CSC-Patterns
-
-
-
- Securitypatterns.io Threat Library
- BSI Threat Library
- Security building blocks
- CAPEC Threat Library (meta-attack patterns)
- LINDDUN Threat Library
- STRIDE Threat Library
-
-
-
- NIST 800-53 Controls
- AC-4(17): Information Flow Enforcement | Domain Authentication
- SA-5(1): System Documentation | Functional Properties of Security Controls
- AU-12: Audit Record Generation
- SA-4(1): Acquisition Process | Functional Properties of Controls
- SI-7(13): Software, Firmware, and Information Integrity | Code Execution in Protected Environments
- SC-26: Decoys
- RA-6: Technical Surveillance Countermeasures Survey
- SA-15(7): Development Process, Standards, and Tools | Automated Vulnerability Analysis
- PE-6(3): Monitoring Physical Access | Video Surveillance
- SA-12(7): Supply Chain Protection | Assessments Prior to Selection / Acceptance / Update
- CA-8: Penetration Testing
- AC-4(3): Information Flow Enforcement | Dynamic Information Flow Control
- PE-11(1): Emergency Power | Alternate Power Supply — Minimal Operational Capability
- SA-10: Developer Configuration Management
- SA-12(12): Supply Chain Protection | Inter-organizational Agreements
- SC-23(1): Session Authenticity | Invalidate Session Identifiers at Logout
- SA-9(7): External System Services | Organization-controlled Integrity Checking
- SC-12(6): Cryptographic Key Establishment and Management | Physical Control of Keys
- AC-19(2): Access Control for Mobile Devices | Use of Personally Owned Portable Storage Devices
- SA-3(1): System Development Life Cycle | Manage Preproduction Environment
- SI-7(16): Software, Firmware, and Information Integrity | Time Limit on Process Execution Without Supervision
- PE-6(1): Monitoring Physical Access | Intrusion Alarms and Surveillance Equipment
- SC-42(3): Sensor Capability and Data | Prohibit Use of Devices
- AC-6(1): Least Privilege | Authorize Access to Security Functions
- AC-3(11): Access Enforcement | Restrict Access to Specific Information Types
- IA-12(2): Identity Proofing | Identity Evidence
- AC-9(3): Previous Logon Notification | Notification of Account Changes
- SI-15: Information Output Filtering
- AC-20(3): Use of External Systems | Non-organizationally Owned Systems — Restricted Use
- CP-4(1): Contingency Plan Testing | Coordinate with Related Plans
- SI-10(4): Information Input Validation | Timing Interactions
- IR-4(6): Incident Handling | Insider Threats
- SC-50: Software-enforced Separation and Policy Enforcement
- PM-21: Accounting of Disclosures
- IA-3(4): Device Identification and Authentication | Device Attestation
- CM-8(5): System Component Inventory | No Duplicate Accounting of Components
- SC-3(3): Security Function Isolation | Minimize Nonsecurity Functionality
- SA-5(2): System Documentation | Security-relevant External System Interfaces
- SC-18(1): Mobile Code | Identify Unacceptable Code and Take Corrective Actions
- MA-5: Maintenance Personnel
- AC-7(2): Unsuccessful Logon Attempts | Purge or Wipe Mobile Device
- CA-7(1): Continuous Monitoring | Independent Assessment
- SA-15: Development Process, Standards, and Tools
- SR-11: Component Authenticity
- SC-7(13): Boundary Protection | Isolation of Security Tools, Mechanisms, and Support Components
- AU-12(4): Audit Record Generation | Query Parameter Audits of Personally Identifiable Information
- RA-4: Risk Assessment Update
- SC-7.h: Category blocking
- PM-8: Critical Infrastructure Plan
- IA-8: Identification and Authentication (non-organizational Users)
- PS-7: External Personnel Security
- CM-7(6): Least Functionality | Confined Environments with Limited Privileges
- IA-8(1): Identification and Authentication (non-organizational Users) | Acceptance of PIV Credentials from Other Agencies
- SI-18(4): Personally Identifiable Information Quality Operations | Individual Requests
- SI-21: Information Refresh
- AC-4(9): Information Flow Enforcement | Human Reviews
- SI-8: Spam Protection
- CM-6(2): Configuration Settings | Respond to Unauthorized Changes
- SC-4: Information in Shared System Resources
- AC-4(29): Information Flow Enforcement | Filter Orchestration Engines
- PE-3(7): Physical Access Control | Physical Barriers
- PT-2(2): Authority to Process Personally Identifiable Information | Automation
- SI-13(4): Predictable Failure Prevention | Standby Component Installation and Notification
- IR-4(9): Incident Handling | Dynamic Response Capability
- AU-7: Audit Record Reduction and Report Generation
- PE-19(1): Information Leakage | National Emissions Policies and Procedures
- MA-4(2): Nonlocal Maintenance | Document Nonlocal Maintenance
- SI-4(2): System Monitoring | Automated Tools and Mechanisms for Real-time Analysis
- CA-9: Internal System Connections
- MP-6(3): Media Sanitization | Nondestructive Techniques
- SA-20: Customized Development of Critical Components
- MA-5(4): Maintenance Personnel | Foreign Nationals
- AC-17: Remote Access
- CP-2(1): Contingency Plan | Coordinate with Related Plans
- IA-5(18): Authenticator Management | Password Managers
- IA-2(8): Identification and Authentication (organizational Users) | Access to Accounts — Replay Resistant
- SA-10(2): Developer Configuration Management | Alternative Configuration Management Processes
- PM-18: Privacy Program Plan
- SC-7(3): Boundary Protection | Access Points
- SC-5: Denial-of-service Protection
- IA-2(10): Identification and Authentication (organizational Users) | Single Sign-on
- SR-10: Inspection of Systems or Components
- SA-8(16): Security and Privacy Engineering Principles | Self-reliant Trustworthiness
- SI-7(10): Software, Firmware, and Information Integrity | Protection of Boot Firmware
- IR-2(1): Incident Response Training | Simulated Events
- SC-15: Collaborative Computing Devices and Applications
- CA-7(5): Continuous Monitoring | Consistency Analysis
- IR-4(8): Incident Handling | Correlation with External Organizations
- SA-12(5): Supply Chain Protection | Limitation of Harm
- SA-8(20): Security and Privacy Engineering Principles | Secure Metadata Management
- PS-3(1): Personnel Screening | Classified Information
- CM-8(4): System Component Inventory | Accountability Information
- SC-3(1): Security Function Isolation | Hardware Separation
- CA-3(6): Information Exchange | Transfer Authorizations
- AC-7(1): Unsuccessful Logon Attempts | Automatic Account Lock
- MA-2: Controlled Maintenance
- PL-10: Baseline Selection
- SI-20: Tainting
- PS-3(2): Personnel Screening | Formal Indoctrination
- CM-5(6): Access Restrictions for Change | Limit Library Privileges
- AU-4(1): Audit Log Storage Capacity | Transfer to Alternate Storage
- PT-2: Authority to Process Personally Identifiable Information
- CM-7(2): Least Functionality | Prevent Program Execution
- CA-3(4): Information Exchange | Connections to Public Networks
- SI-2(2): Flaw Remediation | Automated Flaw Remediation Status
- AC-16(5): Security and Privacy Attributes | Attribute Displays on Objects to Be Output
- PL-8(2): Security and Privacy Architectures | Supplier Diversity
- SA-12(6): Supply Chain Protection | Minimizing Procurement Time
- AC-21: Information Sharing
- SI-19(8): De-identification | Motivated Intruder
- SI-10(3): Information Input Validation | Predictable Behavior
- SI-4(13): System Monitoring | Analyze Traffic and Event Patterns
- AC-3(5): Access Enforcement | Security-relevant Information
- IR-9(3): Information Spillage Response | Post-spill Operations
- CP-8(3): Telecommunications Services | Separation of Primary and Alternate Providers
- CA-9(1): Internal System Connections | Compliance Checks
- SR-11(2): Component Authenticity | Configuration Control for Component Service and Repair
- IA-2(4): Identification and Authentication (organizational Users) | Local Access to Non-privileged Accounts
- CP-9(2): System Backup | Test Restoration Using Sampling
- PS-6(2): Access Agreements | Classified Information Requiring Special Protection
- SI-14(3): Non-persistence | Non-persistent Connectivity
- PE-23: Facility Location
- IA-12(5): Identity Proofing | Address Confirmation
- PE-18: Location of System Components
- AU-14: Session Audit
- SI-7(11): Software, Firmware, and Information Integrity | Confined Environments with Limited Privileges
- PL-2: System Security and Privacy Plans
- AC-9(4): Previous Logon Notification | Additional Logon Information
- AU-10: Non-repudiation
- SA-16: Developer-provided Training
- CP-6(2): Alternate Storage Site | Recovery Time and Recovery Point Objectives
- SI-19(3): De-identification | Release
- AC-20(2): Use of External Systems | Portable Storage Devices — Restricted Use
- AC-16(3): Security and Privacy Attributes | Maintenance of Attribute Associations by System
- IA-5(5): Authenticator Management | Change Authenticators Prior to Delivery
- CP-4(4): Contingency Plan Testing | Full Recovery and Reconstitution
- AC-4(26): Information Flow Enforcement | Audit Filtering Actions
- PE-8(1): Visitor Access Records | Automated Records Maintenance and Review
- RA-5(5): Vulnerability Monitoring and Scanning | Privileged Access
- PE-6(4): Monitoring Physical Access | Monitoring Physical Access to Systems
- PE-7: Visitor Control
- AC-4(12): Information Flow Enforcement | Data Type Identifiers
- AC-3(8): Access Enforcement | Revocation of Access Authorizations
- SC-36: Distributed Processing and Storage
- SA-8(23): Security and Privacy Engineering Principles | Secure Defaults
