Attachment D13 H_H_H - RTM 5May21.pdf
PDF 1 MB Posted
- Attached to
- Transportation Security Administration Checkpoint Integrated Logistics Support (ILS) Services
- Solicitation number
- TSA25-04-0338
About this file
This federal contract opportunity notice seeks proposals for Transportation Security Administration Checkpoint Integrated Logistics Support (ILS) Services. The solicitation seeks to establish a single-award IDIQ contract to provide ILS services including maintenance, supply chain management, training support, and equipment refurbishment for TSA checkpoint security equipment. Proposals are due by April 30, 2025 and the contract will have a one-year base period and four one-year options, for a total of five years. The place of performance will be nationwide at TSA facilities. The estimated value is $50 million. The set-aside type is unrestricted.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| Questions and Answers.pdf | ||
| Part F- Attachment TSE Inventory List.xlsx | XLSX spreadsheet | |
| D-2 Contract Data Requirements Lists (CDRLs).zip | ZIP file | |
| D-3a Data Dictionary.xlsx | XLSX spreadsheet | |
| Attachment D7 - TSA ILS SLA Performance Metrics.rtf | RTF text file | |
| D-1 Fed Airport Listing and Airport Operational Hours.xlsx | XLSX spreadsheet | |
| D-2 Data Item Descriptions (DIDs).zip | ZIP file | |
| D-3 TSE Metrics Terms and Definitions and RMA Metrics.docx | DOCX document | |
| Attachment D-12 Cybersecurity and Enterprise Architecture Policy.docx | DOCX document | |
| ILS Checkpoint Draft PWS 12.19.pdf |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
FOR OFFICIAL USE ONLY
[System Name]
Requirements Traceability Matrix
(RTM)
H-H-H
Prepared for
Department of Homeland Security
5 May 2021 i
1. Introduction
The Requirements Traceability Matrix (RTM) relates requirements from requirement source documents to the security certification process. It ensures that all security requirements are identified and investigated. Each row of the matrix identifies a specific requirement and provides the details of how it was tested or analyzed and the results.
The table is arranged to display the system security requirements from the applicable regulation documents, which are listed below:
• NIST 800-53 w/ DHS 4300A Rev 4 - Department of Homeland Security Sensitive Systems Policy Directive 4300A Version 12 (with NIST 800-53 Rev 4)
The columns of the RTM are defined as follows:
Control Ref. Refers to the name (short title) of the source document and the ID or paragraph number of the listed control or requirement.
Security Req./ Control
Short title describing the security control or requirement (and the text of the control/requirement, which may be paraphrased for brevity).
Security Category
Category and class associated with the security control.
Control Type
Auto populated if the requirement is identified with two security control types: common and system-specific; i.e., a part of the requirement is identified as common type and another part of it is system-specific.
• Common. Auto populated if the requirement is designated to one or more information systems.
• Hybrid. Auto populated if the requirement is identified with two security control types:
common and system-specific; i.e., a part of the requirement is identified as common type and another part of it is system-specific.
• System-Specific. Auto populated if the requirement is assigned to a specific information system.
• Inherited. Auto populated if the requirement is inherited from another system.
• Not Specified. Auto populated if the requirement does not require any security control.
Planned Imp.
Auto populated if the requirement is identified with two security control types: common and system-specific; i.e., a part of the requirement is identified as common type and another part of it is system-specific.
• Common. Auto populated if the requirement is designated to one or more information systems.
• Hybrid. Auto populated if the requirement is identified with two security control types:
common and system-specific; i.e., a part of the requirement is identified as common type and another part of it is system-specific.
• System-Specific. Auto populated if the requirement is assigned to a specific information system.
• Inherited. Auto populated if the requirement is inherited from another system.
• Not Specified. Auto populated if the requirement does not require any security control.
Actual Imp. Identification whether the control is in place and how it has been implemented, or differences ii in how the control was implemented compared to what was planned.
• As Planned. Auto populated if Implemented control status is selected and Planned
Implementation column does not read Not Entered.
• Pending Implementation. Auto populated if Planned control status is selected and
Planned Implementation column does not read Not Entered.
• Partially Implemented. Auto populated if Partial control status is selected and
Planned Implementation column does not read Not Entered.
• Not Entered. Auto populated if the Planned Implementation column reads Not
Entered.
• Not Assigned. Auto populated if the Control Type and/or Control Status were not selected.
Test #(s) The ID number of the specific test procedure(s) that is used to validate the requirement or control.
• -. The control is not applicable.
Methods
The evaluation method (or methods) used to assess the requirement.
• I. Interview.
• E. Examine.
• T. Testing.
• -. The control is not applicable.
Tailored
The tailored control that modifies the control set.
• In. The control was tailored in.
• Out. The control was tailored out.
• - . The control was not affected from tailoring.
Overlays
The controls included or excluded from the controls already in the baseline.
• In. The control was added in to the controls in the baseline.
• Out. The control was removed from the controls in the baseline.
• - . The control was not affected from overlay(s).
Result
The summarized result for the test procedures that cover the requirement/control.
• Met - Requirement fully satisfied.
• Not Met - Requirement not satisfied.
• Not Applicable - Requirement not applicable.
Notes Identifies the factor, and the basis for; any tailoring of controls from the NIST 800-53 w/ DHS 4300A Rev 4 baseline or organizational overlay that was used for the system.
2. Requirements Traceability Matrix
Control Ref.
Security Req./
Control
Security Category
Control Type
Planned Imp.
Actual Imp.
Test #(s)
Methods Tailored Result Notes
I E T IN OUT
NIST 800-
53 w/ DHS 4300A Rev
4 AC-1
Access Control
Policy and Procedures
Access Control
Policy and Procedures
(T)
System- Specific Not Entered Not Assigned
AC-1.1,
AC-1.1,
AC-1.1,
AC-1.2,
AC-1.2,
AC-1.2
X X - X - Not Met Control was added by overlay "DHS
Overlay 1.0"
NIST 800-
53 w/ DHS 4300A Rev
4 AC-1
(DHS-
5.1.1.c)
Sharing of Personal
Passwords
Access Control
Policy and Procedures
(T)
System- Specific Not Entered Not Assigned
AC-
1(DHS-
5.1.1.c), AC-
1(DHS-
5.1.1.c), AC-
1(DHS-
5.1.1.c)
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 AC-2
Account Management
Account Management
(T)
System- Specific Not Entered Not Assigned
AC-2.1,
AC-2.1,
AC-2.1
X X - X - Not Met
Not pursuing an
ATP
Control was added by overlay "DHS
Overlay 1.0"
NIST 800-
53 w/ DHS 4300A Rev
4 AC-2 (1)
Automated System Account
Management
Account Management
(T)
System- Specific Not Entered Not Assigned
AC-
2(1).1, AC-
2(1).1, AC-2(1).1
X X - - - Not Met None
NIST 800- Removal Of Account System- Not Entered Not Assigned AC- X X - - - Not Met None
Control Ref.
Security Req./
Category
Control Type
Planned Imp.
Actual Imp.
Test #(s) Methods Tailored Result Notes
53 w/ DHS 4300A Rev
4 AC-2 (2)
Temporary / Emergency Accounts
Management (T)
Specific 2(2).1, AC-
2(2).1, AC-2(2).1
NIST 800-
53 w/ DHS 4300A Rev
4 AC-2 (3)
Disable Inactive
Accounts
Account Management
(T)
System- Specific Not Entered Not Assigned
AC-
2(3).1, AC-
2(3).1, AC-2(3).1
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 AC-2 (4)
Automated Audit Actions
Account Management
(T)
System- Specific Not Entered Not Assigned
AC-
2(4).1, AC-
2(4).1, AC-2(4).1
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 AC-2 (5)
Inactivity Logout
Account Management
(T)
System- Specific Not Entered Not Assigned
AC-
2(5).1, AC-
2(5).1, AC-2(5).1
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 AC-2
(11)
Usage Conditions
Account Management
(T)
System- Specific Not Entered Not Assigned
AC-
2(11).1, AC-
2(11).1, AC-
2(11).1
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 AC-3
Access Enforcement
Access Enforcement
(T)
System- Specific Not Entered Not Assigned
AC-3.1,
AC-3.1,
AC-3.1
X X - X - Not Met
Overlay 1.0"
NIST 800-
53 w/ DHS 4300A Rev
Use of group passwords
Access Enforcement
(T)
System- Specific Not Entered Not Assigned
AC-
3(DHS-
5.1.1.d), Control Ref.
