J.P-14_C-SCRM Control Selections.xlsx
XLSX spreadsheet 48 KB Posted
- Solicitation number
- 47QTCK22N003
- Issued by
-
GSA Federal Acquisition Service
About this file
This spreadsheet outlines the Cybersecurity Supply Chain Risk Management (C-SCRM) controls from NIST Special Publication 800-161 Revision 1 mapped across four tiers of implementation.
The spreadsheet lists 161 controls across four tiers: Tier 1 (baseline) includes 40 controls, Tier 2 (basic) adds 57 controls for a total of 97, Tier 3 (intermediate) adds 41 controls for a total of 138, and Tier 4 (advanced) adds 23 controls for a total of 161. For each control, the spreadsheet indicates whether it is "Selected" or "Not Selected" for implementation at each tier. The controls are organized under their respective families, including Access Control, Audit and Accountability, Configuration Management, Contingency Planning, Identification and Authentication, Incident Response, Risk Assessment, System and Services Acquisition, System and Communications Protection, and Supply Chain Risk Management.
The related federal contract opportunity is for the Alliant 3 GWAC 2nd Draft Request for Proposal (RFP), Request for Information (RFI) from GSA Federal Acquisition Service. No additional context is provided on products/services, response dates, or other salient details.
View the file
Other files
Show all 16
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Baselines
| 40 Total | 97 Total | 138 Total | 161 Total | ||||
| Cybersecurity Supply Chain Risk Management (C-SCRM) Controls (from NIST Special Publication 800-161 Revision 1) | C-SCRM Baselines | ||||||
| Control Family | Control Family Name | Control Identifier | Control (or Control Enhancement) Name | Tier 1 (Baseline) | Tier 2 (Basic) | Tier 3 (Intermediate) | Tier 4 (Advanced) |
| AC | Access Control | AC-1 | Policy and Procedures | Not Selected | Selected | Selected | Selected |
| AC | Access Control | AC-2 | Account Management | Selected | Selected | Selected | Selected |
| AC | Access Control | AC-3 | Access Enforcement | Not Selected | Selected | Selected | Selected |
| AC | Access Control | AC-3(8) | Access Enforcement | Revocation of Access Authorizations | Not Selected | Not Selected | Not Selected | Not Selected |
| AC | Access Control | AC-3(9) | Access Enforcement | Controlled Release | Not Selected | Not Selected | Not Selected | Not Selected |
| AC | Access Control | AC-4 | Information Flow Enforcement | Not Selected | Not Selected | Selected | Selected |
| AC | Access Control | AC-4(6) | Information Flow Enforcement | Metadata | Not Selected | Not Selected | Not Selected | Not Selected |
| AC | Access Control | AC-4(17) | Information Flow Enforcement | Domain Authentication | Not Selected | Not Selected | Not Selected | Not Selected |
| AC | Access Control | AC-4(19) | Information Flow Enforcement | Validation of Metadata | Not Selected | Not Selected | Not Selected | Not Selected |
| AC | Access Control | AC-4(21) | Information Flow Enforcement | Physical or Logical Separation of Information Flows | Not Selected | Not Selected | Not Selected | Not Selected |
| AC | Access Control | AC-5 | Separation of Duties | Not Selected | Not Selected | Selected | Selected |
| AC | Access Control | AC-6(6) | Least Privilege | Privileged Access by Non-organizational Users | Not Selected | Not Selected | Not Selected | Not Selected |
| AC | Access Control | AC-17 | Remote Access | Not Selected | Selected | Selected | Selected |
| AC | Access Control | AC-17(6) | Remote Access | Protection of Mechanism Information | Not Selected | Not Selected | Not Selected | Not Selected |
| AC | Access Control | AC-18 | Wireless Access | Not Selected | Selected | Selected | Selected |
| AC | Access Control | AC-19 | Access Control for Mobile Devices | Not Selected | Selected | Selected | Selected |
| AC | Access Control | AC-20 | Use of External Systems | Not Selected | Selected | Selected | Selected |
| AC | Access Control | AC-20(1) | Use of External Systems | Limits on Authorized Use | Not Selected | Not Selected | Selected | Selected |
| AC | Access Control | AC-20(3) | Use of External Systems | Non-organizationally Owned Systems — Restricted Use | Not Selected | Not Selected | Not Selected | Not Selected |
| AC | Access Control | AC-21 | Information Sharing | Not Selected | Not Selected | Selected | Selected |
| AC | Access Control | AC-22 | Publicly Accessible Content | Not Selected | Selected | Selected | Selected |
| AC | Access Control | AC-23 | Data Mining Protection | Not Selected | Not Selected | Not Selected | Not Selected |
| AC | Access Control | AC-24 | Access Control Decisions | Not Selected | Not Selected | Not Selected | Not Selected |
| AT | Awareness and Training | AT-1 | Policy and Procedures | Not Selected | Selected | Selected | Selected |
| AT | Awareness and Training | AT-2(1) | Literacy Training and Awareness | Practical Exercises | Not Selected | Not Selected | Not Selected | Not Selected |
| AT | Awareness and Training | AT-2(2) | Literacy Training and Awareness | Insider Threat | Not Selected | Selected | Selected | Selected |
| AT | Awareness and Training | AT-2(3) | Literacy Training and Awareness | Social Engineering and Mining | Not Selected | Not Selected | Selected | Selected |
| AT | Awareness and Training | AT-2(4) | Literacy Training and Awareness | Suspicious Communications and Anomalous System Behavior | Not Selected | Not Selected | Not Selected | Not Selected |
| AT | Awareness and Training | AT-2(5) | Literacy Training and Awareness | Advanced Persistent Threat | Not Selected | Not Selected | Not Selected | Not Selected |
| AT | Awareness and Training | AT-2(6) | Literacy Training and Awareness | Cyber Threat Environment | Not Selected | Not Selected | Not Selected | Not Selected |
| AT | Awareness and Training | AT-3 | Role-based Training | Selected | Selected | Selected | Selected |
| AT | Awareness and Training | AT-3(2) | Role-based Training | Physical Security Controls | Not Selected | Not Selected | Not Selected | Not Selected |
| AT | Awareness and Training | AT-4 | Training Records | Not Selected | Selected | Selected | Selected |
| AU | Audit and Accountability | AU-1 | Policy and Procedures | Not Selected | Selected | Selected | Selected |
| AU | Audit and Accountability | AU-2 | Event Logging | Selected | Selected | Selected | Selected |
| AU | Audit and Accountability | AU-3 | Content of Audit Records | Not Selected | Selected | Selected | Selected |
| AU | Audit and Accountability | AU-6 | Audit Record Review, Analysis, and Reporting | Selected | Selected | Selected | Selected |
| AU | Audit and Accountability | AU-6(9) | Audit Record Review, Analysis, and Reporting | Correlation with Information from Nontechnical Sources | Not Selected | Not Selected | Not Selected | Not Selected |
| AU | Audit and Accountability | AU-10 | Non-repudiation | Not Selected | Not Selected | Not Selected | Selected |
| AU | Audit and Accountability | AU-10(1) | Non-repudiation | Association of Identities | Not Selected | Not Selected | Not Selected | Not Selected |
| AU | Audit and Accountability | AU-10(2) | Non-repudiation | Validate Binding of Information Producer Identity | Not Selected | Not Selected | Not Selected | Not Selected |
| AU | Audit and Accountability | AU-10(3) | Non-repudiation | Chain of Custody | Not Selected | Not Selected | Not Selected | Not Selected |