- SC-42(5): Sensor Capability and Data | Collection Minimization
- PL-6: Security-related Activity Planning
- IA-4(4): Identifier Management | Identify User Status
- AU-9(2): Protection of Audit Information | Store on Separate Physical Systems or Components
- SA-12(9): Supply Chain Protection | Operations Security
- IR-4(2): Incident Handling | Dynamic Reconfiguration
- SC-2: Separation of System and User Functionality
- PM-30: Supply Chain Risk Management Strategy
- SA-11(7): Developer Testing and Evaluation | Verify Scope of Testing and Evaluation
- CM-5(7): Access Restrictions for Change | Automatic Implementation of Security Safeguards
- SC-34(3): Non-modifiable Executable Programs | Hardware-based Protection
- SC-23(2): Session Authenticity | User-initiated Logouts and Message Displays
- SA-5: System Documentation
- SC-3(2): Security Function Isolation | Access and Flow Control Functions
- AC-4(1): Information Flow Enforcement | Object Security and Privacy Attributes
- SR-11(3): Component Authenticity | Anti-counterfeit Scanning
- AT-5: Contacts with Security Groups and Associations
- IR-2(2): Incident Response Training | Automated Training Environments
- SC-11(1): Trusted Path | Irrefutable Communications Path
- PL-3: System Security Plan Update
- AC-6(8): Least Privilege | Privilege Levels for Code Execution
- SC-7(22): Boundary Protection | Separate Subnets for Connecting to Different Security Domains
- SA-15(3): Development Process, Standards, and Tools | Criticality Analysis
- MP-3: Media Marking
- SA-8(9): Security and Privacy Engineering Principles | Trusted Components
- PE-1: Policy and Procedures
- SC-28(2): Protection of Information at Rest | Offline Storage
- AC-4(21): Information Flow Enforcement | Physical or Logical Separation of Information Flows
- SC-7(6): Boundary Protection | Response to Recognized Failures
- SA-8(29): Security and Privacy Engineering Principles | Repeatable and Documented Procedures
- AU-6(5): Audit Record Review, Analysis, and Reporting | Integrated Analysis of Audit Records
- MA-4(3): Nonlocal Maintenance | Comparable Security and Sanitization
- AU-9(3): Protection of Audit Information | Cryptographic Protection
- AC-16(8): Security and Privacy Attributes | Association Techniques and Technologies
- SC-29: Heterogeneity
- AC-18(4): Wireless Access | Restrict Configurations by Users
- MP-8: Media Downgrading
- CP-2(2): Contingency Plan | Capacity Planning
- SI-4(5): System Monitoring | System-generated Alerts
- AC-4(28): Information Flow Enforcement | Linear Filter Pipelines
- SC-45(1): System Time Synchronization | Synchronization with Authoritative Time Source
- MP-2(1): Media Access | Automated Restricted Access
- AC-16(1): Security and Privacy Attributes | Dynamic Attribute Association
- IA-2(13): Identification and Authentication (organizational Users) | Out-of-band Authentication
- PE-3: Physical Access Control
- IA-12(4): Identity Proofing | In-person Validation and Verification
- PM-24: Data Integrity Board
- CP-9(1): System Backup | Testing for Reliability and Integrity
- SA-7: User-installed Software
- AT-3(1): Role-based Training | Environmental Controls
- AC-17(3): Remote Access | Managed Access Control Points
- AC-24: Access Control Decisions
- IR-1: Policy and Procedures
- MA-3(4): Maintenance Tools | Restricted Tool Use
- MP-8(4): Media Downgrading | Classified Information
- SA-15(9): Development Process, Standards, and Tools | Use of Live Data
- SC-46: Cross Domain Policy Enforcement
- SR-9: Tamper Resistance and Detection
- SA-17(5): Developer Security and Privacy Architecture and Design | Conceptually Simple Design
- AU-5(5): Response to Audit Logging Process Failures | Alternate Audit Logging Capability
- AC-19(5): Access Control for Mobile Devices | Full Device or Container-based Encryption
- AC-12(1): Session Termination | User-initiated Logouts
- SC-23: Session Authenticity
- RA-8: Privacy Impact Assessments
- MP-1: Policy and Procedures
- PT-4(3): Consent | Revocation
- RA-5(7): Vulnerability Monitoring and Scanning | Automated Detection and Notification of Unauthorized Components
- CM-2(1): Baseline Configuration | Reviews and Updates
- AC-6(9): Least Privilege | Log Use of Privileged Functions
- AC-17(6): Remote Access | Protection of Mechanism Information
- SA-8(18): Security and Privacy Engineering Principles | Trusted Communications Channels
- IA-5(9): Authenticator Management | Federated Credential Management
- SA-4(2): Acquisition Process | Design and Implementation Information for Controls
- AC-13: Supervision and Review — Access Control
- CA-7(4): Continuous Monitoring | Risk Monitoring
- IA-5(11): Authenticator Management | Hardware Token-based Authentication
- IR-3(1): Incident Response Testing | Automated Testing
- SC-34(1): Non-modifiable Executable Programs | No Writable Storage
- SA-3(3): System Development Life Cycle | Technology Refresh
- PE-8: Visitor Access Records
- SA-17(4): Developer Security and Privacy Architecture and Design | Informal Correspondence
- SC-18(5): Mobile Code | Allow Execution Only in Confined Environments
- SR-4(1): Provenance | Identity
- SC-5(1): Denial-of-service Protection | Restrict Ability to Attack Other Systems
- IA-5(16): Authenticator Management | In-person or Trusted External Party Authenticator Issuance
- CP-10: System Recovery and Reconstitution
- SI-18(2): Personally Identifiable Information Quality Operations | Data Tags
- PE-15(1): Water Damage Protection | Automation Support
- AU-6(9): Audit Record Review, Analysis, and Reporting | Correlation with Information from Nontechnical Sources
- AC-2(4): Account Management | Automated Audit Actions
- SI-4(11): System Monitoring | Analyze Communications Traffic Anomalies
- SA-8(15): Security and Privacy Engineering Principles | Predicate Permission
- SC-30(2): Concealment and Misdirection | Randomness
- IR-4: Incident Handling
- SA-11: Developer Testing and Evaluation
- MP-8(3): Media Downgrading | Controlled Unclassified Information
- SC-44: Detonation Chambers
- SA-4(10): Acquisition Process | Use of Approved PIV Products
- CM-7(5): Least Functionality | Authorized Software — Allow-by-exception
- PM-17: Protecting Controlled Unclassified Information on External Systems
- PM-10: Authorization Process
- MA-3(5): Maintenance Tools | Execution with Privilege
- IR-4(10): Incident Handling | Supply Chain Coordination
- SC-7(9): Boundary Protection | Restrict Threatening Outgoing Communications Traffic
- IA-9: Service Identification and Authentication
- CM-3(6): Configuration Change Control | Cryptography Management
- SA-11(8): Developer Testing and Evaluation | Dynamic Code Analysis
- SC-35: External Malicious Code Identification
- PE-11: Emergency Power
- SI-5: Security Alerts, Advisories, and Directives
- PT-4: Consent
- SA-21: Developer Screening
- CP-7: Alternate Processing Site
- SC-3(5): Security Function Isolation | Layered Structures
- SI-4: System Monitoring
- SA-3: System Development Life Cycle
- RA-9: Criticality Analysis
- SC-4(1): Information in Shared System Resources | Security Levels
- IR-3(3): Incident Response Testing | Continuous Improvement
- SC-42: Sensor Capability and Data
- CP-2(3): Contingency Plan | Resume Mission and Business Functions
- SR-2(1): Supply Chain Risk Management Plan | Establish SCRM Team
- AU-16: Cross-organizational Audit Logging
- AC-18(2): Wireless Access | Monitoring Unauthorized Connections
- SA-8(10): Security and Privacy Engineering Principles | Hierarchical Trust
- MP-4(2): Media Storage | Automated Restricted Access
- AT-2(4): Literacy Training and Awareness | Suspicious Communications and Anomalous System Behavior
- AC-1: Policy and Procedures
- SI-4(21): System Monitoring | Probationary Periods
- CM-5(3): Access Restrictions for Change | Signed Components
- CA-3(3): Information Exchange | Unclassified Non-national Security System Connections
- SI-16: Memory Protection
- IA-5(7): Authenticator Management | No Embedded Unencrypted Static Authenticators
- IA-4(1): Identifier Management | Prohibit Account Identifiers as Public Identifiers
- AC-10: Concurrent Session Control
- MA-2(1): Controlled Maintenance | Record Content
- CP-11: Alternate Communications Protocols
- AU-6(1): Audit Record Review, Analysis, and Reporting | Automated Process Integration
- IA-5(10): Authenticator Management | Dynamic Credential Binding
- IA-8(5): Identification and Authentication (non-organizational Users) | Acceptance of PVI-I Credentials
- SA-8(8): Security and Privacy Engineering Principles | Secure Evolvability
- SI-4(23): System Monitoring | Host-based Devices
- PE-12: Emergency Lighting
- PE-22: Component Marking
- AT-2(5): Literacy Training and Awareness | Advanced Persistent Threat
- SA-8(32): Security and Privacy Engineering Principles | Sufficient Documentation
- AC-20(5): Use of External Systems | Portable Storage Devices — Prohibited Use
- AC-17(5): Remote Access | Monitoring for Unauthorized Connections
- SC-2(1): Separation of System and User Functionality | Interfaces for Non-privileged Users
- AU-4: Audit Log Storage Capacity
- MA-5(3): Maintenance Personnel | Citizenship Requirements for Classified Systems
- SC-40: Wireless Link Protection
- MA-3(6): Maintenance Tools | Software Updates and Patches
- SI-19(2): De-identification | Archiving
- SC-23(3): Session Authenticity | Unique System-generated Session Identifiers