Control Type
Planned Imp.
Actual Imp.
Test #(s) Methods Tailored Result Notes
4 AC-3
(DHS-
5.1.1.d)
AC-
3(DHS-
5.1.1.d), AC-
3(DHS-
5.1.1.d)
NIST 800-
53 w/ DHS 4300A Rev
4 AC-4
Information Flow
Enforcement
Information Flow
Enforcement (T)
System- Specific Not Entered Not Assigned
AC-4.1,
AC-4.1,
AC-4.1
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 AC-5
Separation of Duties
Separation of Duties (T)
System- Specific Not Entered Not Assigned
AC-5.1,
AC-5.1,
AC-5.1
X X - X - Not Met Control was added by overlay "DHS
Overlay 1.0"
NIST 800-
53 w/ DHS 4300A Rev
4 AC-6
Least Privilege
Least Privilege (T)
System- Specific Not Entered Not Assigned
AC-6.1,
AC-6.1,
AC-6.1
X X - X - Not Met
Overlay 1.0"
NIST 800-
53 w/ DHS 4300A Rev
4 AC-6 (1)
Authorize Access To Security
Functions
Least Privilege (T)
System- Specific Not Entered Not Assigned
AC-
6(1).1, AC-
6(1).1, AC-6(1).1
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 AC-6 (2)
Non- Privileged Access For Nonsecurity Functions
Least Privilege (T)
System- Specific Not Entered Not Assigned
AC-
6(2).1, AC-
6(2).1, AC-6(2).1
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 AC-6 (3)
Network Access To Privileged Commands
Least Privilege (T)
System- Specific Not Entered Not Assigned
AC-
6(3).1, AC-
6(3).1, Control Ref.
Control Type
Planned Imp.
Actual Imp.
Test #(s) Methods Tailored Result Notes
AC-6(3).1
NIST 800-
53 w/ DHS 4300A Rev
4 AC-6 (5)
Privileged Accounts
Least Privilege (T)
System- Specific Not Entered Not Assigned
AC-
6(5).1, AC-
6(5).1, AC-6(5).1
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 AC-6 (9)
Auditing Use Of Privileged
Functions
Least Privilege (T)
System- Specific Not Entered Not Assigned
AC-
6(9).1, AC-
6(9).1, AC-6(9).1
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 AC-6
(10)
Prohibit Non- Privileged
Users From Executing Privileged Functions
Least Privilege (T)
System- Specific Not Entered Not Assigned
AC-
6(10).1, AC-
6(10).1, AC-
6(10).1
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 AC-7
Unsuccessful Logon
Attempts
Unsuccessful Logon
Attempts (T)
System- Specific Not Entered Not Assigned
AC-7.1,
AC-7.1,
AC-7.1
X X - X - Not Met Control was added by overlay "DHS
Overlay 1.0"
NIST 800-
53 w/ DHS 4300A Rev
4 AC-8
System Use Notification
System Use Notification
(T)
System- Specific Not Entered Not Assigned
AC-8.1,
AC-8.1,
AC-8.1,
AC-8.2,
AC-8.2,
AC-8.2
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 AC-8
(DHS-
4.8.5.d)
Government Funded Office
Equipment
System Use Notification
(T)
System- Specific Not Entered Not Assigned
AC-
8(DHS-
4.8.5.d), AC-
8(DHS-
4.8.5.d), AC-
8(DHS-
4.8.5.d)
X X - - - Not Met None
NIST 800-
53 w/ DHS
Concurrent Session
Concurrent Session
System- Specific Not Entered Not Assigned AC-10.1, AC-10.1, X X - - - Not Met None
Control Ref.
Control Type
Planned Imp.
Actual Imp.
Test #(s) Methods Tailored Result Notes
4300A Rev
4 AC-10
Control Control (T) AC-10.1
NIST 800-
53 w/ DHS 4300A Rev
4 AC-11
Session Lock Session Lock (T)
System- Specific Not Entered Not Assigned
AC-11.1,
AC-11.1,
AC-11.1
X X - X - Not Met
Overlay 1.0"
NIST 800-
53 w/ DHS 4300A Rev
4 AC-11
(1)
Pattern- Hiding
Displays
Session Lock (T)
System- Specific Not Entered Not Assigned
AC-
11(1).1, AC-
11(1).1, AC-
11(1).1
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 AC-11
(DHS-
4.6.2.o)
Mobile Device Idle
Lockout
Session Lock (T)
System- Specific Not Entered Not Assigned
AC-
11(DHS-
4.6.2.o), AC-
11(DHS-
4.6.2.o), AC-
11(DHS-
4.6.2.o)
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 AC-12
Session Termination
Session Termination
(T)
System- Specific Not Entered Not Assigned
AC-12.1,
AC-12.1,
AC-12.1
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 AC-14
Permitted Actions without
Identification or
Authenticatio n
Permitted Actions without
Identification or
Authenticatio n (T)
System- Specific Not Entered Not Assigned
AC-14.1,
AC-14.1,
AC-14.1
Control Ref.
Control Type
Planned Imp.
Actual Imp.
Test #(s) Methods Tailored Result Notes
NIST 800-
53 w/ DHS 4300A Rev
4 AC-17
Remote Access
Remote Access (T)
System- Specific Not Entered Not Assigned
AC-17.1,
AC-17.1,
AC-17.1
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 AC-17
(1)
Automated Monitoring /
Control
Remote Access (T)
System- Specific Not Entered Not Assigned
AC-
17(1).1, AC-
17(1).1, AC-
17(1).1
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 AC-17
(2)
Protection Of Confidentialit y / Integrity
Using Encryption
Remote Access (T)
System- Specific Not Entered Not Assigned
AC-
17(2).1, AC-
17(2).1, AC-
17(2).1
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 AC-17
(3)
Managed Access Control Points
Remote Access (T)
System- Specific Not Entered Not Assigned
AC-
17(3).1, AC-
17(3).1, AC-
17(3).1
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 AC-17
(4)
Privileged Commands /
Access
Remote Access (T)
System- Specific Not Entered Not Assigned
AC-
17(4).1, AC-
17(4).1, AC-
17(4).1
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 AC-17
(DHS-
5.4.1.b)
Remote Access
Connection Management
Remote Access (T)
System- Specific Not Entered Not Assigned
AC-
17(DHS-
5.4.1.b), AC-
17(DHS-
5.4.1.b), AC-
17(DHS-
5.4.1.b)
NIST 800- Remote Remote System- Not Entered Not Assigned AC- X X - - - Not Met None
Control Ref.
Control Type
Planned Imp.
Actual Imp.
Test #(s) Methods Tailored Result Notes
53 w/ DHS 4300A Rev
4 AC-17
(DHS-
5.4.1.c)
Access of PII Access (T) Specific 17(DHS- 5.4.1.c), AC-
17(DHS-
5.4.1.c), AC-
17(DHS-
5.4.1.c)
NIST 800-
53 w/ DHS 4300A Rev
4 AC-18
Wireless Access
Wireless Access (T)
System- Specific Not Entered Not Assigned
AC-18.1,
AC-18.1,
AC-18.1
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 AC-18
(1)
Authenticatio n And
Encryption
Wireless Access (T)
System- Specific Not Entered Not Assigned
AC-
18(1).1, AC-
18(1).1, AC-
18(1).1
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 AC-18
(4)
Restrict Configuration s By Users
Wireless Access (T)
System- Specific Not Entered Not Assigned
AC-
18(4).1, AC-
18(4).1, AC-
18(4).1
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 AC-18
(5)
Antennas / Transmission Power Levels
Wireless Access (T)
System- Specific Not Entered Not Assigned
AC-
18(5).1, AC-
18(5).1, AC-
18(5).1
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 AC-18
(DHS-
4.8.6.a)
Wireless Settings for Peripheral Equipment
Wireless Access (T)
System- Specific Not Entered Not Assigned
AC-
18(DHS-
4.8.6.a), AC-
18(DHS-
4.8.6.a), AC-
18(DHS-
Control Ref.