| AU | Audit and Accountability | AU-12 | Audit Record Generation | Not Selected | Selected | Selected | Selected |
| AU | Audit and Accountability | AU-13 | Monitoring for Information Disclosure | Not Selected | Not Selected | Not Selected | Not Selected |
| AU | Audit and Accountability | AU-14 | Session Audit | Not Selected | Not Selected | Not Selected | Not Selected |
| AU | Audit and Accountability | AU-16 | Cross-organizational Audit Logging | Not Selected | Not Selected | Not Selected | Not Selected |
| AU | Audit and Accountability | AU-16(2) | Cross-organizational Audit Logging | Sharing of Audit Information | Not Selected | Not Selected | Not Selected | Not Selected |
| CA | Assessment, Authorization, And Monitoring | CA-1 | Policy and Procedures | Not Selected | Selected | Selected | Selected |
| CA | Assessment, Authorization, And Monitoring | CA-2 | Control Assessments | Not Selected | Selected | Selected | Selected |
| CA | Assessment, Authorization, And Monitoring | CA-2(2) | Control Assessments | Specialized Assessments | Not Selected | Not Selected | Not Selected | Selected |
| CA | Assessment, Authorization, And Monitoring | CA-2(3) | Control Assessments | Leveraging Results from External Organizations | Not Selected | Not Selected | Not Selected | Not Selected |
| CA | Assessment, Authorization, And Monitoring | CA-3 | Information Exchange | Not Selected | Selected | Selected | Selected |
| CA | Assessment, Authorization, And Monitoring | CA-5 | Plan of Action and Milestones | Selected | Selected | Selected | Selected |
| CA | Assessment, Authorization, And Monitoring | CA-6 | Authorization | Not Selected | Selected | Selected | Selected |
| CA | Assessment, Authorization, And Monitoring | CA-7(3) | Continuous Monitoring | Trend Analyses | Not Selected | Not Selected | Not Selected | Not Selected |
| CM | Configuration Management | CM-1 | Policy and Procedures | Not Selected | Selected | Selected | Selected |
| CM | Configuration Management | CM-2 | Baseline Configuration | Selected | Selected | Selected | Selected |
| CM | Configuration Management | CM-2(6) | Baseline Configuration | Development and Test Environments | Not Selected | Not Selected | Not Selected | Not Selected |
| CM | Configuration Management | CM-3 | Configuration Change Control | Not Selected | Not Selected | Selected | Selected |
| CM | Configuration Management | CM-3(1) | Configuration Change Control | Automated Documentation, Notification, and Prohibition of Changes | Not Selected | Not Selected | Not Selected | Selected |
| CM | Configuration Management | CM-3(2) | Configuration Change Control | Testing, Validation, and Documentation of Changes | Not Selected | Not Selected | Selected | Selected |
| CM | Configuration Management | CM-3(4) | Configuration Change Control | Security and Privacy Representatives | Not Selected | Not Selected | Selected | Selected |
| CM | Configuration Management | CM-3(8) | Configuration Change Control | Prevent or Restrict Configuration Changes | Not Selected | Not Selected | Not Selected | Not Selected |
| CM | Configuration Management | CM-4 | Impact Analyses | Selected | Selected | Selected | Selected |
| CM | Configuration Management | CM-4(1) | Impact Analyses | Separate Test Environments | Not Selected | Not Selected | Not Selected | Selected |
| CM | Configuration Management | CM-5 | Access Restrictions for Change | Not Selected | Selected | Selected | Selected |
| CM | Configuration Management | CM-5(1) | Access Restrictions for Change | Automated Access Enforcement and Audit Records | Not Selected | Not Selected | Not Selected | Selected |
| CM | Configuration Management | CM-5(6) | Access Restrictions for Change | Limit Library Privileges | Not Selected | Not Selected | Not Selected | Not Selected |
| CM | Configuration Management | CM-6 | Configuration Settings | Not Selected | Selected | Selected | Selected |
| CM | Configuration Management | CM-6(1) | Configuration Settings | Automated Management, Application, and Verification | Not Selected | Not Selected | Not Selected | Selected |
| CM | Configuration Management | CM-6(2) | Configuration Settings | Respond to Unauthorized Changes | Not Selected | Not Selected | Not Selected | Selected |
| CM | Configuration Management | CM-7 | Least Functionality | Not Selected | Selected | Selected | Selected |
| CM | Configuration Management | CM-7(1) | Least Functionality | Periodic Review | Not Selected | Not Selected | Selected | Selected |
| CM | Configuration Management | CM-7(4) | Least Functionality | Unauthorized Software | Not Selected | Not Selected | Not Selected | Not Selected |
| CM | Configuration Management | CM-7(5) | Least Functionality | Authorized Software | Not Selected | Not Selected | Selected | Selected |
| CM | Configuration Management | CM-7(6) | Least Functionality | Confined Environments with Limited Privileges | Not Selected | Not Selected | Not Selected | Not Selected |
| CM | Configuration Management | CM-7(7) | Least Functionality | Code Execution in Protected Environments | Not Selected | Not Selected | Not Selected | Not Selected |
| CM | Configuration Management | CM-7(8) | Least Functionality | Binary or Machine Executable Code | Not Selected | Not Selected | Not Selected | Not Selected |
| CM | Configuration Management | CM-7(9) | Least Functionality | Prohibiting the Use of Unauthorized Hardware | Not Selected | Not Selected | Not Selected | Not Selected |
| CM | Configuration Management | CM-8 | System Component Inventory | Selected | Selected | Selected | Selected |
| CM | Configuration Management | CM-8(1) | System Component Inventory | Updates During Installation and Removal | Not Selected | Not Selected | Selected | Selected |
| CM | Configuration Management | CM-8(2) | System Component Inventory | Automated Maintenance | Not Selected | Not Selected | Not Selected | Selected |
| CM | Configuration Management | CM-8(4) | System Component Inventory | Accountability Information | Not Selected | Not Selected | Not Selected | Selected |
| CM | Configuration Management | CM-8(6) | System Component Inventory | Assessed Configurations and Approved Deviations | Not Selected | Not Selected | Not Selected | Not Selected |
| CM | Configuration Management | CM-8(7) | System Component Inventory | Centralized Repository | Not Selected | Not Selected | Not Selected | Not Selected |
| CM | Configuration Management | CM-8(8) | System Component Inventory | Automated Location Tracking | Not Selected | Not Selected | Not Selected | Not Selected |
| CM | Configuration Management | CM-8(9) | System Component Inventory | Assignment of Components to Systems | Not Selected | Not Selected | Not Selected | Not Selected |
| CM | Configuration Management | CM-9 | Configuration Management Plan | Not Selected | Not Selected | Selected | Selected |
| CM | Configuration Management | CM-9(1) | Configuration Management Plan | Assignment of Responsibility | Not Selected | Not Selected | Not Selected | Not Selected |
| CM | Configuration Management | CM-10 | Software Usage Restrictions | Not Selected | Selected | Selected | Selected |
| CM | Configuration Management | CM-10(1) | Software Usage Restrictions | Open source Software | Not Selected | Not Selected | Not Selected | Not Selected |
| CM | Configuration Management | CM-11 | User-installed Software | Not Selected | Selected | Selected | Selected |
| CM | Configuration Management | CM-12 | Information Location | Not Selected | Not Selected | Selected | Selected |