- SA-15(8): Development Process, Standards, and Tools | Reuse of Threat and Vulnerability Information
- AU-2: Event Logging
- MP-7(2): Media Use | Prohibit Use of Sanitization-resistant Media
- PL-8: Security and Privacy Architectures
- SA-4(6): Acquisition Process | Use of Information Assurance Products
- SA-19(3): Component Authenticity | Component Disposal
- CM-2(5): Baseline Configuration | Authorized Software
- AT-2(2): Literacy Training and Awareness | Insider Threat
- SA-17(9): Developer Security and Privacy Architecture and Design | Design Diversity
- PE-3(5): Physical Access Control | Tamper Protection
- IA-5(14): Authenticator Management | Managing Content of PKI Trust Stores
- AC-4(10): Information Flow Enforcement | Enable and Disable Security or Privacy Policy Filters
- AC-17(8): Remote Access | Disable Nonsecure Network Protocols
- SR-4: Provenance
- SR-5: Acquisition Strategies, Tools, and Methods
- CP-2(8): Contingency Plan | Identify Critical Assets
- SA-12(13): Supply Chain Protection | Critical Information System Components
- MP-7(1): Media Use | Prohibit Use Without Owner
- MA-5(1): Maintenance Personnel | Individuals Without Appropriate Access
- MA-4: Nonlocal Maintenance
- AU-2(2): Event Logging | Selection of Audit Events by Component
- CM-12: Information Location
- CM-5(5): Access Restrictions for Change | Privilege Limitation for Production and Operation
- AC-18: Wireless Access
- AU-3(2): Content of Audit Records | Centralized Management of Planned Audit Record Content
- CP-2(4): Contingency Plan | Resume All Mission and Business Functions
- AC-6(3): Least Privilege | Network Access to Privileged Commands
- AU-14(1): Session Audit | System Start-up
- SI-3(10): Malicious Code Protection | Malicious Code Analysis
- SC-7(26): Boundary Protection | Classified National Security System Connections
- CA-3: Information Exchange
- AU-6(3): Audit Record Review, Analysis, and Reporting | Correlate Audit Record Repositories
- CP-2(6): Contingency Plan | Alternate Processing and Storage Sites
- SA-8(4): Security and Privacy Engineering Principles | Partially Ordered Dependencies
- AU-6(10): Audit Record Review, Analysis, and Reporting | Audit Level Adjustment
- AC-16(6): Security and Privacy Attributes | Maintenance of Attribute Association
- AU-12(2): Audit Record Generation | Standardized Formats
- IR-4(1): Incident Handling | Automated Incident Handling Processes
- AC-4(18): Information Flow Enforcement | Security Attribute Binding
- SA-14(1): Criticality Analysis | Critical Components with No Viable Alternative Sourcing
- SC-7(17): Boundary Protection | Automated Enforcement of Protocol Formats
- AU-3(3): Content of Audit Records | Limit Personally Identifiable Information Elements
- PT-4(1): Consent | Tailored Consent
- SA-8(26): Security and Privacy Engineering Principles | Performance Security
- SI-4(22): System Monitoring | Unauthorized Network Services
- PS-3(4): Personnel Screening | Citizenship Requirements
- AC-3(2): Access Enforcement | Dual Authorization
- IR-5: Incident Monitoring
- IA-2(2): Identification and Authentication (organizational Users) | Multi-factor Authentication to Non-privileged Accounts
- AC-7(3): Unsuccessful Logon Attempts | Biometric Attempt Limiting
- IA-2(7): Identification and Authentication (organizational Users) | Network Access to Non-privileged Accounts — Separate Device
- SC-37(1): Out-of-band Channels | Ensure Delivery and Transmission
- CM-2(3): Baseline Configuration | Retention of Previous Configurations
- PM-14: Testing, Training, and Monitoring
- AT-6: Training Feedback
- SA-17(1): Developer Security and Privacy Architecture and Design | Formal Policy Model
- CP-10(6): System Recovery and Reconstitution | Component Protection
- AC-7: Unsuccessful Logon Attempts
- SA-18(2): Tamper Resistance and Detection | Inspection of Systems or Components
- SI-18(5): Personally Identifiable Information Quality Operations | Notice of Correction or Deletion
- SC-7.g : Authentication / Authorization
- IA-4(8): Identifier Management | Pairwise Pseudonymous Identifiers
- SA-4(7): Acquisition Process | NIAP-approved Protection Profiles
- AC-4(5): Information Flow Enforcement | Embedded Data Types
- PS-4(2): Personnel Termination | Automated Actions
- PM-31: Continuous Monitoring Strategy
- SR-5(1): Acquisition Strategies, Tools, and Methods | Adequate Supply
- PM-12: Insider Threat Program
- PE-2(3): Physical Access Authorizations | Restrict Unescorted Access
- SC-7(23): Boundary Protection | Disable Sender Feedback on Protocol Validation Failure
- AC-3(1): Access Enforcement | Restricted Access to Privileged Functions
- SI-7(7): Software, Firmware, and Information Integrity | Integration of Detection and Response
- AC-23: Data Mining Protection
- SC-5(2): Denial-of-service Protection | Capacity, Bandwidth, and Redundancy
- SC-28(1): Protection of Information at Rest | Cryptographic Protection
- SI-9: Information Input Restrictions
- SA-2: Allocation of Resources
- CM-7(3): Least Functionality | Registration Compliance
- SI-4(16): System Monitoring | Correlate Monitoring Information
- PE-12(1): Emergency Lighting | Essential Mission and Business Functions
- IA-9(1): Service Identification and Authentication | Information Exchange
- PE-10(1): Emergency Shutoff | Accidental and Unauthorized Activation
- PM-4: Plan of Action and Milestones Process
- SC-40(2): Wireless Link Protection | Reduce Detection Potential
- CM-8(2): System Component Inventory | Automated Maintenance
- SC-7(1): Boundary Protection | Physically Separated Subnetworks
- SA-8: Security and Privacy Engineering Principles
- RA-5: Vulnerability Monitoring and Scanning
- AC-21(2): Information Sharing | Information Search and Retrieval
- SA-12(15): Supply Chain Protection | Processes to Address Weaknesses or Deficiencies
- MP-8(1): Media Downgrading | Documentation of Process
- MA-3: Maintenance Tools
- SC-18(2): Mobile Code | Acquisition, Development, and Use
- RA-5(2): Vulnerability Monitoring and Scanning | Update Vulnerabilities to Be Scanned
- RA-3(1): Risk Assessment | Supply Chain Risk Assessment
- RA-2: Security Categorization
- AC-3(15): Access Enforcement | Discretionary and Mandatory Access Control
- SC-31(2): Covert Channel Analysis | Maximum Bandwidth
- CP-6: Alternate Storage Site
- CM-7(4): Least Functionality | Unauthorized Software — Deny-by-exception
- PE-2(1): Physical Access Authorizations | Access by Position or Role
- SA-8(6): Security and Privacy Engineering Principles | Minimized Sharing
- CA-3(5): Information Exchange | Restrictions on External System Connections
- PE-15: Water Damage Protection
- IA-8(6): Identification and Authentication (non-organizational Users) | Disassociability
- SC-16(2): Transmission of Security and Privacy Attributes | Anti-spoofing Mechanisms
- CP-5: Contingency Plan Update
- SA-8(2): Security and Privacy Engineering Principles | Least Common Mechanism
- IA-6: Authentication Feedback
- CA-3(7): Information Exchange | Transitive Information Exchanges
- AU-10(2): Non-repudiation | Validate Binding of Information Producer Identity
- SA-12(1): Supply Chain Protection | Acquisition Strategies / Tools / Methods
- PM-13: Security and Privacy Workforce
- CA-2(1): Control Assessments | Independent Assessors
- IR-4(4): Incident Handling | Information Correlation
- IR-5(1): Incident Monitoring | Automated Tracking, Data Collection, and Analysis
- AC-20(1): Use of External Systems | Limits on Authorized Use
- SI-3(6): Malicious Code Protection | Testing and Verification
- SA-18: Tamper Resistance and Detection
- AC-4(31): Information Flow Enforcement | Failed Content Transfer Prevention
- SR-3: Supply Chain Controls and Processes
- SI-8(3): Spam Protection | Continuous Learning Capability
- SI-3(8): Malicious Code Protection | Detect Unauthorized Commands
- AC-16(4): Security and Privacy Attributes | Association of Attributes by Authorized Individuals
- PM-3: Information Security and Privacy Resources
- SI-4(15): System Monitoring | Wireless to Wireline Communications
- SR-2: Supply Chain Risk Management Plan
- IR-6(2): Incident Reporting | Vulnerabilities Related to Incidents
- AU-2(3): Event Logging | Reviews and Updates
- IR-4(7): Incident Handling | Insider Threats — Intra-organization Coordination
- IA-8(4): Identification and Authentication (non-organizational Users) | Use of Defined Profiles
- IR-2(3): Incident Response Training | Breach
- CP-10(3): System Recovery and Reconstitution | Compensating Security Controls
- SI-4(20): System Monitoring | Privileged Users
- CA-8(1): Penetration Testing | Independent Penetration Testing Agent or Team
- PL-2(2): System Security and Privacy Plans | Functional Architecture
- IA-8(2): Identification and Authentication (non-organizational Users) | Acceptance of External Authenticators
- SA-11(1): Developer Testing and Evaluation | Static Code Analysis
- SA-23: Specialization
- AC-3(12): Access Enforcement | Assert and Enforce Application Access
- MP-6(5): Media Sanitization | Classified Information
- SI-2(5): Flaw Remediation | Automatic Software and Firmware Updates
- IA-4(5): Identifier Management | Dynamic Management
- RA-5(10): Vulnerability Monitoring and Scanning | Correlate Scanning Information
- AC-4(13): Information Flow Enforcement | Decomposition into Policy-relevant Subcomponents
- PE-13(1): Fire Protection | Detection Systems — Automatic Activation and Notification
