WWYK263009_65 Design Analysis Part 28_Part4.pdf
PDF 194 KB Posted
- Solicitation number
- W912BV25S0014
About this file
This file contains a list of Control Correlation Identifiers (CCIs) related to cybersecurity requirements for fire protection systems at Tinker Air Force Base's Bomber Agile Common Hangar (BACH) project. The document outlines specific security controls and implementation requirements across multiple domains including access control, audit capabilities, authentication, system maintenance, and vulnerability management.
The CCI list details technical specifications for items such as password complexity requirements, audit logging capabilities, vulnerability scanning procedures, and system access controls. Each CCI is categorized with a control number, definition, implementation status (TRUE/FALSE), responsible party (Designer, Enclave, Non-Designer), and reference to specific sections of technical requirements. Key areas covered include wireless access restrictions, information flow control policies, system monitoring capabilities, and device authentication protocols. The document appears to be part of a larger 55-page technical specification package defining cybersecurity requirements for the BACH facility's control and monitoring systems.
View the file
Other files
Show 40 more
Latest 50 of 95 listed here. See the rest on GovTribe.
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Tinker BACH 65% CCI LIST FIRE PROTECTION
AC-18(3) CCI-001449 The organization disables, when not intended for use, wireless networking capabilities internally embedded within information system components prior to issuance and deployment.
TRUE Designer ---
AC-4 CCI-001368 The information system enforces approved authorizations for controlling the flow of information within the system based on organization-defined information flow control policies.
TRUE Enclave
Designer
Impractical
3.2.1 Information Flow
Enforcement In MOD...
AC-4 CCI-001414 The information system enforces approved authorizations for controlling the flow of information between interconnected systems based on organization-defined information flow control policies.
TRUE Enclave
Designer
Impractical
3.2.1 Information Flow
Enforcement In MOD...
AC-4 CCI-001548 The organization defines the information flow control policies for controlling the flow of information within the system.
TRUE Enclave
Designer
Non-Designer
Impractical
3.2.1 Information Flow
Enforcement In MOD...
AC-4 CCI-001549 The organization defines the information flow control policies for controlling the flow of information between interconnected systems.
TRUE Enclave
Designer
Non-Designer
Impractical
3.2.1 Information Flow
Enforcement In MOD...
AC-4 CCI-001550 The organization defines approved authorizations for controlling the flow of information within the system.
TRUE Enclave
Designer
Non-Designer
Impractical
3.2.1 Information Flow
Enforcement In MOD...
AC-4 CCI-001551 The organization defines approved authorizations for controlling the flow of information between interconnected systems.
TRUE Enclave
Designer
Non-Designer
Impractical
3.2.1 Information Flow
Enforcement In MOD...
AC-7 CCI-000043 The organization defines the maximum number of consecutive invalid logon attempts to the information system by a user during
TRUE DoD-Defined
Designer
Impractical
3.3.2 Unsuccessful Logon
Attempts
AC-7 CCI-000044 The information system enforces the organization-defined limit of consecutive invalid logon attempts by a user during the organization-
TRUE Designer 3.3.2 Unsuccessful Logon
Attempts
AC-7 CCI-001423 The organization defines the time period in which the organization-defined maximum number of consecutive invalid logon attempts
TRUE DoD-Defined
Designer
Impractical
3.3.2 Unsuccessful Logon
Attempts
AC-7 CCI-002236 The organization defines the time period the information system will automatically lock the account or node when the maximum number of
TRUE DoD-Defined
Designer
Impractical
3.3.2 Unsuccessful Logon
Attempts
AC-7 CCI-002237 The organization defines the delay algorithm to be employed by the information system to delay the next login prompt when the maximum
TRUE DoD-Defined
Designer
Impractical
3.3.2 Unsuccessful Logon
Attempts
AC-7 CCI-002238 The information system automatically locks the account or node for either an organization-defined time period, until the locked account or node is released by an administrator, or delays the next login prompt according to the organization-defined delay algorithm when the maximum
TRUE Designer
Impractical
3.3.2 Unsuccessful Logon
Attempts
AU-2 CCI-000123 The organization determines the information system must be capable of auditing an organization-defined list of auditable events.
TRUE Designer
Non-Designer
3.5.1 Audit Events, Content of
Audit Reco...
AU-2 CCI-001571 The organization defines the information system auditable events.
TRUE DoD-Defined
Designer
Impractical
3.5.1 Audit Events, Content of
Audit Reco...
AU-2 CCI-000125 The organization provides a rationale for why the list of auditable events is deemed to be adequate to support after-the-fact investigations of security incidents.
TRUE Designer
Non-Designer
3.5.1 Audit Events, Content of
Audit Reco...
AU-2 CCI-001485 The organization defines the events which are to be audited on the information system on an organization-defined frequency of (or situation requiring) auditing for each
TRUE Designer
Non-Designer
3.5.1 Audit Events, Content of
Audit Reco...
CA-1 CCI-002061 The organization defines the personnel or roles to whom security assessment and authorization policy is to be disseminated.
TRUE DoD-Defined
Non-Designer
Impractical
CA-1 CCI-002062 The organization defines the personnel or roles to whom the security assessment and authorization procedures are to be
TRUE DoD-Defined
Non-Designer
Impractical
CA-9 CCI-002103 The organization documents, for each internal connection, the interface characteristics.
TRUE Designer 1.9.3 Network Communication
Report
CA-9 CCI-002104 The organization documents, for each internal connection, the security requirements.
TRUE Designer 1.9.3 Network Communication
Report
CA-9 CCI-002105 The organization documents, for each internal connection, the nature of the information communicated.
TRUE Designer 1.9.3 Network Communication
Report
CA-9 CCI-002102 The organization defines the information system components or classes of components that that are authorized internal connections to the information system.