| CM | Configuration Management | CM-12(1) | Information Location | Automated Tools to Support Information Location | Not Selected | Not Selected | Selected | Selected |
| CM | Configuration Management | CM-13 | Data Action Mapping | Not Selected | Not Selected | Not Selected | Not Selected |
| CM | Configuration Management | CM-14 | Signed Components | Not Selected | Not Selected | Not Selected | Not Selected |
| CP | Contingency Planning | CP-1 | Policy and Procedures | Not Selected | Selected | Selected | Selected |
| CP | Contingency Planning | CP-2 | Contingency Plan | Selected | Selected | Selected | Selected |
| CP | Contingency Planning | CP-2(1) | Contingency Plan | Coordinate with Related Plans | Not Selected | Not Selected | Selected | Selected |
| CP | Contingency Planning | CP-2(2) | Contingency Plan | Capacity Planning | Not Selected | Not Selected | Not Selected | Selected |
| CP | Contingency Planning | CP-2(7) | Contingency Plan | Coordinate with External Service Providers | Not Selected | Not Selected | Not Selected | Not Selected |
| CP | Contingency Planning | CP-2(8) | Contingency Plan | Identify Critical Assets | Not Selected | Not Selected | Selected | Selected |
| CP | Contingency Planning | CP-3 | Contingency Training | Not Selected | Selected | Selected | Selected |
| CP | Contingency Planning | CP-3(1) | Contingency Training | Simulated Events | Not Selected | Not Selected | Not Selected | Selected |
| CP | Contingency Planning | CP-4 | Contingency Plan Testing | Not Selected | Selected | Selected | Selected |
| CP | Contingency Planning | CP-6 | Alternate Storage Site | Not Selected | Not Selected | Selected | Selected |
| CP | Contingency Planning | CP-6(1) | Alternate Storage Site | Separation from Primary Site | Not Selected | Not Selected | Selected | Selected |
| CP | Contingency Planning | CP-7 | Alternate Processing Site | Not Selected | Not Selected | Selected | Selected |
| CP | Contingency Planning | CP-8 | Telecommunications Services | Not Selected | Not Selected | Selected | Selected |
| CP | Contingency Planning | CP-8(3) | Telecommunications Services | Separation of Primary and Alternate Providers | Not Selected | Not Selected | Not Selected | Selected |
| CP | Contingency Planning | CP-8(4) | Telecommunications Services | Provider Contingency Plan | Not Selected | Not Selected | Not Selected | Selected |
| CP | Contingency Planning | CP-11 | Alternate Communications Protocols | Not Selected | Not Selected | Not Selected | Not Selected |
| IA | Identification and Authentication | IA-1 | Policy and Procedures | Not Selected | Selected | Selected | Selected |
| IA | Identification and Authentication | IA-2 | Identification and Authentication (Organizational Users) | Selected | Selected | Selected | Selected |
| IA | Identification and Authentication | IA-3 | Device Identification and Authentication | Not Selected | Not Selected | Selected | Selected |
| IA | Identification and Authentication | IA-4 | Identifier Management | Not Selected | Selected | Selected | Selected |
| IA | Identification and Authentication | IA-4(6) | Identifier Management | Cross-organization Management | Not Selected | Not Selected | Not Selected | Not Selected |
| IA | Identification and Authentication | IA-5 | Authenticator Management | Not Selected | Selected | Selected | Selected |
| IA | Identification and Authentication | IA-5(5) | Authenticator Management | Change Authenticators Prior to Delivery | Not Selected | Not Selected | Not Selected | Not Selected |
| IA | Identification and Authentication | IA-5(9) | Authenticator Management | Federated Credential Management | Not Selected | Not Selected | Not Selected | Not Selected |
| IA | Identification and Authentication | IA-8 | Identification and Authentication (non-organizational Users) | Not Selected | Selected | Selected | Selected |
| IA | Identification and Authentication | IA-9 | Service Identification and Authentication | Not Selected | Not Selected | Not Selected | Not Selected |
| IR | Incident Response | IR-1 | Policy and Procedures | Not Selected | Selected | Selected | Selected |
| IR | Incident Response | IR-2 | Incident Response Training | Not Selected | Selected | Selected | Selected |
| IR | Incident Response | IR-3 | Incident Response Testing | Not Selected | Not Selected | Selected | Selected |
| IR | Incident Response | IR-4(6) | Incident Handling | Insider Threats | Not Selected | Not Selected | Not Selected | Not Selected |
| IR | Incident Response | IR-4(7) | Incident Handling | Insider Threats — Intra- organization Coordination | Not Selected | Not Selected | Not Selected | Not Selected |
| IR | Incident Response | IR-4(10) | Incident Handling | Supply Chain Coordination | Not Selected | Not Selected | Not Selected | Not Selected |
| IR | Incident Response | IR-4(11) | Incident Handling | Integrated Incident Response Team | Not Selected | Not Selected | Not Selected | Selected |
| IR | Incident Response | IR-5 | Incident Monitoring | Selected | Selected | Selected | Selected |
| IR | Incident Response | IR-6(3) | Incident Reporting | Supply Chain Coordination | Not Selected | Not Selected | Selected | Selected |
| IR | Incident Response | IR-7(2) | Incident Response Assistance | Coordination with External Providers | Not Selected | Not Selected | Not Selected | Not Selected |
| IR | Incident Response | IR-8 | Incident Response Plan | Selected | Selected | Selected | Selected |
| IR | Incident Response | IR-9 | Information Spillage Response | Not Selected | Not Selected | Not Selected | Not Selected |
| MA | Maintenance | MA-1 | Policy and Procedures | Not Selected | Selected | Selected | Selected |
| MA | Maintenance | MA-2(2) | Controlled Maintenance | Automated Maintenance Activities | Not Selected | Not Selected | Not Selected | Selected |
| MA | Maintenance | MA-3 | Maintenance Tools | Not Selected | Not Selected | Selected | Selected |
| MA | Maintenance | MA-3(1) | Maintenance Tools | Inspect Tools | Not Selected | Not Selected | Selected | Selected |
| MA | Maintenance | MA-3(2) | Maintenance Tools | Inspect Media | Not Selected | Not Selected | Selected | Selected |
| MA | Maintenance | MA-3(3) | Maintenance Tools | Prevent Unauthorized Removal | Not Selected | Not Selected | Selected | Selected |
| MA | Maintenance | MA-4 | Nonlocal Maintenance | Not Selected | Selected | Selected | Selected |
| MA | Maintenance | MA-4(3) | Nonlocal Maintenance | Comparable Security and Sanitization | Not Selected | Not Selected | Not Selected | Selected |
| MA | Maintenance | MA-5 | Maintenance Personnel | Selected | Selected | Selected | Selected |
| MA | Maintenance | MA-5(4) | Maintenance Personnel | Foreign Nationals | Not Selected | Not Selected | Not Selected | Not Selected |
| MA | Maintenance | MA-6 | Timely Maintenance (note: SA-12(13) was incorporated) | Not Selected | Not Selected | Selected | Selected |
| MA | Maintenance | MA-7 | Field Maintenance | Not Selected | Not Selected | Not Selected | Not Selected |
| MA | Maintenance | MA-8 | Maintenance Monitoring and Information Sharing | Not Selected | Not Selected | Not Selected | Not Selected |
| MP | Media Protection | MP-1 | Policy and Procedures | Not Selected | Selected | Selected | Selected |
| MP | Media Protection | MP-4 | Media Storage | Not Selected | Not Selected | Selected | Selected |
| MP | Media Protection | MP-5 | Media Transport | Not Selected | Not Selected | Selected | Selected |
