NIST public full text Public Domain

NIST SP 800-53Ar5: Assessing Security and Privacy Controls in Information Systems and Organizations

Joint Task Force · National Institute of Standards and Technology (NIST)

NIST · Standards · License: Public Domain

access-control computer-security cryptography cybersecurity identity incident-response nist privacy

Conceptio Open Archive

Analyze & explore related research in Conceptio

Connect this record directly into your research workflow or AI agent. Explore citations across open repositories, query full text, and export structured proof bundles.

Explore in Search →Connect via MCP / API ↗

NIST Special Publication 800-53A Revision 5

Assessing Security and Privacy Controls in Information Systems and Organizations

JOINT TASK FORCE

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53Ar5

NIST Special Publication 800-53A Revision 5

Assessing Security and Privacy Controls in Information Systems and Organizations JOINT TASK FORCE

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53Ar5

January 2022

U.S. Department of Commerce Gina M. Raimondo, Secretary

National Institute of Standards and Technology James K. Olthoff, Performing the Non-Exclusive Functions and Duties of the Under Secretary of Commerce for Standards and Technology & Director, National Institute of Standards and Technology

Authority This publication has been developed by NIST to further its statutory responsibilities under the Federal Information Security Modernization Act (FISMA), 44 U.S.C. § 3551 et seq., Public Law (P.L.) 113-283. NIST is responsible for developing information security standards and guidelines, including minimum requirements for federal information systems. Such information security standards and guidelines shall not apply to national security systems without the express approval of the appropriate federal officials exercising policy authority over such systems. This guideline is consistent with the requirements of the Office of Management and Budget (OMB) Circular A-130. Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on federal agencies by the Secretary of Commerce under statutory authority. Nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, OMB Director, or any other federal official. This publication may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright in the United States. Attribution would, however, be appreciated by NIST. National Institute of Standards and Technology Special Publication 800-53A Revision 5 Natl. Inst. Stand. Technol. Spec. Publ. 800-53A, Rev. 5, 733 pages (January 2022) CODEN: NSPUE2 This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53Ar5 Certain commercial entities, equipment, or materials may be identified in this document to describe an experimental procedure or concept adequately. Such identification is not intended to imply recommendation or endorsement by NIST, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts, practices, and methodologies may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST. Organizations are encouraged to review draft publications during the designated public comment periods and provide feedback to NIST. Many NIST publications, other than the ones noted above, are available at https://csrc.nist.gov/publications.

Submit comments on this publication to: sec-cert@nist.gov National Institute of Standards and Technology Attn: Computer Security Division, Information Technology Laboratory 100 Bureau Drive (Mail Stop 8930) Gaithersburg, MD 20899-8930

All comments are subject to release under the Freedom of Information Act (FOIA) [FOIA96].

NIST SP 800-53A REV. 5 ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS _________________________________________________________________________________________________

Reports on Computer Systems Technology

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53Ar5

The National Institute of Standards and Technology (NIST) Information Technology Laboratory (ITL) promotes the U.S. economy and public welfare by providing technical leadership for the Nation’s measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology (IT). ITL’s responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the costeffective security of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL’s research, guidelines, and outreach efforts in information systems security and privacy and its collaborative activities with industry, government, and academic organizations.

Abstract This publication provides a methodology and set of procedures for conducting assessments of security and privacy controls employed within systems and organizations within an effective risk management framework. The assessment procedures, executed at various phases of the system development life cycle, are consistent with the security and privacy controls in NIST Special Publication 800-53, Revision 5. The procedures are customizable and can be easily tailored to provide organizations with the needed flexibility to conduct security and privacy control assessments that support organizational risk management processes and are aligned with the stated risk tolerance of the organization. Information on building effective security and privacy assessment plans is also provided with guidance on analyzing assessment results.

Keywords Assessment; assessment plan; assurance; control assessment; FISMA; Privacy Act; privacy controls; Open Security Controls Assessment Language; OSCAL; privacy requirements; Risk Management Framework; security controls; security requirements.

Acknowledgments This publication was developed by the Joint Task Force Interagency Working Group. The group includes representatives from the civil, defense, and intelligence communities. The National Institute of Standards and Technology wishes to acknowledge and thank the senior leaders from the Department of Commerce, Department of Defense, the Office of the Director of National Intelligence, the Committee on National Security Systems, and the members of the interagency working group whose dedicated efforts contributed significantly to this publication.

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53Ar5

Department of Defense

Office of the Director of National Intelligence

HON. John Sherman Chief Information Officer

Michael E. Waschull Acting Chief Information Officer

Dr. Kelly Fletcher Principal Deputy Chief Information Officer

Michael E. Waschull Deputy Chief Information Officer

David McKeown Deputy CIO for Cybersecurity and DoD CISO

C. Matthew Conner Cybersecurity Group and IC CISO

Mark Hakun Principal Deputy CIO for Cybersecurity

Cheri Benedict Director, Security Coordination Center

Kevin Dulany Director, Cybersecurity Policy and Partnerships

National Institute of Standards and Technology

Committee on National Security Systems

James St. Pierre Acting Director, Information Technology Laboratory (ITL)

Mark G. Hakun Chair

Kevin Stine Cybersecurity Advisor, ITL

Dominic A. Cussatt Co-Chair

Matthew Scholl Chief, Computer Security Division

Kevin Dulany Tri-Chair—Defense Community

Kevin Stine Chief, Applied Cybersecurity Division

Chris Johnson Tri-Chair—Intelligence Community

Victoria Yan Pillitteri Risk Management Framework Project Leader

Vicki Michetti Tri-Chair—Civil Agencies

Joint Task Force (JTF) Working Group Victoria Yan Pillitteri NIST, JTF Leader

Eduardo Takamura NIST

Kelley Dempsey NIST

Ron Ross NIST

McKay Tolboe DoD

Dave Myers Veterans Affairs

Vicki Michetti Veterans Affairs

Naomi Lefkovitz NIST

Andy Rovnak Intelligence Community

Peter Duspiva Intelligence Community

Chris Johnson Intelligence Community

Jessica Dickson NIST

Angela Smith NIST

Jon Boyens NIST

Ned Goren NIST

Kaitlin Boeckl NIST

Katie Isaacson The MITRE Corporation

Randy Gabel The MITRE Corporation

David Black The MITRE Corporation

Pam Miller The MITRE Corporation

iii

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53Ar5

In addition to the above acknowledgments, a special note of thanks goes to Jeff Brewer, Jim Foti, Cristina Ritfeld, Isabel Van Wyk, and the NIST web team for their outstanding administrative support, Chris Enloe for his technical review and insight, and to David Waltermire and Wendell Piez for their contribution to the development of the SP 800-53A assessment tables (both electronic sources, and derivative publications) using Open Security Controls Assessment Language (OSCAL). The authors also wish to recognize the professional staff from the NIST Computer Security Division and Applied Cybersecurity Division, and the representatives from the Federal Chief Information Officer (CIO) Council, Federal Chief Information Security Officer (CISO) Council, and Federal Privacy Council for their ongoing contributions in helping to improve the content of the publication. Finally, the authors gratefully acknowledge the contributions from individuals and organizations in the public and private sectors, both nationally and internationally, whose insightful and constructive comments improved the overall quality, thoroughness, and usefulness of this publication. HISTORICAL CONTRIBUTIONS TO NIST SPECIAL PUBLICATION 800-53A The authors wanted to acknowledge the many individuals who contributed to previous versions of Special Publication 800-53A since its inception in 2005. They include Marshall Abrams, Dennis Bailey, Matt Barrett, Nadya Bartol, Frank Belz, Paul Bicknell, Deb Bodeau, Brett Burley, Bill Burr, Dawn Cappelli, Corinne Castanza, Matt Coose, George Dinolt, Donna Dodson, Randy Easter, Kurt Eleam, Jennifer Fabius, Daniel Faigin, Denise Farrar, Harriett Goldman, Peter Gouldmann, Richard Graubart, Jennifer Guild, Sarbari Gupta, Peggy Himes, Bennett Hodge, Cynthia Irvina, Arnold Johnson, Roger Johnson, Lisa Kaiser, Stu Katzke, Sharon Keller, Cass Kelly, Steve LaFountain, Steve Lipner, Bill MacGregor, Tom Macklin, Tom Madden, Erika McCallister, Tim McChesney, Michael McEvilley, John Mildner, Sandra Miravalle, Joji Montelibano, Doug Montgomery, George Moore, Harvey Newstrom, Robert Niemeyer, LouAnna Notargiacomo, Dorian Pappas, Tim Polk, Esten Porter, Karen Quigg, Steve Quinn, Ed Roback, George Rogers, Scott Rose, Mike Rubin, Karen Scarfone, Roger Schell, Matt Scholl, Murugiah Souppaya, Kevin Stine, Gary Stoneburner, Keith Stouffer, Marianne Swanson, Pat Toth, Glenda Turner, Joe Weiss, Richard Wilsher, Mark Wilson, John Woodward, and Carol Woody.

Document Conventions For the purposes of this document, the term “security and privacy” is universally used since the guidance is applicable to both security and privacy control assessments. For certain systems, however, the guidance may only be relevant for security or privacy. Organizations make their own determinations on when to manage security and privacy control assessments together or separately.

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53Ar5

SP 800-53A provides guidance on assessing controls in information security program plans, privacy program plans, system security plans, and privacy plans. Where the guidance refers to all plans listed above, the term “security and privacy plans” is used. If the guidance is specific to a single type of plan (e.g., system security plan), the specific type of plan is specified.

Supplemental Content The assessment procedures in Chapter 4 are published in multiple data formats, including comma-separated values (CSV), plain text, and Open Security Controls Assessment (OSCAL). The available data formats are accessible from the NIST SP 800-53A Revision 5, publication details page at https://csrc.nist.gov/publications/detail/sp/800-53a/rev-5/final. The OSCAL Content Git Repository is available at https://github.com/usnistgov/oscal-content. The CSV, plain text, and OSCAL formats represent derivative formats of the (normative) assessment procedures in this publication. If there are any discrepancies between the content in derivative formats and this publication, please contact sec-cert@nist.gov.

Patent Disclosure Notice NOTICE: The Information Technology Laboratory (ITL) has requested that holders of patent claims whose use may be required for compliance with the guidance or requirements of this publication disclose such patent claims to ITL. However, holders of patents are not obligated to respond to ITL calls for patents and ITL has not undertaken a patent search in order to identify which, if any, patents may apply to this publication. As of the date of publication and following call(s) for the identification of patent claims whose use may be required for compliance with the guidance or requirements of this publication, no such patent claims have been identified to ITL. No representation is made or implied by ITL that licenses are not required to avoid patent infringement in the use of this publication.

DEVELOPING COMMON INFORMATION SECURITY AND PRIVACY FOUNDATIONS COLLABORATION AMONG PUBLIC AND PRIVATE SECTOR ENTITIES

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53Ar5

In developing standards and guidelines required by [FISMA], NIST consults with other federal agencies and offices as well as private sector entities to improve information security, avoid unnecessary and costly duplication of effort, and ensure that NIST publications complement the standards and guidelines employed for the protection of national security systems. In addition to its comprehensive public review and vetting process, NIST collaborates with the Office of the Director of National Intelligence (ODNI), the Department of Defense (DoD), and the Committee on National Security Systems (CNSS) to establish and maintain a unified framework and common foundation for information security across the Federal Government. A common foundation and framework for information security provides the intelligence, defense, and civilian sectors of the Federal Government and their contractors more uniform and consistent ways to manage risks to organizational operations and assets, individuals, other organizations, and the Nation that result from the operation and use of systems. A common foundation and framework also provides a strong basis for the reciprocal acceptance of security authorization decisions and facilitate information sharing. NIST also works with public and private sector entities to establish and maintain specific mappings and relationships between the security standards and guidelines developed by NIST, the International Organization for Standardization (ISO), and the International Electrotechnical Commission (IEC).

ASSESSMENT PROCEDURE FORMATTING The new format for assessment procedures introduced in Special Publication (SP) 800-53A Revision 4, is further improved in this revision (SP 800-53A Revision 5). The format continues to reflect the decomposition of assessment objectives into more granular determination statements wherever possible, thus providing the capability to identify and assess specific parts of security and privacy controls. Updates to SP 800-53A Revision 5: • This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53Ar5

• • • • •

Identify determination statements for organization-defined parameters (ODPs) first and separately from the determination statements for each control item; Improve the readability of the assessment procedures; Provide a structured schema for automated tools when assessment information is imported into such tools; Provide greater flexibility in conducting assessments by giving organizations the capability to target certain aspects of controls (highlighting the particular weaknesses and/or deficiencies in controls), Improve the efficiency of security and privacy control assessments; Support continuous monitoring and ongoing authorization programs by providing a greater number of component parts of security and privacy controls that can be assessed at organization-defined frequencies and degrees of rigor.

The ability to apply assessment and monitoring resources in a targeted and precise manner and simultaneously maximize the use of automation technologies can result in more timely and cost-effective assessment processes for organizations. Note: NIST [SP 800-53] will be updated accordingly to ensure that the numbering scheme for all security and privacy controls is consistent with the new format introduced in this publication.

vii

Executive Summary

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53Ar5

Security and privacy control assessments are not about checklists, simple pass/fail results, or generating paperwork to pass inspections or audits. Rather, control assessments are the principal vehicle used to verify that selected security and privacy controls are implemented and meeting stated goals and objectives. Special Publication (SP) 800-53A, Assessing Security and Privacy Controls in Information Systems and Organizations, facilitates security control assessments and privacy control assessments conducted within an effective risk management framework. A major design objective for SP 800-53A is to provide an assessment framework and initial starting point for assessment procedures that are flexible enough to meet the needs of different organizations while providing consistency in conducting control assessments. Control assessment results provide organizational officials with: • • •

Evidence of the effectiveness of implemented controls, An indication of the quality of the risk management processes, and Information about the security and privacy strengths and weaknesses of systems that are supporting organizational missions and business functions.

The findings identified by assessors are used to determine the overall effectiveness of security and privacy controls associated with systems and their environments of operation and to provide credible and meaningful inputs to the organization’s risk management process. A wellexecuted assessment helps determine the validity of the controls contained in the organization’s security and privacy plans and subsequently employed in organizational systems and environments of operation. Control assessments facilitate a cost-effective approach to managing risk by identifying weaknesses or deficiencies in systems, thus enabling the organization to determine appropriate risk responses in a disciplined manner that is consistent with organizational mission and business needs. SP 800-53A is a companion guideline to [SP 800-53] Security and Privacy Controls for Systems and Organizations. Each publication provides guidance for implementing specific steps in the Risk Management Framework (RMF). 1 SP 800-53 and [SP 800-53B] address the Select step of the RMF and provide guidance on security and privacy control selection (i.e., determining the controls needed to manage risks to organizational operations and assets, individuals, other organizations, and the Nation). SP 800-53A addresses the Assess and Monitor steps of the RMF and provides guidance on the security and privacy control assessment processes. SP 800-53A also includes guidance on how to build effective assessment plans and how to analyze and manage assessment results. SP 800-53A provides a process that allows organizations to tailor the assessment procedures outlined in the guidance. Tailoring involves customizing the assessment procedures to match the characteristics of the system and its environment of operation more closely. The tailoring process described in this guidance gives organizations the flexibility needed to avoid assessment approaches that are unnecessarily complex or costly while simultaneously meeting the assessment requirements and risk management principles established in the RMF. Tailoring decisions are left to the discretion of the organization to maximize flexibility in developing assessment plans – applying the results of risk assessments to determine the extent, rigor, and level of intensity of the assessments needed to provide sufficient assurance about the security and privacy posture of the system. 1 [SP 800-37], Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach

for Security and Privacy, provides guidance on applying the RMF to systems and organizations.

viii

Table of Contents CHAPTER ONE INTRODUCTION ............................................................................................................... 1 1.1 PURPOSE AND APPLICABILITY .......................................................................................................... 1 1.2 TARGET AUDIENCE ............................................................................................................................ 4 1.3 RELATED PUBLICATIONS AND ASSESSMENT PROCESSES ............................................................... 4 1.4 ORGANIZATION OF THIS PUBLICATION ........................................................................................... 5 CHAPTER TWO THE FUNDAMENTALS ..................................................................................................... 6

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53Ar5

2.1 ASSESSMENTS WITHIN THE SYSTEM DEVELOPMENT LIFE CYCLE .................................................. 6 2.2 CONTROL STRUCTURE AND ORGANIZATION .................................................................................. 7 2.3 BUILDING AN EFFECTIVE ASSURANCE CASE .................................................................................... 8 2.4 ASSESSMENT PROCEDURES: ASSESSMENT OBJECTS, METHODS AND OBJECTIVES ................... 11 CHAPTER THREE THE PROCESS ............................................................................................................. 19 3.1 PREPARE FOR SECURITY AND PRIVACY CONTROL ASSESSMENTS ............................................... 19 3.2 DEVELOP SECURITY AND PRIVACY ASSESSMENT PLANS .............................................................. 23 3.3 CONDUCT SECURITY AND PRIVACY CONTROL ASSESSMENTS ..................................................... 30 3.4 ANALYZE ASSESSMENT REPORT RESULTS ..................................................................................... 32 3.5 ASSESS SECURITY AND PRIVACY CAPABILITIES.............................................................................. 34 CHAPTER FOUR SECURITY AND PRIVACY ASSESSMENT PROCEDURES ................................................. 37 4.1 ACCESS CONTROL............................................................................................................................ 40 4.2 AWARENESS AND TRAINING ........................................................................................................ 118 4.3 AUDIT AND ACCOUNTABILITY ...................................................................................................... 128 4.4 ASSESSMENT, AUTHORIZATION, AND MONITORING ................................................................. 160 4.5 CONFIGURATION MANAGEMENT................................................................................................ 177 4.6 CONTINGENCY PLANNING............................................................................................................ 215 4.7 IDENTIFICATION AND AUTHENTICATION .................................................................................... 243 4.8 INCIDENT RESPONSE ............................................................................................................... 275 4.9 MAINTENANCE ........................................................................................................................ 298 4.10 MEDIA PROTECTION .............................................................................................................. 316 4.11 PHYSICAL AND ENVIRONMENTAL PROTECTION ....................................................................... 330 4.12 PLANNING ............................................................................................................................. 361 4.13 PROGRAM MANAGEMENT .................................................................................................... 372 4.14 PERSONNEL SECURITY ........................................................................................................... 401 4.15 PERSONALLY IDENTIFIABLE INFORMATION PROCESSING AND TRANSPARENCY ................... 412 4.16 RISK ASSESSMENT ................................................................................................................. 426 4.17 SYSTEM AND SERVICES ACQUISITION ....................................................................................... 441 4.18 SYSTEM AND COMMUNICATIONS PROTECTION ...................................................................... 522 4.19 SYSTEM AND INFORMATION INTEGRITY ................................................................................... 599 4.20 SUPPLY CHAIN RISK MANAGEMENT .......................................................................................... 665 REFERENCES ........................................................................................................................................ 684 APPENDIX A GLOSSARY....................................................................................................................... 689 APPENDIX B ACRONYMS ..................................................................................................................... 705 APPENDIX C ASSESSMENT METHOD DESCRIPTIONS........................................................................... 707 APPENDIX D PENETRATION TESTING .................................................................................................. 715 APPENDIX E ASSESSMENT REPORTS ................................................................................................... 718 APPENDIX F ONGOING ASSESSMENT AND AUTOMATION ................................................................. 721

CHAPTER ONE

INTRODUCTION THE NEED TO ASSESS SECURITY AND PRIVACY CONTROL EFFECTIVENESS

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53Ar5

Today’s systems 2 are complex assemblages of technology (i.e., hardware, software, and firmware), processes, and people working together to provide organizations with the capabilities to process, store, and transmit information in a timely manner in support of various mission and business functions. The degree to which organizations have come to depend upon systems to conduct routine, important, and critical mission and business functions means that the protection of the underlying systems and environments of operation is paramount to the success of the organization. The selection of appropriate security and privacy controls for a system is an important task that can have significant implications on the operations and assets of an organization as well as the welfare of individuals. Security controls are the safeguards or countermeasures prescribed for a system or an organization to protect the confidentiality, integrity, and availability of its system and information and to manage information security risk. Privacy controls are the administrative, technical, and physical safeguards employed within a system or an organization to manage privacy risks and ensure compliance with applicable privacy requirements. 3 Once employed within a system, security and privacy controls are assessed to determine their overall effectiveness (i.e., the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting the security and privacy requirements for the system and the organization). Understanding the overall effectiveness of implemented security and privacy controls is essential in determining the risk to the organization’s operations and assets, individuals, other organizations, and the Nation resulting from the use of the system.

1.1 PURPOSE AND APPLICABILITY The purpose of this publication is to provide guidelines for building effective security and privacy assessment plans, as well as a comprehensive set of procedures for assessing the effectiveness of security and privacy controls employed in systems and organizations. The guidelines apply to the security and privacy controls defined in [SP 800-53] (as amended), Security and Privacy Controls for Information Systems and Organizations. The guidelines have been developed to help achieve more secure systems by: • • •

Enabling more consistent, efficient, comparable, and repeatable assessments of security and privacy controls with reproducible results; Promoting a better understanding of the risks to organizational operations, organizational assets, individuals, other organizations, and the Nation resulting from the operation and use of systems; Facilitating more cost-effective assessments of security and privacy controls; and

2 A system is a discrete set of information resources organized expressly for the collection, processing, maintenance,

use, sharing, dissemination, or disposition of information.

3 OMB Circular A-130 [OMB A-130] defines security and privacy controls.

CHAPTER ONE

PAGE 1

•

Creating more complete, reliable, and trustworthy information for organizational officials to support risk management decisions, reciprocity of assessment results, information sharing, and compliance with federal laws, Executive Orders, directives, regulations, and policies.

