

AC-17(2) IR-4 PE-5 SC-15

AC-18(1)

Configuration

Management IR-5 SC-28

AC-19 CM-2 IR-6

Program

Management

AC-20(1) CM-6 PM-10

System &

Information

Integrity

AC-20(2) CM-7 Maintenance SI-2

AC-22 CM-8 MA-4(6) Risk Assessment SI-3

MA-5 RA-5 SI-4

Awareness &

Training Contingency Planning MA-6

AT-2 CP-9

Legend:

AC: Access Control MA: Maintenance

AT: Awareness and Training MP: Media Protection

AU: Auditing and Accountability PE: Physical & Environmental Protection

CM: Configuration Management PM: Program Management

CP: Contingency Planning RA: Risk Assessment

IA: Identification and Authentication SC: System & Communications Protection

IR: Incident Response SI: System & Information Integrity http://csrc.nist.gov/publications/PubsSPs.html