| MP | Media Protection | MP-6 | Media Sanitization | Selected | Selected | Selected | Selected |
| PE | Physical and Environmental | PE-1 | Policy and Procedures | Not Selected | Selected | Selected | Selected |
| PE | Physical and Environmental | PE-2 | Physical Access Authorizations | Not Selected | Selected | Selected | Selected |
| PE | Physical and Environmental | PE-2(1) | Physical Access Authorizations | Access by Position or Role | Not Selected | Not Selected | Not Selected | Not Selected |
| PE | Physical and Environmental | PE-3 | Physical Access Control | Selected | Selected | Selected | Selected |
| PE | Physical and Environmental | PE-3(1) | Physical Access Control | System Access | Not Selected | Not Selected | Not Selected | Selected |
| PE | Physical and Environmental | PE-3(2) | Physical Access Control | Facility and Systems | Not Selected | Not Selected | Not Selected | Not Selected |
| PE | Physical and Environmental | PE-3(5) | Physical Access Control | Tamper Protection | Not Selected | Not Selected | Not Selected | Not Selected |
| PE | Physical and Environmental | PE-6 | Monitoring Physical Access | Selected | Selected | Selected | Selected |
| PE | Physical and Environmental | PE-16 | Delivery and Removal | Not Selected | Selected | Selected | Selected |
| PE | Physical and Environmental | PE-17 | Alternate Work Site | Not Selected | Not Selected | Selected | Selected |
| PE | Physical and Environmental | PE-18 | Location of System Components | Not Selected | Not Selected | Not Selected | Selected |
| PE | Physical and Environmental | PE-20 | Asset Monitoring and Tracking | Not Selected | Not Selected | Not Selected | Not Selected |
| PE | Physical and Environmental | PE-23 | Facility Location | Not Selected | Not Selected | Not Selected | Not Selected |
| PL | Planning | PL-1 | Policy and Procedures | Not Selected | Selected | Selected | Selected |
| PL | Planning | PL-2 | System Security and Privacy Plans (note: PL-2(3), PL-3, PL-6) was incorporated) | Not Selected | Selected | Selected | Selected |
| PL | Planning | PL-4 | Rules of Behavior | Not Selected | Selected | Selected | Selected |
| PL | Planning | PL-7 | Concept of Operations | Not Selected | Not Selected | Not Selected | Not Selected |
| PL | Planning | PL-8 (M,H) | Security and Privacy Architectures | Selected | Selected | Selected | Selected |
| PL | Planning | PL-8(2) | Security and Privacy Architectures | Supplier Diversity | Not Selected | Not Selected | Not Selected | Not Selected |
| PL | Planning | PL-9 | Central Management | Not Selected | Not Selected | Not Selected | Not Selected |
| PL | Planning | PL-10 | Baseline Selection | Not Selected | Selected | Selected | Selected |
| PM | Program Management | PM-2 | Information Security Program Leadership Role | Not Selected | Not Selected | Not Selected | Not Selected |
| PM | Program Management | PM-3 | Information Security and Privacy Resources | Not Selected | Not Selected | Not Selected | Not Selected |
| PM | Program Management | PM-4 | Plan of Action and Milestones Process | Not Selected | Not Selected | Not Selected | Not Selected |
| PM | Program Management | PM-5 | System Inventory | Not Selected | Not Selected | Not Selected | Not Selected |
| PM | Program Management | PM-6 | Measures of Performance | Not Selected | Not Selected | Not Selected | Not Selected |
| PM | Program Management | PM-7 | Enterprise Architecture | Not Selected | Not Selected | Not Selected | Not Selected |
| PM | Program Management | PM-8 | Critical Infrastructure Plan | Not Selected | Not Selected | Not Selected | Not Selected |
| PM | Program Management | PM-9 | Risk Management Strategy | Not Selected | Not Selected | Not Selected | Not Selected |
| PM | Program Management | PM-10 | Authorization Process | Not Selected | Not Selected | Not Selected | Not Selected |
| PM | Program Management | PM-11 | Mission and Business Process Definition | Not Selected | Not Selected | Not Selected | Not Selected |
| PM | Program Management | PM-12 | Insider Threat Program | Not Selected | Not Selected | Not Selected | Not Selected |
| PM | Program Management | PM-13 | Security and Privacy Workforce | Not Selected | Not Selected | Not Selected | Not Selected |
| PM | Program Management | PM-14 | Testing, Training, and Monitoring | Not Selected | Not Selected | Not Selected | Not Selected |
| PM | Program Management | PM-15 | Security and Privacy Groups and Associations | Not Selected | Not Selected | Not Selected | Not Selected |
| PM | Program Management | PM-16 | Threat Awareness Program | Not Selected | Not Selected | Not Selected | Not Selected |
| PM | Program Management | PM-17 | Protecting Controlled Unclassified Information on External Systems | Not Selected | Not Selected | Not Selected | Not Selected |
| PM | Program Management | PM-18 | Privacy Program Plan | Not Selected | Not Selected | Not Selected | Not Selected |
| PM | Program Management | PM-19 | Privacy Program Leadership Role | Not Selected | Not Selected | Not Selected | Not Selected |
| PM | Program Management | PM-20 | Dissemination of Privacy Program Information | Not Selected | Not Selected | Not Selected | Not Selected |
| PM | Program Management | PM-21 | Accounting of Disclosures | Not Selected | Not Selected | Not Selected | Not Selected |
| PM | Program Management | PM-22 | Personally Identifiable Information Quality Management | Not Selected | Not Selected | Not Selected | Not Selected |
| PM | Program Management | PM-23 | Data Governance Body | Not Selected | Not Selected | Not Selected | Not Selected |
| PM | Program Management | PM-25 | Minimization of Personally Identifiable Information Used in Testing, Training, and Research | Not Selected | Not Selected | Not Selected | Not Selected |
| PM | Program Management | PM-26 | Complaint Management | Not Selected | Not Selected | Not Selected | Not Selected |
| PM | Program Management | PM-27 | Privacy Reporting | Not Selected | Not Selected | Not Selected | Not Selected |
| PM | Program Management | PM-28 | Risk Framing | Not Selected | Not Selected | Not Selected | Not Selected |
| PM | Program Management | PM-29 | Risk Management Program Leadership Roles | Not Selected | Not Selected | Not Selected | Not Selected |
| PM | Program Management | PM-30 | Supply Chain Risk Management Strategy | Not Selected | Not Selected | Not Selected | Not Selected |
| PM | Program Management | PM-31 (NB) | Continuous Monitoring Strategy | Selected | Selected | Selected | Selected |
| PM | Program Management | PM-32 | Purposing | Not Selected | Not Selected | Not Selected | Not Selected |
| PS | Personnel Security | PS-1 | Policy and Procedures | Not Selected | Selected | Selected | Selected |
| PS | Personnel Security | PS-3 | Personnel Screening | Selected | Selected | Selected | Selected |
| PS | Personnel Security | PS-6 | Access Agreements | Not Selected | Selected | Selected | Selected |
| PS | Personnel Security | PS-7 | External Personnel Security | Not Selected | Selected | Selected | Selected |
| PT | Personally Identifiable Information Processing and Transparency | PT-1 | Policy and Procedures | Not Selected | Not Selected | Not Selected | Not Selected |
| RA | Risk Assessment | RA-1 | Policy and Procedures | Not Selected | Selected | Selected | Selected |
| RA | Risk Assessment | RA-2 | Security Categorization | Not Selected | Selected | Selected | Selected |