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53Ar5

This publication satisfies the requirements of Office of Management and Budget (OMB) Circular A-130 [OMB A-130] and the provisions of the Federal Information Security Modernization Act [FISMA]. The security and privacy guidelines in this publication are applicable to federal systems other than those systems designated as national security systems, as defined in 44 U.S.C., Section 3542. The guidelines have been broadly developed from a technical perspective to complement similar guidelines for national security systems and may be used for such systems with the approval of appropriate federal officials exercising policy authority over such systems. 4 Organizations use this publication in conjunction with approved information security program plans, privacy program plans, system security plans, and privacy plans in developing assessment plans for producing and compiling the information necessary to determine the effectiveness of the security and privacy controls employed in the system and organization. The guidance in this publication has been developed with the intention of enabling organizations to tailor the basic assessment procedures provided. The assessment procedures are used as a starting point for and as input to the assessment plan. In developing effective security and privacy assessment plans, organizations take into consideration existing information about the controls to be assessed (e.g., results from assessments of risk; platformspecific dependencies in the hardware, software, or firmware; and any assessment procedures needed as a result of organization-specific controls not included in [SP 800-53]). 5 The selection of appropriate assessment procedures and the rigor, intensity, and scope of the assessment depend on the following factors: • •

The security categorization of the system; 6 The privacy risk assessment for the system;

In accordance with the provisions of [FISMA] and OMB policy, whenever the interconnection of federal systems to systems operated by state/local/tribal governments, contractors, or grantees involves the processing, storage, or transmission of federal information, the information security standards and guidelines described in this publication apply. Specific information security requirements and the terms and conditions of the system interconnections are expressed in Memoranda of Understanding (MOU) and Interconnection Security Agreements (ISAs) established by participating organizations. For additional guidance on managing the security of information exchanges, see NIST [SP 800-47], Revision 1, Managing the Security of Information Exchanges. 5 For example, detailed test scripts may need to be developed for the specific operating system, network component,

middleware, or application employed within the system to adequately assess certain characteristics of a particular security or privacy control. Such test scripts are at a lower level of detail than provided by the assessment procedures contained in this guidance and are, therefore, beyond the scope of this publication. 6

For national security systems, security categorization is accomplished in accordance with CNSS Instruction 1253 [CNSSI 1253]. For other than national security systems, security categorization is accomplished in accordance with Federal Information Processing Standard (FIPS) 199 [FIPS 199], NIST [SP 800-37], NIST [SP 800-60 Vol 1], NIST [SP 80060 Vol 2], and the Controlled Unclassified Information (CUI) Registry [NARA CUI] as managed by the National Archives and Records Administration.

CHAPTER ONE

PAGE 2

• •

The security and privacy controls from [SP 800-53] as identified in the approved information security program plans, privacy program plans, security plans, and privacy plans; 7 and The assurance requirements that the organization intends to meet in determining the overall effectiveness of the security and privacy controls.

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53Ar5

The assessment process is an information-gathering activity of the as-implemented state of the system or common controls, not a security- or privacy-producing activity. Organizations determine the most cost-effective implementation of the assessment process by applying the results of risk assessments, considering the maturity and quality level of the organization’s risk management processes, and taking advantage of the flexibility in the concepts described in this publication. The use of SP 800-53A as a starting point in the process of defining procedures for assessing the security and privacy controls in systems and organizations promotes the consistent application of security and privacy controls and offers the needed flexibility to customize the assessment based on organizational policies and requirements, known threat and vulnerability information, operational considerations, system and platform dependencies, and tolerance for risk. 8 The information produced during control assessments can be used by an organization to: • • • • • • •

Identify potential problems or shortfalls in the organization’s implementation of the Risk Management Framework, Identify security- and privacy-related weaknesses and deficiencies in the system and in the environment in which the system operates, Prioritize risk response decisions and associated risk response activities, 9 Confirm that identified security- and privacy-related weaknesses and deficiencies in the system and in the environment of operation have been addressed, Support monitoring activities and information security and privacy situational awareness, Facilitate all types of system authorization decisions, 10 and Inform budgetary decisions and the capital investment process.

Organizations are not expected to employ all of the assessment methods and assessment objects contained within the assessment procedures identified in this publication for the associated security and privacy controls deployed within or available for inheritance by organizational systems. Rather, organizations have the inherent flexibility to determine the level of effort needed and the assurance required for a particular assessment (e.g., which assessment methods and assessment objects are most useful in obtaining the desired results). Determination of the level of effort and required assurance is made based on what is 7 The security and privacy controls for the system and organization are documented in the system security plans and

privacy plans after the initial selection and tailoring of the controls, as described in [SP 800-53] and [CNSSI 1253]. The Program Management controls are documented in information security program plans and privacy program plans, as described in SP 800-53. 8 In this publication, the term risk is used to mean risk to organizational operations (i.e., mission, functions, image,

and reputation), organizational assets, individuals, other organizations, and the Nation. 9

[SP 800-39] provides additional information about the types of risk response.

10 Types of authorization decisions are described in [SP 800-37], Appendix F.

CHAPTER ONE

PAGE 3

necessary to accomplish the assessment objectives in the most cost-effective manner and with sufficient confidence to support the subsequent determination of the resulting mission or business risk (i.e., risk management). Organizations balance the resources expended on the deployment of security and privacy controls (i.e., safeguards and countermeasures implemented for security and privacy protection) with the resources expended to determine overall control effectiveness, both initially and on an ongoing basis through continuous monitoring programs.

1.2 TARGET AUDIENCE This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53Ar5

This publication is intended to serve a diverse group of system and information security and privacy professionals, including: • • •

•

Individuals with system development responsibilities (e.g., program managers, system designers and developers, systems integrators, information security engineers and privacy engineers); Individuals with information security and privacy assessment and monitoring responsibilities (e.g., Inspectors General, system evaluators, assessors, independent verifiers/validators, auditors, analysts, system owners, common control providers); Individuals with system, security, privacy, risk management, and oversight responsibilities (e.g., authorizing officials, chief information officers, senior information security officers, 11 senior agency officials for privacy/chief privacy officers, system managers, information security and privacy managers); and Individuals with information security and privacy implementation and operational responsibilities (e.g., system owners, common control providers, information owners/stewards, mission and business owners, system administrators, system security officers, system privacy officers).

1.3 RELATED PUBLICATIONS AND ASSESSMENT PROCESSES SP 800-53A is designed to support [SP 800-37], Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy. In particular, the assessment procedures contained in this publication and the guidelines provided for developing security and privacy assessment plans for organizational systems directly support the assessment and monitoring activities that are integral to the risk management process. The integral activities include providing near real-time security- and privacy-related information to organizational officials regarding the ongoing security and privacy state of their systems and organizations. Organizations are encouraged to take advantage of the control assessment results and associated assessment documentation, artifacts, and evidence available for system components from previous assessments, including independent third-party testing, evaluation, and validation. 12 Product testing, evaluation, and validation may be conducted on 11

At the federal agency level, the role is known as the Senior Agency Information Security Officer. Organizations may also refer to the role as the Senior Information Security Officer or the Chief Information Security Officer.

Assessment results can be obtained from many activities that occur routinely during the system development life cycle. For example, assessment results are produced during the testing and evaluation of new system components

CHAPTER ONE

PAGE 4

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53Ar5

cryptographic modules and general-purpose information technology products, such as operating systems, database systems, firewalls, intrusion detection systems, web browsers, web applications, smart cards, biometrics devices, personal identity verification devices, network devices, and hardware platforms using national and international standards. If a system component product is identified as providing support for the implementation of a particular control in [SP 800-53], then evidence produced during the product testing, evaluation, and validation processes (e.g., security or privacy specifications, analyses and test results, validation reports, and validation certificates) 13 is used to the extent that it is applicable. The applicable product testing evidence can be combined with the assessmentrelated evidence obtained from the application of the assessment procedures in this publication to cost-effectively produce the information necessary to determine whether the security and privacy controls are effective in their application.

1.4 ORGANIZATION OF THIS PUBLICATION The remainder of this publication is organized as follows: •

•

• •

Chapter Two describes the fundamental concepts associated with security and privacy control assessments, including the integration of assessments into the system development life cycle, the importance of an organization-wide strategy for conducting security and privacy control assessments, the development of effective assurance cases to help increase grounds for confidence in the effectiveness of the security and privacy controls being assessed, and the format and content of assessment procedures. Chapter Three describes the process of assessing the security and privacy controls in organizational systems and their environments of operation, including the activities carried out by organizations and assessors to prepare for security and privacy control assessments; the development of security assessment plans; the conduct of security and privacy control assessments; the analysis, documentation, and reporting of assessment results; and the post-assessment report analysis and follow-on activities carried out by organizations. Chapter Four provides a catalog of security and privacy assessment procedures that can be used to develop plans for assessing security controls. Supporting appendices provide detailed assessment-related information, including general references, definitions and terms, acronyms, a description of assessment methods, penetration testing guidelines, content of security and privacy assessment reports, and automation support for ongoing assessments.

during system upgrades or system integration activities. Organizations can take advantage of previous assessment results whenever possible, to reduce the overall cost of assessments and to make the assessment process more efficient. Organizations review the available information from component information technology products to determine what security and privacy controls are implemented by the product, if those controls meet the intended control requirements of the system under assessment, if the configuration of the product and the environment in which the product operates are consistent with the environmental and product configuration stated by the vendor and/or developer, and if the assurance requirements stated in the developer/vendor specification satisfy the assurance requirements for assessing those controls. Meeting the above criteria provides a sound rationale that the product is suitable and meets the intended security and privacy control requirements of the system under assessment. 13

CHAPTER ONE

PAGE 5

CHAPTER TWO

THE FUNDAMENTALS BASIC CONCEPTS ASSOCIATED WITH SECURITY AND PRIVACY CONTROL ASSESSMENTS

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53Ar5

This chapter describes the basic concepts associated with assessing the security and privacy controls in organizational systems and the environments in which those systems operate, including the integration of assessments into the system development life cycle, the importance of an organization-wide strategy for conducting assessments, the development of effective assurance cases to help increase grounds for confidence in the effectiveness of security and privacy controls, and the format and content of assessment procedures. A fundamental design objective for SP 800-53A is to provide a flexible assessment framework and a starting point for assessment procedures to be used by different organizations and systems while providing a repeatable approach to facilitate consistency in conducting control assessments.

2.1 ASSESSMENTS WITHIN THE SYSTEM DEVELOPMENT LIFE CYCLE Security and privacy assessments can be carried out throughout system development life cycle phases 14 to increase grounds for confidence that the security and privacy controls employed within or inherited by a system are effective in their application. The guidance in this publication provides a comprehensive set of assessment procedures to support security and privacy assessment activities throughout the system development life cycle. For example, security and privacy assessments are routinely conducted during the development/acquisition and implementation phases of the life cycle. Conducting assessments during the development/acquisition and implementation phases helps ensure that the required controls for the system are designed and developed consistent with risk management goals, correctly implemented, and consistent with the established organizational information security and privacy architecture before the system enters the operations and maintenance phase. Security and privacy assessments conducted in pre-operational system development life cycle phases include design and code reviews, application scanning, regression testing, and ensuring that applicable privacy laws and policies are adhered to and that privacy protections are embedded in the design of the system. Security- and privacy-related weaknesses and deficiencies identified early in the system development life cycle can be resolved more quickly and cost-effectively than deficiencies identified in subsequent phases of the life cycle. Early identification of security- and privacyrelated weaknesses and deficiencies in the selected security and privacy controls facilitates determination and implementation of appropriate risk responses and allows for effectiveness of control implementations to be validated during system design and testing. Security and privacy assessments are also conducted during the operations and maintenance phase of the life cycle to ensure that the controls continue to be effective in the operational environment and protect against constantly evolving risks. Organizations assess all security and privacy controls employed within and inherited by the system during the initial system 14

There are typically five phases in a generic system development life cycle: (i) initiation, (ii) development/acquisition, (iii) implementation, (iv) operations and maintenance, and (v) disposition (disposal).

CHAPTER TWO

PAGE 6

authorization. Following the initial authorization, the organization assesses all implemented security and privacy controls on an ongoing basis in accordance with its Information Security Continuous Monitoring (ISCM) strategy and privacy continuous monitoring strategy. 15 The ongoing assessment and monitoring of controls use the assessment procedures defined in this publication. The frequency of such assessments and monitoring is determined by the organization, system owner, and/or common control provider and is approved by the authorizing official. Finally, at the end of the life cycle, security and privacy assessments are conducted to ensure that important organizational information, including personally identifiable information, are purged from the system prior to disposal and organizational retention schedules are adhered to. This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53Ar5

2.2 CONTROL STRUCTURE AND ORGANIZATION Organizations are encouraged to develop a broad-based, organization-wide strategy for conducting security and privacy assessments to facilitate more cost-effective and consistent assessments across the inventory of systems. Maximizing the number of common controls employed within an organization significantly reduces the costs of development, implementation, and assessment of security and privacy controls; allows organizations to centralize and automate control assessments and amortize the cost of those assessments across all systems in the organization; and increases the consistency of security and privacy control implementations. THE BENEFIT OF IMPLEMENTATION AND ASSESSMENT OF COMMON CONTROLS AND SHARING ASSESSMENT RESULTS An organization-wide approach to identifying common controls early in the application of the RMF facilitates a more global strategy for assessing those common controls and sharing assessment results with system owners and authorizing officials. The sharing of assessment results among key organizational officials across system boundaries has many important benefits, including: • Providing the capability to review assessment results for all systems and to make mission and business-related decisions on risk mitigation activities according to organizational priorities, the security categorization of the systems, and risk assessment results; • Providing a more global view of systemic weaknesses and deficiencies occurring in systems across the organization and an opportunity to develop organization-wide solutions to information security and privacy problems; and • Increasing the organization’s knowledge base regarding threats, vulnerabilities, privacy risks, and strategies for more cost-effective solutions to common information security and privacy problems.

Organizations can also promote a more focused and cost-effective assessment process by developing specific assessment procedures that are tailored to their specific environments of operation and requirements (instead of relegating assessment procedure development tasks to individual control assessors or assessment teams) and by providing organization-wide tools,

[SP 800-137] provides guidance on the continuous monitoring of security controls as part of an ISCM Program. Continuous monitoring can be applied effectively to privacy controls consistent with the concepts, techniques, and principles described in SP 800-137. Senior Agency Officials for Privacy (SAOPs)/Chief Privacy Officers (CPOs) provide guidance on the ongoing monitoring of privacy controls. NIST Interagency Report 8011 [NISTIR 8011], Automation Support for Security Control Assessments, provides guidance on methods to automate the assessment process.

CHAPTER TWO

PAGE 7

templates, and techniques to support more consistent assessments throughout the organization. 16

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53Ar5

The roles responsible for conducting control assessments may include system owners, common control providers, system security and privacy officers, independent assessors, auditors, and Inspectors General with oversight by the authorizing official(s). 17 There is also significant involvement in the assessment process of other parties within the organization who have a vested interest in the outcome of assessments. Other interested parties include mission and business owners and information owners/stewards (when those roles are filled by someone other than the system owner). It is imperative that system owners and common control providers identify and coordinate with other parties in the organization that have an interest in control assessments to help ensure that the organization’s core missions and business functions are adequately addressed in the assessment of security and privacy controls. CAUTIONARY NOTE Organizations carefully consider the potential impacts of employing the assessment procedures defined in this publication when assessing the security and privacy controls in operational systems. Certain assessment procedures – particularly those that directly impact the operation or function of the hardware, software, or firmware components of a system – may inadvertently affect the routine processing, transmission, or storage of information that supports organizational missions or business functions. For example, a critical system component may be taken offline for assessment purposes, or a component may suffer a fault or failure during the assessment process. Organizations take the necessary precautions to ensure that organizational missions and business functions continue to be supported by systems and that any potential impacts to operational effectiveness resulting from assessment activities are considered in advance.

2.3 BUILDING AN EFFECTIVE ASSURANCE CASE Building an effective assurance case 18 for security and privacy control effectiveness is a process that involves compiling evidence from a variety of activities conducted during the system development life cycle that the controls employed in the system are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting the security and privacy requirements of the system and the organization and presenting the evidence in a manner that decision makers are able to use effectively in making risk-based decisions about the operation or use of the system (i.e., to manage risk). The evidence described above comes from 16

Organizations may also provide security and privacy control assessment plans, including tailored assessment procedures, to external service providers who are operating systems on behalf of those organizations. In addition, tailored control and privacy assessment plans can recommend supporting templates, tools, and techniques and also be further tailored to the contract with the service provider, helping to make assessments more consistent and to maximize the reuse of assessment-related artifacts. The reuse of artifacts can improve security and privacy through uniformity and reduce/eliminate contracting ambiguity, resulting in reduced costs and risk to the organization.

In accordance with [OMB A-130], an independent evaluation of privacy program and practices is not required. However, an organization may choose to employ independent privacy assessments at the organization’s discretion. 18

An assurance case is a body of evidence organized into an argument demonstrating that some claim about a system holds (i.e., is assured). An assurance case is needed when it is important to show that a system exhibits some complex property, such as safety, security, privacy, or reliability.

CHAPTER TWO

PAGE 8

the implementation of the security and privacy controls in the system and inherited by the system (i.e., common controls) and from the assessments of that implementation. Ideally, the assessor builds on previously developed materials that started with the specification of the organization’s information security and privacy needs and was further developed during the design, development, and implementation of the system. The materials developed while implementing security and privacy throughout the life cycle of the system provide the initial evidence for an assurance case.

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53Ar5

During the assessment process, assessors obtain the evidence needed to allow the appropriate organizational officials to make objective determinations about the effectiveness of the security and privacy controls and the overall security and privacy state of the system. The assessment evidence needed to make such determinations can be obtained from a variety of sources, including information technology product and system assessments and – in the case of privacy assessments – documentation such as privacy impact assessments and Privacy Act system of record notices. Product assessments (also known as product testing, evaluation, and validation) are typically conducted by independent, third-party testing organizations. Assessments examine the security and privacy functions of products and established configuration settings. Assessments can be conducted to demonstrate compliance with industry, national, or international information security and privacy standards and developer/vendor claims. Since many information technology products are assessed by commercial testing organizations and then subsequently deployed in millions of systems, product assessments can be carried out at a greater level of depth and provide deeper insights into the security and privacy capabilities of the particular products. System and common control assessments are typically conducted by system developers, system integrators, system owners, common control providers, assessors, auditors, Inspectors General, and organizational information security and privacy personnel. The assessors or assessment teams bring together available information about the system or common control, such as the results from individual component product assessments, information in the system security and privacy plans, other system/common control documentation, or previous assessment results, and conduct additional system-level or common control assessments using a variety of methods and techniques. System and common control assessments are used to compile and evaluate the evidence needed by organizational officials to determine how effectively the security and privacy controls employed in systems mitigate risks to organizational operations and assets, individuals, other organizations, and the Nation. The results of assessments conducted using system-specific and organization-specific assessment procedures derived from the guidelines in this publication contribute to compiling the necessary evidence to determine security and privacy control effectiveness in accordance with the assurance requirements documented in security and privacy plans. Assurance Evidence from Developmental and Operational Activities Organizations obtain security and privacy assurance by the actions taken by system developers, implementers, operators, maintainers, and assessors. Actions by individuals and/or groups during the development/operation of systems produce security and privacy evidence that contributes to the assurance, or measures of confidence, in the security and privacy functionality needed to deliver the security and privacy capability. The depth and coverage of these actions (as described in Appendix C) also contribute to the efficacy of the evidence and

CHAPTER TWO

PAGE 9

measures of confidence. The evidence produced by developers, implementers, operators, assessors, and maintainers during the system development life cycle (e.g., design/development artifacts and assessment results) contributes to the understanding of the effectiveness of security and privacy controls implemented by organizations.

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53Ar5

The strength of the security and privacy functionality 19 plays an important part in achieving the desired capabilities and subsequently satisfying the security and privacy requirements of organizations. System developers can increase the strength of security and privacy functionality by employing well-defined security and privacy policies and procedures, structured and rigorous design and development techniques, and sound system, security, and privacy engineering techniques as part of the system development process. The artifacts generated by development activities (e.g., functional specifications, system design documentation, and the results of testing and code analysis) can provide important evidence that systems and their components are more reliable and trustworthy. Security and privacy evidence can also be generated from testing conducted by independent, third-party assessment organizations and other assessment activities conducted by government and private sector organizations. 20 In addition to the evidence produced in the development environment, organizations can produce evidence from the operational environment that contributes to the assurance of functionality and security and privacy capabilities. Operational evidence includes records of remediation actions, the results of security incident reporting (including breaches involving personally identifiable information), and the results of organizational continuous monitoring activities. Such evidence helps determine the effectiveness of deployed security and privacy controls, changes to systems and environments of operation, and compliance with legislation, policies, directives, regulations, and standards. Security and privacy evidence – whether obtained from development or operational activities – helps organizations determine the extent to which their systems are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting stated security and privacy requirements, thus providing greater assurance in the system’s security and privacy capabilities. The depth and coverage of security and privacy evidence can affect the level of assurance in the functionality implemented. Depth and coverage are attributes associated with assessment methods and the generation of security and privacy evidence. 21 Assessment methods can be applied to support developmental and operational assurance. For developmental assurance, depth is associated with the rigor, level of detail, and formality of the artifacts produced during system design and development. The level of detail available in development artifacts can affect the type of testing, evaluation, and analysis conducted during the system development life cycle (e.g., basic testing, comprehensive testing, and focused testing, static/dynamic analysis). For operational assurance, the depth attribute addresses the rigor and level of detail for the 19

The security or privacy strength of a system component (i.e., hardware, software, or firmware) is determined by the degree to which the security or privacy functionality implemented within that component is correct, complete, resistant to direct attacks (strength of mechanism), and resistant to bypass or tampering.

For example, third-party assessment organizations assess cloud services and service providers in support of the Federal Risk and Authorization Management Program [FedRAMP]. Common Criteria Testing Laboratories test and evaluate information technology products using [ISO 15408]. Cryptographic/Security Testing Laboratories test cryptographic modules using the [FIPS 140-3] standard. 21

For additional information about depth and coverage, see Section 2.4 and Appendix C.