TRUE Designer 1.9.3 Network Communication
Report
CM-
11(2)
CCI-001812 The information system prohibits user installation of software without explicit privileged status.
TRUE Designer
Non-Designer
3.3.1 User Accounts
CM-2 CCI-000293 The organization develops and documents a current baseline configuration of the information
TRUE Designer ---
CM-6 CCI-000363 The organization defines security configuration checklists to be used to establish and document configuration settings for the information system technology products employed.
TRUE Designer 3.6 REQUIREMENTS FOR LEAST
FUNCTIONALIT...
CM-6 CCI-000364 The organization establishes configuration settings for information technology products employed within the information system using organization-defined security configuration checklists.
TRUE Designer 3.6 REQUIREMENTS FOR LEAST
FUNCTIONALIT...
CM-6 CCI-000365 The organization documents configuration settings for information technology products employed within the information system using organization-defined security configuration checklists that reflect the most restrictive mode consistent with operational requirements.
TRUE DoD-Defined
Designer
Non-Designer
Impractical
3.6 REQUIREMENTS FOR LEAST
FUNCTIONALIT...
CM-6 CCI-001755 The organization defines the information system components for which any deviation from the established configuration settings are to be identified, documented and
TRUE DoD-Defined
Designer
Non-Designer
Impractical
3.6 REQUIREMENTS FOR LEAST
FUNCTIONALIT...
CM-6 CCI-001588 The organization-defined security configuration checklists reflect the most restrictive mode consistent with operational requirements.
TRUE DoD-Defined
Designer
Non-Designer
Impractical
3.2.5 IP Control Networks
3.6 REQUIREMENTS FOR
LEAST FUNCTIONALIT...
CM-7 CCI-000382 The organization configures the information system to prohibit or restrict the use of organization-defined functions, ports, protocols, and/or services.
TRUE Designer 3.2.5 IP Control Networks
3.6 REQUIREMENTS FOR
LEAST FUNCTIONALIT...
CM-7 CCI-000380 The organization defines for the information system prohibited or restricted functions, ports, protocols, and/or services.
TRUE Designer 3.2.5 IP Control Networks
3.6 REQUIREMENTS FOR
LEAST FUNCTIONALIT...
CM-7 CCI-000381 The organization configures the information system to provide only essential capabilities.
TRUE Designer 3.2.5 IP Control Networks
3.6 REQUIREMENTS FOR
LEAST FUNCTIONALIT...
CM-7(5) CCI-001772 The organization defines the software programs authorized to execute on the information system.
TRUE Designer ---
CM-7(5) CCI-001773 The organization identifies the organization-defined software programs authorized to execute on the information system.
TRUE Designer ---
CM-7(5) CCI-001774 The organization employs an deny-all, permit-by-exception policy to allow the execution of authorized software programs on the information
TRUE Designer ---
CM-8 CCI-000389 The organization develops and documents an inventory of information system components that accurately reflects the current
TRUE Designer 1.9.4 Control System Inventory
Report
CM-8 CCI-000392 The organization develops and documents an inventory of information system components that includes all components within the authorization boundary of the
TRUE Designer 1.9.4 Control System Inventory
Report
CM-8 CCI-000398 The organization defines information deemed necessary to achieve effective information system component accountability.
TRUE DoD-Defined
Designer
Non-Designer
Impractical
1.9.4 Control System Inventory
Report
CP-10 CCI-000550 The organization provides for the recovery and reconstitution of the information system to a known state after a disruption.
TRUE Enclave
Designer
Non-Designer
1.9.5 Software and Configuration
Backups
CP-10 CCI-000551 The organization provides for the recovery and reconstitution of the information system to a known state after a compromise.
TRUE Enclave
Designer
Non-Designer
1.9.5 Software and Configuration
Backups
CP-10 CCI-000552 The organization provides for the recovery and reconstitution of the information system to a known state after a failure.
TRUE Enclave
Designer
Non-Designer
1.9.5 Software and Configuration
Backups
IA-2 CCI-000764 The information system uniquely identifies and authenticates organizational users (or processes acting on behalf of organizational users).
TRUE Enclave
Designer
Impractical
3.3.1 User Accounts
3.4 USER IDENTIFICATION AND
AUTHENTICAT...
IA-3 CCI-000777 The organization defines a list of specific and/or types of devices for which identification and authentication is required before establishing a connection to the information system.
TRUE DoD-Defined
Enclave
Designer
Impractical
1.9.4 Control System Inventory
Report
3.2.7 Device Identification and
Authentic...
IA-3 CCI-000778 The information system uniquely identifies an organization defined list of specific and/or types of devices before establishing a local, remote, or network connection.
TRUE Enclave
Designer
Impractical
1.9.4 Control System Inventory
Report
3.2.7 Device Identification and
Authentic...
IA-3 CCI-001958 The information system authenticates an organization defined list of specific and/or types of devices before establishing a local, remote, or network connection.
TRUE Enclave
Designer
Impractical
1.9.4 Control System Inventory
Report
3.2.7 Device Identification and
Authentic...
IA-5 CCI-001544 The organization manages information system authenticators by ensuring that authenticators have sufficient strength of mechanism for
TRUE Designer
Non-Designer
Impractical
3.4 USER IDENTIFICATION AND
AUTHENTICAT...
IA-5 CCI-001989 The organization manages information system authenticators by changing default content of authenticators prior to information system installation.
TRUE Designer 3.4 USER IDENTIFICATION AND
IA-5 CCI-000182 The organization manages information system authenticators by changing/refreshing authenticators in accordance with the organization defined time period by authenticator type.
TRUE DoD-Defined
Designer
Non-Designer
Impractical
3.4 USER IDENTIFICATION AND
AUTHENTICAT...
IA-5 CCI-001610 The organization defines the time period (by authenticator type) for changing/refreshing authenticators.