- AU-10(5): Non-repudiation | Digital Signatures
- AC-18(5): Wireless Access | Antennas and Transmission Power Levels
- MA-4(7): Nonlocal Maintenance | Disconnect Verification
- SC-30(4): Concealment and Misdirection | Misleading Information
- PE-13: Fire Protection
- SC-7(20): Boundary Protection | Dynamic Isolation and Segregation
- SR-4(4): Provenance | Supply Chain Integrity — Pedigree
- SI-18(1): Personally Identifiable Information Quality Operations | Automation Support
- AT-3(4): Role-based Training | Suspicious Communications and Anomalous System Behavior
- PL-2(3): System Security and Privacy Plans | Plan and Coordinate with Other Organizational Entities
- SC-7(27): Boundary Protection | Unclassified Non-national Security System Connections
- AT-1: Policy and Procedures
- SI-10: Information Input Validation
- IR-9(1): Information Spillage Response | Responsible Personnel
- AC-6: Least Privilege
- IR-4(14): Incident Handling | Security Operations Center
- PT-6(2): System of Records Notice | Exemption Rules
- SI-4(19): System Monitoring | Risk for Individuals
- MP-6(1): Media Sanitization | Review, Approve, Track, Document, and Verify
- PE-10: Emergency Shutoff
- SA-8(25): Security and Privacy Engineering Principles | Economic Security
- SI-7(8): Software, Firmware, and Information Integrity | Auditing Capability for Significant Events
- MP-7: Media Use
- AU-14(2): Session Audit | Capture and Record Content
- PM-19: Privacy Program Leadership Role
- SA-10(7): Developer Configuration Management | Security and Privacy Representatives
- SA-8(31): Security and Privacy Engineering Principles | Secure System Modification
- SA-8(12): Security and Privacy Engineering Principles | Hierarchical Protection
- SC-15(1): Collaborative Computing Devices and Applications | Physical or Logical Disconnect
- AC-4(2): Information Flow Enforcement | Processing Domains
- AU-10(3): Non-repudiation | Chain of Custody
- AU-5: Response to Audit Logging Process Failures
- AU-9: Protection of Audit Information
- SC-30(5): Concealment and Misdirection | Concealment of System Components
- AU-16(3): Cross-organizational Audit Logging | Disassociability
- MA-6(3): Timely Maintenance | Automated Support for Predictive Maintenance
- SC-28: Protection of Information at Rest
- CP-1: Policy and Procedures
- AC-4(15): Information Flow Enforcement | Detection of Unsanctioned Information
- AC-2(2): Account Management | Automated Temporary and Emergency Account Management
- SR-6: Supplier Assessments and Reviews
- CA-6(1): Authorization | Joint Authorization — Intra-organization
- AU-6(6): Audit Record Review, Analysis, and Reporting | Correlation with Physical Monitoring
- SA-9(1): External System Services | Risk Assessments and Organizational Approvals
- SA-4(12): Acquisition Process | Data Ownership
- SA-8(21): Security and Privacy Engineering Principles | Self-analysis
- IA-5(3): Authenticator Management | In-person or Trusted External Party Registration
- AT-2(3): Literacy Training and Awareness | Social Engineering and Mining
- IA-4(2): Identifier Management | Supervisor Authorization
- PE-9(2): Power Equipment and Cabling | Automatic Voltage Controls
- IA-4(3): Identifier Management | Multiple Forms of Certification
- AC-17(9): Remote Access | Disconnect or Disable Access
- IA-4(7): Identifier Management | In-person Registration
- CM-8(1): System Component Inventory | Updates During Installation and Removal
- SI-6(2): Security and Privacy Function Verification | Automation Support for Distributed Testing
- SA-12(2): Supply Chain Protection | Supplier Reviews
- IA-5: Authenticator Management
- SC-19: Voice Over Internet Protocol
- AC-3(10): Access Enforcement | Audited Override of Access Control Mechanisms
- PM-7: Enterprise Architecture
- CM-3(8): Configuration Change Control | Prevent or Restrict Configuration Changes
- CP-7(1): Alternate Processing Site | Separation from Primary Site
- CM-9(1): Configuration Management Plan | Assignment of Responsibility
- IA-12: Identity Proofing
- AC-6(4): Least Privilege | Separate Processing Domains
- AC-17(4): Remote Access | Privileged Commands and Access
- SA-11(5): Developer Testing and Evaluation | Penetration Testing
- SA-9(3): External System Services | Establish and Maintain Trust Relationship with Providers
- CA-5: Plan of Action and Milestones
- SA-10(1): Developer Configuration Management | Software and Firmware Integrity Verification
- SA-4(8): Acquisition Process | Continuous Monitoring Plan for Controls
- MP-5(4): Media Transport | Cryptographic Protection
- CM-6(3): Configuration Settings | Unauthorized Change Detection
- SA-10(5): Developer Configuration Management | Mapping Integrity for Version Control
- SI-10(2): Information Input Validation | Review and Resolve Errors
- SA-9(8): External System Services | Processing and Storage Location — U.S. Jurisdiction
- CA-1: Policy and Procedures
- CA-5(1): Plan of Action and Milestones | Automation Support for Accuracy and Currency
- SI-7(1): Software, Firmware, and Information Integrity | Integrity Checks
- CM-3(5): Configuration Change Control | Automated Security Response
- SC-13: Cryptographic Protection
- PE-4: Access Control for Transmission
- AU-12(1): Audit Record Generation | System-wide and Time-correlated Audit Trail
- SI-19(7): De-identification | Validated Algorithms and Software
- SR-3(3): Supply Chain Controls and Processes | Sub-tier Flow Down
- IR-6: Incident Reporting
- SC-33: Transmission Preparation Integrity
- PE-13(3): Fire Protection | Automatic Fire Suppression
- MA-4(5): Nonlocal Maintenance | Approvals and Notifications
- SC-13(4): Cryptographic Protection | Digital Signatures
- CM-6(4): Configuration Settings | Conformance Demonstration
- SC-7.d : URL filtering
- SC-14: Public Access Protections
- AU-16(2): Cross-organizational Audit Logging | Sharing of Audit Information
- CM-10(1): Software Usage Restrictions | Open-source Software
- SC-12(4): Cryptographic Key Establishment and Management | PKI Certificates
- SI-7(12): Software, Firmware, and Information Integrity | Integrity Verification
- PE-19: Information Leakage
- RA-7: Risk Response
- SC-16(3): Transmission of Security and Privacy Attributes | Cryptographic Binding
- CM-14: Signed Components
- PL-9: Central Management
- SI-19(5): De-identification | Statistical Disclosure Control
- SA-4(3): Acquisition Process | Development Methods, Techniques, and Practices
- PM-5(1): System Inventory | Inventory of Personally Identifiable Information
- AT-4: Training Records
- CP-9(3): System Backup | Separate Storage for Critical Information
- SC-7(28): Boundary Protection | Connections to Public Networks
- SA-17: Developer Security and Privacy Architecture and Design
- SC-31: Covert Channel Analysis
- SA-6: Software Usage Restrictions
- AC-4(8): Information Flow Enforcement | Security and Privacy Policy Filters
- AC-4(7): Information Flow Enforcement | One-way Flow Mechanisms
- SC-20: Secure Name/address Resolution Service (authoritative Source)
- SA-4: Acquisition Process
- SI-19(6): De-identification | Differential Privacy
- PE-11(2): Emergency Power | Alternate Power Supply — Self-contained
- CM-6: Configuration Settings
- AC-2(9): Account Management | Restrictions on Use of Shared and Group Accounts
- AC-16(2): Security and Privacy Attributes | Attribute Value Changes by Authorized Individuals
- CA-6(2): Authorization | Joint Authorization — Inter-organization
- AC-3(6): Access Enforcement | Protection of User and System Information
- CM-5: Access Restrictions for Change
- MA-5(2): Maintenance Personnel | Security Clearances for Classified Systems
- PL-4(1): Rules of Behavior | Social Media and External Site/application Usage Restrictions
- CP-9(8): System Backup | Cryptographic Protection
- AC-2(12): Account Management | Account Monitoring for Atypical Usage
- SC-47: Alternate Communications Paths
- SI-3(3): Malicious Code Protection | Non-privileged Users
- MP-5: Media Transport
- PE-20: Asset Monitoring and Tracking
- PE-9: Power Equipment and Cabling
- PS-6(3): Access Agreements | Post-employment Requirements
- SR-8: Notification Agreements
- MA-1: Policy and Procedures
- SC-7(11): Boundary Protection | Restrict Incoming Communications Traffic
- SI-8(2): Spam Protection | Automatic Updates
- CM-3(4): Configuration Change Control | Security and Privacy Representatives
- SA-8(28): Security and Privacy Engineering Principles | Acceptable Security
- PE-8(3): Visitor Access Records | Limit Personally Identifiable Information Elements
- PT-2(1): Authority to Process Personally Identifiable Information | Data Tagging
- RA-5(11): Vulnerability Monitoring and Scanning | Public Disclosure Program
- SC-1: Policy and Procedures
- IR-8: Incident Response Plan
- SC-15(3): Collaborative Computing Devices and Applications | Disabling and Removal in Secure Work Areas
- AC-2(7): Account Management | Privileged User Accounts
- SC-7(10): Boundary Protection | Prevent Exfiltration
- SI-8(1): Spam Protection | Central Management
- PE-6(2): Monitoring Physical Access | Automated Intrusion Recognition and Responses
- RA-5(6): Vulnerability Monitoring and Scanning | Automated Trend Analyses
- SC-12(5): Cryptographic Key Establishment and Management | PKI Certificates / Hardware Tokens
- SI-4(8): System Monitoring | Protection of Monitoring Information
- CP-4: Contingency Plan Testing
