Attachment_7_-_Security_Controls.pdf

Attachment 7

HTC711-15-R-R021

Minimum Security Controls

A description of the security controls is in the NIST SP 800-53, “Security and Privacy Controls for Federal Information Systems and Organizations” (http://csrc.nist.gov/publications/PubsSPs.html).)

Access Control Audit &

Accountability Identification and

Authentication Media Protection System & Comm

Protection

AC-2 AU-2 IA-2 MP-4 SC-2

AC-3(4) AU-3 IA-4 MP-6 SC-4

AC-4 AU-6(1) IA-5(1) SC-7

AC-6 AU-7

Physical and Environmental

Protection SC-8(1)

AC-7 AU-8 Incident Response PE-2 SC-13

AC-11(1) AU-9 IR-2 PE-3

AC-17(2) IR-4 PE-5 SC-15

AC-18(1)

Configuration Management IR-5 SC-28

AC-19 CM-2 IR-6

Program

Management

AC-20(1) CM-6 PM-10

System & Information

Integrity

AC-20(2) CM-7 Maintenance SI-2

AC-22 CM-8 MA-4(6) Risk Assessment SI-3

MA-5 RA-5 SI-4

Awareness & Training Contingency Planning MA-6

AT-2 CP-9

Legend:

AC: Access Control MA: Maintenance AT: Awareness and Training MP: Media Protection AU: Auditing and Accountability PE: Physical & Environmental Protection CM: Configuration Management PM: Program Management CP: Contingency Planning RA: Risk Assessment IA: Identification and Authentication SC: System & Communications Protection IR: Incident Response SI: System & Information Integrity