TRUE DoD-Defined
Designer
Non-Designer
Impractical
3.4 USER IDENTIFICATION AND
AUTHENTICAT...
IA-5(1) CCI-000192 The information system enforces password complexity by the minimum number of upper case characters used.
TRUE Enclave
Designer
3.4 USER IDENTIFICATION AND
IA-5(1) CCI-000193 The information system enforces password complexity by the minimum number of lower case characters used.
TRUE Enclave
Designer
3.4 USER IDENTIFICATION AND
AUTHENTICAT...
IA-5(1) CCI-000194 The information system enforces password complexity by the minimum number of numeric characters used.
TRUE Enclave
Designer
3.4 USER IDENTIFICATION AND
AUTHENTICAT...
IA-5(1) CCI-000205 The information system enforces minimum password length.
TRUE Enclave
Designer
3.4 USER IDENTIFICATION AND
IA-5(1) CCI-001619 The information system enforces password complexity by the minimum number of special characters used.
TRUE Enclave
Designer
3.4 USER IDENTIFICATION AND
AUTHENTICAT...
IA-5(1) CCI-001611 The organization defines the minimum number of special characters for password complexity enforcement.
TRUE DoD-Defined
Designer
Impractical
3.4 USER IDENTIFICATION AND
AUTHENTICAT...
IA-5(1) CCI-001612 The organization defines the minimum number of upper case characters for password complexity enforcement.
TRUE DoD-Defined
Designer
Impractical
3.4 USER IDENTIFICATION AND
AUTHENTICAT...
IA-5(1) CCI-001613 The organization defines the minimum number of lower case characters for password complexity enforcement.
TRUE DoD-Defined
Designer
Impractical
3.4 USER IDENTIFICATION AND
AUTHENTICAT...
IA-5(1) CCI-001614 The organization defines the minimum number of numeric characters for password complexity enforcement.
TRUE DoD-Defined
Designer
Impractical
3.4 USER IDENTIFICATION AND
IA-5(1) CCI-000195 The information system, for password-based authentication, when new passwords are created, enforces that at least an organization-defined number of characters are changed.
TRUE Enclave
Designer
3.4 USER IDENTIFICATION AND
AUTHENTICAT...
IA-5(1) CCI-001615 The organization defines the minimum number of characters that are changed when new passwords are created.
TRUE DoD-Defined
Designer
Impractical
3.4 USER IDENTIFICATION AND
AUTHENTICAT...
IA-5(1) CCI-000196 The information system, for password-based authentication, stores only cryptographically-protected passwords.
TRUE Enclave
Designer
Impractical
3.4 USER IDENTIFICATION AND
IA-5(1) CCI-000197 The information system, for password-based authentication, transmits only cryptographically-protected passwords.
TRUE Enclave
Designer
3.4 USER IDENTIFICATION AND
AUTHENTICAT...
IA-5(1) CCI-000198 The information system enforces minimum password lifetime restrictions.
TRUE Designer
Impractical
3.4 USER IDENTIFICATION AND
AUTHENTICAT...
IA-5(1) CCI-000199 The information system enforces maximum password lifetime restrictions.
TRUE Enclave
Designer
3.4 USER IDENTIFICATION AND
IA-5(1) CCI-001616 The organization defines minimum password lifetime restrictions.
TRUE DoD-Defined
Designer
Impractical
3.4 USER IDENTIFICATION AND
AUTHENTICAT...
IA-5(1) CCI-001617 The organization defines maximum password lifetime restrictions.
TRUE DoD-Defined
Designer
Impractical
3.4 USER IDENTIFICATION AND
AUTHENTICAT...
IA-5(1) CCI-001618 The organization defines the number of generations for which password reuse is prohibited.
TRUE DoD-Defined
Enclave
Designer
Impractical
3.4 USER IDENTIFICATION AND
AUTHENTICAT...
IA-5(1) CCI-000200 The information system prohibits password reuse for the organization defined number of generations.
TRUE Enclave
Designer
Non-Designer
Impractical
3.4 USER IDENTIFICATION AND
IA-5(1) CCI-002041 The information system allows the use of a temporary password for system logons with an immediate change to a permanent password.
TRUE Enclave
Designer
Impractical
3.4 USER IDENTIFICATION AND
AUTHENTICAT...
IA-5(11) CCI-002002 The organization defines the token quality requirements to be employed by the information system mechanisms for token-based authentication.
TRUE DoD-Defined
Enclave
Designer
Impractical
3.4 USER IDENTIFICATION AND
IA-5(11) CCI-002003 The information system, for token-based authentication, employs mechanisms that satisfy organization-defined token quality requirements.
TRUE Enclave
Designer
Impractical
3.4 USER IDENTIFICATION AND
AUTHENTICAT...
MA-3 CCI-000865 The organization approves information system maintenance tools.
TRUE Designer
Non-Designer
3.9 SYSTEM MAINTENANCE
TOOL SOFTWARE
PE-11 CCI-002955 The organization provides a short-term uninterruptible power supply to facilitate an orderly shutdown of the information system and/or transition of the information system to long-term alternate power in the event of a primary power source loss.
TRUE Enclave
Designer
Impractical
3.10 DEVICE POWER
PL-2 CCI-003051 The organization's security plan for the information system explicitly defines the authorization boundary for the system.
TRUE Enclave
Designer
Non-Designer
1.9.6 Cybersecurity Riser Diagram
PL-2 CCI-003053 The organization's security plan for the information system provides the security categorization of the information system including supporting rationale.
TRUE Designer
Non-Designer
1.9.6 Cybersecurity Riser Diagram
RA-5 CCI-001055 The organization defines a frequency for scanning for vulnerabilities in the information system and hosted applications.
TRUE DoD-Defined
Enclave
Designer
Impractical
3.11 VULNERABILITY SCANNING
RA-5 CCI-001054 The organization scans for vulnerabilities in the information system and hosted applications on an organization-defined frequency.