- SA-11(9): Developer Testing and Evaluation | Interactive Application Security Testing
- PL-7: Concept of Operations
- SC-3(4): Security Function Isolation | Module Coupling and Cohesiveness
- SA-22(1): Unsupported System Components | Alternative Sources for Continued Support
- PL-5: Privacy Impact Assessment
- SA-4(9): Acquisition Process | Functions, Ports, Protocols, and Services in Use
- SI-4(4): System Monitoring | Inbound and Outbound Communications Traffic
- PE-3(4): Physical Access Control | Lockable Casings
- AU-13(1): Monitoring for Information Disclosure | Use of Automated Tools
- SI-12(2): Information Management and Retention | Minimize Personally Identifiable Information in Testing, Training, and Research
- SR-11(1): Component Authenticity | Anti-counterfeit Training
- SC-23(5): Session Authenticity | Allowed Certificate Authorities
- SI-7(4): Software, Firmware, and Information Integrity | Tamper-evident Packaging
- CP-8(4): Telecommunications Services | Provider Contingency Plan
- AU-12(3): Audit Record Generation | Changes by Authorized Individuals
- SA-15(2): Development Process, Standards, and Tools | Security and Privacy Tracking Tools
- PE-2(2): Physical Access Authorizations | Two Forms of Identification
- SA-8(7): Security and Privacy Engineering Principles | Reduced Complexity
- CP-3: Contingency Training
- PM-28: Risk Framing
- PE-21: Electromagnetic Pulse Protection
- AC-19(4): Access Control for Mobile Devices | Restrictions for Classified Information
- SI-4(12): System Monitoring | Automated Organization-generated Alerts
- PE-6: Monitoring Physical Access
- CM-2(6): Baseline Configuration | Development and Test Environments
- SC-31(1): Covert Channel Analysis | Test Covert Channels for Exploitability
- SI-2: Flaw Remediation
- AC-19(1): Access Control for Mobile Devices | Use of Writable and Portable Storage Devices
- SI-13(2): Predictable Failure Prevention | Time Limit on Process Execution Without Supervision
- AC-3(13): Access Enforcement | Attribute-based Access Control
- AC-3(14): Access Enforcement | Individual Access
- IR-2: Incident Response Training
- SI-7(15): Software, Firmware, and Information Integrity | Code Authentication
- SA-15(6): Development Process, Standards, and Tools | Continuous Improvement
- SA-10(3): Developer Configuration Management | Hardware Integrity Verification
- SC-7(5): Boundary Protection | Deny by Default — Allow by Exception
- SC-48(1): Sensor Relocation | Dynamic Relocation of Sensors or Monitoring Capabilities
- SC-8(1): Transmission Confidentiality and Integrity | Cryptographic Protection
- PT-7(2): Specific Categories of Personally Identifiable Information | First Amendment Information
- MA-6(2): Timely Maintenance | Predictive Maintenance
- SC-7(24): Boundary Protection | Personally Identifiable Information
- AU-11: Audit Record Retention
- PM-26: Complaint Management
- AC-6(2): Least Privilege | Non-privileged Access for Nonsecurity Functions
- SA-18(1): Tamper Resistance and Detection | Multiple Phases of System Development Life Cycle
- SC-13(2): Cryptographic Protection | NSA-approved Cryptography
- CM-5(1): Access Restrictions for Change | Automated Access Enforcement and Audit Records
- SC-7(18): Boundary Protection | Fail Secure
- CA-4: Security Certification
- AC-4(6): Information Flow Enforcement | Metadata
- AC-9(2): Previous Logon Notification | Successful and Unsuccessful Logons
- SC-37: Out-of-band Channels
- SC-16(1): Transmission of Security and Privacy Attributes | Integrity Verification
- CP-8(2): Telecommunications Services | Single Points of Failure
- SC-17: Public Key Infrastructure Certificates
- CM-11(2): User-installed Software | Software Installation with Privileged Status
- PT-3(2): Personally Identifiable Information Processing Purposes | Automation
- AC-12(2): Session Termination | Termination Message
- IA-10: Adaptive Authentication
- CA-7(6): Continuous Monitoring | Automation Support for Monitoring
- IR-4(13): Incident Handling | Behavior Analysis
- AC-17(7): Remote Access | Additional Protection for Security Function Access
- AC-4(32): Information Flow Enforcement | Process Requirements for Information Transfer
- AU-11(1): Audit Record Retention | Long-term Retrieval Capability
- CM-8(3): System Component Inventory | Automated Unauthorized Component Detection
- SC-16: Transmission of Security and Privacy Attributes
- SA-12(14): Supply Chain Protection | Identity and Traceability
- MA-3(2): Maintenance Tools | Inspect Media
- SC-51: Hardware-based Protection
- SI-11: Error Handling
- SI-4(18): System Monitoring | Analyze Traffic and Covert Exfiltration
- AC-2: Account Management
- PE-13(4): Fire Protection | Inspections
- SC-7(14): Boundary Protection | Protect Against Unauthorized Physical Connections
- PS-9: Position Descriptions
- IA-4(6): Identifier Management | Cross-organization Management
- PE-2: Physical Access Authorizations
- SC-8(2): Transmission Confidentiality and Integrity | Pre- and Post-transmission Handling
- CP-4(2): Contingency Plan Testing | Alternate Processing Site
- SA-9: External System Services
- PE-18(1): Location of System Components | Facility Site
- PS-1: Policy and Procedures
- SA-19(4): Component Authenticity | Anti-counterfeit Scanning
- PE-17: Alternate Work Site
- SI-2(6): Flaw Remediation | Removal of Previous Versions of Software and Firmware
- IA-5(15): Authenticator Management | GSA-approved Products and Services
- SA-9(4): External System Services | Consistent Interests of Consumers and Providers
- AU-16(1): Cross-organizational Audit Logging | Identity Preservation
- IA-1: Policy and Procedures
- CP-6(1): Alternate Storage Site | Separation from Primary Site
- SI-4(10): System Monitoring | Visibility of Encrypted Communications
- IA-5(12): Authenticator Management | Biometric Authentication Performance
- SA-8(1): Security and Privacy Engineering Principles | Clear Abstractions
- CP-10(1): System Recovery and Reconstitution | Contingency Plan Testing
- SC-8(4): Transmission Confidentiality and Integrity | Conceal or Randomize Communications
- AC-4(20): Information Flow Enforcement | Approved Solutions
- AC-16(9): Security and Privacy Attributes | Attribute Reassignment — Regrading Mechanisms
- SC-32: System Partitioning
- CP-9: System Backup
- AC-7(4): Unsuccessful Logon Attempts | Use of Alternate Authentication Factor
- SA-8(22): Security and Privacy Engineering Principles | Accountability and Traceability
- CP-12: Safe Mode
- AC-17(2): Remote Access | Protection of Confidentiality and Integrity Using Encryption
- SI-19: De-identification
- SC-15(4): Collaborative Computing Devices and Applications | Explicitly Indicate Current Participants
- SA-4(11): Acquisition Process | System of Records
- SA-8(33): Security and Privacy Engineering Principles | Minimization
- CM-11(1): User-installed Software | Alerts for Unauthorized Installations
- SC-7(25): Boundary Protection | Unclassified National Security System Connections
- SC-34: Non-modifiable Executable Programs
- SI-7(14): Software, Firmware, and Information Integrity | Binary or Machine Executable Code
- PE-9(1): Power Equipment and Cabling | Redundant Cabling
- RA-3: Risk Assessment
- SC-45: System Time Synchronization
- PE-5: Access Control for Output Devices
- SC-43: Usage Restrictions
- IA-8(3): Identification and Authentication (non-organizational Users) | Use of FICAM-approved Products
- AC-4(14): Information Flow Enforcement | Security or Privacy Policy Filter Constraints
- CA-2(3): Control Assessments | Leveraging Results from External Organizations
- SC-34(2): Non-modifiable Executable Programs | Integrity Protection on Read-only Media
- SA-15(10): Development Process, Standards, and Tools | Incident Response Plan
- MA-5(5): Maintenance Personnel | Non-system Maintenance
- AC-21(1): Information Sharing | Automated Decision Support
- SC-15(2): Collaborative Computing Devices and Applications | Blocking Inbound and Outbound Communications Traffic
- CP-7(5): Alternate Processing Site | Equivalent Information Security Safeguards
- PT-6(1): System of Records Notice | Routine Uses
- CP-4(5): Contingency Plan Testing | Self-challenge
- IA-3(1): Device Identification and Authentication | Cryptographic Bidirectional Authentication
- AC-15: Automated Marking
- SA-12: Supply Chain Protection
- SI-19(4): De-identification | Removal, Masking, Encryption, Hashing, or Replacement of Direct Identifiers
- IR-3: Incident Response Testing
- SC-20(1): Secure Name/address Resolution Service (authoritative Source) | Child Subspaces
- AU-6(2): Audit Record Review, Analysis, and Reporting | Automated Security Alerts
- IA-2: Identification and Authentication (organizational Users)
- SC-48: Sensor Relocation
- IA-12(6): Identity Proofing | Accept Externally-proofed Identities
- PM-30(1): Supply Chain Risk Management Strategy | Suppliers of Critical or Mission-essential Items
- AC-2(11): Account Management | Usage Conditions
- PM-20: Dissemination of Privacy Program Information
- SC-13(1): Cryptographic Protection | FIPS-validated Cryptography
- CP-9(4): System Backup | Protection from Unauthorized Modification
- SI-14(1): Non-persistence | Refresh from Trusted Sources
- SC-5(3): Denial-of-service Protection | Detection and Monitoring
- IA-5(1): Authenticator Management | Password-based Authentication
- SC-18: Mobile Code
- SA-8(3): Security and Privacy Engineering Principles | Modularity and Layering