| RA | Risk Assessment | RA-3 | Risk Assessment | Selected | Selected | Selected | Selected |
| RA | Risk Assessment | RA-5 | Vulnerability Monitoring and Scanning | Not Selected | Selected | Selected | Selected |
| RA | Risk Assessment | RA-5(3) | Vulnerability Monitoring and Scanning | Breadth and Depth of Coverage | Not Selected | Not Selected | Not Selected | Not Selected |
| RA | Risk Assessment | RA-5(6) | Vulnerability Monitoring and Scanning | Automated Trend Analyses | Not Selected | Not Selected | Not Selected | Not Selected |
| RA | Risk Assessment | RA-7 | Risk Response | Selected | Selected | Selected | Selected |
| RA | Risk Assessment | RA-9 | Criticality Analysis (note: SA-12(13) and RA-14 was incorporated) | Not Selected | Not Selected | Selected | Selected |
| RA | Risk Assessment | RA-10 | Threat Hunting | Not Selected | Not Selected | Not Selected | Not Selected |
| SA | System And Services Acquisition | SA-1 | Policy and Procedures | Selected | Selected | Selected | Selected |
| SA | System And Services Acquisition | SA-2 | Allocation of Resources | Selected | Selected | Selected | Selected |
| SA | System And Services Acquisition | SA-3 | System Development Life Cycle | Selected | Selected | Selected | Selected |
| SA | System And Services Acquisition | SA-4 | Acquisition Process | Selected | Selected | Selected | Selected |
| SA | System And Services Acquisition | SA-4(5) | Acquisition Process | System, Component, and Service Configurations | Not Selected | Not Selected | Not Selected | Selected |
| SA | System And Services Acquisition | SA-4(7) | Acquisition Process | NIAP-approved Protection Profiles | Not Selected | Not Selected | Not Selected | Not Selected |
| SA | System And Services Acquisition | SA-4(8) | Acquisition Process | Continuous Monitoring Plan for Controls | Not Selected | Not Selected | Not Selected | Not Selected |
| SA | System And Services Acquisition | SA-5 | System Documentation | Selected | Selected | Selected | Selected |
| SA | System And Services Acquisition | SA-8 | Security and Privacy Engineering Principles | Selected | Selected | Selected | Selected |
| SA | System And Services Acquisition | SA-9(1) | External System Services | Risk Assessments and Organizational Approvals | Not Selected | Not Selected | Not Selected | Not Selected |
| SA | System And Services Acquisition | SA-9(3) | External System Services | Establish and Maintain Trust Relationship with Providers | Not Selected | Not Selected | Not Selected | Not Selected |
| SA | System And Services Acquisition | SA-9(4) | External System Services | Consistent Interests of Consumers and Providers | Not Selected | Not Selected | Not Selected | Not Selected |
| SA | System And Services Acquisition | SA-9(5) | External System Services | Processing, Storage, and Service Location | Not Selected | Not Selected | Not Selected | Not Selected |
| SA | System And Services Acquisition | SA-10 | Developer Configuration Management | Not Selected | Not Selected | Selected | Selected |
| SA | System And Services Acquisition | SA-11 | Developer Testing and Evaluation | Not Selected | Not Selected | Selected | Selected |
| SA | System And Services Acquisition | SA-15 | Development Process, Standards, and Tools | Not Selected | Not Selected | Selected | Selected |
| SA | System And Services Acquisition | SA-15(3) | Development Process, Standards, and Tools | Criticality Analysis | Not Selected | Not Selected | Selected | Selected |
| SA | System And Services Acquisition | SA-15(4) | Development Process, Standards, and Tools | Threat Modeling and Vulnerability Analysis | Not Selected | Not Selected | Not Selected | Not Selected |
| SA | System And Services Acquisition | SA-15(8) | Development Process, Standards, and Tools | Reuse of Threat and Vulnerability Information | Not Selected | Not Selected | Not Selected | Not Selected |
| SA | System And Services Acquisition | SA-16 | Developer-provided Training | Not Selected | Not Selected | Not Selected | Selected |
| SA | System And Services Acquisition | SA-17 | Developer Security and Privacy Architecture and Design | Not Selected | Not Selected | Not Selected | Selected |
| SA | System And Services Acquisition | SA-20 | Customized Development of Critical Components | Not Selected | Not Selected | Not Selected | Not Selected |
| SA | System And Services Acquisition | SA-21 | Developer Screening | Not Selected | Not Selected | Not Selected | Selected |
| SA | System And Services Acquisition | SA-21(1) | Developer Screening | Validation of Screening | Not Selected | Not Selected | Not Selected | Not Selected |
| SA | System And Services Acquisition | SA-22 | Unsupported System Components | Selected | Selected | Selected | Selected |
| SC | System And Communications Protection | SC-1 | Policy and Procedures | Not Selected | Selected | Selected | Selected |
| SC | System And Communications Protection | SC-4 | Information in Shared System Resources | Not Selected | Not Selected | Selected | Selected |
| SC | System And Communications Protection | SC-5(2) | Denial-of-service Protection | Capacity, Bandwidth, and Redundancy | Not Selected | Not Selected | Not Selected | Not Selected |
| SC | System And Communications Protection | SC-7 | Boundary Protection | Selected | Selected | Selected | Selected |
| SC | System And Communications Protection | SC-7(13) | Boundary Protection | Isolation of Security Tools, Mechanisms, and Support Components | Not Selected | Not Selected | Not Selected | Not Selected |
| SC | System And Communications Protection | SC-7(14) | Boundary Protection | Protect Against Unauthorized Physical Connections | Not Selected | Not Selected | Not Selected | Not Selected |
| SC | System And Communications Protection | SC-7(19) | Boundary Protection | Block Communication from Non-organizationally Configured Hosts | Not Selected | Not Selected | Not Selected | Not Selected |
| SC | System And Communications Protection | SC-8 (M,H) | Transmission Confidentiality and Integrity | Selected | Selected | Selected | Selected |
| SC | System And Communications Protection | SC-18 | Mobile Code | Not Selected | Not Selected | Selected | Selected |
| SC | System And Communications Protection | SC-18(2) | Mobile Code | Acquisition, Development, and Use | Not Selected | Not Selected | Not Selected | Not Selected |
| SC | System And Communications Protection | SC-27 | Platform-independent Applications | Not Selected | Not Selected | Not Selected | Not Selected |
| SC | System And Communications Protection | SC-28 | Protection of Information at Rest | Not Selected | Not Selected | Selected | Selected |
| SC | System And Communications Protection | SC-29 | Heterogeneity | Not Selected | Not Selected | Not Selected | Not Selected |
| SC | System And Communications Protection | SC-30 | Concealment and Misdirection | Not Selected | Not Selected | Not Selected | Not Selected |
| SC | System And Communications Protection | SC-30(2) | Concealment and Misdirection | Randomness | Not Selected | Not Selected | Not Selected | Not Selected |
| SC | System And Communications Protection | SC-30(3) | Concealment and Misdirection | Change Processing and Storage Locations | Not Selected | Not Selected | Not Selected | Not Selected |
| SC | System And Communications Protection | SC-30(4) | Concealment and Misdirection | Misleading Information | Not Selected | Not Selected | Not Selected | Not Selected |