TRUE Enclave
Designer
Non-Designer
3.11 VULNERABILITY SCANNING
RA-5 CCI-001056 The organization scans for vulnerabilities in the information system and hosted applications when new vulnerabilities potentially affecting the system/applications are identified and reported.
TRUE Enclave
Designer
Non-Designer
3.11 VULNERABILITY SCANNING
RA-5 CCI-001641 The organization defines the process for conducting random vulnerability scans on the information system and hosted applications.
TRUE Enclave
Designer
Non-Designer
Impractical
3.11 VULNERABILITY SCANNING
RA-5 CCI-001643 The organization scans for vulnerabilities in the information system and hosted applications in accordance with the organization-defined process for random scans.
TRUE Enclave
Designer
Non-Designer
3.11 VULNERABILITY SCANNING
RA-5 CCI-001057 The organization employs vulnerability scanning tools and techniques that facilitate interoperability among tools and automate parts of the vulnerability management process by using standards for: enumerating
TRUE Enclave
Designer
Non-Designer
Impractical
3.11 VULNERABILITY SCANNING
RA-5 CCI-001058 The organization analyzes vulnerability scan reports and results from security control assessments.
TRUE Enclave
Designer
Non-Designer
RA-5 CCI-001059 The organization remediates legitimate vulnerabilities in organization-defined response times in accordance with an organizational assessment risk.
TRUE Enclave
Designer
Non-Designer
Impractical
3.11 VULNERABILITY SCANNING
RA-5(5) CCI-001067 The information system implements privileged access authorization to organization-identified information system components for selected organization-defined vulnerability scanning activities.
TRUE Enclave
Designer
2.3 DATABASE AND WEB
SERVER SOFTWARE FO...
3.11 VULNERABILITY
SCANNING
RA-5(5) CCI-001645 The organization identifies the information system components to which privileged access is authorized for selected organization-defined vulnerability scanning activities.
TRUE DoD-Defined
Enclave
Designer
Impractical
2.3 DATABASE AND WEB
SERVER SOFTWARE FO...
3.11 VULNERABILITY
SCANNING
RA-5(5) CCI-002906 The organization defines the vulnerability scanning activities in which the information system implements privileged access authorization to organization-identified information system components.
TRUE Enclave
Designer
2.3 DATABASE AND WEB
SERVER SOFTWARE FO...
3.11 VULNERABILITY
SCANNING
SI-17 CCI-002773 The organization defines the fail-safe procedures to be implemented by the information system when organization-defined failure conditions occur.
TRUE Designer 1.9.4 Control System Inventory
Report
3.8 SAFE MODE AND FAIL SAFE
OPERATION
SI-17 CCI-002774 The organization defines the failure conditions which, when they occur, will result in the information system implementing organization-defined fail-safe procedures.
TRUE Designer 1.9.4 Control System Inventory
Report
3.8 SAFE MODE AND FAIL SAFE
OPERATION
SI-2 CCI-001227 The organization corrects information system flaws.
TRUE Enclave
Non-Designer
Impractical
1.10 SOFTWARE LICENSING
SI-2 CCI-002605 The organization installs security-relevant software updates within organization-defined time period of the release of the updates
TRUE Non-Designer 1.10 SOFTWARE LICENSING
SI-7 CCI-002703 The organization defines the software, firmware, and information which will be subjected to integrity verification tools to detect unauthorized changes.
TRUE Enclave
Designer
Tinker AFB BACH HVAC CCI List
Control
Number
CCI CCI Definition Combined
Category UFGS REFERENCE
AC-11 CCI-000057 The information system initiates a session lock after the organization-defined time period of inactivity.
3.3.4 Session Lock and Session
Terminatio...
AC-11 CCI-000059 The organization defines the time period of inactivity after which the information system initiates a session lock.
DoD-Defined
Enclave
Designer
Impractical
3.3.4 Session Lock and Session
Terminatio...
AC-11 CCI-000058 The information system provides the capability for users to directly initiate session lock mechanisms.
Enclave
Designer
Impractical
3.3.4 Session Lock and Session
Terminatio...
AC-11 CCI-000056 The information system retains the session lock until the user reestablishes access using established identification and authentication procedures.
Enclave
Designer
Impractical
3.3.4 Session Lock and Session
Terminatio...
AC-14 CCI-000061 The organization identifies and defines organization-defined user actions that can be performed on the information system without identification or authentication consistent with organizational missions/business functions.
Designer 3.3.5 Permitted Actions Without
Identific...
AC-14 CCI-000232 The organization documents and provides supporting rationale in the security plan for the information system, user actions not requiring identification and authentication.
Designer 3.3.5 Permitted Actions Without
Identific...
AC-18 CCI-001438 The organization establishes usage restrictions for wireless access.
Designer
Non-Designer
3.2.3 Wireless and Wired Broadcast
Commun...
AC-18 CCI-002323 The organization establishes configuration/connection requirements for wireless access.
Designer
Non-Designer
3.2.3 Wireless and Wired Broadcast
Commun...
AC-18 CCI-001439 The organization establishes implementation guidance for wireless access.
Designer
Non-Designer
3.2.3 Wireless and Wired Broadcast
Commun...
AC-18 CCI-001441 The organization authorizes wireless access to the information system prior to allowing such connections.
Designer
Non-Designer
3.2.3 Wireless and Wired Broadcast
Commun...
AC-18(1) CCI-001443 The information system protects wireless access to the system using authentication of users and/or devices.
Designer
Impractical
AC-18(1) CCI-001444 The information system protects wireless access to the system using encryption.
Designer
Impractical
AC-18(3) CCI-001449 The organization disables, when not intended for use, wireless networking capabilities internally embedded within information system components prior to issuance and deployment.
Designer ---
AC-2 CCI-002110 The organization defines the information system account types that support the organizational missions/business functions.