CHAPTER TWO

PAGE 10

assessment. In contrast, the coverage attribute is associated with the assessment methods employed during development and operations, addressing the scope and breadth of assessment objects included in the assessments (e.g., number and types of tests conducted on source code).

2.4 ASSESSMENT PROCEDURES: ASSESSMENT OBJECTS, METHODS AND OBJECTIVES

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53Ar5

An assessment procedure consists of a set of assessment objectives, each with an associated set of potential assessment methods and assessment objects. An assessment objective includes one or more determination statements related to the [SP 800-53] control under review. The determination statements are linked to the content of the control (i.e., the security and privacy control functionality) to ensure the traceability of assessment results back to the fundamental control requirements. The application of an assessment procedure to a control produces assessment findings. 22 Assessment findings reflect or are subsequently used to help determine the overall effectiveness of the control and help the authorizing official make an informed, riskbased decision on whether to place the system into operation or continue its operation. 2.4.1 ASSESSMENT OBJECTS

Assessment objects identify the specific items being assessed as part of a given control and include specifications, mechanisms, activities, and individuals. Specifications are the documentbased artifacts (e.g., policies, procedures, plans, system security and privacy requirements, functional specifications, architectural designs) associated with a system or common control. Mechanisms are the specific hardware, software, or firmware safeguards and countermeasures employed within a system or common control. 23 Activities are the specific protection-related actions supporting a system or common control that involve people (e.g., conducting system backup operations, monitoring network traffic, exercising a contingency plan). Individuals or groups of individuals are people applying the specifications, mechanisms, or activities described above. 2.4.2 ASSESSMENT METHODS

Assessment methods define the nature of the assessor actions and include examine, interview, and test. • • •

The examine method is the process of reviewing, inspecting, observing, studying, or analyzing one or more assessment objects (i.e., specifications, mechanisms, or activities) to facilitate assessor understanding, achieve clarification, or obtain evidence. The interview method is the process of holding discussions with individuals or groups of individuals within an organization to facilitate assessor understanding, achieve clarification, or obtain evidence. The test method is the process of exercising one or more assessment objects (i.e., activities or mechanisms) under specified conditions to compare the actual state of the object to the desired state or expected behavior of the object.

22 For more information about control assessment findings, see Section 3.3. 23 Mechanisms also include physical protection devices associated with a system or common control (e.g., locks, keypads, security cameras, fire protection devices, fireproof safes, etc.).

CHAPTER TWO

PAGE 11

In all three assessment methods, the results are used to make specific determinations called for in the determination statements and thereby achieve the objectives for the assessment procedure. A complete description of assessment methods and assessment objects is provided in Appendix C. Assessment methods have a set of associated attributes – depth and coverage – which help define the level of effort for the assessment. The attributes are hierarchical in nature, providing the means to define the rigor and scope of the assessment for the increased assurances that may be needed for some systems. This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53Ar5

• •

The depth attribute addresses the rigor and level of detail in the examination, interview, and testing processes. Values for the depth attribute include basic, focused, and comprehensive. The coverage attribute addresses the scope or breadth of the examination, interview, and testing processes, including the number and types of specifications, mechanisms, and activities to be examined or tested and individuals to be interviewed. Similar to the depth attribute, values for the coverage attribute include basic, focused, and comprehensive.

The appropriate depth and coverage attribute values for a particular assessment method are based on the assurance requirements specified by the organization and are an important component of protecting information commensurate with risk (i.e., risk management). As assurance requirements increase with regard to the development, implementation, and operation of controls within or inherited by the system, the rigor and scope of the assessment activities (as reflected in the selection of assessment methods and objects and the assignment of depth and coverage attribute values) tend to increase as well. 24 Appendix C provides a detailed description of assessment method attributes and attribute values. 2.4.3 ASSESSMENT OBJECTIVES

The assessment objectives are numbered sequentially, first in accordance with the numbering scheme in [SP 800-53] and, subsequently, where necessary to further granularize the security or privacy control requirements to facilitate assessment. Square bracketed sequential numbers, as opposed to parentheses, are used to indicate that the control from SP 800-53 has been further granularized (e.g., AC-17a.[01], AC-17a.[02], AC-17a.[03]).

The level of effort for the assessment, including the depth and coverage, is primarily determined by the privacy risk assessment or security categorization of the system or common control being assessed.

CHAPTER TWO

PAGE 12

Figure 1 illustrates an example assessment procedure developed to assess the effectiveness of control AC-17. The assessment objective for AC-17 is derived from the base control statement described in [SP 800-53]. AC-17a.[01] is an example of a determination statement for a control item that is further granularized from SP 800-53. AC-17b. is an example of a determination statement for a control item that corresponds directly with the SP 800-53 control. Potential assessment methods and objects are added to each assessment procedure. Not all assessment procedures include all three potential assessment methods (i.e., examine, interview, test). The organization determines the assessment methods needed to provide the level of assurance required by the organization. This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53Ar5

AC-17

REMOTE ACCESS ASSESSMENT OBJECTIVE: Determine if:

Control further granularized from SP 800 -53

Corresponds directly with SP 800-53 control

AC-17a.[01]

usage restric�ons are established and documented for each type of remote access allowed;

AC-17a.[02]

conﬁgura�on/connec�on requirements are established and documented foreach type of remote access allowed;

AC-17a.[03]

implementa�on guidance is established and documented for each type of remote access allowed;

AC-17b.

each type of remote access to the system is authorized prior to allowing such connec�ons.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: AC-17-Examine

[SELECT FROM: Access control policy; procedures addressing remote access implementa�on and usage (including restric�ons); conﬁgura�on management plan; system conﬁgura�on se�ngs and associated documenta�on; remote access authoriza�ons; system audit records; system security plan; other relevant documents or records].

AC-17-Interview

[SELECT FROM: Organiza�onal personnel with responsibili�es for managing remote access connec�ons; system/network administrators; organiza�onal personnel with informa�on security responsibili�es].

AC-17-Test

[SELECT FROM: Remote access management capability for the system]. FIGURE 1: ASSESSMENT PROCEDURE FOR A CONTROL

CHAPTER TWO

PAGE 13

Another example of granularization to support control assessments is the case of a privacy control requirement not being applicable to a particular system (e.g., the system does not process personally identifiable information); assessors can disregard such non-applicable requirements and still find that the control is satisfied. Figure 2 provides an example of control CM-04 25, which is further granularized to address security impacts in CM-04[01] and privacy impacts in CM-04[02]. CM-04

IMPACT ANALYSES ASSESSMENT OBJECTIVE: Determine if:

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53Ar5

CM-04[01]

changes to the system are analyzed to determine poten�al security impacts prior to change implementa�on;

CM-04[02]

changes to the system are analyzed to determine poten�al privacy impacts prior to change implementa�on.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: CM-04-Examine

[SELECT FROM: Conﬁgura�on management policy; procedures addressing Granularized to address security impact analyses for changes to the system; procedures addressing privacy impacts separate privacy impact analyses for changes to the system; conﬁgura�on management from security impacts plan; security impact analysis documenta�on; privacy impact analysis documenta�on; privacy impact assessment; privacy risk assessment documenta�on, system design documenta�on; analysis tools and associated outputs; change control records; system audit records; system security plan; privacy plan; other relevant documents or records].

CM-04-Interview

[SELECT FROM: Organiza�onal personnel with responsibility for conduc�ng security impact analyses; organiza�onal personnel with responsibility for conduc�ng privacy impact analyses; organiza�onal personnel with informa�on security and privacy responsibili�es; system developer; system/network administrators; members of change control board or similar].

CM-04-Test

[SELECT FROM: Organiza�onal processes for security impact analyses; organiza�onal processes for privacy impact analyses].

FIGURE 2. ASSESSMENT PROCEDURE FOR A CONTROL FURTHER GRANULARIZED TO FACILITATE ASSESSMENT

Additionally, determination statements for organization-defined parameters (ODPs) are listed first and separately from the determination statements for each control item within each control or control enhancement to enable the assessor to quickly determine whether the ODPs are defined or selected by the organization. ODPs appear first in the determination statements, and each include a unique identifier associated with the control to facilitate a more efficient and streamlined assessment. ODPs include: • •

Assignment operations, where the organization defines a value (e.g., frequency, circumstances, personnel, or roles) Selection operations, where the organization selects one or more of the options provided in the ODP

The ODP numbering convention is “XX-nn_ODP”, where XX is the two-character control family abbreviation, and nn is the control number (with a leading zero for single digits) followed by 25 Note that the control identifiers (e.g., CM-4), as published in [SP 800-53], do not include a leading zero. Future

revisions of SP 800-53 control identifiers will include a leading zero (e.g., CM-04).

CHAPTER TWO

PAGE 14

“_ODP”. If there is more than one ODP for the assessment procedure, “_ODP” is followed by square-bracketed sequential numbers starting from “01”. The ODP value is referenced in subsequent determination statements using the ODP unique identifier and a short phrase describing the ODP surrounded by < >. Similar to declaring a variable in computer programming, the ODP serves as a symbolic name to reference a stored value. In this scenario, the ODP unique identifier serves as the symbolic name, and the value assigned or selected by the organization is the stored value. Figure 3 provides an example of an assessment procedure for control CM-02 that includes two assignment operations: CM-02_ODP[01] and CM-02_ODP[02]. This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53Ar5

CM-02

BASELINE CONFIGURATION ASSESSMENT OBJECTIVE: Determine if:

Organiza�onDeﬁned Parameter (ODP) iden�ﬁer

CM-02_ODP[01]

the frequency of baseline conﬁguration review and update is deﬁned;

CM-02_ODP[02]

the circumstances requiring baseline conﬁguration review and update are deﬁned;

CM-02a.[01]

a current baseline conﬁgura�on of the system is developed and documented;

CM-02a.[02]

a current baseline conﬁgura�on of the system is maintained under conﬁgura�on Assignment Statement control;

CM-02b.01

the baseline conﬁgura�on of the system is reviewed and updated <CM-02_ODP[01] frequency>;

CM-02b.02

to when required the baseline conﬁgura�on of the system is reviewedReference and updated ODP in due to <CM-02_ODP[02] circumstances>;

CM-02b.03

the baseline conﬁgura�on of the system is reviewed statement and updated when system components are installed or upgraded.

determina�on

POTENTIAL ASSESSMENT METHODS AND OBJECTS: CM-02-Examine

[SELECT FROM: Conﬁgura�on management policy; procedures addressing the baseline conﬁgura�on of the system; conﬁgura�on management plan; enterprise architecture documenta�on; system design documenta�on; system security plan; privacy plan; system architecture and conﬁgura�on documenta�on; system conﬁgura�on se�ngs and associated documenta�on; system component inventory; change control records; other relevant documents or records].

CM-02-Interview

[SELECT FROM: Organiza�onal personnel with conﬁgura�on management responsibili�es; organiza�onal personnel with informa�on security and privacy responsibili�es; system/network administrators].

CM-02-Test

[SELECT FROM: Organiza�onal processes for managing baseline conﬁgura�ons; automated mechanisms suppor�ng conﬁgura�on control of the baseline conﬁgura�on].

FIGURE 3. ASSESSMENT PROCEDURE FOR CONTROL WITH ORGANIZATION-DEFINED PARAMETER: ASSIGNMENT OPERATIONS

CHAPTER TWO

PAGE 15

Figure 4 provides an example of an assessment procedure for a control, MP-07, that includes assignment operations and a selection operation. Selection operations include a list of potential parameter values that the organization chooses from and instructions to select one or more parameters. The list of parameter values is identified using braces { }, with each potential parameter value separated with a semicolon. When the ODP for a selection operation is referenced in a subsequent determination statement, the ODP unique identifier and phrase “SELECTED PARAMETER VALUE(S)” is surrounded by < >. MP-07

MEDIA USE

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53Ar5

ASSESSMENT OBJECTIVE: Determine if: Organiza�onDeﬁned Parameter (ODP) iden�ﬁer

MP-07_ODP[01]

types of system media to be restricted or prohibited from use on systems or system components are deﬁned;

MP-07_ODP[02]

one of the following PARAMETER VALUES is selected to be applied on speciﬁc types of system media: {restrict; prohibit};

MP-07_ODP[03]

systems or system components on which the use of speciﬁc types of system media to be restricted or prohibited are deﬁned;

MP-07_ODP[04]

controls to restrict or prohibit the use of speciﬁc types of system media on systems or system components are deﬁned;

MP-07a.

Reference to the use of <MP-07_ODP[01] types of system media> is ODP in <MP-07_ODP[02] SELECTED PARAMETER VALUE> on <MP-07_ODP[03] systems determina�on or system components> using <MP-07_ODP[04] controls>; statement

MP-07b.

Selec�on Statement

the use of portable storage devices in organiza�onal systems is prohibited when such devices have no iden�ﬁable owner.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: MP-07-Examine

[SELECT FROM: System media protec�on policy; system use policy; procedures addressing media usage restric�ons; rules of behavior; system design documenta�on; system conﬁgura�on se�ngs and associated documenta�on; audit records; system security plan; other relevant documents or records].

MP-07-Interview

[SELECT FROM: Organiza�onal personnel with system media use responsibili�es; organiza�onal personnel with informa�on security responsibili�es; system/network administrators].

MP-07-Test

[SELECT FROM: Organiza�onal processes for media use; automated mechanisms restric�ng or prohibi�ng use of system media on systems or system components].

FIGURE 4. ASSESSMENT PROCEDURE FOR CONTROL WITH ORGANIZATION-DEFINED PARAMETER: SELECTION OPERATION

CHAPTER TWO

PAGE 16

Figure 5 provides an example of an assessment procedure for a control, CA-03, that includes an ODP that consists of a selection operation with an embedded assignment operation. The selection operation, CA-03(01)_ODP[01], identifies a list of parameters to choose from, including another ODP. The assignment operation for CA-03(01)_ODP[02] is only defined if the organization selects the ODP from the list of parameters. When the ODP for a selection operation is referenced in a subsequent determination statement, the ODP unique identifier and phrase “SELECTED PARAMETER VALUE(S)” is surrounded by < >. In this scenario, if the embedded assignment operation is selected, it becomes the “SELECTED PARAMETER VALUE(S)”.

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53Ar5

CA-03

Selec�on statement with assignment statement as poten�al parameter value

INFORMATION EXCHANGE ASSESSMENT OBJECTIVE: Determine if:

Organiza�onDeﬁned Parameter (ODP) iden�ﬁer

CA-03_ODP[01]

one or more of the following PARAMETER VALUES is/are selected: {interconnection security agreements; information exchange security agreements; memoranda of understanding or agreement; service level agreements; user agreements; non-disclosure agreements; <CA-03_ODP[02] type of agreement>};

CA-03_ODP[02]

the type of agreement used to approve and manage the exchange of information is deﬁned (if selected);

CA-03_ODP[03]

the frequency at which to review and update agreements is deﬁned;

CA-03a.

the exchange of informa�on between system and other systems is approved and

Embedded Assignment managed using <CA-03_ODP[01] SELECTED PARAMETER VALUE(S)>; Statement, deﬁned CA-03b.[01] only ifthe selected interface characteris�cs are documented as part of each exchange

agreement;

Reference to ODP with

CA-03b.[02]

security requirements are documented as part PARAMETER of each exchange agreement; SELECTED

CA-03b.[03]

privacy requirements are documented as part of each exchange agreement; statement

CA-03b.[04]

controls are documented as part of each exchange agreement;

CA-03b.[05]

responsibili�es for each system are documented as part of each exchange agreement;

CA-03b.[06]

the impact level of the informa�on communicated is documented as part of each exchange agreement;

CA-03c.

agreements are reviewed and updated <CA-03_ODP[03] frequency>.

VALUE(S) in determina�on

POTENTIAL ASSESSMENT METHODS AND OBJECTS: CA-03-Examine

[SELECT FROM: Access control policy; procedures addressing system connec�ons; system and communica�ons protec�on policy; system interconnec�on security agreements; informa�on exchange security agreements; memoranda of understanding or agreements; service level agreements; non-disclosure agreements; system design documenta�on; system conﬁgura�on se�ngs and associated documenta�on; system security plan; privacy plan; other relevant documents or records].

CA-03-Interview

[SELECT FROM: Organiza�onal personnel with responsibili�es for developing, implemen�ng, or approving system interconnec�on agreements; organiza�onal personnel with informa�on security and privacy responsibili�es; personnel managing the system(s) to which the interconnec�on security agreement applies].

FIGURE 5. ASSESSMENT PROCEDURE FOR CONTROL WITH ORGANIZATION-DEFINED PARAMETERS: SELECTION OPERATION WITH EMBEDDED ASSIGNMENT OPERATION

CHAPTER TWO

PAGE 17

Although not explicitly noted with each assessment method in the assessment procedure, the attribute values of depth and coverage 26 are assigned by the organization and specified within the assessment plan (e.g., the level of rigor for documentation review, the number of similar assessment objects to test). The assessor/assessment team applies the depth and coverage attributes in the execution of the assessment method against an assessment object to provide the level of assurance required by the organization.

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53Ar5

If the control has any enhancements as designated by sequential parenthetical numbers (for example, AC-17(01) for the first enhancement for AC-17), assessment objectives are developed for each enhancement using the same process used for the base control. The resulting assessment objectives are numbered sequentially in the same way as the assessment procedure for the base control – first in accordance with the numbering scheme in [SP 800-53] and, subsequently, using bracketed sequential numbers to further apportion control enhancement requirements to facilitate assessments (e.g., AC-17(01), AC-17(02), AC-17(03)). Figure 6 illustrates an example of an assessment procedure developed to assess the effectiveness of the first enhancement to security control AC-17, AC-17(01). AC-17(01) REMOTE ACCESS | MONITORING AND CONTROL ASSESSMENT OBJECTIVE: Determine if: AC-17(01)[01]

automated mechanisms are employed to monitor remote access methods;

AC-17(01)[02]

automated mechanisms are employed to control remote access methods.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: AC-17(01)-Examine

[SELECT FROM: Access control policy; procedures addressing remote access to the system; system design documenta�on; system conﬁgura�on se�ngs and associated documenta�on; system audit records; system monitoring records; system security plan; other relevant documents or records].

AC-17(01)-Interview

[SELECT FROM: System/network administrators; organiza�onal personnel with informa�on security responsibili�es; system developers].

AC-17(01)-Test

[SELECT FROM: Automated mechanisms monitoring and controlling remote access methods].

FIGURE 6: ASSESSMENT PROCEDURE FOR CONTROL ENHANCEMENT

26 Attribute values of depth and coverage are described in Appendix C.

CHAPTER TWO

PAGE 18

CHAPTER THREE

THE PROCESS CONDUCTING EFFECTIVE SECURITY AND PRIVACY CONTROL ASSESSMENTS

This chapter describes the process of assessing the security and privacy controls in organizational systems and environments of operation. The process to assess controls includes: • This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53Ar5

• •

the activities carried out by organizations and assessors to prepare for security and privacy control assessments; the development of security and privacy assessment plans; the conduct of control assessments and the analysis, documentation, and reporting of assessment results; and post-assessment report analysis and follow-on activities.

Additionally, this chapter describes assessing security and privacy capabilities. 27

FIGURE 7. OVERVIEW OF PROCESS TO CONDUCT EFFECTIVE SECURITY AND PRIVACY CONTROL ASSESSMENTS

3.1 PREPARE FOR SECURITY AND PRIVACY CONTROL ASSESSMENTS Table 1 provides a summary of the purpose, roles, and expected outcomes of the Prepare for Security and Privacy Control Assessments Step. TABLE 1. PREPARE FOR SECURITY AND PRIVACY CONTROL ASSESSMENTS SUMMARY

Purpose Primary Roles Supporting Roles Outcomes

Address a range of issues pertaining to the cost, schedule, scope, and performance of the control assessment. Authorizing Official, Authorizing Official Designated Representative, system owner, common control provider, control assessors System security officer, system privacy officer • • • • • •

The objective, scope, and timeframe of control assessment determined Key organizational stakeholders notified and necessary resources allocated Assessors/assessment teams identified Artifacts collected and provided to assessors/assessment teams Mechanism to minimize ambiguities and misunderstandings about control implementation and identified control deficiencies or weaknesses established Assessors/assessment teams understand the organization’s operations, structure, objective, scope, and timeframe of control assessment

A security and privacy capability is a combination of mutually reinforcing security and privacy controls (i.e., safeguards and countermeasures) implemented by technical means (i.e., functionality in hardware, software, and firmware), physical means (i.e., physical devices and protective measures), and procedural means (i.e., procedures performed by individuals).

CHAPTER THREE

PAGE 19

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53Ar5

Conducting security and privacy control assessments can be difficult, challenging, and resource intensive. Security and privacy control assessments may be conducted by different organizational entities with distinct oversight responsibilities. However, success requires the cooperation and collaboration of all parties with a vested interest in the organization’s information security or privacy posture, including control assessors, system security and privacy officers, system owners, common control providers, authorizing officials, chief information officers, senior information security officers, senior agency officials for privacy/chief privacy officers, chief executive officers/heads of agencies, security and privacy staffs, Inspectors General, and OMB. Establishing an appropriate set of expectations before, during, and after an assessment is paramount to achieving an acceptable outcome (i.e., producing information necessary to help the authorizing official make a credible, risk-based decision on whether to place the system into operation or continue its operation). Thorough preparation by the organization and assessors is an important aspect of conducting effective security and privacy control assessments. Preparatory activities address a range of issues relating to the cost, schedule, and performance of the assessment. From an organizational perspective, preparing for a security and privacy control assessment includes the following key activities: • •

• • • • • •

Ensuring that appropriate policies covering security and privacy control assessments are in place and understood by all affected organizational elements; Ensuring that all steps in the RMF prior to the security or privacy control assessment step have been successfully completed and received appropriate management oversight; 28 Establishing the objective and scope of assessments (i.e., the purpose of the assessments and what is being assessed); Ensuring that security and privacy controls identified as common controls (and the common portion of hybrid controls) have been assigned to appropriate organizational entities (i.e., common control providers) for development and implementation; 29 Notifying key organizational officials of impending assessments and allocating necessary resources to carry out the assessments; Establishing appropriate communication channels among organizational officials with an interest in the assessments; Establishing time frames for completing the assessments and key milestone decision points required by the organization; Identifying and selecting appropriate assessors/assessment teams that will be responsible for conducting the assessments and considering issues of assessor independence;

28 Conducting security and privacy control assessments in parallel with the development/acquisition and

implementation phases of the life cycle allows for the early identification of weaknesses and deficiencies and provides the most cost-effective method for initiating corrective actions. Issues found during development assessments can be referred to authorizing officials for early resolution, as appropriate. The results of security and privacy control assessments carried out during system development and implementation can also be used (consistent with reuse criteria) during the authorization process to avoid system fielding delays or the costly repetition of assessments. 29

Common control assessments and assessments of the common part of hybrid controls are the responsibility of the common control providers, not the system owner inheriting the controls.