Control Type
Planned Imp.
Actual Imp.
Test #(s) Methods Tailored Result Notes
4.8.6.a)
NIST 800-
53 w/ DHS 4300A Rev
4 AC-18
(DHS-
4.8.6.b)
Disabling Wireless
Wireless Access (T)
System- Specific Not Entered Not Assigned
AC-
18(DHS-
4.8.6.b), AC-
18(DHS-
4.8.6.b), AC-
18(DHS-
4.8.6.b)
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 AC-19
Access Control for
Mobile Devices
Access Control for
Mobile Devices (T)
System- Specific Not Entered Not Assigned
AC-19.1,
AC-19.1,
AC-19.1
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 AC-19
(5)
Full Device / Container-
Based Encryption
Access Control for
Mobile Devices (T)
System- Specific Not Entered Not Assigned
AC-
19(5).1, AC-
19(5).1, AC-
19(5).1
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 AC-20
Use of External
Information Systems
Use of External
Information Systems (T)
System- Specific Not Entered Not Assigned
AC-20.1,
AC-20.1,
AC-20.1
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 AC-20
(1)
Limits On Authorized
Use
Use of External
Information Systems (T)
System- Specific Not Entered Not Assigned
AC-
20(1).1, AC-
20(1).1, AC-
20(1).1
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 AC-20
(2)
Portable Storage Devices
Use of External
Information Systems (T)
System- Specific Not Entered Not Assigned
AC-
20(2).1, AC-
20(2).1, AC-
20(2).1
X X - - - Not Met None
NIST 800-
53 w/ DHS
Information Sharing
Information Sharing (T)
System- Specific Not Entered Not Assigned AC-21.1, AC-21.1, X X - - - Not Met None
Control Ref.
Control Type
Planned Imp.
Actual Imp.
Test #(s) Methods Tailored Result Notes
4300A Rev
4 AC-21
AC-21.1
NIST 800-
53 w/ DHS 4300A Rev
4 AC-22
Publicly Accessible
Content
Publicly Accessible Content (T)
System- Specific Not Entered Not Assigned
AC-22.1,
AC-22.1,
AC-22.1
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 AT-1
Security Awareness and Training Policy and Procedures
Security Awareness and Training Policy and Procedures
(O)
System- Specific Not Entered Not Assigned
AT-1.1,
AT-1.1,
AT-1.1,
AT-1.2,
AT-1.2,
AT-1.2
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 AT-2
Security Awareness Training
Security Awareness
Training (O)
System- Specific Not Entered Not Assigned
AT-2.1,
AT-2.1,
AT-2.1
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 AT-2 (2)
Insider Threat Security
Awareness Training (O)
System- Specific Not Entered Not Assigned
AT-
2(2).1, AT-
2(2).1, AT-2(2).1
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 AT-3
Role-Based Security Training
Role-Based Security
Training (O)
System- Specific Not Entered Not Assigned
AT-3.1,
AT-3.1,
AT-3.1
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 AT-4
Security Training Records
Security Training
Records (O)
System- Specific Not Entered Not Assigned
AT-4.1,
AT-4.1,
AT-4.1
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 AU-1
Audit and Accountabilit y Policy and Procedures
Audit and Accountabilit y Policy and Procedures
(T)
System- Specific Not Entered Not Assigned
AU-1.1,
AU-1.1,
AU-1.1,
AU-1.2,
AU-1.2,
AU-1.2
X X - X - Not Met Control was added by overlay "DHS
Overlay 1.0"
NIST 800-
53 w/ DHS 4300A Rev
Audit Events Audit Events (T)
System- Specific Not Entered Not Assigned
AU-2.1,
AU-2.1,
AU-2.1
X X - X - Not Met
Control Ref.
Control Type
Planned Imp.
Actual Imp.
Test #(s) Methods Tailored Result Notes
4 AU-2
Overlay 1.0"
NIST 800-
53 w/ DHS 4300A Rev
4 AU-2 (3)
Reviews And Updates
Audit Events (T)
System- Specific Not Entered Not Assigned
AU-
2(3).1, AU-
2(3).1, AU-2(3).1
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 AU-3
Content of Audit
Records
Content of Audit
Records (T)
System- Specific Not Entered Not Assigned
AU-3.1,
AU-3.1,
AU-3.1
X X - X - Not Met Control was added by overlay "DHS
Overlay 1.0"
NIST 800-
53 w/ DHS 4300A Rev
4 AU-3 (1)
Additional Audit
Information
Content of Audit
Records (T)
System- Specific Not Entered Not Assigned
AU-
3(1).1, AU-
3(1).1, AU-3(1).1
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 AU-3 (2)
Centralized Management Of Planned
Audit Record Content
Content of Audit
Records (T)
System- Specific Not Entered Not Assigned
AU-
3(2).1, AU-
3(2).1, AU-3(2).1
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 AU-3
(DHS-
5.3.a)
DHS
Required
Contents for Audit
Records
Content of Audit
Records (T)
System- Specific Not Entered Not Assigned
AU-
3(DHS-
5.3.a), AU-
3(DHS-
5.3.a), AU-
3(DHS-
5.3.a)
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
Audit Storage Capacity
Audit Storage Capacity (T)
System- Specific Not Entered Not Assigned
AU-4.1,
AU-4.1,
AU-4.1
Control Ref.
Control Type
Planned Imp.
Actual Imp.
Test #(s) Methods Tailored Result Notes
4 AU-4
NIST 800-
53 w/ DHS 4300A Rev
4 AU-5
Response to Audit
Processing Failures
Response to Audit
Processing Failures (T)
System- Specific Not Entered Not Assigned
AU-5.1,
AU-5.1,
AU-5.1
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 AU-5 (1)
Audit Storage Capacity
Response to Audit
Processing Failures (T)
System- Specific Not Entered Not Assigned
AU-
5(1).1, AU-
5(1).1, AU-5(1).1
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 AU-5 (2)
Real-Time Alerts
Response to Audit
Processing Failures (T)
System- Specific Not Entered Not Assigned
AU-
5(2).1, AU-
5(2).1, AU-5(2).1
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 AU-6
Audit Review, Analysis, and Reporting
Audit Review, Analysis, and Reporting (T)
System- Specific Not Entered Not Assigned
AU-6.1,
AU-6.1,
AU-6.1,
AU-6.2,
AU-6.2,
AU-6.2
X X - X - Not Met Control was added by overlay "DHS
Overlay 1.0"
NIST 800-
53 w/ DHS 4300A Rev
4 AU-6 (1)
Process Integration
Audit Review, Analysis, and Reporting (T)
System- Specific Not Entered Not Assigned
AU-
6(1).1, AU-
6(1).1, AU-6(1).1
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 AU-6 (3)
Correlate Audit
Repositories
Audit Review, Analysis, and Reporting (T)
System- Specific Not Entered Not Assigned
AU-
6(3).1, AU-
6(3).1, AU-6(3).1
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 AU-6 (5)
Integration / Scanning
And Monitoring Capabilities
Audit Review, Analysis, and Reporting (T)
System- Specific Not Entered Not Assigned
AU-
6(5).1, AU-
6(5).1, AU-6(5).1
X X - - - Not Met None
NIST 800-
53 w/ DHS
Correlation With Physical
Audit Review, System- Specific Not Entered Not Assigned AU-
6(6).1, X X - - - Not Met None
Control Ref.
Control Type
Planned Imp.
Actual Imp.