- CA-3(2): Information Exchange | Classified National Security System Connections
- RA-3(4): Risk Assessment | Predictive Cyber Analytics
- AC-16(10): Security and Privacy Attributes | Attribute Configuration by Authorized Individuals
- AC-4(22): Information Flow Enforcement | Access Only
- SI-6(3): Security and Privacy Function Verification | Report Verification Results
- SC-36(2): Distributed Processing and Storage | Synchronization
- SI-4(9): System Monitoring | Testing of Monitoring Tools and Mechanisms
- PS-3(3): Personnel Screening | Information Requiring Special Protective Measures
- SI-3(2): Malicious Code Protection | Automatic Updates
- AC-11(1): Device Lock | Pattern-hiding Displays
- SC-26(1): Decoys | Detection of Malicious Code
- AU-9(6): Protection of Audit Information | Read-only Access
- SA-21(1): Developer Screening | Validation of Screening
- SC-27: Platform-independent Applications
- AU-14(3): Session Audit | Remote Viewing and Listening
- SC-22: Architecture and Provisioning for Name/address Resolution Service
- SA-8(13): Security and Privacy Engineering Principles | Minimized Security Elements
- IR-9: Information Spillage Response
- MP-8(2): Media Downgrading | Equipment Testing
- PT-8: Computer Matching Requirements
- SA-8(17): Security and Privacy Engineering Principles | Secure Distributed Composition
- RA-2(1): Security Categorization | Impact-level Prioritization
- IA-2(12): Identification and Authentication (organizational Users) | Acceptance of PIV Credentials
- IA-2(11): Identification and Authentication (organizational Users) | Remote Access — Separate Device
- CM-8(6): System Component Inventory | Assessed Configurations and Approved Deviations
- CM-2(2): Baseline Configuration | Automation Support for Accuracy and Currency
- PT-7: Specific Categories of Personally Identifiable Information
- SI-2(3): Flaw Remediation | Time to Remediate Flaws and Benchmarks for Corrective Actions
- AC-5: Separation of Duties
- SC-32(1): System Partitioning | Separate Physical Domains for Privileged Functions
- IA-5(6): Authenticator Management | Protection of Authenticators
- PM-7(1): Enterprise Architecture | Offloading
- PM-32: Purposing
- SI-4(3): System Monitoring | Automated Tool and Mechanism Integration
- MA-7: Field Maintenance
- AC-24(2): Access Control Decisions | No User or Process Identity
- AC-4(30): Information Flow Enforcement | Filter Mechanisms Using Multiple Processes
- MP-5(3): Media Transport | Custodians
- MP-4(1): Media Storage | Cryptographic Protection
- SA-8(19): Security and Privacy Engineering Principles | Continuous Protection
- AU-9(7): Protection of Audit Information | Store on Component with Different Operating System
- AU-13: Monitoring for Information Disclosure
- MP-6: Media Sanitization
- MP-6(2): Media Sanitization | Equipment Testing
- IR-4(3): Incident Handling | Continuity of Operations
- IR-6(3): Incident Reporting | Supply Chain Coordination
- PE-3(2): Physical Access Control | Facility and Systems
- CP-7(6): Alternate Processing Site | Inability to Return to Primary Site
- AU-6: Audit Record Review, Analysis, and Reporting
- SI-7(9): Software, Firmware, and Information Integrity | Verify Boot Process
- AC-4(24): Information Flow Enforcement | Internal Normalized Format
- CM-8(8): System Component Inventory | Automated Location Tracking
- AC-17(1): Remote Access | Monitoring and Control
- IR-10: Integrated Information Security Analysis Team
- IA-11: Re-authentication
- AC-22: Publicly Accessible Content
- SC-31(3): Covert Channel Analysis | Measure Bandwidth in Operational Environments
- SC-42(4): Sensor Capability and Data | Notice of Collection
- AT-3: Role-based Training
- AC-6(7): Least Privilege | Review of User Privileges
- SA-17(6): Developer Security and Privacy Architecture and Design | Structure for Testing
- PS-8: Personnel Sanctions
- PM-29: Risk Management Program Leadership Roles
- PS-4(1): Personnel Termination | Post-employment Requirements
- SA-19(2): Component Authenticity | Configuration Control for Component Service and Repair
- IR-7: Incident Response Assistance
- SC-7: Boundary Protection
- SA-11(4): Developer Testing and Evaluation | Manual Code Reviews
- IA-4(9): Identifier Management | Attribute Maintenance and Protection
- CP-9(7): System Backup | Dual Authorization for Deletion or Destruction
- PS-5: Personnel Transfer
- SI-14(2): Non-persistence | Non-persistent Information
- SA-12(11): Supply Chain Protection | Penetration Testing / Analysis of Elements, Processes, and Actors
- RA-3(2): Risk Assessment | Use of All-source Intelligence
- CM-2(7): Baseline Configuration | Configure Systems and Components for High-risk Areas
- CM-4: Impact Analyses
- SC-7(7): Boundary Protection | Split Tunneling for Remote Devices
- SC-12: Cryptographic Key Establishment and Management
- SA-9(6): External System Services | Organization-controlled Cryptographic Keys
- AC-24(1): Access Control Decisions | Transmit Access Authorization Information
- AC-19(3): Access Control for Mobile Devices | Use of Portable Storage Devices with No Identifiable Owner
- SC-18(3): Mobile Code | Prevent Downloading and Execution
- SA-9(2): External System Services | Identification of Functions, Ports, Protocols, and Services
- PT-5: Privacy Notice
- MA-4(6): Nonlocal Maintenance | Cryptographic Protection
- SI-12(3): Information Management and Retention | Information Disposal
- PM-23: Data Governance Body
- PE-3(1): Physical Access Control | System Access
- SC-7(19): Boundary Protection | Block Communication from Non-organizationally Configured Hosts
- CP-2(5): Contingency Plan | Continue Mission and Business Functions
- AC-14: Permitted Actions Without Identification or Authentication
- PM-1: Information Security Program Plan
- SC-39: Process Isolation
- PE-14(2): Environmental Controls | Monitoring with Alarms and Notifications
- CM-9: Configuration Management Plan
- SC-36(1): Distributed Processing and Storage | Polling Techniques
- SC-8: Transmission Confidentiality and Integrity
- SR-4(2): Provenance | Track and Trace
- PM-20(1): Dissemination of Privacy Program Information | Privacy Policies on Websites, Applications, and Digital Services
- AC-14(1): Permitted Actions Without Identification or Authentication | Necessary Uses
- IR-3(2): Incident Response Testing | Coordination with Related Plans
- SA-17(2): Developer Security and Privacy Architecture and Design | Security-relevant Components
- AC-2(10): Account Management | Shared and Group Account Credential Change
- MA-3(1): Maintenance Tools | Inspect Tools
- SC-40(3): Wireless Link Protection | Imitative or Manipulative Communications Deception
- SI-13(1): Predictable Failure Prevention | Transferring Component Responsibilities
- CA-8(2): Penetration Testing | Red Team Exercises
- SR-3(2): Supply Chain Controls and Processes | Limitation of Harm
- AC-4(4): Information Flow Enforcement | Flow Control of Encrypted Information
- CM-2: Baseline Configuration
- IR-4(12): Incident Handling | Malicious Code and Forensic Analysis
- SA-5(4): System Documentation | Low-level Design
- CA-3(1): Information Exchange | Unclassified National Security System Connections
- PM-5: System Inventory
- AC-9: Previous Logon Notification
- CM-10: Software Usage Restrictions
- PE-14(1): Environmental Controls | Automatic Controls
- AC-2(13): Account Management | Disable Accounts for High-risk Individuals
- PT-3(1): Personally Identifiable Information Processing Purposes | Data Tagging
- PE-13(2): Fire Protection | Suppression Systems — Automatic Activation and Notification
- CM-8: System Component Inventory
- CP-8(1): Telecommunications Services | Priority of Service Provisions
- SI-14: Non-persistence
- SC-23(4): Session Authenticity | Unique Session Identifiers with Randomization
- IR-9(4): Information Spillage Response | Exposure to Unauthorized Personnel
- IA-5(4): Authenticator Management | Automated Support for Password Strength Determination
- PE-5(3): Access Control for Output Devices | Marking Output Devices
- CM-1: Policy and Procedures
- PT-5(2): Privacy Notice | Privacy Act Statements
- CP-7(3): Alternate Processing Site | Priority of Service
- MP-6(7): Media Sanitization | Dual Authorization
- AU-10(4): Non-repudiation | Validate Binding of Information Reviewer Identity
- SC-7(29): Boundary Protection | Separate Subnets to Isolate Functions
- PL-1: Policy and Procedures
- IA-3(3): Device Identification and Authentication | Dynamic Address Allocation
- SI-3: Malicious Code Protection
- MP-5(2): Media Transport | Documentation of Activities
- IA-7: Cryptographic Module Authentication
- SA-19: Component Authenticity
- SA-22: Unsupported System Components
- AU-9(4): Protection of Audit Information | Access by Subset of Privileged Users
- AC-3(9): Access Enforcement | Controlled Release
- CA-7(2): Continuous Monitoring | Types of Assessments
- SA-5(5): System Documentation | Source Code
- SI-7(5): Software, Firmware, and Information Integrity | Automated Response to Integrity Violations
- AT-2(6): Literacy Training and Awareness | Cyber Threat Environment
- SR-5(2): Acquisition Strategies, Tools, and Methods | Assessments Prior to Selection, Acceptance, Modification, or Update
- SC-39(2): Process Isolation | Separate Execution Domain Per Thread
- AU-9(5): Protection of Audit Information | Dual Authorization
- CM-11(3): User-installed Software | Automated Enforcement and Monitoring