CHAPTER THREE

PAGE 20

•

Providing artifacts to the assessors/assessment teams (e.g., policies, procedures, plans, specifications, designs, records, administrator/operator manuals, system documentation, information exchange agreements, previous assessment results, legal requirements); and Establishing a mechanism between the organization and the assessors and/or assessment teams to minimize ambiguities or misunderstandings about the implementation of security and privacy controls and related weaknesses or deficiencies identified during the assessments.

Control assessors/assessment teams begin preparing for their respective assessments by: This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53Ar5

• •

• • • • •

Obtaining a general understanding of the organization’s operations (including mission, functions, and business processes) and how the system or common control that is the subject of the particular assessment supports those organizational operations, Obtaining an understanding of the structure of the system (i.e., system architecture) and the security and privacy controls being assessed (including system-specific, hybrid, and common controls), Identifying the organizational entities responsible for the development and implementation of the common controls (or the common portion of hybrid controls) supporting the system, Meeting with appropriate organizational officials to ensure common understanding for assessment objectives and the proposed rigor and scope of the assessment, Obtaining artifacts needed for the assessment (e.g., policies, procedures, plans, specifications, designs, records, administrator and operator manuals, system documentation, information exchange agreements, previous assessment results), Establishing appropriate organizational points of contact to carry out the assessments, and Obtaining previous assessment results that may be appropriately reused for the current assessment (e.g., Inspector General reports, audits, vulnerability scans, physical security inspections, developmental testing and evaluation, vendor flaw remediation activities, [ISO 15408] evaluations).

In preparation for the assessment of security and privacy controls, the necessary background information is assembled and made available to the assessors or assessment team. 30 To the extent necessary to support the specific assessment, and depending upon whether security controls or privacy controls are being assessed, the organization identifies and arranges access to elements of the organization responsible for developing, documenting, disseminating, reviewing, and updating: • •

all policies and associated procedures for implementing policy-compliant controls; the policies for the system and any associated implementing procedures, individuals, or groups responsible for the development, implementation, operation, and maintenance of controls;

30 System (or program) owners and organizational entities developing, implementing, and/or administering common controls (i.e., common control providers) are responsible for providing needed information to assessors.

CHAPTER THREE

PAGE 21

•

any artifacts or materials (e.g., security or privacy plans, records, schedules, assessment reports, after-action reports, agreements, authorization packages) associated with the implementation and operation of the controls to be assessed; and the specific objects to be assessed. 31

The availability of essential documentation as well as access to key organizational personnel and the system or common control being assessed are paramount to a successful assessment.

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53Ar5

Organizations consider both the technical expertise and level of independence required in selecting security and privacy control assessors. 32 Organizations ensure that assessors possess the required skills and technical expertise to successfully carry out assessments of systemspecific, hybrid, and common controls. 33 Skills and expertise includes knowledge of and experience with the specific hardware, software, and firmware components employed by the organization. An independent assessor is any individual capable of conducting an impartial assessment of security and privacy controls employed within or inherited by a system. Impartiality implies that security and privacy control assessors are free from any perceived or actual conflicts of interest with respect to the development, operation, and/or management of the system or the determination of security and privacy control effectiveness. 34 The authorizing official or designated representative determines the required level of independence for assessors based on the results of the security categorization process for the system (in the case of security control assessments) and the risk to organizational operations and assets, individuals, other organizations, and the Nation. The authorizing official determines whether the level of assessor independence is sufficient to provide confidence that the assessment results produced are sound and can be used to make a risk-based decision on whether to place the system or common control into operation or continue its operation. Independent security and privacy control assessment services can be obtained from other elements within the organization or be contracted to a public or private sector entity outside of the organization. In special situations (e.g., when the organization that owns the system or common control is small or the organizational structure requires that the security or privacy control assessment be accomplished by individuals who are in the developmental, operational, and/or management chain of the system owner), independence in the assessment process can be achieved by ensuring that the assessment results are carefully reviewed and analyzed by an

In situations where there are multiple security and privacy assessments ongoing or planned within an organization, access to organizational elements, individuals, and artifacts supporting the assessments is centrally managed by the organization to ensure a cost-effective use of time and resources.

In accordance with [OMB A-130], an independent evaluation of the privacy program and practices is not required. However, an organization may choose to employ independent privacy assessments at its discretion. 33

NIST [SP 800-181] describes the Workforce Framework for Cybersecurity (National Initiative for Cybersecurity Education [NICE] Framework), a fundamental reference for describing and sharing information about cybersecurity work through Task statements, and Knowledge and Skills Statements. The NICE Framework is a reference source with which organizations or sectors can develop additional publications or tools that meet their needs to define or provide guidance on different aspects of cybersecurity education, training, and workforce development. 34

Contracted assessment services are considered independent if the system (or program) owner is not directly involved in the contracting process or cannot unduly influence the independence of the assessor(s) conducting the assessment of the security or privacy controls.

CHAPTER THREE

PAGE 22

independent team of experts to validate the completeness, consistency, and veracity of the results. 35

3.2 DEVELOP SECURITY AND PRIVACY ASSESSMENT PLANS Table 2 provides a summary of the purpose, roles, and expected outcomes of the Develop Security and Privacy Assessment Plans Step. TABLE 2. DEVELOP SECURITY AND PRIVACY PLANS SUMMARY

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53Ar5

Purpose Primary Roles Supporting Roles Outcomes

Provide the objectives for the security and privacy control assessments, as well as a detailed roadmap of how to conduct such assessments based on the security and privacy plan(s). Control assessors System security officers, system privacy officers, system owners • • • •

Controls and control enhancements to be included in assessments are determined Assessment procedures are selected and tailored; additional procedures for security and privacy requirements/controls not covered by [SP 800-53] are developed Assessment procedures are optimized to reduce duplication of effort Assessment plan is finalized, and organizational approval is obtained

The security assessment plan and privacy assessment plan provide the objectives for the security and privacy control assessments, respectively, as well as a detailed roadmap of how to conduct such assessments. The assessment plans may be developed as one integrated plan or as distinct plans, depending upon organizational needs. The following steps are considered by assessors when developing plans to assess the security and privacy controls in organizational systems or common controls available for inheritance: •

• • •

Determine which security and privacy controls/control enhancements are to be included in assessments based on the contents of the security plan and privacy plan (or equivalent document if the controls to be assessed are non-system-based common controls) 36 and the purpose and scope of the assessments, Select the appropriate assessment procedures to be used during assessments based on the security or privacy controls and control enhancements to be assessed, Tailor the selected assessment procedures (e.g., select appropriate assessment methods and objects, and assign depth and coverage attribute values), Develop additional assessment procedures to address any security requirements or controls that are not covered by [SP 800-53],

The authorizing official consults with the Office of the Inspector General, the senior information security officer, senior agency officials for privacy/chief privacy officers, and the chief information officer, as appropriate, to discuss the implications of any decisions on assessor independence in the types of special circumstances described above.

The approach to developing assessment plans and conducting control assessments also applies to information security program plans and privacy program plans.

CHAPTER THREE

PAGE 23

•

Optimize the assessment procedures to reduce duplication of effort (e.g., sequencing and consolidating assessment procedures) and provide cost-effective assessment solutions, and Finalize assessment plans and obtain the necessary approvals to execute the plans.

3.2.1 DETERMINE WHICH SECURITY AND PRIVACY CONTROLS ARE TO BE ASSESSED

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53Ar5

The security plan and privacy plan provide an overview of the security and privacy requirements for the system and organization and describe the security controls and privacy controls in place or planned for meeting those requirements. For the assessment of common controls that are not implemented by a system, a document equivalent to the security or privacy plan may be used. The assessor starts with the security or privacy controls described in the security or privacy plan and considers the purpose of the assessment. A security or privacy control assessment can be a complete assessment of all controls in a system (e.g., during an initial system authorization process), a partial assessment of the controls in a system (e.g., during system development as part of a targeted assessment resulting from changes affecting specific controls or where controls were previously assessed and the results accepted in the reciprocity process), or a common control assessment. For partial assessments, system owners and common control providers collaborate with organizational officials with an interest in the assessment (e.g., senior information security officers, senior agency officials for privacy/chief privacy officers, mission/information owners, Inspectors General, and authorizing officials) to determine which controls are to be assessed. The determination of the controls to be assessed depends on the purpose of the assessment. For example, during the initial phases of the system development life cycle, specific controls may be selected for assessment to promote the early detection of weakness and deficiencies and a more cost-effective approach to risk response. After the initial authorization to operate has been granted, targeted assessments may be necessary when changes are made to the system, specific security or privacy controls, common controls, or the environment of operation. In such cases, the focus of the assessment is on the controls that may have been affected by the change. 3.2.2 SELECT PROCEDURES TO ASSESS THE SECURITY AND PRIVACY CONTROLS SP 800-53A provides assessment procedures for each security and privacy control and control enhancement in [SP 800-53]. For each control in the security plan and privacy plan to be included in the assessment, assessors select the corresponding assessment procedure from Chapter 4. The selected assessment procedures can vary from assessment to assessment based on the current content of the security plans and privacy plans and the purpose of the assessment (e.g., complete assessment, partial assessment, common control assessment). 3.2.3 TAILOR ASSESSMENT PROCEDURES In a manner similar to how the controls from [SP 800-53] are tailored for the organization’s mission, business functions, characteristics of the system, and operating environment, organizations tailor the assessment procedures in Chapter 4 to meet specific organizational needs. Organizations have the flexibility to perform the tailoring process at the organization level for all systems or common controls, at the individual system level, or using a combination of organization-level and system-specific approaches. Control assessors determine if the

CHAPTER THREE

PAGE 24

organization provides additional tailoring guidance prior to initiating the tailoring process. Assessment procedures are tailored by: • • •

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53Ar5

• • •

Selecting the appropriate assessment methods and objects needed to satisfy the stated assessment objectives, Selecting the appropriate depth and coverage attribute values to define the rigor and scope of the assessment, Identifying common controls and inherited portions of hybrid controls that have been assessed by a separately documented security assessment plan or privacy assessment plan and do not require the repeated execution of the assessment procedures, 37 Developing system/platform-specific and organization-specific assessment procedures (which may be adaptations of those in Chapter 4), Incorporating assessment results from previous assessments where the results are deemed applicable, and Making appropriate adjustments in assessment procedures to obtain the requisite assessment evidence from external providers.

3.2.3.1 ASSESSMENT METHOD- AND OBJECT-RELATED CONSIDERATIONS Organizations can specify, document, and configure their systems in a variety of ways, and the content and applicability of existing assessment evidence varies. This variety may result in the need to apply a mixture of assessment methods to assessment objects to generate the assessment evidence needed to determine whether the security and privacy controls are effective in their application. Additionally, as described in Section 2.3 and Section 2.4, the number and type of assessment methods and assessment objects needed to provide the required assurance varies based on the depth and coverage needed for the assessment. Therefore, the assessment methods and objects provided with each assessment procedure are termed potential to reflect the need to choose the specific methods and objects most appropriate for a specific assessment. The assessment methods and objects chosen are those deemed necessary to produce the evidence needed to make the determinations described in the determination statements in support of assurance requirements and the associated management of risk. The potential methods and objects in the assessment procedure are provided as a resource to assist in the selection of appropriate methods and objects and not with the intent of limiting the selection. Organizations use their judgment when selecting assessment methods and associated assessment objects. Organizations select those methods and objects that most cost-effectively manage risk and contribute to making the determinations associated with the assessment objective. 38 The quality of assessment results is based on the soundness of the rationale provided for selecting the methods and objects, not the specific set

Common controls are not assessed as part of system control assessments unless the common controls are part of a system that provides the common control(s) for inheritance by other systems. The assessor simply verifies that the system being assessed has actually inherited the common control (i.e., that a given inherited common control is being used by the system being assessed to provide protection) and the control is not implemented at the level of the system being assessed.

38 The selection of assessment methods and objects (including the number and type of assessment objects, i.e., coverage) can be a significant factor in cost-effectively managing risk while still meeting the assessment objectives.

CHAPTER THREE

PAGE 25

of methods and objects applied. It is not necessary, in most cases, to apply every assessment method to every assessment object to obtain the desired assurance. 3.2.3.2 DEPTH- AND COVERAGE-RELATED CONSIDERATIONS

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53Ar5

In addition to selecting appropriate assessment methods and objects, each assessment method (i.e., examine, interview, and test) is associated with the depth and coverage attributes described in Appendix C. The attribute values identify the rigor (depth) and scope (coverage) of the assessment procedures executed by the assessor. The values selected by the organization are based on the characteristics of the system being assessed (including assurance requirements) and the specific determinations to be made. The depth and coverage attribute values are associated with the assurance requirements specified by the organization (i.e., the rigor and scope of the assessment increases in direct relationship with the assurance requirements, which in turn increase in direct relationship with the adverse impact of loss). 3.2.3.3 COMMON CONTROL-RELATED CONSIDERATIONS Assessors note which security and privacy controls (or parts of such controls) in security plans or privacy plans are designated as common controls. 39 Since the assessment of common controls is the responsibility of the organizational entity that developed and implemented the controls (i.e., common control provider), the assessment procedures in Chapter 4 are also used to assess common controls. The results from the common control assessment are made available to organizational systems and system owners that elect to inherit the common controls. 40 Another consideration in assessing common controls is awareness of system-specific aspects of a control that are not covered by the organizational entities responsible for the common aspects of the control. Such controls are referred to as hybrid controls. For example, CP-02, the contingency planning security control, may be considered a hybrid control by the organization if there is a contingency plan developed by the organization for all organizational systems. System owners are expected to adjust or tailor the organization-developed contingency plan when there are specific aspects of the plan that need to be defined for the particular system where the control is employed. For each hybrid control, assessors include in security assessment plans or privacy assessment plans the portions of the assessment procedures from Chapter 4 related to the parts of the control that are system-specific to ensure that, along with the results from common control assessments, all aspects of the control are assessed.

39 Common controls support multiple systems within the organization, and the protection measures provided by common controls are inherited by individual systems. Therefore, the organization determines the appropriate set of common controls to ensure that both the strength of the controls (i.e., security or privacy capability) and level of rigor and intensity of the control assessments are commensurate with the privacy risk assessment and categorization of the individual systems inheriting those controls. Weaknesses or deficiencies in common controls have the potential to adversely affect large portions of the organization and thus require significant attention. 40 If assessment results are not currently available for the common controls, the assessment plans for the systems under assessment that depend on those controls are duly noted. The assessments cannot be considered complete until the assessment results for the common controls are made available to system owners.

CHAPTER THREE

PAGE 26

ASSESSING COMMON CONTROLS AND PORTIONS OF HYBRID CONTROLS INHERITED FROM A COMMON CONTROL PROVIDER

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53Ar5

In system security and privacy plans, common controls or portions of hybrid controls implemented and maintained by the common control provider are indicated as “inherited” with a reference to the common control provider. The system owner is not responsible for assessing common controls or the inherited portion of hybrid controls. Common controls are assessed separately and are not reassessed at the system level by each system that inherits them. However, the assessor verifies if the system does, in fact, inherit and utilize the common control as indicated in the system security plans and privacy plans. The assessment of common controls (for the common control provider) is carried out using the same process as a system control assessment.

3.2.3.4 SYSTEM/PLATFORM- AND ORGANIZATION-RELATED CONSIDERATIONS The assessment procedures in SP 800-53A may be adapted to address system-, platform-, or organization-specific dependencies. For example, the assessment of a Linux implementation of control IA-02 for the identification and authentication of users might include an explicit examination of any key-based, “password-less” login capability and potential risks inherent from any deficiency in key management, account management, system and boundary protection, physical and environmental protection, and other safeguards to prevent identification and authentication bypass by unauthorized users or processes acting on behalf of users. 3.2.3.5 REUSE OF ASSESSMENT EVIDENCE-RELATED CONSIDERATIONS Reuse of assessment results from previously accepted or approved assessments is considered in the body of evidence for determining overall security and privacy control effectiveness. Previously accepted or approved assessments include assessments of inherited common controls that are managed by the organization and support multiple systems, assessments of security or privacy controls that are reviewed as part of the control implementation (e.g., CP-02 requires a review of the contingency plan), or security-related information generated by the organization’s ISCM program. The acceptability of reusing assessment results in a security control assessment or privacy control assessment is coordinated with and approved by the users of the assessment results. It is essential that system owners and common control providers collaborate with authorizing officials and other appropriate organizational officials to determine the acceptability of using previous assessment results. When considering the reuse of assessment results and the value of those results to the current assessment, assessors determine the credibility of the assessment evidence, the appropriateness of previous analysis, and the applicability of the assessment evidence to current system operating conditions. If previous assessment results are reused, the date and type of the original assessment are documented in the assessment plan and assessment report. In certain situations, it may be necessary to supplement previous assessment results under consideration for reuse with additional assessment activities to fully address the current assessment objectives. For example, if an independent evaluation of an information technology product did not test a particular configuration setting that is employed by the organization in a system, then the assessor may need to supplement the original test results with additional testing to cover that configuration setting for the current system environment. The decision to reuse assessment results is documented in the security assessment plan or privacy assessment

CHAPTER THREE

PAGE 27

plan and the final security assessment report or privacy assessment report, and it is consistent with legislation, policies, directives, standards, and guidelines. The following items are considered when validating previous assessment results for reuse: •

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53Ar5

•

Changing conditions associated with security controls and privacy controls over time. Security and privacy controls that were deemed effective during previous assessments may have become ineffective due to changing conditions within the system or its environment of operation, including emergent threat information. Assessment results that were found to be previously acceptable may no longer provide credible evidence for the determination of security or privacy control effectiveness, and therefore, a reassessment may be required. Applying previous assessment results to a current assessment necessitates the identification of any changes that have occurred since the previous assessment and the impact of these changes on the previous results. For example, reusing previous assessment results from examining an organization’s security or privacy policies and procedures may be acceptable if it is determined that there have not been any significant changes to the identified policies and procedures. Reusing assessment results produced during the previous authorization of a system is a costeffective method for supporting continuous monitoring activities and annual FISMA reporting requirements when the related controls have not changed and there are adequate reasons for confidence in their continued application. Amount of time that has transpired since previous assessments. In general, as the time between current and previous assessments increases, the credibility and utility of the previous assessment results decrease. This is primarily because the system or the environment in which the system operates is more likely to change with the passage of time, possibly invalidating the original conditions or assumptions on which the previous assessment was based. Degree of independence of previous assessments. Assessor independence can be a critical factor in certain types of assessments. The degree of independence required from assessment to assessment should be consistent. For example, it is not appropriate to reuse results from a previous self-assessment where no assessor independence was required when a current assessment requires a greater degree of independence.

3.2.3.6 EXTERNAL SYSTEM- RELATED CONSIDERATIONS The assessment procedures in Chapter 4 need to be adjusted, as appropriate, to accommodate the assessment of external systems. 41 Because the organization does not always have direct control over the security or privacy controls used in external systems or sufficient visibility into the development, implementation, and assessment of those controls, alternative assessment approaches may need to be applied, resulting in the need to tailor the assessment procedures described in Chapter 4. Where required assurances of agreed-upon security or privacy controls within a system are documented in contracts or service-level agreements, assessors review the contracts or agreements and tailor the assessment procedures as appropriate to assess the 41 An external system is a system or component of a system that is outside of the authorization boundary established

by the organization and for which the organization typically has no direct control over the application of required security and privacy controls or the assessment of control effectiveness. [SP 800-37] and [SP 800-53] provide additional guidance on external systems and the effect of employing security and privacy controls in external environments.