Designer 3.3.1 User Accounts
AC-2(3) CCI-000017 The information system automatically disables inactive accounts after an organization-defined time period.
DoD-Defined
Enclave
Designer
Non-Designer
Impractical
3.3.1 User Accounts
AC-2(3) CCI-000217 The organization defines a time period after which inactive accounts are automatically disabled.
DoD-Defined
Designer
Impractical
3.3.1 User Accounts
AC-4 CCI-001548 The organization defines the information flow control policies for controlling the flow of information within the system.
Enclave
Designer
Non-Designer
Impractical
3.2.1 Information Flow Enforcement In
MOD...
AC-4 CCI-001549 The organization defines the information flow control policies for controlling the flow of information between interconnected systems.
Enclave
Designer
Non-Designer
Impractical
3.2.1 Information Flow Enforcement In
MOD...
AC-4 CCI-001550 The organization defines approved authorizations for controlling the flow of information within the system.
Enclave
Designer
Non-Designer
Impractical
3.2.1 Information Flow Enforcement In
MOD...
AC-4 CCI-001551 The organization defines approved authorizations for controlling the flow of information between interconnected systems.
Enclave
Designer
Non-Designer
Impractical
3.2.1 Information Flow Enforcement In
MOD...
AC-4 CCI-001368 The information system enforces approved authorizations for controlling the flow of information within the system based on organization-defined information flow control policies.
Enclave
Designer
Impractical
3.2.1 Information Flow Enforcement In
MOD...
AC-4 CCI-001414 The information system enforces approved authorizations for controlling the flow of information between interconnected systems based on organization-defined information flow control policies.
Enclave
Designer
Impractical
3.2.1 Information Flow Enforcement In
MOD...
AC-6(1) CCI-001558 The organization defines the security functions
(deployed in hardware, software, and firmware) for which access must be explicitly authorized.
DoD-Defined
Designer
Impractical
3.3.1 User Accounts
3.4 USER IDENTIFICATION AND
AUTHENTICAT...
AC-6(1) CCI-002221 The organization defines the security-relevant information for which access must be explicitly authorized.
DoD-Defined
Designer
Impractical
3.3.1 User Accounts
3.4 USER IDENTIFICATION AND
AC-6(1) CCI-002222 The organization explicitly authorizes access to organization-defined security functions.
DoD-Defined
Designer
Impractical
3.3.1 User Accounts
3.4 USER IDENTIFICATION AND
AUTHENTICAT...
AC-6(1) CCI-002223 The organization explicitly authorizes access to organization-defined security-relevant information.
DoD-Defined
Designer
Impractical
3.3.1 User Accounts
3.4 USER IDENTIFICATION AND
AUTHENTICAT...
AC-6(2) CCI-000039 The organization requires that users of information system accounts or roles, with access to organization-defined security functions or security-relevant information, use non-privileged accounts, or roles, when accessing nonsecurity functions.
DoD-Defined
Designer
Impractical
3.3.1 User Accounts
3.4 USER IDENTIFICATION AND
AC-6(2) CCI-001419 The organization defines the security functions or security-relevant information to which users of information system accounts, or roles, have access.
DoD-Defined
Designer
Impractical
3.3.1 User Accounts
3.4 USER IDENTIFICATION AND
AUTHENTICAT...
AC-7 CCI-000043 The organization defines the maximum number of consecutive invalid logon attempts to the information system by a user during an organization-defined time period.
DoD-Defined
Designer
Impractical
3.3.2 Unsuccessful Logon Attempts
AC-7 CCI-000044 The information system enforces the organization-defined limit of consecutive invalid logon attempts by a user during the organization-defined time period.
Designer 3.3.2 Unsuccessful Logon Attempts
AC-7 CCI-001423 The organization defines the time period in which the organization-defined maximum number of consecutive invalid logon attempts occur.
DoD-Defined
Designer
Impractical
3.3.2 Unsuccessful Logon Attempts
AC-7 CCI-002236 The organization defines the time period the information system will automatically lock the account or node when the maximum number of unsuccessful attempts is exceeded.
DoD-Defined
Designer
Impractical
3.3.2 Unsuccessful Logon Attempts
AC-7 CCI-002237 The organization defines the delay algorithm to be employed by the information system to delay the next login prompt when the maximum number of unsuccessful attempts is exceeded.
DoD-Defined
Designer
Impractical
3.3.2 Unsuccessful Logon Attempts
AC-7 CCI-002238 The information system automatically locks the account or node for either an organization-defined time period, until the locked account or node is released by an administrator, or delays the next login prompt according to the organization-defined delay algorithm when the maximum number of unsuccessful attempts is exceeded.
Designer
Impractical
3.3.2 Unsuccessful Logon Attempts
AT-3(4) CCI-002054 The organization defines indicators of malicious code to recognize suspicious communications and anomalous behavior in organizational information systems.
Designer
Non-Designer
AU-12(1) CCI-000173 The organization defines the level of tolerance for relationship between time stamps of individual records in the audit trail that will be used for correlation.
Designer
Non-Designer
3.5.3.4 Audit Reduction and Report
Generati...
AU-12(1) CCI-001577 The organization defines the information system components from which audit records are to be compiled into the system-wide audit trail.
Designer
Non-Designer
3.5.3.4 Audit Reduction and Report
Generati...
AU-12(1) CCI-000174 The information system compiles audit records from organization-defined information system components into a system-wide (logical or physical) audit trail that is time-correlated to within organization defined level of tolerance for relationship between time stamps of individual records in the audit trail.
Designer 3.5.3.4 Audit Reduction and Report
Generati...
AU-14 CCI-001919 The information system provides the capability for authorized users to select a user session to capture/record or view/hear.
Designer
Non-Designer
3.5.1 Audit Events, Content of Audit
Reco...