| SC | System And Communications Protection | SC-30(5) | Concealment and Misdirection | Concealment of System Components | Not Selected | Not Selected | Not Selected | Not Selected |
| SC | System And Communications Protection | SC-36 | Distributed Processing and Storage | Not Selected | Not Selected | Not Selected | Not Selected |
| SC | System And Communications Protection | SC-37(1) | Out-of-band Channels | Ensure Delivery and Transmission | Not Selected | Not Selected | Not Selected | Not Selected |
| SC | System And Communications Protection | SC-38 | Operations Security | Not Selected | Not Selected | Not Selected | Not Selected |
| SC | System And Communications Protection | SC-47 | Alternate Communications Paths | Not Selected | Not Selected | Not Selected | Not Selected |
| SI | System and Information Integrity | SI-1 | Policy and Procedures | Not Selected | Selected | Selected | Selected |
| SI | System and Information Integrity | SI-2 | Flaw Remediation | Not Selected | Selected | Selected | Selected |
| SI | System and Information Integrity | SI-2(5) | Flaw Remediation | Automatic Software and Firmware Updates | Not Selected | Not Selected | Not Selected | Not Selected |
| SI | System and Information Integrity | SI-3 | Malicious Code Protection | Selected | Selected | Selected | Selected |
| SI | System and Information Integrity | SI-4 | System Monitoring | Not Selected | Selected | Selected | Selected |
| SI | System and Information Integrity | SI-4(17) | System Monitoring | Integrated Situational Awareness | Not Selected | Not Selected | Not Selected | Not Selected |
| SI | System and Information Integrity | SI-4(19) | System Monitoring | Risk for Individuals | Not Selected | Not Selected | Not Selected | Not Selected |
| SI | System and Information Integrity | SI-5 | Security Alerts, Advisories, and Directives | Selected | Selected | Selected | Selected |
| SI | System and Information Integrity | SI-7 | Software, Firmware, and Information Integrity | Not Selected | Not Selected | Selected | Selected |
| SI | System and Information Integrity | SI-7(14) | Software, Firmware, and Information Integrity | Binary or Machine Executable Code | Not Selected | Not Selected | Not Selected | Not Selected |
| SI | System and Information Integrity | SI-7(15) | Software, Firmware, and Information Integrity | Code Authentication | Not Selected | Not Selected | Not Selected | Selected |
| SI | System and Information Integrity | SI-12 | Information Management and Retention | Not Selected | Selected | Selected | Selected |
| SI | System and Information Integrity | SI-20 | Tainting | Not Selected | Not Selected | Not Selected | Not Selected |
| SR | Supply Chain Risk Management | SR-1 | Policy and Procedures | Selected | Selected | Selected | Selected |
| SR | Supply Chain Risk Management | SR-2 | Supply Chain Risk Management Plan | Not Selected | Selected | Selected | Selected |
| SR | Supply Chain Risk Management | SR-3 | Supply Chain Controls and Processes | Not Selected | Selected | Selected | Selected |
| SR | Supply Chain Risk Management | SR-3(1) | Supply Chain Controls and Processes | Diverse Supply Base | Not Selected | Not Selected | Not Selected | Not Selected |
| SR | Supply Chain Risk Management | SR-3(3) | Supply Chain Controls and Processes | Sub-tier Flow Down | Not Selected | Not Selected | Not Selected | Not Selected |
| SR | Supply Chain Risk Management | SR-4 (NB) | Provenance | Selected | Selected | Selected | Selected |
| SR | Supply Chain Risk Management | SR-5 | Acquisition Strategies, Tools, and Methods | Selected | Selected | Selected | Selected |
| SR | Supply Chain Risk Management | SR-6 | Supplier Assessments and Reviews | Not Selected | Not Selected | Selected | Selected |
| SR | Supply Chain Risk Management | SR-7 | Supply Chain Operations Security | Not Selected | Not Selected | Not Selected | Not Selected |
| SR | Supply Chain Risk Management | SR-8 | Notification Agreements | Selected | Selected | Selected | Selected |
| SR | Supply Chain Risk Management | SR-9 (H) | Tamper Resistance and Detection (note: SI-7(4) and SA-18 was incorporated) | Selected | Selected | Selected | Selected |
| SR | Supply Chain Risk Management | SR-10 | Inspection of Systems or Components | Selected | Selected | Selected | Selected |
| SR | Supply Chain Risk Management | SR-11 | Component Authenticity | Selected | Selected | Selected | Selected |
| SR | Supply Chain Risk Management | SR-11(1) | Component Authenticity | Anti-counterfeit Training | Not Selected | Selected | Selected | Selected |
| SR | Supply Chain Risk Management | SR-11(2) | Component Authenticity | Configuration Control for Component Service and Repair | Not Selected | Selected | Selected | Selected |
| SR | Supply Chain Risk Management | SR-11(3) | Component Authenticity | Anti-counterfeit Scanning | Not Selected | Not Selected | Not Selected | Not Selected |
| SR | Supply Chain Risk Management | SR-12 | Component Disposal | Selected | Selected | Selected | Selected |
| SR | Supply Chain Risk Management | SR-13 | Supplier Inventory | Not Selected | Not Selected | Not Selected | Not Selected |
Tier 1
| Tier 1- Baseline (40 controls total) | |||
| Cybersecurity Supply Chain Risk Management (C-SCRM) Controls (from NIST Special Publication 800-161 Revision 1) | |||
| Control Family | Control Family Name | Control Identifier | Control (or Control Enhancement) Name |
| AC | Access Control | AC-2 | Account Management |
| AT | Awareness and Training | AT-3 | Role-based Training |
| AU | Audit and Accountability | AU-2 | Event Logging |
| AU | Audit and Accountability | AU-6 | Audit Record Review, Analysis, and Reporting |
| CA | Assessment, Authorization, And Monitoring | CA-5 | Plan of Action and Milestones |
| CM | Configuration Management | CM-2 | Baseline Configuration |
| CM | Configuration Management | CM-4 | Impact Analyses |
| CM | Configuration Management | CM-8 | System Component Inventory |
| CP | Contingency Planning | CP-2 | Contingency Plan |
| IA | Identification and Authentication | IA-2 | Identification and Authentication (Organizational Users) |
| IR | Incident Response | IR-5 | Incident Monitoring |
| IR | Incident Response | IR-8 | Incident Response Plan |
| MA | Maintenance | MA-5 | Maintenance Personnel |
| MP | Media Protection | MP-6 | Media Sanitization |
| PE | Physical and Environmental | PE-3 | Physical Access Control |
| PE | Physical and Environmental | PE-6 | Monitoring Physical Access |
| PL | Planning | PL-8 (M,H) | Security and Privacy Architectures |
| PM | Program Management | PM-31 (NB) | Continuous Monitoring Strategy |
| PS | Personnel Security | PS-3 | Personnel Screening |
| RA | Risk Assessment | RA-3 | Risk Assessment |
| RA | Risk Assessment | RA-7 | Risk Response |
| SA | System And Services Acquisition | SA-1 | Policy and Procedures |
| SA | System And Services Acquisition | SA-2 | Allocation of Resources |
| SA | System And Services Acquisition | SA-3 | System Development Life Cycle |
| SA | System And Services Acquisition | SA-4 | Acquisition Process |
| SA | System And Services Acquisition | SA-5 | System Documentation |
| SA | System And Services Acquisition | SA-8 | Security and Privacy Engineering Principles |
| SA | System And Services Acquisition | SA-22 | Unsupported System Components |
| SC | System And Communications Protection | SC-7 | Boundary Protection |
| SC | System And Communications Protection | SC-8 (M,H) | Transmission Confidentiality and Integrity |