CHAPTER THREE

PAGE 28

security or privacy controls or the security and privacy control assessment results provided through contracts or agreements. In addition, assessors consider any other assessments that have been conducted or are in the process of being conducted for external systems that are relied upon with regard to protecting the system under assessment. Applicable information from these assessments, if deemed reliable, is incorporated into the security assessment report or privacy assessment report, as appropriate. 3.2.4 DEVELOP ASSESSMENT PROCEDURES FOR ORGANIZATION-SPECIFIC CONTROLS

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53Ar5

Based on organizational policies, mission or business function requirements, and an assessment of risk, organizations may choose to develop and implement additional (organization-specific) controls or control enhancements for their systems that are beyond the scope of [SP 800-53]. Such controls are documented in the security plan and privacy plan as controls not found in SP 800-53. To assess the controls not found in SP 800-53, assessors use the guidelines in Chapter 2 to develop assessment procedures for those controls and control enhancements. The assessment procedures developed are subsequently integrated into the assessment plan, as appropriate. 3.2.5 OPTIMIZE SELECTED ASSESSMENT PROCEDURES TO ENSURE MAXIMUM EFFICIENCY Assessors have flexibility in organizing assessment plans that meet the needs of the organization and that provide the best opportunity for obtaining the necessary evidence to determine security or privacy control effectiveness while reducing overall assessment costs. Combining and consolidating assessment procedures is one area where flexibility can be applied. During the assessment of a system, assessment methods are applied numerous times to a variety of assessment objects within a particular family of controls. To save time, reduce assessment costs, and maximize the usefulness of assessment results, assessors review the selected assessment procedures for the control families and combine or consolidate the procedures (or parts of procedures) whenever possible or practicable. For example, assessors may consolidate interviews with key organizational officials who deal with a variety of security- or privacy-related topics. Assessors may have other opportunities for significant consolidation and cost savings by examining all policies and procedures from the families of security controls and privacy controls at the same time or by organizing groups of related policies and procedures that could be examined as a unified entity. Obtaining and examining configuration settings from similar hardware and software components within the system is another example that can provide significant assessment efficiencies. An additional area for consideration in optimizing the assessment process is the sequence in which controls are assessed. The assessment of some controls before others may provide useful information that facilitates understanding and more efficient assessments of other controls. For example, controls such as CM-2 (Baseline Configuration), CM-8 (System Component Inventory), PL-2 (System Security and Privacy Plans), RA-2 (Security Categorization), and RA-3 (Risk Assessment) produce general descriptions of the system. Assessing related controls early in the assessment process may provide a basic understanding of the system that can aid in assessing other controls. In SP 800-53, the discussion section for each control identifies related controls that can provide useful information for organizing the assessment procedures. For example, AC19 (Access Control for Mobile Devices) lists controls MP-4 (Media Storage) and MP-5 (Media Transport) as being related to AC-19. Since AC-19 is related to MP-4 and MP-5, the sequence in

CHAPTER THREE

PAGE 29

which assessments are conducted for AC-19, MP-4, and MP-5 may facilitate the reuse of assessment information from one control in assessing other related controls. 3.2.6 FINALIZE ASSESSMENT PLAN AND OBTAIN APPROVAL TO EXECUTE PLAN

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53Ar5

After selecting the assessment procedures (including developing necessary procedures not contained in the SP 800-53A catalog of procedures), tailoring the procedures for system/platform-specific and organization-specific conditions, optimizing the procedures for efficiency, and addressing the potential for unexpected events that may impact the assessment, the assessment plan is finalized and the schedule is established, including key milestones for the assessment process. Once the assessment plan is completed, the plan is reviewed and approved by appropriate organizational officials 42 to ensure that the plan is complete, consistent with the security and privacy objectives of the organization and the organization’s assessment of risk, and cost-effectively manages risk with regard assessment methods and objects, depth and coverage attributes, and to the resources allocated for the assessment.

3.3 CONDUCT SECURITY AND PRIVACY CONTROL ASSESSMENTS Table 3 provides a summary of the purpose, roles, and expected outcomes of the Conduct Security and Privacy Control Assessments Step. TABLE 3. CONDUCT SECURITY AND PRIVACY CONTROL ASSESSMENTS SUMMARY

Purpose

Primary Roles

Conduct the security and privacy control assessment in accordance with the assessment plan, and document the results in security and privacy assessment report(s). Control assessors

Supporting Roles

System security and privacy officers, system owners, security and privacy engineers, security and privacy architects, system administrators, system users

Outcomes

• •

In-scope controls and control enhancements are assessed in accordance with the security and privacy assessment plan(s) Security and privacy assessment report(s) documenting the effectiveness of the controls and identified weaknesses/deficiencies are produced

After the assessment plan is approved by the organization, the assessor(s) or assessment team executes the plan in accordance with the agreed-upon schedule. Determining the size and organizational makeup of the assessment team (i.e., skill sets, technical expertise, and assessment experience of the individuals composing the team) is one of the risk management decisions made by the organization requesting and initiating the assessment. The results of control assessments are documented in assessment reports, which are key inputs in the authorization package developed by system owners and common control providers for

42 Organizations establish a security and privacy assessment plan approval process with the specific organizational

officials (e.g., systems owners, common control providers, system security and privacy officers, senior information security officers, senior agency officials for privacy/chief privacy officers, authorizing officials) designated as approving authorities.

CHAPTER THREE

PAGE 30

authorizing officials. 43 Assessment reports include information from assessors (in the form of assessment findings) that is necessary to determine the effectiveness of the security and privacy controls employed within the system. 44 Assessment reports are an important factor in an authorizing official’s determination of risk. Organizations may choose to develop an assessment summary from the detailed findings that are generated by assessors during the security control assessments and privacy control assessments. An assessment summary can provide an authorizing official with an abbreviated version of an assessment report that focuses on the highlights of the assessment, synopsis of key findings, and recommendations for addressing weaknesses and deficiencies in the security or privacy controls assessed. Appendix E provides information on the recommended content of assessment reports. This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53Ar5

Assessment objectives are achieved by applying the designated assessment methods to selected assessment objects and compiling or producing the evidence necessary to make the determination associated with each assessment objective. Each determination statement 45 contained within an assessment procedure executed by an assessor produces one of the following findings: • •

satisfied (S); or other than satisfied (O).

A finding of “satisfied” indicates that – for the portion of the control addressed by the determination statement – the assessment objective for the control has been met and produces a fully acceptable result. A finding of “other than satisfied” indicates – for the portion of the control addressed by the determination statement – potential anomalies in the operation or implementation of the control that may need to be addressed by the organization. A finding of “other than satisfied” may also indicate that the assessor was unable to obtain sufficient information to make the determination called for in the determination statement for reasons specified in the assessment report. For assessment findings that are “other than satisfied”, organizations may choose to define subcategories of findings indicating the severity and/or criticality of the weaknesses or deficiencies discovered and the potential adverse effects on organizational operations (i.e., mission, functions, image, or reputation), organizational assets, individuals, other organizations, or the Nation. Defining such subcategories can help to establish priorities for needed risk mitigation actions. Assessor findings are an unbiased, factual reporting of what was found concerning the control assessed. For each finding of “other than satisfied”, assessors indicate which parts of the control are affected by the finding (i.e., aspects of the control that were deemed not satisfied or were not able to be assessed) and describe how the actual state of the control differs from the planned or expected/desired state. The potential for compromises to confidentiality, integrity,

43 In accordance with [SP 800-37], the authorization package consists of the security plan, privacy plan, security

assessment report, privacy assessment report, and plan of action and milestones (POA&M).

44 See Section 3.2.3 for additional information about assessing common controls and portions of hybrid controls

inherited from a common control provider.

45 For additional information on determination statements and assessment findings, see Appendix E.

CHAPTER THREE

PAGE 31

and availability or privacy risks due to “other than satisfied” findings are also noted by the assessor in the assessment report.

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53Ar5

Risk determination and acceptance activities are conducted by the organization postassessment as part of the risk management strategy established by the organization. Postassessment risk management activities involve the senior leadership of the organization, such as heads of agencies, mission and business owners, information owners/stewards, risk executive (function), and authorizing officials in consultation with appropriate organizational support staff (e.g., senior information security officers, senior agency officials for privacy/chief privacy officers, chief information officers, system owners, common control providers, and assessors). Security control assessment and privacy control assessment results are documented at a level of detail appropriate for the assessment in accordance with the reporting format prescribed by organizational policy, NIST guidelines, and OMB policy. The reporting format is appropriate for the type of assessment conducted (e.g., self-assessments by system owners and common control providers, independent verification and validation, independent assessments supporting the authorization process, automated assessments, or independent audits or inspections). System owners and common control providers rely on the expertise and technical judgment of assessors to assess the security and privacy controls in the system and inherited by the system and provide recommendations on how to respond to the control assessment results (e.g., accept risk, reject risk, mitigate risk by correcting weaknesses or deficiencies in the controls and reducing or eliminating identified vulnerabilities). The assessment results produced by the assessor (i.e., findings of “satisfied” or “other than satisfied”, identification of the parts of the security or privacy control that did not produce a satisfactory result, and a description of resulting potential for compromises to the system or its environment of operation) are provided to system owners and common control providers in the initial security assessment reports and privacy assessment reports. System owners and common control providers may choose to act on selected recommendations of the assessor before the assessment reports are finalized if there are specific opportunities to correct weaknesses or deficiencies in the security or privacy controls or to correct and/or clarify misunderstandings or interpretations of assessment results. 46 Security or privacy controls that are modified, enhanced, or added during this process are reassessed by the assessor prior to the production of the final assessment reports.

3.4 ANALYZE ASSESSMENT REPORT RESULTS Table 4 provides a summary of the purpose, roles, and expected outcomes of the Analyze Assessment Report Results Step.

46 The correction of weaknesses or deficiencies in security or privacy controls or carrying out recommendations during

the review of the initial security assessment reports or privacy assessment reports by system owners or common control providers are not intended to replace the formal risk response process by the organization, which occurs after the delivery of the final reports. Rather, it provides the system owner or common control provider with an opportunity to address weaknesses or deficiencies that may be quickly corrected. However, in situations where limited resources exist for remediating weaknesses and deficiencies discovered during the security control assessments or privacy control assessments, organizations may decide without prejudice that waiting for the risk assessment to prioritize remediation efforts is the better course of action.

CHAPTER THREE

PAGE 32

Purpose

Analyze the risks resulting from identified weaknesses and deficiencies in controls and determine an approach to respond to risk in accordance with organizational priorities.

Primary Roles Supporting Roles Outcomes

System owners or common control providers, authorizing officials

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53Ar5

System security and privacy officers, security and privacy engineers, security and privacy architects • Control assessment findings are reviewed • Subsequent risk responses are taken to manage risk • Authorization package artifacts (e.g., security and privacy plans, security and privacy assessment reports, and plans of action and milestones) are updated to reflect the as-implemented state of the system or common controls

The results of control assessments ultimately influence control implementations, the content of security plans and privacy plans, and the respective plans of action and milestones. Accordingly, system owners and common control providers review the security assessment reports, privacy assessment reports, and updated risk assessment documentation and artifacts and – with the concurrence of designated organizational officials (e.g., authorizing officials, chief information officer, senior information security officer, senior agency officials for privacy/chief privacy officers, mission/information owners) – determine the appropriate steps required to respond to those weaknesses and deficiencies identified during the assessment. By using the labels of “satisfied” and “other than satisfied”, the reporting format for the assessment findings provides organizational officials with visibility into specific weaknesses and deficiencies in security or privacy controls within the system or inherited by the system and facilitates a disciplined and structured approach to responding to risks in accordance with organizational priorities. For example, system owners or common control providers in consultation with designated organizational officials may decide that certain assessment findings marked as “other than satisfied” present no significant risk to the organization and can be accepted. Conversely, system owners or common control providers may decide that certain findings marked as “other than satisfied” are significant and require remediation actions. In all cases, the organization reviews each assessment finding of “other than satisfied” and applies its judgment with regard to the severity of the finding and whether it is significant enough to warrant further investigation or remedial action. 47 Senior leadership involvement in the mitigation process may be necessary to ensure that the organization’s resources are effectively allocated in accordance with organizational priorities, provide resources first to the systems that support the most critical and sensitive missions for the organization, or correct the deficiencies that pose the greatest degree of risk. Ultimately, the assessment findings and any subsequent response actions (informed by the updated risk assessment) trigger updates to the key artifacts used by authorizing officials to determine the security and privacy risks of the system and its suitability for authorization to operate. The artifacts include security plans and privacy plans, security assessment reports and privacy assessment reports, and the respective plans of action and milestones. 47 Potential risk response actions include risk acceptance, risk mitigation, risk rejection, and risk transfer/sharing.

[SP 800-39] provides guidance on risk response actions from a risk management perspective.

CHAPTER THREE

PAGE 33

3.5 ASSESS SECURITY AND PRIVACY CAPABILITIES

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53Ar5

In accordance with [SP 800-53], organizations may define a set of security and privacy capabilities as a precursor to the security and privacy control selection process. The concept of capability 48 recognizes that the protection of individuals’ privacy and information being processed by systems seldom derives from a single security or privacy safeguard or countermeasure. In most cases, such protection results from the selection and implementation of a set of mutually reinforcing security and privacy controls. Each control contributes to the overall organization-defined capability with some controls potentially contributing to a greater degree and other controls contributing to a lesser degree. For example, organizations may wish to define a capability for secure remote authentication. A secure remote authentication capability can be achieved by the implementation of a set of security controls from SP 800-53 (i.e., IA-02(01), IA-02(02), IA-02(08)], and SC-08(01)). Security and privacy capabilities can address a variety of areas, including technical means, physical means, procedural means, or any combination thereof. By employing the capability concept, organizations can obtain greater visibility into and a better understanding of the relationships (i.e., dependencies) among controls, the effects of specific control failures on organization-defined capabilities, and the potential severity of control weaknesses or deficiencies. However, when specific capabilities are affected by the failure of particular security and privacy controls, the capability approach may add complexity to assessments and necessitate root cause failure analysis to determine which control or controls are contributing to the failure. The greater the number of controls included in an organization-defined capability, the more difficult it may be to ascertain the root cause of failures. There may also be interactions among defined capabilities, which may contribute to the complexity of assessments. If it is found that a control is neither contributing to a defined capability nor to the overall security and privacy of the system, the organization revisits the RMF Select step, tailors the control set, and documents the rationale in the system security plan or privacy plan. Traditionally, assessments have been conducted on a control-by-control basis and produce results that are characterized as pass (i.e., control satisfied) or fail (i.e., control not satisfied). However, the failure of a single control or, in some cases, the failure of multiple controls may not affect the overall security and privacy capability required by an organization. This is not to say that such controls do not contribute to the security or privacy of the system and/or organization (as defined by the security requirements and privacy requirements during the initiation phase of the system development life cycle) but rather that such controls may not support the particular security or privacy capability. Furthermore, every implemented security and privacy control may not necessarily support or need to support an organization-defined capability. When organizations employ the concept of capabilities, automated and manual assessments account for all security and privacy controls that comprise the security and privacy capabilities. Assessors are aware of how the controls work together to provide such capabilities. In this way, 48 A security capability or privacy capability is a combination of mutually reinforcing security controls or privacy

controls (i.e., safeguards and countermeasures) implemented by technical means (i.e., functionality in hardware, software, and firmware), physical means (i.e., physical devices and protective measures), and procedural means (i.e., procedures performed by individuals).

CHAPTER THREE

PAGE 34

when assessments identify a failure in a capability, a root cause analysis can be conducted to determine the specific control or controls that are responsible for the failure based on the established relationships among controls. Moreover, employing the broader capability construct allows organizations to assess the severity of vulnerabilities discovered in their systems and organizations and determine if the failure of a particular security control or privacy control (associated with a vulnerability) or the decision not to deploy a certain control during the initial tailoring process (RMF Select step) affects the overall capability needed for mission and business protection. For example, the failure of a security control deemed critical for a particular security capability may be assigned a higher severity rating than a failed control of lesser importance to the capability. This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53Ar5

Ultimately, authorization decisions (i.e., risk acceptance decisions) are made based on the degree to which the desired security and privacy capabilities have been effectively achieved and are meeting the security and privacy requirements defined by an organization. Risk-based decisions are directly related to organizational risk tolerance that is defined as part of an organization’s risk management strategy. CAPABILITY-BASED ASSESSMENTS The grouping of controls into security and privacy capabilities necessitates root cause analyses to determine if the failure of a particular security or privacy capability can be traced to the failure of one or more security or privacy controls based on the established relationships among controls. The structure of the assessment procedures in this publication with the token-level decomposition and labelling of assessment objectives linked to the specific content of security and privacy controls supports such root cause analysis. Thus, assessments of security and privacy controls (defined as part of capabilities) can be tailored based on the guidance in Section 3.2.3 and [SP 800-137] to define the resource expenditures (e.g., frequency and level of effort) associated with such assessments. This additional precision in assessments is essential to supporting the continuous monitoring strategies developed by organizations and the ongoing authorization decisions of senior leaders.

CHAPTER THREE

PAGE 35

Figure 8 summarizes the security and privacy control assessment process, including the activities carried out before, during, and after the assessment.

Organiza�on

Prepare for Security and Privacy Control Assessments

Approved Security and Privacy Plans

Assessment

Develop Security and Privacy Assessment Plans

• Implement controls • No�fy key organiza�onal oﬃcials of impending assessment • Establish communica�ons channels among stakeholders • Iden�fy and allocate resources; assemble assessment team • Establish scope and key milestones • Assemble ar�facts for assessment

• Establish organiza�onal points of contact • Understand organiza�on’s mission, func�ons, and business processes • Understand system structure/architecture • Understand selected controls for assessment and relevant NIST standards and guidelines

Post-Assessment

Conduct Security and Privacy Control Assessments

Analyze Assessment Report Results

• Ensure assessment plan is appropriately tailored • Involve senior leadership • Balance schedule, performance, and cost • Approve assessment plan

Assessment Plan(s)

Assessor / Assessment Team

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53Ar5

Pre-Assessment

• Review assessor ﬁndings and assess the risk of weaknesses and deﬁciencies • Determine appropriate response ac�ons • Develop/update Plans of Ac�on and Milestones • Update Security and Privacy Plans (and Risk Assessment)

1. Initial draft report 2. Final report with organizational annotations

Assessment Report(s)

Plans of Ac�on and Milestones

Updated Security and Privacy Plans

Authorization Package • Develop assessment plan based on security and privacy plans • Select assessment methods and objects • Tailor procedures for organiza�on and system • Iden�fy schedule and milestones • Obtain ar�facts for assessment

• Implement assessment plan(s) • Execute assessment procedures to achieve assessment objec�ves • Produce assessment ﬁndings • Recommend speciﬁc remedia�on ac�ons • Produce ini�al (dra�) and ﬁnal assessment report(s)

• Consult with organiza�onal oﬃcials regarding control eﬀec�veness

FIGURE 8: SECURITY AND PRIVACY CONTROL ASSESSMENT PROCESS OVERVIEW

CHAPTER THREE

PAGE 36

CHAPTER FOUR

SECURITY AND PRIVACY ASSESSMENT PROCEDURES OBJECTIVES, METHODS, AND OBJECTS FOR ASSESSING SECURITY AND PRIVACY CONTROLS

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53Ar5

This chapter provides a catalog of procedures to assess the security and privacy controls and control enhancements in [SP 800-53]. 49 Assessors select assessment procedures from the catalog in accordance with the guidance provided in Section 3.2. Since the contents of the security and privacy plan are the basis for the development of the security and privacy assessment plans and the assessments, there will likely be assessment procedures in the catalog not used by assessors because the associated security and privacy controls or control enhancements are not contained in the security and privacy plan for the system, 50 or the security and privacy controls or control enhancements are not being assessed at this time. SP 800-53A REVISION 5, ASSESSMENT PROCEDURE SCHEMA Section 2.4 provides an overview of the assessment procedures, including the naming and numbering convention, assessment objectives, determination statements, potential assessment methods, and objects. Appendix C provides definitions of the assessment methods, applicable objects, and additional information on assessment attributes of depth and coverage.

The same assessment object may appear in multiple assessment object lists in a variety of assessment procedures. The same object may be used in multiple contexts to obtain needed information or evidence for a particular aspect of an assessment. Assessors use the general references as appropriate to obtain the necessary information to make the specified determinations required by the assessment objective. For example, a reference to access control policy appears in the assessment procedures for AC-02 and AC-07. For assessment procedure AC-02, assessors use the access control policy to find information about that portion of the policy that addresses account management for the system. For assessment procedure AC07, assessors use the access control policy to find information about that portion of the policy that addresses unsuccessful login attempts for the system. Assessors are responsible for combining and consolidating the assessment procedures whenever possible or practical. Optimizing assessment procedures can save time, reduce assessment costs, and maximize the usefulness of assessment results. Assessors optimize assessment procedures by determining the best sequencing of the procedures. The assessment

49 [SP 800-53] remains the definitive expression of the control or enhancement in the event of any differences

between the assessment objectives identified for assessing the security and privacy controls and the underlying intent expressed by the security and privacy control statements defined in the most recent version of SP 800-53. 50 The execution of the RMF includes the selection of an initial set of security and privacy controls employed within or

inherited by an organizational system followed by a control tailoring process. The tailoring process often changes the set of security and privacy controls contained in the final security plan and privacy program plan. Therefore, the selection of assessment procedures from the catalog of available procedures is based solely on the content of the plan(s) after the tailoring activities are completed.

CHAPTER FOUR

PAGE 37

of some security and privacy controls before others may provide information that facilitates understanding and assessment of other controls. 51 The assessment procedures are published in multiple data formats, including comma-separated values (CSV), plain text, and Open Security Controls Assessment (OSCAL). The available data formats are accessible from on the NIST SP 800-53A Revision 5, publication details page at https://csrc.nist.gov/publications/detail/sp/800-53A/rev-5. The OSCAL Content Git Repository is available at https://github.com/usnistgov/oscal-content. CAUTIONARY NOTE This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53Ar5

Whereas a set of potential assessment methods are included in the following catalog of assessment procedures, the potential assessment methods are not intended to be mandatory or exclusive. Depending on the particular circumstances of the system or organization to be assessed, not all methods may be required, or other assessment methods may also be used. In addition, the set of potential assessment objects listed in the catalog are not intended to be mandatory but rather a set from which the necessary and sufficient set of objects for a given assessment can be selected to make the appropriate determinations. Organizational assurance requirements and other risk management-related factors (e.g., system categorization, organizational risk tolerance) are primary drivers for determining the appropriate assessment methods and objects for a given assessment.

51 For additional information on optimizing assessment procedures, refer to Section 3.2.5.

CHAPTER FOUR

PAGE 38

IMPLEMENTATION TIPS TIP #1: Select only those assessment procedures from Chapter 4 that correspond to the controls and control enhancements in the approved system security plan and privacy plan to be included in the assessment.