Test #(s) Methods Tailored Result Notes
4300A Rev
4 AU-6 (6)
Monitoring Analysis, and Reporting (T)
AU-
6(6).1, AU-6(6).1
NIST 800-
53 w/ DHS 4300A Rev
4 AU-6
(DHS-
5.3.h)
Audit Reduction and Report Generation Capability
Audit Review, Analysis, and Reporting (T)
System- Specific Not Entered Not Assigned
AU-
6(DHS-
5.3.h), AU-
6(DHS-
5.3.h), AU-
6(DHS-
5.3.h)
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 AU-6
(DHS-
5.3.i)
Audit Time Stamps
Audit Review, Analysis, and Reporting (T)
System- Specific Not Entered Not Assigned
AU-
6(DHS-
5.3.i), AU-
6(DHS-
5.3.i), AU-
6(DHS-
5.3.i)
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 AU-6
(DHS-
5.4.6.f)
Mail Server Administratio n
Audit Review, Analysis, and Reporting (T)
System- Specific Not Entered Not Assigned
AU-
6(DHS-
5.4.6.f), AU-
6(DHS-
5.4.6.f), AU-
6(DHS-
5.4.6.f)
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 AU-7
Audit Reduction and Report Generation
Audit Reduction and Report Generation
(T)
System- Specific Not Entered Not Assigned
AU-7.1,
AU-7.1,
AU-7.1
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
Automatic Processing
Audit Reduction and Report
System- Specific Not Entered Not Assigned
AU-
7(1).1, AU-
Control Ref.
Control Type
Planned Imp.
Actual Imp.
Test #(s) Methods Tailored Result Notes
4 AU-7 (1) Generation (T)
7(1).1, AU-7(1).1
NIST 800-
53 w/ DHS 4300A Rev
4 AU-8
Time Stamps Time Stamps (T)
System- Specific Not Entered Not Assigned
AU-8.1,
AU-8.1,
AU-8.1
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 AU-8 (1)
Synchronizati on With
Authoritative Time Source
Time Stamps (T)
System- Specific Not Entered Not Assigned
AU-
8(1).1, AU-
8(1).1, AU-8(1).1
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 AU-9
Protection of Audit
Information
Protection of Audit
Information (T)
System- Specific Not Entered Not Assigned
AU-9.1,
AU-9.1,
AU-9.1
X X - X - Not Met Control was added by overlay "DHS
Overlay 1.0"
NIST 800-
53 w/ DHS 4300A Rev
4 AU-9 (2)
Audit Backup On Separate
Physical Systems /
Components
Protection of Audit
Information (T)
System- Specific Not Entered Not Assigned
AU-
9(2).1, AU-
9(2).1, AU-9(2).1
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 AU-9 (3)
Cryptographi c Protection
Protection of Audit
Information (T)
System- Specific Not Entered Not Assigned
AU-
9(3).1, AU-
9(3).1, AU-9(3).1
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 AU-9 (4)
Access By Subset Of Privileged
Users
Protection of Audit
Information (T)
System- Specific Not Entered Not Assigned
AU-
9(4).1, AU-
9(4).1, AU-9(4).1
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 AU-10
Non-repudiation
Non-repudiation
(T)
System- Specific Not Entered Not Assigned
AU-10.1,
AU-10.1,
AU-10.1
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 AU-11
Audit Record Retention
Audit Record Retention (T)
System- Specific Not Entered Not Assigned
AU-11.1,
AU-11.1,
AU-11.1
X X - X - Not Met Control was added
Overlay 1.0"
Control Ref.
Control Type
Planned Imp.
Actual Imp.
Test #(s) Methods Tailored Result Notes
NIST 800-
53 w/ DHS 4300A Rev
4 AU-11
(DHS-
5.3.d)
Audit Log Retention
Audit Record Retention (T)
System- Specific Not Entered Not Assigned
AU-
11(DHS-
5.3.d), AU-
11(DHS-
5.3.d), AU-
11(DHS-
5.3.d)
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 AU-12
Audit Generation
Audit Generation
(T)
System- Specific Not Entered Not Assigned
AU-12.1,
AU-12.1,
AU-12.1
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 AU-12
(1)
System-Wide / Time-
Correlated Audit Trail
Audit Generation
(T)
System- Specific Not Entered Not Assigned
AU-
12(1).1, AU-
12(1).1, AU-
12(1).1
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 AU-12
(3)
Changes By Authorized Individuals
Audit Generation
(T)
System- Specific Not Entered Not Assigned
AU-
12(3).1, AU-
12(3).1, AU-
12(3).1
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 AU-12
(DHS-
5.3.g)
Audit Coordination with Component or DHS SOC
Audit Generation
(T)
System- Specific Not Entered Not Assigned
AU-
12(DHS-
5.3.g), AU-
12(DHS-
5.3.g), AU-
12(DHS-
5.3.g)
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 CA-1
Security Assessment and Authorization
Security Assessment and Authorization
System- Specific Not Entered Not Assigned
CA-1.1,
CA-1.1,
CA-1.1,
CA-1.2,
X X - X - Not Met Control was added
Control Ref.
Control Type
Planned Imp.
Actual Imp.
Test #(s) Methods Tailored Result Notes
Policies and Procedures
Policies and Procedures
(M)
CA-1.2,
CA-1.2
NIST 800-
53 w/ DHS 4300A Rev
4 CA-1
(DHS-
3.18.c)
Cloud Environment
Usage
Security Assessment and Authorization Policies and Procedures
(M)
System- Specific Not Entered Not Assigned
CA-
1(DHS-
3.18.c), CA-
1(DHS-
3.18.c), CA-
1(DHS-
3.18.c)
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 CA-1
(DHS-
3.18.d)
Usage of FedRAMP for Cloud Systems
Security Assessment and Authorization Policies and Procedures
(M)
System- Specific Not Entered Not Assigned
CA-
1(DHS-
3.18.d), CA-
1(DHS-
3.18.d), CA-
1(DHS-
3.18.d)
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 CA-1
(DHS-
3.18.e)
Usage of Public Cloud
Service Provider
Security Assessment and Authorization Policies and Procedures
(M)
System- Specific Not Entered Not Assigned
CA-
1(DHS-
3.18.e), CA-
1(DHS-
3.18.e), CA-
1(DHS-
3.18.e)
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 CA-2
Security Assessments
Security Assessments
(M)
System- Specific Not Entered Not Assigned
CA-2.1,
CA-2.1,
CA-2.1,
CA-2.2,
CA-2.2,
CA-2.2
X X - X - Not Met Control was added by overlay "DHS
Overlay 1.0"
NIST 800-
53 w/ DHS
Independent Assessors
Security Assessments
System- Specific Not Entered Not Assigned CA-
2(1).1, X X - - - Not Met None
Control Ref.
Control Type
Planned Imp.
Actual Imp.
Test #(s) Methods Tailored Result Notes
4300A Rev
4 CA-2 (1)
(M) CA-
2(1).1, CA-2(1).1
NIST 800-
53 w/ DHS 4300A Rev
4 CA-2 (2)
Specialized Assessments
Security Assessments
(M)
System- Specific Not Entered Not Assigned
CA-
2(2).1, CA-
2(2).1, CA-2(2).1
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 CA-2
(DHS-
3.3.h)
Configuration Management
Security Assessments
(M)
System- Specific Not Entered Not Assigned
CA-
2(DHS-
3.3.h), CA-
2(DHS-
3.3.h), CA-
2(DHS-
3.3.h)
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 CA-2
(DHS-
3.3.i)
Security Assessment
Plan
Security Assessments
(M)
System- Specific Not Entered Not Assigned
CA-
2(DHS-
3.3.i), CA-
2(DHS-
3.3.i), CA-
2(DHS-
3.3.i)
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 CA-2
(DHS-
3.15.h)
Key Security Control
Assessments
Security Assessments
(M)
System- Specific Not Entered Not Assigned
CA-
2(DHS-
3.15.h), CA-
2(DHS-
3.15.h), CA-
2(DHS-
3.15.h)
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
Cloud Systems
Provided to
Security Assessments
(M)
System- Specific Not Entered Not Assigned
CA-
2(DHS-
3.18.b), Control Ref.