AU-2 CCI-000123 The organization determines the information system must be capable of auditing an organization-defined list of auditable events.
Designer
Non-Designer
3.5.1 Audit Events, Content of Audit
Reco...
AU-2 CCI-000125 The organization provides a rationale for why the list of auditable events is deemed to be adequate to support after-the-fact investigations of security incidents.
Designer
Non-Designer
3.5.1 Audit Events, Content of Audit
Reco...
AU-2 CCI-001485 The organization defines the events which are to be audited on the information system on an organization-defined frequency of (or situation requiring) auditing for each identified event.
Designer
Non-Designer
3.5.1 Audit Events, Content of Audit
Reco...
AU-2 CCI-001571 The organization defines the information system auditable events.
DoD-Defined
Designer
Impractical
3.5.1 Audit Events, Content of Audit
Reco...
AU-4 CCI-001848 The organization defines the audit record storage requirements.
Designer
Non-Designer
3.5.4 Audit Storage Capacity and Audit
Up...
AU-4 CCI-001849 The organization allocates audit record storage capacity in accordance with organization-defined audit record storage requirements.
Designer
Non-Designer
3.5.4 Audit Storage Capacity and Audit
Up...
AU-6(4) CCI-000154 The information system provides the capability to centrally review and analyze audit records from multiple components within the system.
Designer 3.5.3.4 Audit Reduction and Report
Generati...
AU-7 CCI-001875 The information system provides an audit reduction capability that supports on-demand audit review and analysis.
Enclave
Designer
Impractical
3.5.3.4 Audit Reduction and Report
AU-7 CCI-001876 The information system provides an audit reduction capability that supports on-demand reporting requirements.
Enclave
Designer
Impractical
3.5.3.4 Audit Reduction and Report
Generati...
AU-7 CCI-001877 The information system provides an audit reduction capability that supports after-the-fact investigations of security incidents.
Enclave
Designer
Impractical
3.5.3.4 Audit Reduction and Report
Generati...
AU-7 CCI-001878 The information system provides a report generation capability that supports on-demand audit review and analysis.
Enclave
Designer
Impractical
3.5.3.4 Audit Reduction and Report
AU-7 CCI-001879 The information system provides a report generation capability that supports on-demand reporting requirements.
Enclave
Designer
Impractical
3.5.3.4 Audit Reduction and Report
Generati...
AU-7 CCI-001880 The information system provides a report generation capability that supports after-the-fact investigations of security incidents.
Enclave
Designer
Impractical
3.5.3.4 Audit Reduction and Report
Generati...
AU-7 CCI-001881 The information system provides an audit reduction capability that does not alter original content or time ordering of audit records.
Enclave
Designer
Impractical
3.5.3.4 Audit Reduction and Report
AU-7 CCI-001882 The information system provides a report generation capability that does not alter original content or time ordering of audit records.
Enclave
Designer
Impractical
3.5.3.4 Audit Reduction and Report
Generati...
AU-7(1) CCI-000158 The information system provides the capability to process audit records for events of interest based on organization-defined audit fields within audit records.
Enclave
Designer
Impractical
3.5.3.4 Audit Reduction and Report
Generati...
AU-8 CCI-000159 The information system uses internal system clocks to generate time stamps for audit records.
Designer 3.5.2 Audit Time Stamps
AU-8 CCI-001889 The information system records time stamps for audit records that meets organization-defined granularity of time measurement.
Designer 3.5.2 Audit Time Stamps
AU-8 CCI-001890 The information system records time stamps for audit records that can be mapped to
Coordinated Universal Time (UTC) or
Greenwich Mean Time (GMT).
Designer 3.5.2 Audit Time Stamps
CA-3 CCI-000258 The organization documents, for each interconnection, the interface characteristics.
Enclave
Designer
Non-Designer
1.9.2 Cybersecurity Interconnection
Sched...
1.11 CYBERSECURITY DURING
CONSTRUCTION
CA-9 CCI-002103 The organization documents, for each internal connection, the interface characteristics.
Designer 1.9.3 Network Communication Report
CA-9 CCI-002104 The organization documents, for each internal connection, the security requirements.
Designer 1.9.3 Network Communication Report
CA-9 CCI-002105 The organization documents, for each internal connection, the nature of the information communicated.
Designer 1.9.3 Network Communication Report
CA-9 CCI-002102 The organization defines the information system components or classes of components that that are authorized internal connections to the information system.
Designer 1.9.3 Network Communication Report
CM-11(2) CCI-001812 The information system prohibits user installation of software without explicit privileged status.
Designer
Non-Designer
3.3.1 User Accounts
CM-2 CCI-000293 The organization develops and documents a current baseline configuration of the information system.
Designer ---
CM-6 CCI-000365 The organization documents configuration settings for information technology products employed within the information system using organization-defined security configuration checklists that reflect the most restrictive mode consistent with operational requirements.
DoD-Defined
Designer
Non-Designer
Impractical
3.6 REQUIREMENTS FOR LEAST
CM-6 CCI-001755 The organization defines the information system components for which any deviation from the established configuration settings are to be identified, documented and approved.
DoD-Defined
Designer
Non-Designer
Impractical
3.6 REQUIREMENTS FOR LEAST
FUNCTIONALIT...
CM-6 CCI-001588 The organization-defined security configuration checklists reflect the most restrictive mode consistent with operational requirements.
DoD-Defined
Designer
Non-Designer
Impractical
3.2.5 IP Control Networks
3.6 REQUIREMENTS FOR LEAST
FUNCTIONALIT...
CM-6 CCI-000363 The organization defines security configuration checklists to be used to establish and document configuration settings for the information system technology products employed.
Designer 3.6 REQUIREMENTS FOR LEAST
CM-6 CCI-000364 The organization establishes configuration settings for information technology products employed within the information system using organization-defined security configuration checklists.