| SI | System and Information Integrity | SI-3 | Malicious Code Protection |
| SI | System and Information Integrity | SI-5 | Security Alerts, Advisories, and Directives |
| SR | Supply Chain Risk Management | SR-1 | Policy and Procedures |
| SR | Supply Chain Risk Management | SR-4 (NB) | Provenance |
| SR | Supply Chain Risk Management | SR-5 | Acquisition Strategies, Tools, and Methods |
| SR | Supply Chain Risk Management | SR-8 | Notification Agreements |
| SR | Supply Chain Risk Management | SR-9 (H) | Tamper Resistance and Detection (note: SI-7(4) and SA-18 was incorporated) |
| SR | Supply Chain Risk Management | SR-10 | Inspection of Systems or Components |
| SR | Supply Chain Risk Management | SR-11 | Component Authenticity |
| SR | Supply Chain Risk Management | SR-12 | Component Disposal |
Tier 2
| Tier 2- Basic (97 controls total) | |||
| Cybersecurity Supply Chain Risk Management (C-SCRM) Controls (from NIST Special Publication 800-161 Revision 1) | |||
| Control Family | Control Family Name | Control Identifier | Control (or Control Enhancement) Name |
| AC | Access Control | AC-1 | Policy and Procedures |
| AC | Access Control | AC-2 | Account Management |
| AC | Access Control | AC-3 | Access Enforcement |
| AC | Access Control | AC-17 | Remote Access |
| AC | Access Control | AC-18 | Wireless Access |
| AC | Access Control | AC-19 | Access Control for Mobile Devices |
| AC | Access Control | AC-20 | Use of External Systems |
| AC | Access Control | AC-22 | Publicly Accessible Content |
| AT | Awareness and Training | AT-1 | Policy and Procedures |
| AT | Awareness and Training | AT-2(2) | Literacy Training and Awareness | Insider Threat |
| AT | Awareness and Training | AT-3 | Role-based Training |
| AT | Awareness and Training | AT-4 | Training Records |
| AU | Audit and Accountability | AU-1 | Policy and Procedures |
| AU | Audit and Accountability | AU-2 | Event Logging |
| AU | Audit and Accountability | AU-3 | Content of Audit Records |
| AU | Audit and Accountability | AU-6 | Audit Record Review, Analysis, and Reporting |
| AU | Audit and Accountability | AU-12 | Audit Record Generation |
| CA | Assessment, Authorization, And Monitoring | CA-1 | Policy and Procedures |
| CA | Assessment, Authorization, And Monitoring | CA-2 | Control Assessments |
| CA | Assessment, Authorization, And Monitoring | CA-3 | Information Exchange |
| CA | Assessment, Authorization, And Monitoring | CA-5 | Plan of Action and Milestones |
| CA | Assessment, Authorization, And Monitoring | CA-6 | Authorization |
| CM | Configuration Management | CM-1 | Policy and Procedures |
| CM | Configuration Management | CM-2 | Baseline Configuration |
| CM | Configuration Management | CM-4 | Impact Analyses |
| CM | Configuration Management | CM-5 | Access Restrictions for Change |
| CM | Configuration Management | CM-6 | Configuration Settings |
| CM | Configuration Management | CM-7 | Least Functionality |
| CM | Configuration Management | CM-8 | System Component Inventory |
| CM | Configuration Management | CM-10 | Software Usage Restrictions |
| CM | Configuration Management | CM-11 | User-installed Software |
| CP | Contingency Planning | CP-1 | Policy and Procedures |
| CP | Contingency Planning | CP-2 | Contingency Plan |
| CP | Contingency Planning | CP-3 | Contingency Training |
| CP | Contingency Planning | CP-4 | Contingency Plan Testing |
| IA | Identification and Authentication | IA-1 | Policy and Procedures |
| IA | Identification and Authentication | IA-2 | Identification and Authentication (Organizational Users) |
| IA | Identification and Authentication | IA-4 | Identifier Management |
| IA | Identification and Authentication | IA-5 | Authenticator Management |
| IA | Identification and Authentication | IA-8 | Identification and Authentication (non-organizational Users) |
| IR | Incident Response | IR-1 | Policy and Procedures |
| IR | Incident Response | IR-2 | Incident Response Training |
| IR | Incident Response | IR-5 | Incident Monitoring |
| IR | Incident Response | IR-8 | Incident Response Plan |
| MA | Maintenance | MA-1 | Policy and Procedures |
| MA | Maintenance | MA-4 | Nonlocal Maintenance |
| MA | Maintenance | MA-5 | Maintenance Personnel |
| MP | Media Protection | MP-1 | Policy and Procedures |
| MP | Media Protection | MP-6 | Media Sanitization |
| PE | Physical and Environmental | PE-1 | Policy and Procedures |
| PE | Physical and Environmental | PE-2 | Physical Access Authorizations |
| PE | Physical and Environmental | PE-3 | Physical Access Control |
| PE | Physical and Environmental | PE-6 | Monitoring Physical Access |
| PE | Physical and Environmental | PE-16 | Delivery and Removal |
| PL | Planning | PL-1 | Policy and Procedures |
| PL | Planning | PL-2 | System Security and Privacy Plans (note: PL-2(3), PL-3, PL-6) was incorporated) |
| PL | Planning | PL-4 | Rules of Behavior |
| PL | Planning | PL-8 (M,H) | Security and Privacy Architectures |
| PL | Planning | PL-10 | Baseline Selection |
| PM | Program Management | PM-31 (NB) | Continuous Monitoring Strategy |
| PS | Personnel Security | PS-1 | Policy and Procedures |
| PS | Personnel Security | PS-3 | Personnel Screening |
| PS | Personnel Security | PS-6 | Access Agreements |
| PS | Personnel Security | PS-7 | External Personnel Security |
| RA | Risk Assessment | RA-1 | Policy and Procedures |
| RA | Risk Assessment | RA-2 | Security Categorization |
| RA | Risk Assessment | RA-3 | Risk Assessment |
| RA | Risk Assessment | RA-5 | Vulnerability Monitoring and Scanning |
| RA | Risk Assessment | RA-7 | Risk Response |
| SA | System And Services Acquisition | SA-1 | Policy and Procedures |
| SA | System And Services Acquisition | SA-2 | Allocation of Resources |
| SA | System And Services Acquisition | SA-3 | System Development Life Cycle |
| SA | System And Services Acquisition | SA-4 | Acquisition Process |
| SA | System And Services Acquisition | SA-5 | System Documentation |
| SA | System And Services Acquisition | SA-8 | Security and Privacy Engineering Principles |
| SA | System And Services Acquisition | SA-22 | Unsupported System Components |
| SC | System And Communications Protection | SC-1 | Policy and Procedures |
| SC | System And Communications Protection | SC-7 | Boundary Protection |
| SC | System And Communications Protection | SC-8 (M,H) | Transmission Confidentiality and Integrity |
| SI | System and Information Integrity | SI-1 | Policy and Procedures |
| SI | System and Information Integrity | SI-2 | Flaw Remediation |
| SI | System and Information Integrity | SI-3 | Malicious Code Protection |
| SI | System and Information Integrity | SI-4 | System Monitoring |
| SI | System and Information Integrity | SI-5 | Security Alerts, Advisories, and Directives |
| SI | System and Information Integrity | SI-12 | Information Management and Retention |
| SR | Supply Chain Risk Management | SR-1 | Policy and Procedures |
| SR | Supply Chain Risk Management | SR-2 | Supply Chain Risk Management Plan |
| SR | Supply Chain Risk Management | SR-3 | Supply Chain Controls and Processes |
| SR | Supply Chain Risk Management | SR-4 (NB) | Provenance |
| SR | Supply Chain Risk Management | SR-5 | Acquisition Strategies, Tools, and Methods |
| SR | Supply Chain Risk Management | SR-8 | Notification Agreements |
| SR | Supply Chain Risk Management | SR-9 (H) | Tamper Resistance and Detection (note: SI-7(4) and SA-18 was incorporated) |