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53Ar5

TIP #2: The assessment procedures selected from Chapter 4 are example procedures that serve as a starting point for organizations preparing for assessments. These assessment procedures are tailored as necessary by the assessors in accordance with the guidance in Section 3.2.3 to adapt to specific organizational requirements and operating environments. TIP #3: With respect to the assessment procedures in Chapter 4, assessors need only apply those procedures, methods, and objects necessary for making a final determination that a particular security control requirement is “satisfied” or “not satisfied” (see Section 3.3). TIP #4: To each assessment method, assessors apply values for depth and coverage (described in Appendix C) that are commensurate with the characteristics of the system (including assurance requirements) and the specific assessment activity that supports making a determination of the effectiveness of the security controls under review. The values selected for the depth and coverage attributes indicate the relative effort required in applying an assessment method to an assessment object (i.e., the rigor and scope of the activities associated with the assessment). The depth and coverage attributes, while not repeated in every assessment procedure in this appendix, can be represented as follows: Interview: [assign attribute values: <depth>, <coverage>]. [SELECT FROM: Organizational personnel with contingency planning and plan implementation responsibilities]. TIP #5: Assessors may find useful assessment-related information in the Discussion and Related Controls section of each control described in [SP 800-53]. Information from the discussion about related controls can be used to carry out more effective assessments with regard to the application of assessment procedures and the reuse of assessment artifacts. TIP #6: For controls with ODPs, the ODP values are defined during the RMF Select step and updated as necessary during the RMF Implement and Monitor steps. If ODP values are not defined and implemented, control effectiveness cannot be verified, resulting in an “other than satisfied” finding. TIP #7: Organizations may refer to this publication or the derivative data formats to easily identify all of the control parameters whose values to define. The ODP definitions are highlighted within the assessment procedure listing and can be filtered using keyword “_ODP” or “XX-nn_ODP” (where XX is the twocharacter control family abbreviation, and nn is the control number). Note: When assessing agency compliance with NIST guidance, auditors, Inspectors General, evaluators, and/or assessors consider the intent of the security and privacy concepts and principles articulated within the particular guidance document and how the agency applied the guidance in the context of its specific mission responsibilities, operational environments, and unique organizational conditions.

CHAPTER FOUR

PAGE 39

NIST SP 800-53A, REV. 5

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

4.1 ACCESS CONTROL AC-01

POLICY AND PROCEDURES ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5 CHAPTER FOUR

AC-01_ODP[01]

personnel or roles to whom the access control policy is to be disseminated is/are deﬁned;

AC-01_ODP[02]

personnel or roles to whom the access control procedures are to be disseminated is/are deﬁned;

AC-01_ODP[03]

one or more of the following PARAMETER VALUES is/are selected: {organizaonlevel; mission/business process-level; system-level};

AC-01_ODP[04]

an oﬃcial to manage the access control policy and procedures is deﬁned;

AC-01_ODP[05]

the frequency at which the current access control policy is reviewed and updated is deﬁned;

AC-01_ODP[06]

events that would require the current access control policy to be reviewed and updated are deﬁned;

AC-01_ODP[07]

the frequency at which the current access control procedures are reviewed and updated is deﬁned;

AC-01_ODP[08]

events that would require procedures to be reviewed and updated are deﬁned;

AC-01a.[01]

an access control policy is developed and documented;

AC-01a.[02]

the access control policy is disseminated to <AC-01_ODP[01] personnel or roles>;

AC-01a.[03]

access control procedures to facilitate the implementaon of the access control policy and associated controls are developed and documented;

AC-01a.[04]

the access control procedures are disseminated to <AC-01_ODP[02] personnel or roles>;

AC-01a.01(a)[01]

the <AC-01_ODP[03] SELECTED PARAMETER VALUE(S)> access control policy addresses purpose;

AC-01a.01(a)[02]

the <AC-01_ODP[03] SELECTED PARAMETER VALUE(S)> access control policy addresses scope;

AC-01a.01(a)[03]

the <AC-01_ODP[03] SELECTED PARAMETER VALUE(S)> access control policy addresses roles;

AC-01a.01(a)[04]

the <AC-01_ODP[03] SELECTED PARAMETER VALUE(S)> access control policy addresses responsibilies;

AC-01a.01(a)[05]

the <AC-01_ODP[03] SELECTED PARAMETER VALUE(S)> access control policy addresses management commitment;

AC-01a.01(a)[06]

the <AC-01_ODP[03] SELECTED PARAMETER VALUE(S)> access control policy addresses coordinaon among organizaonal enes;

AC-01a.01(a)[07]

the <AC-01_ODP[03] SELECTED PARAMETER VALUE(S)> access control policy addresses compliance;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 40

NIST SP 800-53A, REV. 5

AC-01

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

POLICY AND PROCEDURES

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

AC-01a.01(b)

the <AC-01_ODP[03] SELECTED PARAMETER VALUE(S)> access control policy is consistent with applicable laws, Execuve Orders, direcves, regulaons, policies, standards, and guidelines;

AC-01b.

the <AC-01_ODP[04] oﬃcial> is designated to manage the development, documentaon, and disseminaon of the access control policy and procedures;

AC-01c.01[01]

the current access control policy is reviewed and updated <AC-01_ODP[05] frequency>;

AC-01c.01[02]

the current access control policy is reviewed and updated following <AC-01_ODP[06] events>;

AC-01c.02[01]

the current access control procedures are reviewed and updated <AC-01_ODP[07] frequency>;

AC-01c.02[02]

the current access control procedures are reviewed and updated following <AC-01_ODP[08] events>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

AC-02

AC-01-Examine

[SELECT FROM: Access control policy and procedures; system security plan; privacy plan; other relevant documents or records].

AC-01-Interview

[SELECT FROM: Organizaonal personnel with access control responsibilies; organizaonal personnel with informaon security with informaon security and privacy responsibilies].

ACCOUNT MANAGEMENT ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

AC-02_ODP[01]

prerequisites and criteria for group and role membership are deﬁned;

AC-02_ODP[02]

aributes (as required) for each account are deﬁned;

AC-02_ODP[03]

personnel or roles required to approve requests to create accounts is/are deﬁned;

AC-02_ODP[04]

policy, procedures, prerequisites, and criteria for account creaon, enabling, modiﬁcaon, disabling, and removal are deﬁned;

AC-02_ODP[05]

personnel or roles to be noﬁed is/are deﬁned;

AC-02_ODP[06]

me period within which to nofy account managers when accounts are no longer required is deﬁned;

AC-02_ODP[07]

me period within which to nofy account managers when users are terminated or transferred is deﬁned;

AC-02_ODP[08]

me period within which to nofy account managers when system usage or the need to know changes for an individual is deﬁned;

AC-02_ODP[09]

aributes needed to authorize system access (as required) are deﬁned;

AC-02_ODP[10]

the frequency of account review is deﬁned;

AC-02a.[01]

account types allowed for use within the system are deﬁned and documented;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 41

NIST SP 800-53A, REV. 5

AC-02

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5 CHAPTER FOUR

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

ACCOUNT MANAGEMENT AC-02a.[02]

account types speciﬁcally prohibited for use within the system are deﬁned and documented;

AC-02b.

account managers are assigned;

AC-02c.

<AC-02_ODP[01] prerequisites and criteria> for group and role membership are required;

AC-02d.01

authorized users of the system are speciﬁed;

AC-02d.02

group and role membership are speciﬁed;

AC-02d.03[01]

access authorizaons (i.e., privileges) are speciﬁed for each account;

AC-02d.03[02]

<AC-02_ODP[02] aributes (as required)> are speciﬁed for each account;

AC-02e.

approvals are required by <AC-02_ODP[03] personnel or roles> for requests to create accounts;

AC-02f.[01]

accounts are created in accordance with <AC-02_ODP[04] policy, procedures, prerequisites, and criteria>;

AC-02f.[02]

accounts are enabled in accordance with <AC-02_ODP[04] policy, procedures, prerequisites, and criteria>;

AC-02f.[03]

accounts are modiﬁed in accordance with <AC-02_ODP[04] policy, procedures, prerequisites, and criteria>;

AC-02f.[04]

accounts are disabled in accordance with <AC-02_ODP[04] policy, procedures, prerequisites, and criteria>;

AC-02f.[05]

accounts are removed in accordance with <AC-02_ODP[04] policy, procedures, prerequisites, and criteria>;

AC-02g.

the use of accounts is monitored;

AC-02h.01

account managers and <AC-02_ODP[05] personnel or roles> are noﬁed within <AC-02_ODP[06] me period> when accounts are no longer required;

AC-02h.02

account managers and <AC-02_ODP[05] personnel or roles> are noﬁed within <AC-02_ODP[07] me period> when users are terminated or transferred;

AC-02h.03

account managers and <AC-02_ODP[05] personnel or roles> are noﬁed within <AC-02_ODP[08] me period> when system usage or the need to know changes for an individual;

AC-02i.01

access to the system is authorized based on a valid access authorizaon;

AC-02i.02

access to the system is authorized based on intended system usage;

AC-02i.03

access to the system is authorized based on <AC-02_ODP[09] aributes (as required)>;

AC-02j.

accounts are reviewed for compliance with account management requirements <AC-02_ODP[10] frequency>;

AC-02k.[01]

a process is established for changing shared or group account authencators (if deployed) when individuals are removed from the group;

AC-02k.[02]

a process is implemented for changing shared or group account authencators (if deployed) when individuals are removed from the group;

AC-02l.[01]

account management processes are aligned with personnel terminaon processes;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 42

NIST SP 800-53A, REV. 5

AC-02

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

ACCOUNT MANAGEMENT AC-02l.[02]

account management processes are aligned with personnel transfer processes.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

AC-02(01)

AC-02-Examine

[SELECT FROM: Access control policy; personnel terminaon policy and procedure; personnel transfer policy and procedure; procedures for addressing account management; system design documentaon; system conﬁguraon sengs and associated documentaon; list of acve system accounts along with the name of the individual associated with each account; list of recently disabled system accounts and the name of the individual associated with each account; list of condions for group and role membership; noﬁcaons of recent transfers, separaons, or terminaons of employees; access authorizaon records; account management compliance reviews; system monitoring records; system audit records; system security plan; privacy plan; other relevant documents or records].

AC-02-Interview

[SELECT FROM: Organizaonal personnel with account management responsibilies; system/network administrators; organizaonal personnel with informaon security with informaon security and privacy responsibilies].

AC-02-Test

[SELECT FROM: Organizaonal processes for account management on the system; mechanisms for implemenng account management].

ACCOUNT MANAGEMENT | AUTOMATED SYSTEM ACCOUNT MANAGEMENT ASSESSMENT OBJECTIVE: Determine if:

AC-02(01)_ODP

automated mechanisms used to support the management of system accounts are deﬁned;

AC-02(01)

the management of system accounts is supported using <AC-02(01)_ODP automated mechanisms>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

AC-02(02)

AC-02(01)-Examine

AC-02(01)-Interview

AC-02(01)-Test

[SELECT FROM: Automated mechanisms for implemenng account management funcons].

ACCOUNT MANAGEMENT | AUTOMATED TEMPORARY AND EMERGENCY ACCOUNT MANAGEMENT ASSESSMENT OBJECTIVE: Determine if:

AC-02(02)_ODP[01]

CHAPTER FOUR

one of the following PARAMETER VALUES is selected: {remove; disable};

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 43

NIST SP 800-53A, REV. 5

AC-02(02)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

ACCOUNT MANAGEMENT | AUTOMATED TEMPORARY AND EMERGENCY ACCOUNT MANAGEMENT AC-02(02)_ODP[02]

the me period aer which to automacally remove or disable temporary or emergency accounts is deﬁned;

AC-02(02)

temporary and emergency accounts are automacally <AC-02(02)_ODP[01] SELECTED PARAMETER VALUE> aer <AC-02(02)_ODP[02] me period>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

AC-02(03)

AC-02(02)-Examine

[SELECT FROM: Access control policy; procedures for addressing account management; system design documentaon; system conﬁguraon sengs and associated documentaon; system-generated list of temporary accounts removed and/or disabled; system-generated list of emergency accounts removed and/or disabled; system audit records; system security plan; other relevant documents or records].

AC-02(02)-Interview

AC-02(02)-Test

[SELECT FROM: Automated mechanisms for implemenng account management funcons].

ACCOUNT MANAGEMENT | DISABLE ACCOUNTS ASSESSMENT OBJECTIVE: Determine if:

AC-02(03)_ODP[01]

me period within which to disable accounts is deﬁned;

AC-02(03)_ODP[02]

me period for account inacvity before disabling is deﬁned;

AC-02(03)(a)

accounts are disabled within <AC-02(03)_ODP[01] me period> when the accounts have expired;

AC-02(03)(b)

accounts are disabled within <AC-02(03)_ODP[01] me period> when the accounts are no longer associated with a user or individual;

AC-02(03)(c)

accounts are disabled within <AC-02(03)_ODP[01] me period> when the accounts are in violaon of organizaonal policy;

AC-02(03)(d)

accounts are disabled within <AC-02(03)_ODP[01] me period> when the accounts have been inacve for <AC-02(03)_ODP[02] me period>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

AC-02(03)-Examine

[SELECT FROM: Access control policy; procedures for addressing account management; system security plan; system design documentaon; system conﬁguraon sengs and associated documentaon; system-generated list of accounts removed; system-generated list of emergency accounts disabled; system audit records; system security plan; other relevant documents or records].

AC-02(03)-Interview

[SELECT FROM: Organizaonal personnel with account management responsibilies; system/network administrators; organizaonal personnel with informaon security responsibilies; system developers].

AC-02(03)-Test

[SELECT FROM: Mechanisms for implemenng account management funcons].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 44

NIST SP 800-53A, REV. 5

AC-02(04)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

ACCOUNT MANAGEMENT | AUTOMATED AUDIT ACTIONS ASSESSMENT OBJECTIVE: Determine if:

AC-02(04)[01]

account creaon is automacally audited;

AC-02(04)[02]

account modiﬁcaon is automacally audited;

AC-02(04)[03]

account enabling is automacally audited;

AC-02(04)[04]

account disabling is automacally audited;

AC-02(04)[05]

account removal acons are automacally audited.

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

AC-02(05)

AC-02(04)-Examine

[SELECT FROM: Access control policy; procedures addressing account management; system design documentaon; system conﬁguraon sengs and associated documentaon; noﬁcaons/alerts of account creaon, modiﬁcaon, enabling, disabling, and removal acons; system audit records; system security plan; other relevant documents or records].

AC-02(04)-Interview

[SELECT FROM: Organizaonal personnel with account management responsibilies; system/network administrators; organizaonal personnel with informaon security responsibilies].

AC-02(04)-Test

[SELECT FROM: Automated mechanisms implemenng account management funcons].

ACCOUNT MANAGEMENT | INACTIVITY LOGOUT ASSESSMENT OBJECTIVE: Determine if:

AC-02(05)_ODP

the me period of expected inacvity or descripon of when to log out is deﬁned;

AC-02(05)

users are required to log out when <AC-02(05)_ODP me period of expected inacvity or descripon of when to log out>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

AC-02(05)-Examine

[SELECT FROM: Access control policy; procedures addressing account management; system design documentaon; system conﬁguraon sengs and associated documentaon; security violaon reports; system audit records; system security plan; other relevant documents or records].

AC-02(05)-Interview

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 45

NIST SP 800-53A, REV. 5

AC-02(06)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

ACCOUNT MANAGEMENT | DYNAMIC PRIVILEGE MANAGEMENT ASSESSMENT OBJECTIVE: Determine if:

AC-02(06)_ODP

dynamic privilege management capabilies are deﬁned;

AC-02(06)

<AC-02(06)_ODP dynamic privilege management capabilies> are implemented.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

AC-02(07)

AC-02(06)-Examine

[SELECT FROM: Access control policy; procedures addressing account management; system design documentaon; system conﬁguraon sengs and associated documentaon; system-generated list of dynamic privilege management capabilies; system audit records; system security plan; other relevant documents or records].

AC-02(06)-Interview

AC-02(06)-Test

[SELECT FROM: system or mechanisms implemenng dynamic privilege management capabilies].

ACCOUNT MANAGEMENT | PRIVILEGED USER ACCOUNTS ASSESSMENT OBJECTIVE: Determine if:

AC-02(07)_ODP

one of the following PARAMETER VALUES is selected: {a role-based access scheme; an aribute-based access scheme};

AC-02(07)(a)

privileged user accounts are established and administered in accordance with <AC-02(07)_ODP SELECTED PARAMETER VALUE>;

AC-02(07)(b)

privileged role or aribute assignments are monitored;

AC-02(07)(c)

changes to roles or aributes are monitored;

AC-02(07)(d)

access is revoked when privileged role or aribute assignments are no longer appropriate.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

AC-02(07)-Examine

[SELECT FROM: Access control policy; procedures addressing account management; system design documentaon; system conﬁguraon sengs and associated documentaon; system-generated list of privileged user accounts and associated roles; records of acons taken when privileged role assignments are no longer appropriate; system audit records; audit tracking and monitoring reports; system monitoring records; system security plan; other relevant documents or records].

AC-02(07)-Interview

[SELECT FROM: Organizaonal personnel with account management responsibilies; system/network administrators; organizaonal personnel with informaon security responsibilies].

AC-02(07)-Test

[SELECT FROM: Mechanisms implemenng account management funcons; mechanisms monitoring privileged role assignments].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 46

NIST SP 800-53A, REV. 5

AC-02(08)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

ACCOUNT MANAGEMENT | DYNAMIC ACCOUNT MANAGEMENT ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

AC-02(08)_ODP

system accounts that are dynamically created, acvated, managed, and deacvated are deﬁned;

AC-02(08)[01]

<AC-02(08)_ODP system accounts> are created dynamically;

AC-02(08)[02]

<AC-02(08)_ODP system accounts> are acvated dynamically;

AC-02(08)[03]

<AC-02(08)_ODP system accounts> are managed dynamically;

AC-02(08)[04]

<AC-02(08)_ODP system accounts> are deacvated dynamically.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

AC-02(09)

AC-02(08)-Examine

AC-02(08)-Interview

AC-02(08)-Test

[SELECT FROM: Automated mechanisms implemenng account management funcons].

ACCOUNT MANAGEMENT | RESTRICTIONS ON USE OF SHARED AND GROUP ACCOUNTS ASSESSMENT OBJECTIVE: Determine if:

AC-02(09)_ODP

condions for establishing shared and group accounts are deﬁned;

AC-02(09)

the use of shared and group accounts is only permied if <AC-02(09)_ODP condions> are met.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

AC-02(09)-Examine

[SELECT FROM: Access control policy; procedures addressing account management; system design documentaon; system conﬁguraon sengs and associated documentaon; system-generated list of shared/group accounts and associated roles; system audit records; system security plan; other relevant documents or records].

AC-02(09)-Interview

[SELECT FROM: Organizaonal personnel with account management responsibilies; system/network administrators; organizaonal personnel with informaon security responsibilies].

AC-02(09)-Test

[SELECT FROM: Mechanisms implemenng management of shared/group accounts].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 47

NIST SP 800-53A, REV. 5

AC-02(10)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

ACCOUNT MANAGEMENT | SHARED AND GROUP ACCOUNT CREDENTIAL CHANGE [WITHDRAWN: Incorporated into AC-2k.]

AC-02(11)

ACCOUNT MANAGEMENT | USAGE CONDITIONS ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

AC-02(11)_ODP[01]

circumstances and/or usage condions to be enforced for system accounts are deﬁned;

AC-02(11)_ODP[02]

system accounts subject to enforcement of circumstances and/or usage condions are deﬁned;

AC-02(11)

<AC-02(11)_ODP[01] circumstances and/or usage condions> for <AC-02(11)_ODP[02] system accounts> are enforced.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

AC-02(12)

AC-02(11)-Examine

[SELECT FROM: Access control policy; procedures addressing account management; system design documentaon; system conﬁguraon sengs and associated documentaon; system-generated list of system accounts and associated assignments of usage circumstances and/or usage condions; system audit records; system security plan; other relevant documents or records].

AC-02(11)-Interview

AC-02(11)-Test

[SELECT FROM: Mechanisms implemenng account management funcons].

ACCOUNT MANAGEMENT | ACCOUNT MONITORING FOR ATYPICAL USAGE ASSESSMENT OBJECTIVE: Determine if:

AC-02(12)_ODP[01]

atypical usage for which to monitor system accounts is deﬁned;

AC-02(12)_ODP[02]

personnel or roles to report atypical usage is/are deﬁned;

AC-02(12)(a)

system accounts are monitored for <AC-02(12)_ODP[01] atypical usage>;

AC-02(12)(b)

atypical usage of system accounts is reported to <AC-02(12)_ODP[02] personnel or roles>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

AC-02(12)-Examine

[SELECT FROM: Access control policy; procedures addressing account management; system design documentaon; system conﬁguraon sengs and associated documentaon; system monitoring records; system audit records; audit tracking and monitoring reports; privacy impact assessment; system security plan; privacy plan; other relevant documents or records].

AC-02(12)-Interview

[SELECT FROM: Organizaonal personnel with account management responsibilies; system/network administrators; organizaonal personnel with informaon security responsibilies].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 48

NIST SP 800-53A, REV. 5

AC-02(12)

ACCOUNT MANAGEMENT | ACCOUNT MONITORING FOR ATYPICAL USAGE AC-02(12)-Test

AC-02(13)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

[SELECT FROM: Mechanisms implemenng account management funcons].

ACCOUNT MANAGEMENT | DISABLE ACCOUNTS FOR HIGH-RISK INDIVIDUALS ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

AC-02(13)_ODP[01]

me period within which to disable accounts of individuals who are discovered to pose signiﬁcant risk is deﬁned;

AC-02(13)_ODP[02]

signiﬁcant risks leading to disabling accounts are deﬁned;

AC-02(13)

accounts of individuals are disabled within <AC-02(13)_ODP[01] me period> of discovery of <AC-02(13)_ODP[02] signiﬁcant risks>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

AC-03

AC-02(13)-Examine

[SELECT FROM: Access control policy; procedures addressing account management; system design documentaon; system conﬁguraon sengs and associated documentaon; system-generated list of disabled accounts; list of user acvies posing signiﬁcant organizaonal risk; system audit records; system security plan; other relevant documents or records].

AC-02(13)-Interview

[SELECT FROM: Organizaonal personnel with account management responsibilies; system/network administrators; organizaonal personnel with informaon security responsibilies].

AC-02(13)-Test

[SELECT FROM: Mechanisms implemenng account management funcons].