Designer 3.6 REQUIREMENTS FOR LEAST
FUNCTIONALIT...
CM-7 CCI-000382 The organization configures the information system to prohibit or restrict the use of organization-defined functions, ports, protocols, and/or services.
Designer 3.2.5 IP Control Networks
3.6 REQUIREMENTS FOR LEAST
FUNCTIONALIT...
CM-7 CCI-000380 The organization defines for the information system prohibited or restricted functions, ports, protocols, and/or services.
Designer 3.2.5 IP Control Networks
3.6 REQUIREMENTS FOR LEAST
FUNCTIONALIT...
CM-7 CCI-000381 The organization configures the information system to provide only essential capabilities.
Designer 3.2.5 IP Control Networks
3.6 REQUIREMENTS FOR LEAST
FUNCTIONALIT...
CM-7(3) CCI-000388 The organization ensures compliance with organization-defined registration requirements for functions, ports, protocols, and services.
Designer
Non-Designer
1.9.3 Network Communication Report
CM-7(5) CCI-001772 The organization defines the software programs authorized to execute on the information system.
Designer ---
CM-7(5) CCI-001773 The organization identifies the organization-defined software programs authorized to execute on the information system.
Designer ---
CM-7(5) CCI-001774 The organization employs an deny-all, permit-by-exception policy to allow the execution of authorized software programs on the information system.
Designer ---
CM-8 CCI-000398 The organization defines information deemed necessary to achieve effective information system component accountability.
DoD-Defined
Designer
Non-Designer
Impractical
1.9.4 Control System Inventory Report
CM-8 CCI-000389 The organization develops and documents an inventory of information system components that accurately reflects the current information system.
Designer 1.9.4 Control System Inventory Report
CM-8 CCI-000392 The organization develops and documents an inventory of information system components that includes all components within the authorization boundary of the information system.
Designer 1.9.4 Control System Inventory Report
CP-10 CCI-000550 The organization provides for the recovery and reconstitution of the information system to a known state after a disruption.
Enclave
Designer
Non-Designer
1.9.5 Software and Configuration
Backups
CP-10 CCI-000551 The organization provides for the recovery and reconstitution of the information system to a known state after a compromise.
Enclave
Designer
Non-Designer
1.9.5 Software and Configuration
Backups
CP-10 CCI-000552 The organization provides for the recovery and reconstitution of the information system to a known state after a failure.
Enclave
Designer
Non-Designer
1.9.5 Software and Configuration
Backups
IA-2 CCI-000764 The information system uniquely identifies and authenticates organizational users (or processes acting on behalf of organizational users).
Enclave
Designer
Impractical
3.3.1 User Accounts
3.4 USER IDENTIFICATION AND
IA-3 CCI-000777 The organization defines a list of specific and/or types of devices for which identification and authentication is required before establishing a connection to the information system.
DoD-Defined
Enclave
Designer
Impractical
1.9.4 Control System Inventory Report
3.2.7 Device Identification and
Authentic...
IA-3 CCI-000778 The information system uniquely identifies an organization defined list of specific and/or types of devices before establishing a local, remote, or network connection.
Enclave
Designer
Impractical
1.9.4 Control System Inventory Report
3.2.7 Device Identification and
Authentic...
IA-3 CCI-001958 The information system authenticates an organization defined list of specific and/or types of devices before establishing a local, remote, or network connection.
Enclave
Designer
Impractical
1.9.4 Control System Inventory Report
3.2.7 Device Identification and
Authentic...
IA-5 CCI-001544 The organization manages information system authenticators by ensuring that authenticators have sufficient strength of mechanism for their intended use.
Designer
Non-Designer
Impractical
3.4 USER IDENTIFICATION AND
IA-5 CCI-000182 The organization manages information system authenticators by changing/refreshing authenticators in accordance with the organization defined time period by authenticator type.
DoD-Defined
Designer
Non-Designer
Impractical
3.4 USER IDENTIFICATION AND
AUTHENTICAT...
IA-5 CCI-001610 The organization defines the time period (by authenticator type) for changing/refreshing authenticators.
DoD-Defined
Designer
Non-Designer
Impractical
3.4 USER IDENTIFICATION AND
AUTHENTICAT...
IA-5 CCI-000176 The organization manages information system authenticators by establishing initial authenticator content for authenticators defined by the organization.
Designer
Non-Designer
IA-5 CCI-001988 The organization requires developers/installers of information system components to provide unique authenticators or change default authenticators prior to delivery/installation.
IA-5 CCI-001989 The organization manages information system authenticators by changing default content of authenticators prior to information system installation.
Designer 3.4 USER IDENTIFICATION AND
AUTHENTICAT...
IA-5(1) CCI-000200 The information system prohibits password reuse for the organization defined number of generations.
Enclave
Designer
Non-Designer
Impractical
3.4 USER IDENTIFICATION AND
AUTHENTICAT...
IA-5(1) CCI-000192 The information system enforces password complexity by the minimum number of upper case characters used.
Enclave
Designer
3.4 USER IDENTIFICATION AND
IA-5(1) CCI-000193 The information system enforces password complexity by the minimum number of lower case characters used.
Enclave
Designer
3.4 USER IDENTIFICATION AND
AUTHENTICAT...
IA-5(1) CCI-000194 The information system enforces password complexity by the minimum number of numeric characters used.
Enclave
Designer
3.4 USER IDENTIFICATION AND
AUTHENTICAT...
IA-5(1) CCI-000205 The information system enforces minimum password length.
Enclave
Designer
3.4 USER IDENTIFICATION AND
IA-5(1) CCI-001619 The information system enforces password complexity by the minimum number of special characters used.
Enclave
Designer
3.4 USER IDENTIFICATION AND
AUTHENTICAT...
IA-5(1) CCI-001611 The organization defines the minimum number of special characters for password complexity enforcement.