Control Type
Planned Imp.
Actual Imp.
Test #(s) Methods Tailored Result Notes
4 CA-2
(DHS-
3.18.b)
External Departments
CA-
2(DHS-
3.18.b), CA-
2(DHS-
3.18.b)
NIST 800-
53 w/ DHS 4300A Rev
4 CA-3
System Interconnecti ons
System Interconnecti ons (M)
System- Specific Not Entered Not Assigned
CA-3.1,
CA-3.1,
CA-3.1
X X - X - Not Met
Overlay 1.0"
NIST 800-
53 w/ DHS 4300A Rev
4 CA-3 (5)
Restrictions On External
System Connections
System Interconnecti ons (M)
System- Specific Not Entered Not Assigned
CA-
3(5).1, CA-
3(5).1, CA-3(5).1
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 CA-3
(DHS-
5.4.3.b)
Interconnecti on
Establishmen t Procedures
System Interconnecti ons (M)
System- Specific Not Entered Not Assigned
CA-
3(DHS-
5.4.3.b), CA-
3(DHS-
5.4.3.b), CA-
3(DHS-
5.4.3.b)
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 CA-3
(DHS-
5.4.3.c)
DHS OneNet Interconnecti ons
System Interconnecti ons (M)
System- Specific Not Entered Not Assigned
CA-
3(DHS-
5.4.3.c), CA-
3(DHS-
5.4.3.c), CA-
3(DHS-
Control Ref.
Control Type
Planned Imp.
Actual Imp.
Test #(s) Methods Tailored Result Notes
5.4.3.c)
NIST 800-
53 w/ DHS 4300A Rev
4 CA-3
(DHS-
5.4.3.f)
Interconnecti on Security Agreements
System Interconnecti ons (M)
System- Specific Not Entered Not Assigned
CA-
3(DHS-
5.4.3.f), CA-
3(DHS-
5.4.3.f), CA-
3(DHS-
5.4.3.f)
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 CA-3
(DHS-
5.4.3.m)
Interconnecti on Security Agreements
System Interconnecti ons (M)
System- Specific Not Entered Not Assigned
CA-
3(DHS-
5.4.3.m), CA-
3(DHS-
5.4.3.m), CA-
3(DHS-
5.4.3.m)
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 CA-3
(DHS-
5.4.3.n)
DHS
Interconnecti ons
System Interconnecti ons (M)
System- Specific Not Entered Not Assigned
CA-
3(DHS-
5.4.3.n), CA-
3(DHS-
5.4.3.n), CA-
3(DHS-
5.4.3.n)
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 CA-5
Plan of Action and Milestones
Plan of Action and Milestones
(M)
System- Specific Not Entered Not Assigned
CA-5.1,
CA-5.1,
CA-5.1
X X - X - Not Met
Control Ref.
Control Type
Planned Imp.
Actual Imp.
Test #(s) Methods Tailored Result Notes
NIST 800-
53 w/ DHS 4300A Rev
4 CA-5
(DHS-
2.2.8.d)
DHS
POA&M
Requirements
Plan of Action and Milestones
(M)
System- Specific Not Entered Not Assigned
CA-
5(DHS-
2.2.8.d), CA-
5(DHS-
2.2.8.d), CA-
5(DHS-
2.2.8.d)
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 CA-6
Security Authorization
Security Authorization
(M)
System- Specific Not Entered Not Assigned
CA-6.1,
CA-6.1,
CA-6.1
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 CA-6
(DHS-
4.12.d)
Network Printers and Facsimile Machines
Security Authorization
(M)
System- Specific Not Entered Not Assigned
CA-
6(DHS-
4.12.d), CA-
6(DHS-
4.12.d), CA-
6(DHS-
4.12.d)
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 CA-7
Continuous Monitoring
Continuous Monitoring
(M)
System- Specific Not Entered Not Assigned
CA-7.1,
CA-7.1,
CA-7.1
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 CA-7 (1)
Independent Assessment
Continuous Monitoring
(M)
System- Specific Not Entered Not Assigned
CA-
7(1).1, CA-
7(1).1, CA-7(1).1
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 CA-7
(DHS-
4.6.2.4.a)
Bluetooth Continuous Monitoring
(M)
System- Specific Not Entered Not Assigned
CA-
7(DHS-
4.6.2.4.a), CA-
7(DHS-
4.6.2.4.a), CA-
Control Ref.
Control Type
Planned Imp.
Actual Imp.
Test #(s) Methods Tailored Result Notes
7(DHS-
4.6.2.4.a)
NIST 800-
53 w/ DHS 4300A Rev
4 CA-7
(DHS-
4.6.3.a)
AO
Notification on Disabling
Security Features
Continuous Monitoring
(M)
System- Specific Not Entered Not Assigned
CA-
7(DHS-
4.6.3.a), CA-
7(DHS-
4.6.3.a), CA-
7(DHS-
4.6.3.a)
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 CA-8
Penetration Testing
Penetration Testing (M)
System- Specific Not Entered Not Assigned
CA-8.1,
CA-8.1,
CA-8.1
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 CA-9
Internal System
Connections
Internal System
Connections (M)
System- Specific Not Entered Not Assigned
CA-9.1,
CA-9.1,
CA-9.1
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 CM-1
Configuration Management Policy and Procedures
Configuration Management Policy and Procedures
(O)
System- Specific Not Entered Not Assigned
CM-1.1,
CM-1.1,
CM-1.1,
CM-1.2,
CM-1.2,
CM-1.2
X X - X - Not Met Control was added by overlay "DHS
Overlay 1.0"
NIST 800-
53 w/ DHS 4300A Rev
4 CM-2
Baseline Configuration
Baseline Configuration
(O)
System- Specific Not Entered Not Assigned
CM-2.1,
CM-2.1,
CM-2.1
X X - X - Not Met
Overlay 1.0"
NIST 800-
53 w/ DHS 4300A Rev
Reviews And Updates
Baseline Configuration
(O)
System- Specific Not Entered Not Assigned
CM-
2(1).1, CM-
Control Ref.
Control Type
Planned Imp.
Actual Imp.
Test #(s) Methods Tailored Result Notes
4 CM-2 (1) 2(1).1,
CM-2(1).1
NIST 800-
53 w/ DHS 4300A Rev
4 CM-2 (2)
Automation Support For Accuracy / Currency
Baseline Configuration
(O)
System- Specific Not Entered Not Assigned
CM-
2(2).1, CM-
2(2).1, CM-2(2).1
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 CM-2 (3)
Retention Of Previous
Configuration s
Baseline Configuration
(O)
System- Specific Not Entered Not Assigned
CM-
2(3).1, CM-
2(3).1, CM-2(3).1
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 CM-2 (7)
Configure Systems, Components, Or Devices For High- Risk Areas
Baseline Configuration
(O)
System- Specific Not Entered Not Assigned
CM-
2(7).1, CM-
2(7).1, CM-2(7).1
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 CM-2
(DHS-
4.12.b)
Network Printers and Facsimile Machines
Baseline Configuration
(O)
System- Specific Not Entered Not Assigned
CM-
2(DHS-
4.12.b), CM-
2(DHS-
4.12.b), CM-
2(DHS-
4.12.b)
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 CM-3
Configuration Change Control
Configuration Change
Control (O)
System- Specific Not Entered Not Assigned
CM-3.1,
CM-3.1,
CM-3.1
X X - X - Not Met Control was added by overlay "DHS
Overlay 1.0"
NIST 800-
53 w/ DHS 4300A Rev
4 CM-3 (1)
Automated Document /
Notification / Prohibition Of Changes
Configuration Change
Control (O)
System- Specific Not Entered Not Assigned
CM-
3(1).1, CM-
3(1).1, CM-3(1).1
X X - - - Not Met None
NIST 800-
53 w/ DHS
Test / Validate /
Configuration Change
System- Specific Not Entered Not Assigned CM-
3(2).1, X X - - - Not Met None
Control Ref.