ACCESS ENFORCEMENT ASSESSMENT OBJECTIVE: Determine if: AC-03

approved authorizaons for logical access to informaon and system resources are enforced in accordance with applicable access control policies.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

AC-03-Examine

[SELECT FROM: Access control policy; procedures addressing access enforcement; system design documentaon; system conﬁguraon sengs and associated documentaon; list of approved authorizaons (user privileges); system audit records; system security plan; privacy plan; other relevant documents or records].

AC-03-Interview

AC-03-Test

[SELECT FROM: Mechanisms implemenng access control policy].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 49

NIST SP 800-53A, REV. 5

AC-03(01)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

ACCESS ENFORCEMENT | RESTRICTED ACCESS TO PRIVILEGED FUNCTIONS [WITHDRAWN: Incorporated into AC-06.]

AC-03(02)

ACCESS ENFORCEMENT | DUAL AUTHORIZATION ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

AC-03(02)_ODP

privileged commands and/or other acons requiring dual authorizaon are deﬁned;

AC-03(02)

dual authorizaon is enforced for <AC-03(02)_ODP privileged commands and/or other acons>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

AC-03(03)

AC-03(02)-Examine

[SELECT FROM: Access control policy; procedures addressing access enforcement and dual authorizaon; system design documentaon; system conﬁguraon sengs and associated documentaon; list of privileged commands requiring dual authorizaon; list of acons requiring dual authorizaon; list of approved authorizaons (user privileges); system security plan; other relevant documents or records].

AC-03(02)-Interview

[SELECT FROM: Organizaonal personnel with access enforcement responsibilies; system/network administrators; organizaonal personnel with informaon security responsibilies; system developers].

AC-03(02)-Test

[SELECT FROM: Dual authorizaon mechanisms implemenng access control policy].

ACCESS ENFORCEMENT | MANDATORY ACCESS CONTROL ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

AC-03(03)_ODP[01]

mandatory access control policy enforced over the set of covered subjects is deﬁned;

AC-03(03)_ODP[02]

mandatory access control policy enforced over the set of covered objects is deﬁned;

AC-03(03)_ODP[03]

subjects to be explicitly granted privileges are deﬁned;

AC-03(03)_ODP[04]

privileges to be explicitly granted to subjects are deﬁned;

AC-03(03)[01]

<AC-03(03)_ODP[01] mandatory access control policy> is enforced over the set of covered subjects speciﬁed in the policy;

AC-03(03)[02]

<AC-03(03)_ODP[02] mandatory access control policy> is enforced over the set of covered objects speciﬁed in the policy;

AC-03(03)(a)[01]

<AC-03(03)_ODP[01] mandatory access control policy> is uniformly enforced across the covered subjects within the system;

AC-03(03)(a)[02]

<AC-03(03)_ODP[02] mandatory access control policy> is uniformly enforced across the covered objects within the system;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 50

NIST SP 800-53A, REV. 5

AC-03(03)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

ACCESS ENFORCEMENT | MANDATORY ACCESS CONTROL

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

AC-03(03)(b)(01)

<AC-03(03)_ODP[01] mandatory access control policy> and <AC-03(03)_ODP[02] mandatory access control policy> specifying that a subject that has been granted access to informaon is constrained from passing the informaon to unauthorized subjects or objects are enforced;

AC-03(03)(b)(02)

<AC-03(03)_ODP[01] mandatory access control policy> and <AC-03(03)_ODP[02] mandatory access control policy> specifying that a subject that has been granted access to informaon is constrained from granng its privileges to other subjects are enforced;

AC-03(03)(b)(03)

<AC-03(03)_ODP[01] mandatory access control policy> and <AC-03(03)_ODP[02] mandatory access control policy> specifying that a subject that has been granted access to informaon is constrained from changing one of more security aributes (speciﬁed by the policy) on subjects, objects, the system, or system components are enforced;

AC-03(03)(b)(04)

<AC-03(03)_ODP[01] mandatory access control policy> and <AC-03(03)_ODP[02] mandatory access control policy> specifying that a subject that has been granted access to informaon is constrained from choosing the security aributes and aribute values (speciﬁed by the policy) to be associated with newly created or modiﬁed objects are enforced;

AC-03(03)(b)(05)

<AC-03(03)_ODP[01] mandatory access control policy> and <AC-03(03)_ODP[02] mandatory access control policy> specifying that a subject that has been granted access to informaon is constrained from changing the rules governing access control are enforced;

AC-03(03)(c)

<AC-03(03)_ODP[01] mandatory access control policy> and <AC-03(03)_ODP[02] mandatory access control policy> specifying that <AC-03(03)_ODP[03] subjects> may explicitly be granted <AC-03(03)_ODP[04] privileges> such that they are not limited by any deﬁned subset (or all) of the above constraints are enforced.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

AC-03(04)

AC-03(03)-Examine

[SELECT FROM: Access control policy; mandatory access control policies; procedures addressing access enforcement; system design documentaon; system conﬁguraon sengs and associated documentaon; list of subjects and objects (i.e., users and resources) requiring enforcement of mandatory access control policies; system audit records; system security plan; other relevant documents or records].

AC-03(03)-Interview

AC-03(03)-Test

[SELECT FROM: Automated mechanisms implemenng mandatory access control].

ACCESS ENFORCEMENT | DISCRETIONARY ACCESS CONTROL ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

AC-03(04)_ODP[01]

discreonary access control policy enforced over the set of covered subjects is deﬁned;

AC-03(04)_ODP[02]

discreonary access control policy enforced over the set of covered objects is deﬁned;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 51

NIST SP 800-53A, REV. 5

AC-03(04)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

ACCESS ENFORCEMENT | DISCRETIONARY ACCESS CONTROL

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

AC-03(04)[01]

<AC-03(04)_ODP[01] discreonary access control policy> is enforced over the set of covered subjects speciﬁed in the policy;

AC-03(04)[02]

<AC-03(04)_ODP[02] discreonary access control policy> is enforced over the set of covered objects speciﬁed in the policy;

AC-03(04)(a)

<AC-03(04)_ODP[01] discreonary access control policy> and <AC-03(04)_ODP[02] discreonary access control policy> are enforced where the policy speciﬁes that a subject that has been granted access to informaon can pass the informaon to any other subjects or objects;

AC-03(04)(b)

AC-03(04)(c)

<AC-03(04)_ODP[01] discreonary access control policy> and <AC-03(04)_ODP[02] discreonary access control policy> are enforced where the policy speciﬁes that a subject that has been granted access to informaon can change security aributes on subjects, objects, the system, or the system’s components;

AC-03(04)(d)

<AC-03(04)_ODP[01] discreonary access control policy> and <AC-03(04)_ODP[02] discreonary access control policy> are enforced where the policy speciﬁes that a subject that has been granted access to informaon can choose the security aributes to be associated with newly created or revised objects;

AC-03(04)(e)

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

AC-03(05)

AC-03(04)-Examine

[SELECT FROM: Access control policy; discreonary access control policies; procedures addressing access enforcement; system design documentaon; system conﬁguraon sengs and associated documentaon; list of subjects and objects (i.e., users and resources) requiring enforcement of discreonary access control policies; system audit records; system security plan; other relevant documents or records].

AC-03(04)-Interview

AC-03(04)-Test

[SELECT FROM: Mechanisms implemenng discreonary access control policy].

ACCESS ENFORCEMENT | SECURITY-RELEVANT INFORMATION ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

AC-03(05)_ODP

security-relevant informaon to which access is prevented except during secure, non-operable system states is deﬁned;

AC-03(05)

access to <AC-03(05)_ODP security-relevant informaon> is prevented except during secure, non-operable system states.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 52

NIST SP 800-53A, REV. 5

AC-03(05)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

ACCESS ENFORCEMENT | SECURITY-RELEVANT INFORMATION POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

AC-03(06)

AC-03(05)-Examine

[SELECT FROM: Access control policy; procedures addressing access enforcement; system design documentaon; system conﬁguraon sengs and associated documentaon; system audit records; system security plan; other relevant documents or records].

AC-03(05)-Interview

AC-03(05)-Test

[SELECT FROM: Mechanisms prevenng access to security-relevant informaon within the system].

ACCESS ENFORCEMENT | PROTECTION OF USER AND SYSTEM INFORMATION [WITHDRAWN: Incorporated into MP-04, SC-28.]

AC-03(07)

ACCESS ENFORCEMENT | ROLE-BASED ACCESS CONTROL ASSESSMENT OBJECTIVE: Determine if:

AC-03(07)_ODP[01]

roles upon which to base control of access are deﬁned;

AC-03(07)_ODP[02]

users authorized to assume roles (deﬁned in AC-03(07)_ODP[01]) are deﬁned;

AC-03(07)[01]

a role-based access control policy is enforced over deﬁned subjects;

AC-03(07)[02]

a role-based access control policy is enforced over deﬁned objects;

AC-03(07)[03]

access is controlled based on <AC-03(07)_ODP[01] roles> and <AC-03(07)_ODP[02] users authorized to assume such roles>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

AC-03(07)-Examine

[SELECT FROM: Access control policy; role-based access control policies; procedures addressing access enforcement; system design documentaon; system conﬁguraon sengs and associated documentaon; list of roles, users, and associated privileges required to control system access; system audit records; system security plan; privacy plan; other relevant documents or records].

AC-03(07)-Interview

AC-03(07)-Test

[SELECT FROM: Mechanisms implemenng role-based access control policy].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 53

NIST SP 800-53A, REV. 5

AC-03(08)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

ACCESS ENFORCEMENT | REVOCATION OF ACCESS AUTHORIZATIONS ASSESSMENT OBJECTIVE: Determine if:

AC-03(08)_ODP

rules governing the ming of revocaons of access authorizaons are deﬁned;

AC-03(08)[01]

revocaon of access authorizaons is enforced, resulng from changes to the security aributes of subjects based on <AC-03(08)_ODP rules>;

AC-03(08)[02]

revocaon of access authorizaons is enforced resulng from changes to the security aributes of objects based on <AC-03(08)_ODP rules>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

AC-03(09)

AC-03(08)-Examine

[SELECT FROM: Access control policy; procedures addressing access enforcement; system design documentaon; system conﬁguraon sengs and associated documentaon; rules governing revocaon of access authorizaons, system audit records; system security plan; other relevant documents or records].

AC-03(08)-Interview

AC-03(08)-Test

[SELECT FROM: Mechanisms implemenng access enforcement funcons].

ACCESS ENFORCEMENT | CONTROLLED RELEASE ASSESSMENT OBJECTIVE: Determine if:

AC-03(09)_ODP[01]

the outside system or system component to which to release informaon is deﬁned;

AC-03(09)_ODP[02]

controls to be provided by the outside system or system component (deﬁned in AC-03(09)_ODP[01]) are deﬁned;

AC-03(09)_ODP[03]

controls used to validate appropriateness of informaon to be released are deﬁned;

AC-03(09)(a)

informaon is released outside of the system only if the receiving <AC-03(09)_ODP[01] system or system component> provides <AC-03(09)_ODP[02] controls>;

AC-03(09)(b)

informaon is released outside of the system only if <AC-03(09)_ODP[03] controls> are used to validate the appropriateness of the informaon designated for release.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: AC-03(09)-Examine

CHAPTER FOUR

[SELECT FROM: Access control policy; procedures addressing access enforcement; system design documentaon; system conﬁguraon sengs and associated documentaon; list of security and privacy safeguards provided by receiving system or system components; list of security and privacy safeguards validang appropriateness of informaon designated for release; system audit records; results of period assessments (inspecons/tests) of the external system; informaon sharing agreements; memoranda of understanding; acquisions/ contractual agreements; system security plan; privacy plan; other relevant documents or records].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 54

NIST SP 800-53A, REV. 5

AC-03(09)

AC-03(10)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

ACCESS ENFORCEMENT | CONTROLLED RELEASE AC-03(09)-Interview

[SELECT FROM: Organizaonal personnel with access enforcement responsibilies; system/network administrators; organizaonal personnel with informaon security and privacy responsibilies; organizaonal personnel with responsibility for acquisions/contractual agreements; legal counsel; system developers].

AC-03(09)-Test

[SELECT FROM: Mechanisms implemenng access enforcement funcons].

ACCESS ENFORCEMENT | AUDITED OVERRIDE OF ACCESS CONTROL MECHANISMS

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

ASSESSMENT OBJECTIVE: Determine if:

AC-03(10)_ODP[01]

condions under which to employ an audited override of automated access control mechanisms are deﬁned;

AC-03(10)_ODP[02]

roles allowed to employ an audited override of automated access control mechanisms are deﬁned;

AC-03(10)

an audited override of automated access control mechanisms is employed under <AC-03(10)_ODP[01] condions> by <AC-03(10)_ODP[02] roles>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

AC-03(11)

AC-03(10)-Examine

[SELECT FROM: Access control policy; procedures addressing access enforcement; system design documentaon; system conﬁguraon sengs and associated documentaon; condions for employing audited override of automated access control mechanisms; system audit records; system security plan; other relevant documents or records].

AC-03(10)-Interview

[SELECT FROM: Organizaonal personnel with access enforcement responsibilies; system/network administrators; organizaonal personnel with informaon security responsibilies].

AC-03(10)-Test

[SELECT FROM: Mechanisms implemenng access enforcement funcons].

ACCESS ENFORCEMENT | RESTRICT ACCESS TO SPECIFIC INFORMATION TYPES ASSESSMENT OBJECTIVE: Determine if:

AC-03(11)_ODP

informaon types requiring restricted access to data repositories are deﬁned;

AC-03(11)

access to data repositories containing <AC-03(11)_ODP informaon types> is restricted.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

AC-03(11)-Examine

AC-03(11)-Interview

[SELECT FROM: Organizaonal personnel with access enforcement responsibilies; organizaonal personnel with responsibilies for data repositories; system/network administrators; organizaonal personnel with informaon security responsibilies].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 55

NIST SP 800-53A, REV. 5

AC-03(11)

ACCESS ENFORCEMENT | RESTRICT ACCESS TO SPECIFIC INFORMATION TYPES AC-03(11)-Test

AC-03(12)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

[SELECT FROM: Mechanisms implemenng access enforcement funcons].

ACCESS ENFORCEMENT | ASSERT AND ENFORCE APPLICATION ACCESS ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

AC-03(12)_ODP

system applicaons and funcons requiring access asseron are deﬁned;

AC-03(12)(a)

as part of the installaon process, applicaons are required to assert the access needed to the following system applicaons and funcons: <AC-03(12)_ODP system applicaons and funcons>;

AC-03(12)(b)

an enforcement mechanism to prevent unauthorized access is provided;

AC-03(12)(c)

access changes aer inial installaon of the applicaon are approved.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

AC-03(13)

AC-03(12)-Examine

AC-03(12)-Interview

[SELECT FROM: Organizaonal personnel with access enforcement responsibilies; system/network administrators; organizaonal personnel with informaon security responsibilies].

AC-03(12)-Test

[SELECT FROM: Mechanisms implemenng access enforcement funcons].

ACCESS ENFORCEMENT | ATTRIBUTE-BASED ACCESS CONTROL ASSESSMENT OBJECTIVE: Determine if:

AC-03(13)_ODP

aributes to assume access permissions are deﬁned;

AC-03(13)[01]

the aribute-based access control policy is enforced over deﬁned subjects;

AC-03(13)[02]

the aribute-based access control policy is enforced over deﬁned objects;

AC-03(13)[03]

access is controlled based on <AC-03(13)_ODP aributes>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

AC-03(13)-Examine

[SELECT FROM: Access control policy; procedures addressing access enforcement; system design documentaon; system conﬁguraon sengs and associated documentaon; list of subjects and objects (i.e., users and resources) requiring enforcement of aribute-based access control policies; system audit records; system security plan; other relevant documents or records].

AC-03(13)-Interview

[SELECT FROM: Organizaonal personnel with access enforcement responsibilies; system/network administrators; organizaonal personnel with informaon security responsibilies].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 56

NIST SP 800-53A, REV. 5

AC-03(13)

ACCESS ENFORCEMENT | ATTRIBUTE-BASED ACCESS CONTROL AC-03(13)-Test

AC-03(14)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

[SELECT FROM: Mechanisms implemenng access enforcement funcons].

ACCESS ENFORCEMENT | INDIVIDUAL ACCESS ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

AC-03(14)_ODP[01]

mechanisms enabling individuals to have access to elements of their personally idenﬁable informaon are deﬁned;

AC-03(14)_ODP[02]

elements of personally idenﬁable informaon to which individuals have access are deﬁned;

AC-03(14)

<AC-03(14)_ODP[01] mechanisms> are provided to enable individuals to have access to <AC-03(14)_ODP[02] elements> of their personally idenﬁable informaon.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

AC-03(15)

AC-03(14)-Examine

[SELECT FROM: Access mechanisms (e.g., request forms and applicaon interfaces); access control policy; procedures addressing access enforcement; system design documentaon; system conﬁguraon sengs and associated documentaon; documentaon regarding access to an individual’s personally idenﬁable informaon; system audit records; system security plan; privacy plan; privacy impact assessment; privacy assessment ﬁndings and/or reports; other relevant documents or records].

AC-03(14)-Interview

AC-03(14)-Test

[SELECT FROM: Mechanisms implemenng access enforcement funcons; mechanisms enabling individual access to personally idenﬁable informaon].

ACCESS ENFORCEMENT | DISCRETIONARY AND MANDATORY ACCESS CONTROL ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

AC-03(15)_ODP[01]

a mandatory access control policy enforced over the set of covered subjects speciﬁed in the policy is deﬁned;

AC-03(15)_ODP[02]

a mandatory access control policy enforced over the set of covered objects speciﬁed in the policy is deﬁned;

AC-03(15)_ODP[03]

a discreonary access control policy enforced over the set of covered subjects speciﬁed in the policy is deﬁned;

AC-03(15)_ODP[04]

a discreonary access control policy enforced over the set of covered objects speciﬁed in the policy is deﬁned;

AC-03(15)(a)[01]

<AC-03(15)_ODP[01] mandatory access control policy> is enforced over the set of covered subjects speciﬁed in the policy;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 57

NIST SP 800-53A, REV. 5

AC-03(15)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

ACCESS ENFORCEMENT | DISCRETIONARY AND MANDATORY ACCESS CONTROL AC-03(15)(a)[02]

<AC-03(15)_ODP[02] mandatory access control policy> is enforced over the set of covered objects speciﬁed in the policy;

AC-03(15)(b)[01]

<AC-03(15)_ODP[03] discreonary access control policy> is enforced over the set of covered subjects speciﬁed in the policy;

AC-03(15)(b)[02]

<AC-03(15)_ODP[04] discreonary access control policy> is enforced over the set of covered objects speciﬁed in the policy.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

AC-04

AC-03(15)-Examine

[SELECT FROM: Access control policy; procedures addressing access enforcement; system design documentaon; system conﬁguraon sengs and associated documentaon; list of subjects and objects (i.e., users and resources) requiring enforcement of mandatory access control policies; list of subjects and objects (i.e., users and resources) requiring enforcement of discreonary access control policies; system audit records; system security plan; other relevant documents or records].

AC-03(15)-Interview

AC-03(15)-Test

[SELECT FROM: Mechanisms implemenng mandatory and discreonary access control policy].

INFORMATION FLOW ENFORCEMENT ASSESSMENT OBJECTIVE: Determine if: AC-04_ODP

informaon ﬂow control policies within the system and between connected systems are deﬁned;

AC-04

approved authorizaons are enforced for controlling the ﬂow of informaon within the system and between connected systems based on <AC-04_ODP informaon ﬂow control policies>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

AC-04-Examine

[SELECT FROM: Access control policy; informaon ﬂow control policies; procedures addressing informaon ﬂow enforcement; security architecture documentaon; privacy architecture documentaon; system design documentaon; system conﬁguraon sengs and associated documentaon; system baseline conﬁguraon; list of informaon ﬂow authorizaons; system audit records; system security plan; privacy plan; other relevant documents or records].

AC-04-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security and privacy architecture development responsibilies; organizaonal personnel with informaon security and privacy responsibilies; system developers].

AC-04-Test

[SELECT FROM: Mechanisms implemenng informaon ﬂow enforcement policy].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 58

NIST SP 800-53A, REV. 5

AC-04(01)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

INFORMATION FLOW ENFORCEMENT | OBJECT SECURITY AND PRIVACY ATTRIBUTES ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

AC-04(01)_ODP[01]

security aributes to be associated with informaon, source, and desnaon objects are deﬁned;

AC-04(01)_ODP[02]

privacy aributes to be associated with informaon, source, and desnaon objects are deﬁned;

AC-04(01)_ODP[03]

informaon objects to be associated with informaon security aributes are deﬁned;

AC-04(01)_ODP[04]

informaon objects to be associated with privacy aributes are deﬁned;

AC-04(01)_ODP[05]

source objects to be associated with informaon security aributes are deﬁned;

AC-04(01)_ODP[06]

source objects to be associated with privacy aributes are deﬁned;

AC-04(01)_ODP[07]

desnaon objects to be associated with informaon security aributes are deﬁned;

AC-04(01)_ODP[08]

desnaon objects to be associated with privacy aributes are deﬁned;

AC-04(01)_ODP[09]

informaon ﬂow control policies as a basis for enforcement of ﬂow control decisions are deﬁned;

AC-04(01)[01]

<AC-04(01)_ODP[01] security aributes> associated with <AC-04(01)_ODP[03] informaon objects>, <AC-04(01)_ODP[05] source objects> , and <AC-04(01)_ODP[07] desnaon objects> are used to enforce <AC-04(01)_ODP[09] informaon ﬂow control policies> as a basis for ﬂow control decisions;

AC-04(01)[02]

<AC-04(01)_ODP[02] privacy aributes> associated with <AC-04(01)_ODP[04] informaon objects>, <AC-04(01)_ODP[06] source objects> , and <AC-04(01)_ODP[08] desnaon objects> are used to enforce <AC-04(01)_ODP[09] informaon ﬂow control policies> as a basis for ﬂow control decisions.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

AC-04(01)-Examine

[SELECT FROM: Access control policy; informaon ﬂow control policies; procedures addressing informaon ﬂow enforcement; system design documentaon; system conﬁguraon sengs and associated documentaon; list of security and privacy aributes and associated source and desnaon objects; system audit records; system security plan; privacy plan; other relevant documents or records].