| SR | Supply Chain Risk Management | SR-10 | Inspection of Systems or Components |
| SR | Supply Chain Risk Management | SR-11 | Component Authenticity |
| SR | Supply Chain Risk Management | SR-11(1) | Component Authenticity | Anti-counterfeit Training |
| SR | Supply Chain Risk Management | SR-11(2) | Component Authenticity | Configuration Control for Component Service and Repair |
| SR | Supply Chain Risk Management | SR-12 | Component Disposal |
Tier 3
| Tier 3- Intermediate (138 controls total) | |||
| Cybersecurity Supply Chain Risk Management (C-SCRM) Controls (from NIST Special Publication 800-161 Revision 1) | |||
| Control Family | Control Family Name | Control Identifier | Control (or Control Enhancement) Name |
| AC | Access Control | AC-1 | Policy and Procedures |
| AC | Access Control | AC-2 | Account Management |
| AC | Access Control | AC-3 | Access Enforcement |
| AC | Access Control | AC-4 | Information Flow Enforcement |
| AC | Access Control | AC-5 | Separation of Duties |
| AC | Access Control | AC-17 | Remote Access |
| AC | Access Control | AC-18 | Wireless Access |
| AC | Access Control | AC-19 | Access Control for Mobile Devices |
| AC | Access Control | AC-20 | Use of External Systems |
| AC | Access Control | AC-20(1) | Use of External Systems | Limits on Authorized Use |
| AC | Access Control | AC-21 | Information Sharing |
| AC | Access Control | AC-22 | Publicly Accessible Content |
| AT | Awareness and Training | AT-1 | Policy and Procedures |
| AT | Awareness and Training | AT-2(2) | Literacy Training and Awareness | Insider Threat |
| AT | Awareness and Training | AT-2(3) | Literacy Training and Awareness | Social Engineering and Mining |
| AT | Awareness and Training | AT-3 | Role-based Training |
| AT | Awareness and Training | AT-4 | Training Records |
| AU | Audit and Accountability | AU-1 | Policy and Procedures |
| AU | Audit and Accountability | AU-2 | Event Logging |
| AU | Audit and Accountability | AU-3 | Content of Audit Records |
| AU | Audit and Accountability | AU-6 | Audit Record Review, Analysis, and Reporting |
| AU | Audit and Accountability | AU-12 | Audit Record Generation |
| CA | Assessment, Authorization, And Monitoring | CA-1 | Policy and Procedures |
| CA | Assessment, Authorization, And Monitoring | CA-2 | Control Assessments |
| CA | Assessment, Authorization, And Monitoring | CA-3 | Information Exchange |
| CA | Assessment, Authorization, And Monitoring | CA-5 | Plan of Action and Milestones |
| CA | Assessment, Authorization, And Monitoring | CA-6 | Authorization |
| CM | Configuration Management | CM-1 | Policy and Procedures |
| CM | Configuration Management | CM-2 | Baseline Configuration |
| CM | Configuration Management | CM-3 | Configuration Change Control |
| CM | Configuration Management | CM-3(2) | Configuration Change Control | Testing, Validation, and Documentation of Changes |
| CM | Configuration Management | CM-3(4) | Configuration Change Control | Security and Privacy Representatives |
| CM | Configuration Management | CM-4 | Impact Analyses |
| CM | Configuration Management | CM-5 | Access Restrictions for Change |
| CM | Configuration Management | CM-6 | Configuration Settings |
| CM | Configuration Management | CM-7 | Least Functionality |
| CM | Configuration Management | CM-7(1) | Least Functionality | Periodic Review |
| CM | Configuration Management | CM-7(5) | Least Functionality | Authorized Software |
| CM | Configuration Management | CM-8 | System Component Inventory |
| CM | Configuration Management | CM-8(1) | System Component Inventory | Updates During Installation and Removal |
| CM | Configuration Management | CM-9 | Configuration Management Plan |
| CM | Configuration Management | CM-10 | Software Usage Restrictions |
| CM | Configuration Management | CM-11 | User-installed Software |
| CM | Configuration Management | CM-12 | Information Location |
| CM | Configuration Management | CM-12(1) | Information Location | Automated Tools to Support Information Location |
| CP | Contingency Planning | CP-1 | Policy and Procedures |
| CP | Contingency Planning | CP-2 | Contingency Plan |
| CP | Contingency Planning | CP-2(1) | Contingency Plan | Coordinate with Related Plans |
| CP | Contingency Planning | CP-2(8) | Contingency Plan | Identify Critical Assets |
| CP | Contingency Planning | CP-3 | Contingency Training |
| CP | Contingency Planning | CP-4 | Contingency Plan Testing |
| CP | Contingency Planning | CP-6 | Alternate Storage Site |
| CP | Contingency Planning | CP-6(1) | Alternate Storage Site | Separation from Primary Site |
| CP | Contingency Planning | CP-7 | Alternate Processing Site |
| CP | Contingency Planning | CP-8 | Telecommunications Services |
| IA | Identification and Authentication | IA-1 | Policy and Procedures |
| IA | Identification and Authentication | IA-2 | Identification and Authentication (Organizational Users) |
| IA | Identification and Authentication | IA-3 | Device Identification and Authentication |
| IA | Identification and Authentication | IA-4 | Identifier Management |
| IA | Identification and Authentication | IA-5 | Authenticator Management |
| IA | Identification and Authentication | IA-8 | Identification and Authentication (non-organizational Users) |
| IR | Incident Response | IR-1 | Policy and Procedures |
| IR | Incident Response | IR-2 | Incident Response Training |
| IR | Incident Response | IR-3 | Incident Response Testing |
| IR | Incident Response | IR-5 | Incident Monitoring |
| IR | Incident Response | IR-6(3) | Incident Reporting | Supply Chain Coordination |
| IR | Incident Response | IR-8 | Incident Response Plan |
| MA | Maintenance | MA-1 | Policy and Procedures |
| MA | Maintenance | MA-3 | Maintenance Tools |
| MA | Maintenance | MA-3(1) | Maintenance Tools | Inspect Tools |
| MA | Maintenance | MA-3(2) | Maintenance Tools | Inspect Media |
| MA | Maintenance | MA-3(3) | Maintenance Tools | Prevent Unauthorized Removal |
| MA | Maintenance | MA-4 | Nonlocal Maintenance |
| MA | Maintenance | MA-5 | Maintenance Personnel |
| MA | Maintenance | MA-6 | Timely Maintenance (note: SA-12(13) was incorporated) |
| MP | Media Protection | MP-1 | Policy and Procedures |
| MP | Media Protection | MP-4 | Media Storage |
| MP | Media Protection | MP-5 | Media Transport |
| MP | Media Protection | MP-6 | Media Sanitization |
| PE | Physical and Environmental | PE-1 | Policy and Procedures |
| PE | Physical and Environmental | PE-2 | Physical Access Authorizations |
| PE | Physical and Environmental | PE-3 | Physical Access Control |
| PE | Physical and Environmental | PE-6 | Monitoring Physical Access |
| PE | Physical and Environmental | PE-16 | Delivery and Removal |
| PE | Physical and Environmental | PE-17 | Alternate Work Site |
| PL | Planning | PL-1 | Policy and Procedures |
| PL | Planning | PL-2 | System Security and Privacy Plans (note: PL-2(3), PL-3, PL-6) was incorporated) |
| PL | Planning | PL-4 | Rules of Behavior |
| PL | Planning | PL-8 (M,H) | Security and Privacy Architectures |
| PL | Planning | PL-10 | Baseline Selection |
| PM | Program Management | PM-31 (NB) | Continuous Monitoring Strategy |
| PS | Personnel Security | PS-1 | Policy and Procedures |
| PS | Personnel Security | PS-3 | Personnel Screening |
This is the start of the file's text. The full file is on GovTribe.
File details come from the government source that posted it. Updated .