Control Type
Planned Imp.
Actual Imp.
Test #(s) Methods Tailored Result Notes
4300A Rev
4 CM-3 (2)
Document Changes
Control (O) CM- 3(2).1, CM-3(2).1
NIST 800-
53 w/ DHS 4300A Rev
4 CM-3
(DHS-
2.1.8.g)
Timely Response to
ICCB
Configuration Change
Control (O)
System- Specific Not Entered Not Assigned
CM-
3(DHS-
2.1.8.g), CM-
3(DHS-
2.1.8.g), CM-
3(DHS-
2.1.8.g)
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 CM-3
(DHS-
5.4.3.l)
DHS Change Control Boards
(CCB)
Configuration Change
Control (O)
System- Specific Not Entered Not Assigned
CM-
3(DHS-
5.4.3.l), CM-
3(DHS-
5.4.3.l), CM-
3(DHS-
5.4.3.l)
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 CM-4
Security Impact
Analysis
Security Impact
Analysis (O)
System- Specific Not Entered Not Assigned
CM-4.1,
CM-4.1,
CM-4.1
X X - X - Not Met Control was added by overlay "DHS
Overlay 1.0"
NIST 800-
53 w/ DHS 4300A Rev
4 CM-4 (1)
Separate Test Environments
Security Impact
Analysis (O)
System- Specific Not Entered Not Assigned
CM-
4(1).1, CM-
4(1).1, CM-4(1).1
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 CM-5
Access Restrictions for Change
Access Restrictions for Change
(O)
System- Specific Not Entered Not Assigned
CM-5.1,
CM-5.1,
CM-5.1
X X - X - Not Met Control was added by overlay "DHS
Overlay 1.0"
NIST 800-
53 w/ DHS 4300A Rev
4 CM-5 (1)
Automated Access
Enforcement / Auditing
Access Restrictions for Change
(O)
System- Specific Not Entered Not Assigned
CM-
5(1).1, CM-
5(1).1, Control Ref.
Control Type
Planned Imp.
Actual Imp.
Test #(s) Methods Tailored Result Notes
CM-5(1).1
NIST 800-
53 w/ DHS 4300A Rev
4 CM-5 (2)
Review System
Changes
Access Restrictions for Change
(O)
System- Specific Not Entered Not Assigned
CM-
5(2).1, CM-
5(2).1, CM-5(2).1
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 CM-5 (3)
Signed Components
Access Restrictions for Change
(O)
System- Specific Not Entered Not Assigned
CM-
5(3).1, CM-
5(3).1, CM-5(3).1
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 CM-6
Configuration Settings
Configuration Settings (O)
System- Specific Not Entered Not Assigned
CM-6.1,
CM-6.1,
CM-6.1
X X - X - Not Met Control was added by overlay "DHS
Overlay 1.0"
NIST 800-
53 w/ DHS 4300A Rev
4 CM-6 (1)
Automated Central
Management / Application / Verification
Configuration Settings (O)
System- Specific Not Entered Not Assigned
CM-
6(1).1, CM-
6(1).1, CM-6(1).1
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 CM-6 (2)
Respond To Unauthorized
Changes
Configuration Settings (O)
System- Specific Not Entered Not Assigned
CM-
6(2).1, CM-
6(2).1, CM-6(2).1
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 CM-6
(DHS-
3.7.e)
USGCB
Requirements
Configuration Settings (O)
System- Specific Not Entered Not Assigned
CM-
6(DHS-
3.7.e), CM-
6(DHS-
3.7.e), CM-
6(DHS-
3.7.e)
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 CM-6
USGCB
Compliance
Configuration Settings (O)
System- Specific Not Entered Not Assigned
CM-
6(DHS-
3.7.f), Control Ref.
Control Type
Planned Imp.
Actual Imp.
Test #(s) Methods Tailored Result Notes
(DHS-
3.7.f)
6(DHS-
3.7.f), CM-
6(DHS-
3.7.f)
NIST 800-
53 w/ DHS 4300A Rev
4 CM-6
(DHS-
4.5.2.b)
FAX Server Configuration
Configuration Settings (O)
System- Specific Not Entered Not Assigned
CM-
6(DHS-
4.5.2.b), CM-
6(DHS-
4.5.2.b), CM-
6(DHS-
4.5.2.b)
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 CM-6
(DHS-
4.8.4.a)
Hardening and
Configuration Guidance
Configuration Settings (O)
System- Specific Not Entered Not Assigned
CM-
6(DHS-
4.8.4.a), CM-
6(DHS-
4.8.4.a), CM-
6(DHS-
4.8.4.a)
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 CM-6
(DHS-
4.12.f)
Network Printers, Copiers, and Facsimile
Administratio n
Configuration Settings (O)
System- Specific Not Entered Not Assigned
CM-
6(DHS-
4.12.f), CM-
6(DHS-
4.12.f), CM-
6(DHS-
4.12.f)
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 CM-6
(DHS-
4.12.j)
Multifunction Device
Configuration
Configuration Settings (O)
System- Specific Not Entered Not Assigned
CM-
6(DHS-
4.12.j), CM-
6(DHS-
4.12.j), Control Ref.
Control Type
Planned Imp.
Actual Imp.
Test #(s) Methods Tailored Result Notes
CM-
6(DHS-
4.12.j)
NIST 800-
53 w/ DHS 4300A Rev
4 CM-6
(DHS-
5.4.5.d)
Use of Telnet Configuration Settings (O)
System- Specific Not Entered Not Assigned
CM-
6(DHS-
5.4.5.d), CM-
6(DHS-
5.4.5.d), CM-
6(DHS-
5.4.5.d)
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 CM-6
(DHS-
5.4.5.e)
Use of File Transfer Protocol
(FTP)
Services
Configuration Settings (O)
System- Specific Not Entered Not Assigned
CM-
6(DHS-
5.4.5.e), CM-
6(DHS-
5.4.5.e), CM-
6(DHS-
5.4.5.e)
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 CM-7
Least Functionality
Least Functionality
(O)
System- Specific Not Entered Not Assigned
CM-7.1,
CM-7.1,
CM-7.1
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 CM-7 (1)
Periodic Review
Least Functionality
(O)
System- Specific Not Entered Not Assigned
CM-
7(1).1, CM-
7(1).1, CM-7(1).1
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 CM-7 (2)
Prevent Program
Execution
Least Functionality
(O)
System- Specific Not Entered Not Assigned
CM-
7(2).1, CM-
7(2).1, CM-7(2).1
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
Authorized Software /
Whitelisting
Least Functionality
(O)
System- Specific Not Entered Not Assigned
CM-
7(5).1, Control Ref.
Control Type
Planned Imp.
Actual Imp.
Test #(s) Methods Tailored Result Notes
4 CM-7 (5) 7(5).1,
CM-7(5).1
NIST 800-
53 w/ DHS 4300A Rev
4 CM-7
(DHS-
5.4.5.f)
Remote Desktop
Connections
Least Functionality
(O)
System- Specific Not Entered Not Assigned
CM-
7(DHS-
5.4.5.f), CM-
7(DHS-
5.4.5.f), CM-
7(DHS-
5.4.5.f)
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 CM-8
Information System
Component Inventory
Information System
Component Inventory (O)
System- Specific Not Entered Not Assigned
CM-8.1,
CM-8.1,
CM-8.1
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 CM-8 (1)
Updates During
Installations / Removals
Information System
Component Inventory (O)
System- Specific Not Entered Not Assigned
CM-
8(1).1, CM-
8(1).1, CM-8(1).1
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 CM-8 (2)
Automated Maintenance
Information System
Component Inventory (O)
System- Specific Not Entered Not Assigned
CM-
8(2).1, CM-
8(2).1, CM-8(2).1
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 CM-8 (3)
Automated Unauthorized Component Detection
Information System
Component Inventory (O)
System- Specific Not Entered Not Assigned
CM-
8(3).1, CM-
8(3).1, CM-8(3).1
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 CM-8 (4)
Accountabilit y Information
Information System
Component Inventory (O)
System- Specific Not Entered Not Assigned
CM-
8(4).1, CM-
8(4).1, CM-8(4).1
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
No Duplicate Accounting
Of
Information System
Component
System- Specific Not Entered Not Assigned
CM-
8(5).1, Control Ref.