- AU-6(8): Audit Record Review, Analysis, and Reporting | Full Text Analysis of Privileged Commands
- SI-7: Software, Firmware, and Information Integrity
- SA-9(5): External System Services | Processing, Storage, and Service Location
- IA-2(9): Identification and Authentication (organizational Users) | Network Access to Non-privileged Accounts — Replay Resistant
- CM-11: User-installed Software
- MP-2: Media Access
- AC-3(7): Access Enforcement | Role-based Access Control
- SI-18(3): Personally Identifiable Information Quality Operations | Collection
- SI-22: Information Diversity
- PE-5(1): Access Control for Output Devices | Access to Output by Authorized Individuals
- SA-4(4): Acquisition Process | Assignment of Components to Systems
- SC-30: Concealment and Misdirection
- PT-6: System of Records Notice
- PT-3: Personally Identifiable Information Processing Purposes
- MA-4(4): Nonlocal Maintenance | Authentication and Separation of Maintenance Sessions
- SC-12(1): Cryptographic Key Establishment and Management | Availability
- PE-5(2): Access Control for Output Devices | Link to Individual Identity
- CP-7(4): Alternate Processing Site | Preparation for Use
- SI-23: Information Fragmentation
- SC-7(2): Boundary Protection | Public Access
- SA-15(1): Development Process, Standards, and Tools | Quality Metrics
- SA-11(3): Developer Testing and Evaluation | Independent Verification of Assessment Plans and Evidence
- AC-4(23): Information Flow Enforcement | Modify Non-releasable Information
- SI-4(1): System Monitoring | System-wide Intrusion Detection System
- CM-12(1): Information Location | Automated Tools to Support Information Location
- SI-2(4): Flaw Remediation | Automated Patch Management Tools
- SC-38: Operations Security
- AU-5(1): Response to Audit Logging Process Failures | Storage Capacity Warning
- AC-2(5): Account Management | Inactivity Logout
- PL-4: Rules of Behavior
- SC-13(3): Cryptographic Protection | Individuals Without Formal Access Approvals
- SA-11(2): Developer Testing and Evaluation | Threat Modeling and Vulnerability Analyses
- SI-13(5): Predictable Failure Prevention | Failover Capability
- IA-2(6): Identification and Authentication (organizational Users) | Access to Accounts —separate Device
- PT-5(1): Privacy Notice | Just-in-time Notice
- SC-29(1): Heterogeneity | Virtualization Techniques
- AC-4(19): Information Flow Enforcement | Validation of Metadata
- AC-3(3): Access Enforcement | Mandatory Access Control
- PE-3(3): Physical Access Control | Continuous Guards
- SC-39(1): Process Isolation | Hardware Separation
- SC-12(3): Cryptographic Key Establishment and Management | Asymmetric Keys
- PT-7(1): Specific Categories of Personally Identifiable Information | Social Security Numbers
- PL-2(1): System Security and Privacy Plans | Concept of Operations
- SA-12(10): Supply Chain Protection | Validate as Genuine and Not Altered
- SA-15(4): Development Process, Standards, and Tools | Threat Modeling and Vulnerability Analysis
- AT-2: Literacy Training and Awareness
- SR-3(1): Supply Chain Controls and Processes | Diverse Supply Base
- SI-4(14): System Monitoring | Wireless Intrusion Detection
- PS-2: Position Risk Designation
- CP-6(3): Alternate Storage Site | Accessibility
- SI-4(24): System Monitoring | Indicators of Compromise
- AC-18(1): Wireless Access | Authentication and Encryption
- SI-10(1): Information Input Validation | Manual Override Capability
- AU-3: Content of Audit Records
- SI-7(2): Software, Firmware, and Information Integrity | Automated Notifications of Integrity Violations
- SI-13(3): Predictable Failure Prevention | Manual Transfer Between Components
- MA-2(2): Controlled Maintenance | Automated Maintenance Activities
- SI-7(17): Software, Firmware, and Information Integrity | Runtime Application Self-protection
- SA-1: Policy and Procedures
- IA-5(2): Authenticator Management | Public Key-based Authentication
- SC-8(5): Transmission Confidentiality and Integrity | Protected Distribution System
- SC-12(2): Cryptographic Key Establishment and Management | Symmetric Keys
- AU-9(1): Protection of Audit Information | Hardware Write-once Media
- PE-3(6): Physical Access Control | Facility Penetration Testing
- CP-4(3): Contingency Plan Testing | Automated Testing
- IA-12(1): Identity Proofing | Supervisor Authorization
- SI-7(3): Software, Firmware, and Information Integrity | Centrally Managed Integrity Tools
- AC-11: Device Lock
- CM-7(9): Least Functionality | Prohibiting The Use of Unauthorized Hardware
- SC-18(4): Mobile Code | Prevent Automatic Execution
- SA-8(5): Security and Privacy Engineering Principles | Efficiently Mediated Access
- PT-4(2): Consent | Just-in-time Consent
- SI-4(25): System Monitoring | Optimize Network Traffic Analysis
- SC-21: Secure Name/address Resolution Service (recursive or Caching Resolver)
- SC-41: Port and I/O Device Access
- SI-3(5): Malicious Code Protection | Portable Storage Devices
- AC-17(10): Remote Access | Authenticate Remote Commands
- AC-4(27): Information Flow Enforcement | Redundant/independent Filtering Mechanisms
- CM-5(2): Access Restrictions for Change | Review System Changes
- AU-15: Alternate Audit Logging Capability
- SI-3(7): Malicious Code Protection | Nonsignature-based Detection
- AC-25: Reference Monitor
- SC-8(3): Transmission Confidentiality and Integrity | Cryptographic Protection for Message Externals
- SI-4(7): System Monitoring | Automated Response to Suspicious Events
- PE-3(8): Physical Access Control | Access Control Vestibules
- CP-9(5): System Backup | Transfer to Alternate Storage Site
- PS-4: Personnel Termination
- SC-7(12): Boundary Protection | Host-based Protection
- SI-1: Policy and Procedures
- SI-2(1): Flaw Remediation | Central Management
- SI-5(1): Security Alerts, Advisories, and Directives | Automated Alerts and Advisories
- AC-9(1): Previous Logon Notification | Unsuccessful Logons
- PL-8(1): Security and Privacy Architectures | Defense in Depth
- SA-8(30): Security and Privacy Engineering Principles | Procedural Rigor
- SC-7(8): Boundary Protection | Route Traffic to Authenticated Proxy Servers
- PT-1: Policy and Procedures
- PM-25: Minimization of Personally Identifiable Information Used in Testing, Training, and Research
- CM-8(7): System Component Inventory | Centralized Repository
- PM-15: Security and Privacy Groups and Associations
- CM-3(2): Configuration Change Control | Testing, Validation, and Documentation of Changes
- CM-8(9): System Component Inventory | Assignment of Components to Systems
- IR-4(15): Incident Handling | Public Relations and Reputation Repair
- MP-2(2): Media Access | Cryptographic Protection
- CM-7(1): Least Functionality | Periodic Review
- IR-6(1): Incident Reporting | Automated Reporting
- IR-9(2): Information Spillage Response | Training
- RA-5(8): Vulnerability Monitoring and Scanning | Review Historic Audit Logs
- AT-3(2): Role-based Training | Physical Security Controls
- CP-10(2): System Recovery and Reconstitution | Transaction Recovery
- SA-3(2): System Development Life Cycle | Use of Live or Operational Data
- SC-10: Network Disconnect
- IA-3: Device Identification and Authentication
- AC-2(6): Account Management | Dynamic Privilege Management
- SI-4(17): System Monitoring | Integrated Situational Awareness
- CA-6: Authorization
- AU-5(3): Response to Audit Logging Process Failures | Configurable Traffic Volume Thresholds
- MP-5(1): Media Transport | Protection Outside of Controlled Areas
- SC-20(2): Secure Name/address Resolution Service (authoritative Source) | Data Origin and Integrity
- IA-2(5): Identification and Authentication (organizational Users) | Individual Authentication with Group Authentication
- CP-10(5): System Recovery and Reconstitution | Failover Capability
- CM-7: Least Functionality
- CM-3(3): Configuration Change Control | Automated Change Implementation
- SA-10(6): Developer Configuration Management | Trusted Distribution
- SA-19(1): Component Authenticity | Anti-counterfeit Training
- MA-3(3): Maintenance Tools | Prevent Unauthorized Removal
- IA-12(3): Identity Proofing | Identity Evidence Validation and Verification
- SC-42(2): Sensor Capability and Data | Authorized Use
- CM-3(1): Configuration Change Control | Automated Documentation, Notification, and Prohibition of Changes
- RA-5(1): Vulnerability Monitoring and Scanning | Update Tool Capability
- AC-2(3): Account Management | Disable Accounts
- PL-11: Baseline Tailoring
- CP-8(5): Telecommunications Services | Alternate Telecommunication Service Testing
- SR-6(1): Supplier Assessments and Reviews | Testing and Analysis
- AU-2(4): Event Logging | Privileged Functions
- MP-4: Media Storage
- MP-6(4): Media Sanitization | Controlled Unclassified Information
- SC-6: Resource Availability
- AU-8(1): Time Stamps | Synchronization with Authoritative Time Source
- CM-4(2): Impact Analyses | Verification of Controls
- SC-3: Security Function Isolation
- IA-5(17): Authenticator Management | Presentation Attack Detection for Biometric Authenticators
- AC-12(3): Session Termination | Timeout Warning Message
- MA-4(1): Nonlocal Maintenance | Logging and Review
- AC-3(4): Access Enforcement | Discretionary Access Control
- MP-6(8): Media Sanitization | Remote Purging or Wiping of Information
- AU-13(3): Monitoring for Information Disclosure | Unauthorized Replication of Information