DoD-Defined
Designer
Impractical
3.4 USER IDENTIFICATION AND
AUTHENTICAT...
IA-5(1) CCI-001612 The organization defines the minimum number of upper case characters for password complexity enforcement.
DoD-Defined
Designer
Impractical
3.4 USER IDENTIFICATION AND
AUTHENTICAT...
IA-5(1) CCI-001613 The organization defines the minimum number of lower case characters for password complexity enforcement.
DoD-Defined
Designer
Impractical
3.4 USER IDENTIFICATION AND
AUTHENTICAT...
IA-5(1) CCI-001614 The organization defines the minimum number of numeric characters for password complexity enforcement.
DoD-Defined
Designer
Impractical
3.4 USER IDENTIFICATION AND
IA-5(1) CCI-000195 The information system, for password-based authentication, when new passwords are created, enforces that at least an organization-defined number of characters are changed.
Enclave
Designer
3.4 USER IDENTIFICATION AND
AUTHENTICAT...
IA-5(1) CCI-001615 The organization defines the minimum number of characters that are changed when new passwords are created.
DoD-Defined
Designer
Impractical
3.4 USER IDENTIFICATION AND
AUTHENTICAT...
IA-5(1) CCI-000196 The information system, for password-based authentication, stores only cryptographically-protected passwords.
Enclave
Designer
Impractical
3.4 USER IDENTIFICATION AND
IA-5(1) CCI-000197 The information system, for password-based authentication, transmits only cryptographically-protected passwords.
Enclave
Designer
3.4 USER IDENTIFICATION AND
AUTHENTICAT...
IA-5(1) CCI-000198 The information system enforces minimum password lifetime restrictions.
Designer
Impractical
3.4 USER IDENTIFICATION AND
AUTHENTICAT...
IA-5(1) CCI-000199 The information system enforces maximum password lifetime restrictions.
Enclave
Designer
3.4 USER IDENTIFICATION AND
IA-5(1) CCI-001616 The organization defines minimum password lifetime restrictions.
DoD-Defined
Designer
Impractical
3.4 USER IDENTIFICATION AND
AUTHENTICAT...
IA-5(1) CCI-001617 The organization defines maximum password lifetime restrictions.
DoD-Defined
Designer
Impractical
3.4 USER IDENTIFICATION AND
AUTHENTICAT...
IA-5(1) CCI-001618 The organization defines the number of generations for which password reuse is prohibited.
DoD-Defined
Enclave
Designer
Impractical
3.4 USER IDENTIFICATION AND
AUTHENTICAT...
IA-5(1) CCI-002041 The information system allows the use of a temporary password for system logons with an immediate change to a permanent password.
Enclave
Designer
Impractical
3.4 USER IDENTIFICATION AND
IA-5(11) CCI-002002 The organization defines the token quality requirements to be employed by the information system mechanisms for token-based authentication.
DoD-Defined
Enclave
Designer
Impractical
3.4 USER IDENTIFICATION AND
AUTHENTICAT...
IA-5(11) CCI-002003 The information system, for token-based authentication, employs mechanisms that satisfy organization-defined token quality requirements.
Enclave
Designer
Impractical
3.4 USER IDENTIFICATION AND
IA-5(4) CCI-001996 The organization defines the requirements required by the automated tools to determine if password authenticators are sufficiently strong.
DoD-Defined
Designer
Non-Designer
IA-5(4) CCI-001997 The organization employs automated tools to determine if password authenticators are sufficiently strong to satisfy organization-defined requirements.
Designer
Non-Designer
Impractical
MA-3 CCI-000865 The organization approves information system maintenance tools.
Designer
Non-Designer
3.9 SYSTEM MAINTENANCE TOOL
SOFTWARE
PE-11 CCI-002955 The organization provides a short-term uninterruptible power supply to facilitate an orderly shutdown of the information system and/or transition of the information system to long-term alternate power in the event of a primary power source loss.
Enclave
Designer
Impractical
3.10 DEVICE POWER
PL-2 CCI-003051 The organization's security plan for the information system explicitly defines the authorization boundary for the system.
Enclave
Designer
Non-Designer
1.9.6 Cybersecurity Riser Diagram
PL-2 CCI-003053 The organization's security plan for the information system provides the security categorization of the information system including supporting rationale.
Designer
Non-Designer
1.9.6 Cybersecurity Riser Diagram
RA-5 CCI-001054 The organization scans for vulnerabilities in the information system and hosted applications on an organization-defined frequency.
Enclave
Designer
Non-Designer
3.11 VULNERABILITY SCANNING
RA-5 CCI-001056 The organization scans for vulnerabilities in the information system and hosted applications when new vulnerabilities potentially affecting the system/applications are identified and reported.
Enclave
Designer
Non-Designer
3.11 VULNERABILITY SCANNING
RA-5 CCI-001641 The organization defines the process for conducting random vulnerability scans on the information system and hosted applications.
Enclave
Designer
Non-Designer
Impractical
RA-5 CCI-001643 The organization scans for vulnerabilities in the information system and hosted applications in accordance with the organization-defined process for random scans.
Enclave
Designer
Non-Designer
3.11 VULNERABILITY SCANNING
RA-5 CCI-001057 The organization employs vulnerability scanning tools and techniques that facilitate interoperability among tools and automate parts of the vulnerability management process by using standards for: enumerating platforms, software flaws, and improper configurations;
formatting checklists and test procedures; and
Enclave
Designer
Non-Designer
Impractical
3.11 VULNERABILITY SCANNING
RA-5 CCI-001058 The organization analyzes vulnerability scan reports and results from security control assessments.
Enclave
Designer
Non-Designer
| SECTION 14 - APPENDICES |
| 14.12 CYBERSECURITY APPENDIX |
| 14.12.2 CCI List HVAC |
File details come from the government source that posted it. Updated .