Control Type
Planned Imp.
Actual Imp.
Test #(s) Methods Tailored Result Notes
4 CM-8 (5) Components Inventory (O) 8(5).1, CM-8(5).1
NIST 800-
53 w/ DHS 4300A Rev
4 CM-8
(DHS-
4.6.a)
Introduction of Wireless
Information System
Component Inventory (O)
System- Specific Not Entered Not Assigned
CM-
8(DHS-
4.6.a), CM-
8(DHS-
4.6.a), CM-
8(DHS-
4.6.a)
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 CM-9
Configuration Management
Plan
Configuration Management
Plan (O)
System- Specific Not Entered Not Assigned
CM-9.1,
CM-9.1,
CM-9.1
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 CM-9
(DHS-
3.7.c)
Patching and Configuration Management
Configuration Management
Plan (O)
System- Specific Not Entered Not Assigned
CM-
9(DHS-
3.7.c), CM-
9(DHS-
3.7.c), CM-
9(DHS-
3.7.c)
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 CM-10
Software Usage
Restrictions
SW Usage Restrictions
(O)
System- Specific Not Entered Not Assigned
CM-10.1,
CM-10.1,
CM-10.1
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 CM-10
(DHS-
4.8.4.f)
System Library
Management
SW Usage Restrictions
(O)
System- Specific Not Entered Not Assigned
CM-
10(DHS-
4.8.4.f), CM-
10(DHS-
4.8.4.f), CM-
10(DHS-
4.8.4.f)
NIST 800- User-Installed User-Installed System- Not Entered Not Assigned CM-11.1, X X - - - Not Met None
Control Ref.
Control Type
Planned Imp.
Actual Imp.
Test #(s) Methods Tailored Result Notes
53 w/ DHS 4300A Rev
4 CM-11
Software SW (O) Specific CM-11.1, CM-11.1
NIST 800-
53 w/ DHS 4300A Rev
4 CP-1
Contingency Planning
Policy and Procedures
Contingency Planning
Policy and Procedures
(O)
System- Specific Not Entered Not Assigned
CP-1.1,
CP-1.1,
CP-1.1,
CP-1.2,
CP-1.2,
CP-1.2
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 CP-1
(DHS-
3.5.1.a)
Continuity of Operations Planning
Contingency Planning
Policy and Procedures
(O)
System- Specific Not Entered Not Assigned
CP-
1(DHS-
3.5.1.a), CP-
1(DHS-
3.5.1.a), CP-
1(DHS-
3.5.1.a)
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 CP-1
(DHS-
3.15.f)
DHS
Contingency Plan for CFO
Contingency Planning
Policy and Procedures
(O)
System- Specific Not Entered Not Assigned
CP-
1(DHS-
3.15.f), CP-
1(DHS-
3.15.f), CP-
1(DHS-
3.15.f)
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 CP-2
Contingency Plan
Contingency Plan (O)
System- Specific Not Entered Not Assigned
CP-2.1,
CP-2.1,
CP-2.1,
CP-2.2,
CP-2.2,
CP-2.2
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 CP-2 (1)
Coordinate With Related
Plans
Contingency Plan (O)
System- Specific Not Entered Not Assigned
CP-2(1).1,
CP-2(1).1,
CP-2(1).1
NIST 800- Capacity Contingency System- Not Entered Not Assigned CP-2(2).1, X X - - - Not Met None
Control Ref.
Control Type
Planned Imp.
Actual Imp.
Test #(s) Methods Tailored Result Notes
53 w/ DHS 4300A Rev
4 CP-2 (2)
Planning Plan (O) Specific CP-2(2).1, CP-2(2).1
NIST 800-
53 w/ DHS 4300A Rev
4 CP-2 (3)
Resume Essential
Missions / Business Functions
Contingency Plan (O)
System- Specific Not Entered Not Assigned
CP-2(3).1,
CP-2(3).1,
CP-2(3).1
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 CP-2 (4)
Resume All Missions / Business Functions
Contingency Plan (O)
System- Specific Not Entered Not Assigned
CP-2(4).1,
CP-2(4).1,
CP-2(4).1
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 CP-2 (5)
Continue Essential
Missions / Business Functions
Contingency Plan (O)
System- Specific Not Entered Not Assigned
CP-2(5).1,
CP-2(5).1,
CP-2(5).1
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 CP-2 (8)
Identify Critical Assets
Contingency Plan (O)
System- Specific Not Entered Not Assigned
CP-2(8).1,
CP-2(8).1,
CP-2(8).1
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 CP-2
(DHS-
3.5.2.e)
DHS
Contingency
Plan
Contingency Plan (O)
System- Specific Not Entered Not Assigned
CP-
2(DHS-
3.5.2.e), CP-
2(DHS-
3.5.2.e), CP-
2(DHS-
3.5.2.e)
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 CP-3
Contingency Training
Contingency Training (O)
System- Specific Not Entered Not Assigned
CP-3.1,
CP-3.1,
CP-3.1
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 CP-3 (1)
Simulated Events
Contingency Training (O)
System- Specific Not Entered Not Assigned
CP-3(1).1,
CP-3(1).1,
CP-3(1).1
Control Ref.
Control Type
Planned Imp.
Actual Imp.
Test #(s) Methods Tailored Result Notes
NIST 800-
53 w/ DHS 4300A Rev
4 CP-4
Contingency Plan Testing
Contingency Plan Testing
(O)
System- Specific Not Entered Not Assigned
CP-4.1,
CP-4.1,
CP-4.1
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 CP-4 (1)
Coordinate With Related
Plans
Contingency Plan Testing
(O)
System- Specific Not Entered Not Assigned
CP-4(1).1,
CP-4(1).1,
CP-4(1).1
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 CP-4 (2)
Alternate Processing
Site
Contingency Plan Testing
(O)
System- Specific Not Entered Not Assigned
CP-4(2).1,
CP-4(2).1,
CP-4(2).1
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 CP-4
(DHS-
3.5.2.f)
DHS
Contingency Plan Testing
Contingency Plan Testing
(O)
System- Specific Not Entered Not Assigned
CP-
4(DHS-
3.5.2.f), CP-
4(DHS-
3.5.2.f), CP-
4(DHS-
3.5.2.f)
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 CP-6
Alternate Storage Site
Alternate Storage Site
(O)
System- Specific Not Entered Not Assigned
CP-6.1,
CP-6.1,
CP-6.1
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 CP-6 (1)
Separation From Primary
Site
Alternate Storage Site
(O)
System- Specific Not Entered Not Assigned
CP-6(1).1,
CP-6(1).1,
CP-6(1).1
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 CP-6 (2)
Recovery Time / Point Objectives
Alternate Storage Site
(O)
System- Specific Not Entered Not Assigned
CP-6(2).1,
CP-6(2).1,
CP-6(2).1
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 CP-6 (3)
Accessibility Alternate
Storage Site (O)
System- Specific Not Entered Not Assigned
CP-6(3).1,
CP-6(3).1,
CP-6(3).1
NIST 800- Alternate Alternate System- Not Entered Not Assigned CP-7.1, X X - - - Not Met None
Control Ref.
Control Type
Planned Imp.
Actual Imp.