- CA-8(3): Penetration Testing | Facility Penetration Testing
- AU-6(7): Audit Record Review, Analysis, and Reporting | Permitted Actions
- AU-2(1): Event Logging | Compilation of Audit Records from Multiple Sources
- PS-6(1): Access Agreements | Information Requiring Special Protection
- AU-8: Time Stamps
- SR-12: Component Disposal
- SI-6: Security and Privacy Function Verification
- SR-9(1): Tamper Resistance and Detection | Multiple Stages of System Development Life Cycle
- IA-5(8): Authenticator Management | Multiple System Accounts
- SC-21(1): Secure Name/address Resolution Service (recursive or Caching Resolver) | Data Origin and Integrity
- AT-3(5): Role-based Training | Processing Personally Identifiable Information
- AU-8(2): Time Stamps | Secondary Authoritative Time Source
- CA-7(3): Continuous Monitoring | Trend Analyses
- SA-11(6): Developer Testing and Evaluation | Attack Surface Reviews
- SA-8(11): Security and Privacy Engineering Principles | Inverse Modification Threshold
- SI-10(6): Information Input Validation | Injection Prevention
- AC-19: Access Control for Mobile Devices
- AC-3: Access Enforcement
- SI-13: Predictable Failure Prevention
- AU-5(2): Response to Audit Logging Process Failures | Real-time Alerts
- SA-15(12): Development Process, Standards, and Tools | Minimize Personally Identifiable Information
- SA-8(14): Security and Privacy Engineering Principles | Least Privilege
- AU-13(2): Monitoring for Information Disclosure | Review of Monitored Sites
- AC-12: Session Termination
- SC-40(4): Wireless Link Protection | Signal Parameter Identification
- RA-10: Threat Hunting
- PM-22: Personally Identifiable Information Quality Management
- IR-4(5): Incident Handling | Automatic Disabling of System
- SC-7(15): Boundary Protection | Networked Privileged Accesses
- AC-2(8): Account Management | Dynamic Account Management
- AU-6(4): Audit Record Review, Analysis, and Reporting | Central Review and Analysis
- CP-10(4): System Recovery and Reconstitution | Restore Within Time Period
- SA-15(5): Development Process, Standards, and Tools | Attack Surface Reduction
- SI-6(1): Security and Privacy Function Verification | Notification of Failed Security Tests
- AC-20(4): Use of External Systems | Network Accessible Storage Devices — Prohibited Use
- PM-6: Measures of Performance
- RA-1: Policy and Procedures
- AC-8: System Use Notification
- PM-27: Privacy Reporting
- AC-6(10): Least Privilege | Prohibit Non-privileged Users from Executing Privileged Functions
- CA-2(2): Control Assessments | Specialized Assessments
- SR-7: Supply Chain Operations Security
- IA-2(1): Identification and Authentication (organizational Users) | Multi-factor Authentication to Privileged Accounts
- SA-12(8): Supply Chain Protection | Use of All-source Intelligence
- PS-6: Access Agreements
- MA-6: Timely Maintenance
- CM-7(7): Least Functionality | Code Execution in Protected Environments
- AT-2(1): Literacy Training and Awareness | Practical Exercises
- SC-7(21): Boundary Protection | Isolation of System Components
- AC-6(5): Least Privilege | Privileged Accounts
- SC-30(1): Concealment and Misdirection | Virtualization Techniques
- IA-2(3): Identification and Authentication (organizational Users) | Local Access to Privileged Accounts
- SI-12: Information Management and Retention
- SC-9: Transmission Confidentiality
- RA-3(3): Risk Assessment | Dynamic Threat Awareness
- SC-7.b : Content inspection
- CM-2(4): Baseline Configuration | Unauthorized Software
- SI-3(9): Malicious Code Protection | Authenticate Remote Commands
- IA-9(2): Service Identification and Authentication | Transmission of Decisions
- AC-2(1): Account Management | Automated System Account Management
- SC-2(2): Separation of System and User Functionality | Disassociability
- SA-10(4): Developer Configuration Management | Trusted Generation
- IR-7(1): Incident Response Assistance | Automation Support for Availability of Information and Support
- SC-25: Thin Nodes
- AC-4(11): Information Flow Enforcement | Configuration of Security or Privacy Policy Filters
- PM-11: Mission and Business Process Definition
- SA-15(11): Development Process, Standards, and Tools | Archive System or Component
- MA-6(1): Timely Maintenance | Preventive Maintenance
- IR-8(1): Incident Response Plan | Breaches
- AC-4: Information Flow Enforcement
- SI-12(1): Information Management and Retention | Limit Personally Identifiable Information Elements
- RA-5(9): Vulnerability Monitoring and Scanning | Penetration Testing and Analyses
- SI-3(4): Malicious Code Protection | Updates Only by Privileged Users
- SC-11: Trusted Path
- IA-5(13): Authenticator Management | Expiration of Cached Authenticators
- CA-2: Control Assessments
- SR-1: Policy and Procedures
- PM-16: Threat Awareness Program
- SC-28(3): Protection of Information at Rest | Cryptographic Keys
- CP-3(2): Contingency Training | Mechanisms Used in Training Environments
- AC-6(6): Least Privilege | Privileged Access by Non-organizational Users
- RA-5(4): Vulnerability Monitoring and Scanning | Discoverable Information
- PE-16: Delivery and Removal
- SI-17: Fail-safe Procedures
- SC-30(3): Concealment and Misdirection | Change Processing and Storage Locations
- SI-7(6): Software, Firmware, and Information Integrity | Cryptographic Protection
- SI-10(5): Information Input Validation | Restrict Inputs to Trusted Sources and Approved Formats
- PM-16(1): Threat Awareness Program | Automated Means for Sharing Threat Intelligence
- PM-2: Information Security Program Leadership Role
- CM-5(4): Access Restrictions for Change | Dual Authorization
- IR-7(2): Incident Response Assistance | Coordination with External Providers
- AU-5(4): Response to Audit Logging Process Failures | Shutdown on Failure
- SA-12(4): Supply Chain Protection | Diversity of Suppliers
- PS-3: Personnel Screening
- AU-7(1): Audit Record Reduction and Report Generation | Automatic Processing
- CP-2(7): Contingency Plan | Coordinate with External Service Providers
- SA-8(24): Security and Privacy Engineering Principles | Secure Failure and Recovery
- SI-4(6): System Monitoring | Restrict Non-privileged Users
- AC-4(16): Information Flow Enforcement | Information Transfers on Interconnected Systems
- IA-3(2): Device Identification and Authentication | Cryptographic Bidirectional Network Authentication
- CP-7(2): Alternate Processing Site | Accessibility
- AU-3(1): Content of Audit Records | Additional Audit Information
- AC-18(3): Wireless Access | Disable Wireless Networking
- SC-4(2): Information in Shared System Resources | Multilevel or Periods Processing
- AC-16(7): Security and Privacy Attributes | Consistent Attribute Interpretation
- SC-42(1): Sensor Capability and Data | Reporting to Authorized Individuals or Roles
- AC-16: Security and Privacy Attributes
- SA-14: Criticality Analysis
- SA-4(5): Acquisition Process | System, Component, and Service Configurations
- SA-12(3): Supply Chain Protection | Trusted Shipping and Warehousing
- PE-8(2): Visitor Access Records | Physical Access Records
- SA-17(3): Developer Security and Privacy Architecture and Design | Formal Correspondence
- CM-6(1): Configuration Settings | Automated Management, Application, and Verification
- PM-9: Risk Management Strategy
- SI-19(1): De-identification | Collection
- IA-4: Identifier Management
- AC-20: Use of External Systems
- MP-6(6): Media Sanitization | Media Destruction
- SC-40(1): Wireless Link Protection | Electromagnetic Interference
- CM-3(7): Configuration Change Control | Review System Changes
- PE-14: Environmental Controls
- SC-24: Fail in Known State
- AC-4(25): Information Flow Enforcement | Data Sanitization
- SA-17(7): Developer Security and Privacy Architecture and Design | Structure for Least Privilege
- SI-18: Personally Identifiable Information Quality Operations
- CP-8: Telecommunications Services
- CM-4(1): Impact Analyses | Separate Test Environments
- SI-3(1): Malicious Code Protection | Central Management
- IR-4(11): Incident Handling | Integrated Incident Response Team
- SC-45(2): System Time Synchronization | Secondary Authoritative Time Source
- CM-7(8): Least Functionality | Binary or Machine Executable Code
- SA-8(27): Security and Privacy Engineering Principles | Human Factored Security
- CP-2: Contingency Plan
- CM-3: Configuration Change Control
- RA-5(3): Vulnerability Monitoring and Scanning | Breadth and Depth of Coverage
- SC-49: Hardware-enforced Separation and Policy Enforcement
- SR-4(3): Provenance | Validate as Genuine and Not Altered
- AU-10(1): Non-repudiation | Association of Identities
- AT-3(3): Role-based Training | Practical Exercises
- SC-7(16): Boundary Protection | Prevent Discovery of System Components
- CP-3(1): Contingency Training | Simulated Events
- AU-1: Policy and Procedures
- SA-13: Trustworthiness
- CA-7: Continuous Monitoring
- CM-13: Data Action Mapping
- CP-13: Alternative Security Mechanisms
- CP-9(6): System Backup | Redundant Secondary System
- SA-5(3): System Documentation | High-level Design
- SA-17(8): Developer Security and Privacy Architecture and Design | Orchestration
- AU-7(2): Audit Record Reduction and Report Generation | Automatic Sort and Search
- SC-7(4): Boundary Protection | External Telecommunications Services
-
-
-
-
-
- 2. Patterns
- API inbound security pattern
- Outbound web security pattern
- 1. Security building blocks
- 0. Background