Test #(s) Methods Tailored Result Notes
53 w/ DHS 4300A Rev
4 CP-7
Processing Site
Processing Site (O)
Specific CP-7.1, CP-7.1
NIST 800-
53 w/ DHS 4300A Rev
4 CP-7 (1)
Separation From Primary
Site
Alternate Processing
Site (O)
System- Specific Not Entered Not Assigned
CP-7(1).1,
CP-7(1).1,
CP-7(1).1
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 CP-7 (2)
Accessibility Alternate
Processing Site (O)
System- Specific Not Entered Not Assigned
CP-7(2).1,
CP-7(2).1,
CP-7(2).1
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 CP-7 (3)
Priority Of Service
Alternate Processing
Site (O)
System- Specific Not Entered Not Assigned
CP-7(3).1,
CP-7(3).1,
CP-7(3).1
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 CP-7 (4)
Preparation For Use
Alternate Processing
Site (O)
System- Specific Not Entered Not Assigned
CP-7(4).1,
CP-7(4).1,
CP-7(4).1
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 CP-8
Telecommuni cations
Services
Telecommuni cations
Services (O)
System- Specific Not Entered Not Assigned
CP-8.1,
CP-8.1,
CP-8.1
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 CP-8 (1)
Priority Of Service
Provisions
Telecommuni cations
Services (O)
System- Specific Not Entered Not Assigned
CP-8(1).1,
CP-8(1).1,
CP-8(1).1
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 CP-8 (2)
Single Points Of Failure
Telecommuni cations
Services (O)
System- Specific Not Entered Not Assigned
CP-8(2).1,
CP-8(2).1,
CP-8(2).1
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 CP-8 (3)
Separation Of Primary / Alternate Providers
Telecommuni cations
Services (O)
System- Specific Not Entered Not Assigned
CP-8(3).1,
CP-8(3).1,
CP-8(3).1
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
Provider Contingency
Plan
Telecommuni cations
Services (O)
System- Specific Not Entered Not Assigned
CP-8(4).1,
CP-8(4).1,
CP-8(4).1
Control Ref.
Control Type
Planned Imp.
Actual Imp.
Test #(s) Methods Tailored Result Notes
4 CP-8 (4)
NIST 800-
53 w/ DHS 4300A Rev
4 CP-9
Information System Backup
Information System
Backup (O)
System- Specific Not Entered Not Assigned
CP-9.1,
CP-9.1,
CP-9.1,
CP-9.2,
CP-9.2,
CP-9.2
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 CP-9 (1)
Testing For Reliability /
Integrity
Information System
Backup (O)
System- Specific Not Entered Not Assigned
CP-9(1).1,
CP-9(1).1,
CP-9(1).1
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 CP-9 (2)
Test Restoration
Using Sampling
Information System
Backup (O)
System- Specific Not Entered Not Assigned
CP-9(2).1,
CP-9(2).1,
CP-9(2).1
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 CP-9 (3)
Separate Storage For
Critical Information
Information System
Backup (O)
System- Specific Not Entered Not Assigned
CP-9(3).1,
CP-9(3).1,
CP-9(3).1
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 CP-9 (5)
Transfer To Alternate
Storage Site
Information System
Backup (O)
System- Specific Not Entered Not Assigned
CP-9(5).1,
CP-9(5).1,
CP-9(5).1
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 CP-10
Information System
Recovery and Reconstitutio n
Information System
Recovery and Reconstitutio n (O)
System- Specific Not Entered Not Assigned
CP-10.1,
CP-10.1,
CP-10.1
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 CP-10 (2)
Transaction Recovery
Information System
Recovery and Reconstitutio n (O)
System- Specific Not Entered Not Assigned
CP-
10(2).1, CP-
10(2).1, CP-
10(2).1
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 CP-10 (4)
Restore Within Time
Period
Information System
Recovery and Reconstitutio
System- Specific Not Entered Not Assigned
CP-
10(4).1, CP-
10(4).1, Control Ref.
Control Type
Planned Imp.
Actual Imp.
Test #(s) Methods Tailored Result Notes n (O) CP- 10(4).1
NIST 800-
53 w/ DHS 4300A Rev
4 IA-1
Identification and
Authenticatio n Policy and Procedures
Identification and
Authenticatio n Policy and Procedures
(T)
System- Specific Not Entered Not Assigned
IA-1.1,
IA-1.1,
IA-1.1,
IA-1.2,
IA-1.2,
IA-1.2
X X - X - Not Met Control was added by overlay "DHS
Overlay 1.0"
NIST 800-
53 w/ DHS 4300A Rev
4 IA-1
(DHS-
3.14.7.a)
Online Transactions
Identification and
Authenticatio n Policy and Procedures
(T)
System- Specific Not Entered Not Assigned
IA-
1(DHS-
3.14.7.a), IA-
1(DHS-
3.14.7.a), IA-
1(DHS-
3.14.7.a)
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 IA-1
(DHS-
3.14.7.c)
E- Authenticatio n
Identification and
Authenticatio n Policy and Procedures
(T)
System- Specific Not Entered Not Assigned
IA-
1(DHS-
3.14.7.c), IA-
1(DHS-
3.14.7.c), IA-
1(DHS-
3.14.7.c)
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 IA-1
(DHS-
3.14.7.f)
PIV
Credentials
Identification and
Authenticatio n Policy and Procedures
(T)
System- Specific Not Entered Not Assigned
IA-
1(DHS-
3.14.7.f), IA-
1(DHS-
3.14.7.f), IA-
1(DHS-
3.14.7.f)
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
Identifying Network Devices
Identification and
Authenticatio
System- Specific Not Entered Not Assigned
IA-
1(DHS-
3.14.7.i), Control Ref.
Control Type
Planned Imp.
Actual Imp.
Test #(s) Methods Tailored Result Notes
4 IA-1
(DHS-
3.14.7.i) n Policy and Procedures
(T)
IA-
1(DHS-
3.14.7.i), IA-
1(DHS-
3.14.7.i)
NIST 800-
53 w/ DHS 4300A Rev
4 IA-1
(DHS-
4.6.2.4.b)
Master Device Status
Indicators
Identification and
Authenticatio n Policy and Procedures
(T)
System- Specific Not Entered Not Assigned
IA-
1(DHS-
4.6.2.4.b), IA-
1(DHS-
4.6.2.4.b), IA-
1(DHS-
4.6.2.4.b)
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 IA-1
(DHS-
4.6.2.q)
Biometric Logon
Attempts
Identification and
Authenticatio n Policy and Procedures
(T)
System- Specific Not Entered Not Assigned
IA-
1(DHS-
4.6.2.q), IA-
1(DHS-
4.6.2.q), IA-
1(DHS-
4.6.2.q)
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 IA-1
(DHS-
5.1.1.a)
Password Authenticatio n Configuration
Identification and
Authenticatio n Policy and Procedures
(T)
System- Specific Not Entered Not Assigned
IA-
1(DHS-
5.1.1.a), IA-
1(DHS-
5.1.1.a), IA-
1(DHS-
5.1.1.a)
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 IA-2
Identification and
Authenticatio n
(Organization
Identification and
Authenticatio n
(Organization
System- Specific Not Entered Not Assigned
IA-2.1,
IA-2.1,
IA-2.1
X X - X - Not Met
Control Ref.
Control Type
Planned Imp.
Actual Imp.
Test #(s) Methods Tailored Result Notes al Users) al Users) (T)
Overlay 1.0"
NIST 800-
53 w/ DHS 4300A Rev
4 IA-2 (1)
Network Access To Privileged Accounts
Identification and
Authenticatio n
(Organization al Users) (T)
System- Specific Not Entered Not Assigned
IA-2(1).1,
IA-2(1).1,
IA-2(1).1
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 IA-2 (2)
Network Access To
Non- Privileged Accounts
Identification and
Authenticatio n
(Organization al Users) (T)
System- Specific Not Entered Not Assigned
IA-2(2).1,
IA-2(2).1,
IA-2(2).1
X X - - - Not Met None
NIST 800-
53 w/ DHS 4300A Rev
4 IA-2 (3)
Local Access To Privileged
Accounts
Identification and
Authenticatio n
(Organization al Users) (T)
System- Specific Not Entered Not Assigned
IA-2(3).1,
IA-2(3).1,
IA-2(3).1
X X - - -…
This is the start of the file's text. The full file is on GovTribe.
File details come from the government source that posted it. Updated .