AC-04(01)-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies; organizaonal personnel with privacy responsibilies; system developers].

AC-04(01)-Test

[SELECT FROM: Mechanisms implemenng informaon ﬂow enforcement policy].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 59

NIST SP 800-53A, REV. 5

AC-04(02)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

INFORMATION FLOW ENFORCEMENT | PROCESSING DOMAINS ASSESSMENT OBJECTIVE: Determine if:

AC-04(02)_ODP

informaon ﬂow control policies to be enforced by use of protected processing domains are deﬁned;

AC-04(02)

protected processing domains are used to enforce <AC-04(02)_ODP informaon ﬂow control policies> as a basis for ﬂow control decisions.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

AC-04(03)

AC-04(02)-Examine

[SELECT FROM: Access control policy; informaon ﬂow control policies; procedures addressing informaon ﬂow enforcement; system design documentaon; system security architecture and associated documentaon; system conﬁguraon sengs and associated documentaon; system audit records; system security plan; other relevant documents or records].

AC-04(02)-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies].

AC-04(02)-Test

[SELECT FROM: Mechanisms implemenng informaon ﬂow enforcement policy].

INFORMATION FLOW ENFORCEMENT | DYNAMIC INFORMATION FLOW CONTROL ASSESSMENT OBJECTIVE: Determine if:

AC-04(03)_ODP

informaon ﬂow control policies to be enforced are deﬁned;

AC-04(03)

<AC-04(03)_ODP informaon ﬂow control policies> are enforced.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

AC-04(04)

AC-04(03)-Examine

AC-04(03)-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies; system developers].

AC-04(03)-Test

[SELECT FROM: Mechanisms implemenng informaon ﬂow enforcement policy].

INFORMATION FLOW ENFORCEMENT | FLOW CONTROL OF ENCRYPTED INFORMATION ASSESSMENT OBJECTIVE: Determine if:

AC-04(04)_ODP[01]

CHAPTER FOUR

informaon ﬂow control mechanisms that encrypted informaon is prevented from bypassing are deﬁned;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 60

NIST SP 800-53A, REV. 5

AC-04(04)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

INFORMATION FLOW ENFORCEMENT | FLOW CONTROL OF ENCRYPTED INFORMATION

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

AC-04(04)_ODP[02]

one or more of the following PARAMETER VALUES is/are selected: {decrypng the informaon; blocking the ﬂow of the encrypted informaon; terminang communicaons sessions aempng to pass encrypted informaon; <AC-04(04)_ODP[03] organizaon-deﬁned procedure or method>};

AC-04(04)_ODP[03]

the organizaon-deﬁned procedure or method used to prevent encrypted informaon from bypassing informaon ﬂow control mechanisms is deﬁned (if selected);

AC-04(04)

encrypted informaon is prevented from bypassing <AC-04(04)_ODP[01] informaon ﬂow control mechanisms> by <AC-04(04)_ODP[02] SELECTED PARAMETER VALUE(S)>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

AC-04(05)

AC-04(04)-Examine

AC-04(04)-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies; system developers].

AC-04(04)-Test

[SELECT FROM: Mechanisms implemenng informaon ﬂow enforcement policy].

INFORMATION FLOW ENFORCEMENT | EMBEDDED DATA TYPES ASSESSMENT OBJECTIVE: Determine if:

AC-04(05)_ODP

limitaons on embedding data types within other data types are deﬁned;

AC-04(05)

<AC-04(05)_ODP limitaons> are enforced on embedding data types within other data types.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

AC-04(06)

AC-04(05)-Examine

[SELECT FROM: Access control policy; procedures addressing informaon ﬂow enforcement; system design documentaon; system conﬁguraon sengs and associated documentaon; list of limitaons to be enforced on embedding data types within other data types; system audit records; system security plan; other relevant documents or records].

AC-04(05)-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies; system developers].

AC-04(05)-Test

[SELECT FROM: Mechanisms implemenng informaon ﬂow enforcement policy].

INFORMATION FLOW ENFORCEMENT | METADATA ASSESSMENT OBJECTIVE: Determine if:

AC-04(06)_ODP

CHAPTER FOUR

metadata on which to base enforcement of informaon ﬂow control is deﬁned;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 61

NIST SP 800-53A, REV. 5

AC-04(06)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

INFORMATION FLOW ENFORCEMENT | METADATA AC-04(06)

informaon ﬂow control enforcement is based on <AC-04(06)_ODP metadata>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

AC-04(07)

AC-04(06)-Examine

[SELECT FROM: Access control policy; informaon ﬂow control policies; procedures addressing informaon ﬂow enforcement; system design documentaon; system conﬁguraon sengs and associated documentaon; types of metadata used to enforce informaon ﬂow control decisions; system audit records; system security plan; other relevant documents or records].

AC-04(06)-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies; system developers].

AC-04(06)-Test

[SELECT FROM: Mechanisms implemenng informaon ﬂow enforcement policy].

INFORMATION FLOW ENFORCEMENT | ONE-WAY FLOW MECHANISMS ASSESSMENT OBJECTIVE: Determine if: AC-04(07)

one-way informaon ﬂows are enforced through hardware-based ﬂow control mechanisms.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

AC-04(08)

AC-04(07)-Examine

[SELECT FROM: Access control policy; informaon ﬂow control policies; procedures addressing informaon ﬂow enforcement; system design documentaon; system conﬁguraon sengs and associated documentaon; system hardware mechanisms and associated conﬁguraons; system audit records; system security plan; other relevant documents or records].

AC-04(07)-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies; system developers].

AC-04(07)-Test

[SELECT FROM: Hardware mechanisms implemenng informaon ﬂow enforcement policy].

INFORMATION FLOW ENFORCEMENT | SECURITY AND PRIVACY POLICY FILTERS ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

AC-04(08)_ODP[01]

security policy ﬁlters to be used as a basis for enforcing informaon ﬂow control are deﬁned;

AC-04(08)_ODP[02]

AC-04(08)_ODP[03]

informaon ﬂows for which informaon ﬂow control is enforced by security ﬁlters are deﬁned;

AC-04(08)_ODP[04]

informaon ﬂows for which informaon ﬂow control is enforced by privacy ﬁlters are deﬁned;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 62

NIST SP 800-53A, REV. 5

AC-04(08)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

INFORMATION FLOW ENFORCEMENT | SECURITY AND PRIVACY POLICY FILTERS

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

AC-04(08)_ODP[05]

one or more of the following PARAMETER VALUES is/are selected: {block; strip; modify; quaranne};

AC-04(08)_ODP[06]

security policy idenfying acons to be taken aer a ﬁlter processing failure are deﬁned;

AC-04(08)_ODP[07]

AC-04(08)(a)[01]

informaon ﬂow control is enforced using <AC-04(08)_ODP[01] security policy ﬁlter> as a basis for ﬂow control decisions for <AC-04(08)_ODP[03] informaon ﬂows>;

AC-04(08)(a)[02]

informaon ﬂow control is enforced using <AC-04(08)_ODP[02] privacy policy ﬁlter> as a basis for ﬂow control decisions for <AC-04(08)_ODP[04] informaon ﬂows>;

AC-04(08)(b)

<AC-04(08)_ODP[05] SELECTED PARAMETER VALUE(S)> data aer a ﬁlter processing failure in accordance with <AC-04(08)_ODP[06] security policy>; <AC-04(08)_ODP[05] SELECTED PARAMETER VALUE(S)> data aer a ﬁlter processing failure in accordance with <AC-04(08)_ODP[07] privacy policy>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

AC-04(09)

AC-04(08)-Examine

[SELECT FROM: Access control policy; informaon ﬂow control policies; procedures addressing informaon ﬂow enforcement; system design documentaon; system conﬁguraon sengs and associated documentaon; list of security policy ﬁlters regulang ﬂow control decisions; list of privacy policy ﬁlters regulang ﬂow control decisions; system audit records; system security plan; privacy plan; other relevant documents or records].

AC-04(08)-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security and privacy responsibilies; system developers].

AC-04(08)-Test

[SELECT FROM: Mechanisms implemenng informaon ﬂow enforcement policy; security and privacy policy ﬁlters].

INFORMATION FLOW ENFORCEMENT | HUMAN REVIEWS ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

AC-04(09)_ODP[01]

informaon ﬂows requiring the use of human reviews are deﬁned;

AC-04(09)_ODP[02]

condions under which the use of human reviews for informaon ﬂows are to be enforced are deﬁned;

AC-04(09)

human reviews are used for <AC-04(09)_ODP[01] informaon ﬂows> under <AC-04(09)_ODP[02] condions>.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 63

NIST SP 800-53A, REV. 5

AC-04(09)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

INFORMATION FLOW ENFORCEMENT | HUMAN REVIEWS POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

AC-04(10)

AC-04(09)-Examine

[SELECT FROM: Access control policy; informaon ﬂow control policies; procedures addressing informaon ﬂow enforcement; system design documentaon; system conﬁguraon sengs and associated documentaon; records of human reviews regarding informaon ﬂows; list of informaon ﬂows requiring the use of human reviews; list of condions requiring human reviews for informaon ﬂows; system audit records; system security plan; privacy plan; other relevant documents or records].

AC-04(09)-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security and privacy responsibilies; organizaonal personnel with informaon ﬂow enforcement responsibilies; system developers].

AC-04(09)-Test

[SELECT FROM: Mechanisms enforcing the use of human reviews].

INFORMATION FLOW ENFORCEMENT | ENABLE AND DISABLE SECURITY OR PRIVACY POLICY FILTERS ASSESSMENT OBJECTIVE: Determine if:

AC-04(10)_ODP[01]

security policy ﬁlters that privileged administrators have the capability to enable and disable are deﬁned;

AC-04(10)_ODP[02]

AC-04(10)_ODP[03]

condions under which privileged administrators have the capability to enable and disable security policy ﬁlters are deﬁned;

AC-04(10)_ODP[04]

condions under which privileged administrators have the capability to enable and disable privacy policy ﬁlters are deﬁned;

AC-04(10)[01]

capability is provided for privileged administrators to enable and disable <AC-04(10)_ODP[01] security ﬁlters> under <AC-04(10)_ODP[03] condions>;

AC-04(10)[02]

capability is provided for privileged administrators to enable and disable <AC-04(10)_ODP[02] privacy ﬁlters> under <AC-04(10)_ODP[04] condions>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

AC-04(10)-Examine

[SELECT FROM: Access control policy; informaon ﬂow informaon policies; procedures addressing informaon ﬂow enforcement; system design documentaon; system conﬁguraon sengs and associated documentaon; list of security policy ﬁlters enabled/disabled by privileged administrators; list of privacy policy ﬁlters enabled/disabled by privileged administrators; list of approved data types for enabling/disabling by privileged administrators; system audit records; system security plan; privacy plan; other relevant documents or records].

AC-04(10)-Interview

[SELECT FROM: Organizaonal personnel with responsibilies for enabling/ disabling security and privacy policy ﬁlters; system/network administrators; organizaonal personnel with informaon security and privacy responsibilies; system developers].

AC-04(10)-Test

[SELECT FROM: Mechanisms implemenng informaon ﬂow enforcement policy; security and privacy policy ﬁlters].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 64

NIST SP 800-53A, REV. 5

AC-04(11)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

INFORMATION FLOW ENFORCEMENT | CONFIGURATION OF SECURITY OR PRIVACY POLICY FILTERS ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

AC-04(11)_ODP[01]

security policy ﬁlters that privileged administrators have the capability to conﬁgure to support diﬀerent security and privacy policies are deﬁned;

AC-04(11)_ODP[02]

privacy policy ﬁlters that privileged administrators have the capability to conﬁgure to support diﬀerent security and privacy policies are deﬁned;

AC-04(11)[01]

capability is provided for privileged administrators to conﬁgure <AC-04(11)_ODP[01] security policy ﬁlters> to support diﬀerent security or privacy policies;

AC-04(11)[02]

capability is provided for privileged administrators to conﬁgure <AC-04(11)_ODP[02] privacy policy ﬁlters> to support diﬀerent security or privacy policies.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

AC-04(12)

AC-04(11)-Examine

[SELECT FROM: Access control policy; informaon ﬂow control policies; procedures addressing informaon ﬂow enforcement; system design documentaon; system conﬁguraon sengs and associated documentaon; list of security policy ﬁlters; list of privacy policy ﬁlters; system audit records; system security plan; privacy plan; other relevant documents or records].

AC-04(11)-Interview

[SELECT FROM: Organizaonal personnel with responsibilies for conﬁguring security and privacy policy ﬁlters; system/network administrators; organizaonal personnel with informaon security and privacy responsibilies; system developers].

AC-04(11)-Test

[SELECT FROM: Mechanisms implemenng informaon ﬂow enforcement policy; security and privacy policy ﬁlters].

INFORMATION FLOW ENFORCEMENT | DATA TYPE IDENTIFIERS ASSESSMENT OBJECTIVE: Determine if:

AC-04(12)_ODP

data type idenﬁers to be used to validate data essenal for informaon ﬂow decisions are deﬁned;

AC-04(12)

when transferring informaon between diﬀerent security domains, <AC-04(12)_ODP data type idenﬁers> are used to validate data essenal for informaon ﬂow decisions.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

AC-04(12)-Examine

[SELECT FROM: Access control policy; informaon ﬂow control policies; procedures addressing informaon ﬂow enforcement; system design documentaon; system conﬁguraon sengs and associated documentaon; list of data type idenﬁers; system audit records; system security plan; other relevant documents or records].

AC-04(12)-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies; system developers].

AC-04(12)-Test

[SELECT FROM: Mechanisms implemenng informaon ﬂow enforcement policy].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 65

NIST SP 800-53A, REV. 5

AC-04(13)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

INFORMATION FLOW ENFORCEMENT | DECOMPOSITION INTO POLICY-RELEVANT SUBCOMPONENTS ASSESSMENT OBJECTIVE: Determine if:

AC-04(13)_ODP

policy-relevant subcomponents into which to decompose informaon for submission to policy enforcement mechanisms are deﬁned;

AC-04(13)

when transferring informaon between diﬀerent security domains, informaon is decomposed into <AC-04(13)_ODP policy-relevant subcomponents> for submission to policy enforcement mechanisms.

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

AC-04(14)

AC-04(13)-Examine

AC-04(13)-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies; system developers].

AC-04(13)-Test

[SELECT FROM: Mechanisms implemenng informaon ﬂow enforcement policy].

INFORMATION FLOW ENFORCEMENT | SECURITY OR PRIVACY POLICY FILTER CONSTRAINTS ASSESSMENT OBJECTIVE: Determine if:

AC-04(14)_ODP[01]

security policy ﬁlters to be implemented that require fully enumerated formats restricng data structure and content have been deﬁned;

AC-04(14)_ODP[02]

privacy policy ﬁlters to be implemented that require fully enumerated formats restricng data structure and content are deﬁned;

AC-04(14)[01]

when transferring informaon between diﬀerent security domains, implemented <AC-04(14)_ODP[01] security policy ﬁlters> require fully enumerated formats that restrict data structure and content;

AC-04(14)[02]

when transferring informaon between diﬀerent security domains, implemented <AC-04(14)_ODP[02] privacy policy ﬁlters> require fully enumerated formats that restrict data structure and content.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

AC-04(14)-Examine

[SELECT FROM: Access control policy; informaon ﬂow control policies; procedures addressing informaon ﬂow enforcement; system design documentaon; system conﬁguraon sengs and associated documentaon; list of security and privacy policy ﬁlters; list of data structure policy ﬁlters; list of data content policy ﬁlters; system audit records; system security plan; privacy plan; other relevant documents or records].

AC-04(14)-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security and privacy responsibilies; system developers].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 66

NIST SP 800-53A, REV. 5

AC-04(14)

INFORMATION FLOW ENFORCEMENT | SECURITY OR PRIVACY POLICY FILTER CONSTRAINTS AC-04(14)-Test

AC-04(15)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

[SELECT FROM: Mechanisms implemenng informaon ﬂow enforcement policy; security and privacy policy ﬁlters].

INFORMATION FLOW ENFORCEMENT | DETECTION OF UNSANCTIONED INFORMATION ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

AC-04(15)_ODP[01]

unsanconed informaon to be detected is deﬁned;

AC-04(15)_ODP[02]

security policy that requires the transfer of unsanconed informaon between diﬀerent security domains to be prohibited is deﬁned (if selected);

AC-04(15)_ODP[03]

privacy policy that requires the transfer of organizaon-deﬁned unsanconed informaon between diﬀerent security domains to be prohibited is deﬁned (if selected);

AC-04(15)[01]

when transferring informaon between diﬀerent security domains, informaon is examined for the presence of <AC-04(15)_ODP[01] unsanconed informaon>;

AC-04(15)[02]

when transferring informaon between diﬀerent security domains, transfer of <AC-04(15)_ODP[01] unsanconed informaon> is prohibited in accordance with the <AC-04(15)_ODP[02] security policy>;

AC-04(15)[03]

when transferring informaon between diﬀerent security domains, transfer of <AC-04(15)_ODP[01] unsanconed informaon> is prohibited in accordance with the <AC-04(15)_ODP[03] privacy policy>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

AC-04(16)

AC-04(15)-Examine

[SELECT FROM: Access control policy; informaon ﬂow control policies; procedures addressing informaon ﬂow enforcement; system design documentaon; system conﬁguraon sengs and associated documentaon; list of unsanconed informaon types and associated informaon; system audit records; system security plan; privacy plan; other relevant documents or records].

AC-04(15)-Interview

[SELECT FROM: Organizaonal personnel with informaon security responsibilies; organizaonal personnel with privacy responsibilies; system developers].

AC-04(15)-Test

[SELECT FROM: Mechanisms implemenng informaon ﬂow enforcement policy].

INFORMATION FLOW ENFORCEMENT | INFORMATION TRANSFERS ON INTERCONNECTED SYSTEMS [WITHDRAWN: Incorporated into AC-04.]

CHAPTER FOUR

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 67

NIST SP 800-53A, REV. 5

AC-04(17)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

INFORMATION FLOW ENFORCEMENT | DOMAIN AUTHENTICATION ASSESSMENT OBJECTIVE: Determine if:

AC-04(17)_ODP

one or more of the following PARAMETER VALUES is/are selected: {organizaon, system, applicaon, service, individual};

AC-04(17)

source and desnaon points are uniquely idenﬁed and authencated by <AC-04(17)_ODP SELECTED PARAMETER VALUE(S)> for informaon transfer.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

AC-04(18)

AC-04(17)-Examine

[SELECT FROM: Access control policy; informaon ﬂow control policies; procedures addressing informaon ﬂow enforcement; procedures addressing source and desnaon domain idenﬁcaon and authencaon; system design documentaon; system conﬁguraon sengs and associated documentaon; system audit records; list of system labels; system security plan; privacy plan; other relevant documents or records].

AC-04(17)-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security and privacy responsibilies; system developers].

AC-04(17)-Test

[SELECT FROM: Mechanisms implemenng informaon ﬂow enforcement policy].

INFORMATION FLOW ENFORCEMENT | SECURITY ATTRIBUTE BINDING [WITHDRAWN: Incorporated into AC-16.]

AC-04(19)

INFORMATION FLOW ENFORCEMENT | VALIDATION OF METADATA ASSESSMENT OBJECTIVE: Determine if:

AC-04(19)_ODP[01]

security policy ﬁlters to be implemented on metadata are deﬁned (if selected);

AC-04(19)_ODP[02]

AC-04(19)[01]

when transferring informaon between diﬀerent security domains, <AC-04(19)_ODP[01] security policy ﬁlters> are implemented on metadata;

AC-04(19)[02]

when transferring informaon between diﬀerent security domains, <AC-04(19)_ODP[02] privacy policy ﬁlters> are implemented on metadata.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: AC-04(19)-Examine

CHAPTER FOUR

[SELECT FROM: Informaon ﬂow enforcement policy; informaon ﬂow control policies; procedures addressing informaon ﬂow enforcement; system design documentaon; system conﬁguraon sengs and associated documentaon; list of security policy ﬁltering criteria applied to metadata and data payloads; system audit records; system security plan; privacy plan; other relevant documents or records].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 68

NIST SP 800-53A, REV. 5

AC-04(19)

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

AC-04(20)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

INFORMATION FLOW ENFORCEMENT | VALIDATION OF METADATA AC-04(19)-Interview

[SELECT FROM: Organizaonal personnel with informaon ﬂow enforcement responsibilies; system/network administrators; organizaonal personnel with informaon security responsibilies; organizaonal personnel with privacy responsibilies; system developers].

AC-04(19)-Test

[SELECT FROM: Mechanisms implemenng informaon ﬂow enforcement funcons; security and policy ﬁlters].

INFORMATION FLOW ENFORCEMENT | APPROVED SOLUTIONS ASSESSMENT OBJECTIVE: Determine if:

AC-04(20)_ODP[01]

soluons in approved conﬁguraons to control the ﬂow of informaon across security domains are deﬁned;

AC-04(20)_ODP[02]

informaon to be controlled when it ﬂows across security domains is deﬁned;

AC-04(20)

<AC-04(20)_ODP[01] soluons in approved conﬁguraons> are employed to control the ﬂow of <AC-04(20)_ODP[02] informaon> across security domains.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

AC-04(21)

AC-04(20)-Examine

[SELECT FROM: Informaon ﬂow enforcement policy; informaon ﬂow control policies; procedures addressing informaon ﬂow enforcement; system design documentaon; system conﬁguraon sengs and associated documentaon; list of soluons in approved conﬁguraons; approved conﬁguraon baselines; system audit records; system security plan; other relevant documents or records].

AC-04(20)-Interview

[SELECT FROM: Organizaonal personnel with informaon ﬂow enforcement responsibilies; system/network administrators; organizaonal personnel with informaon security responsibilies].

AC-04(20)-Test

[SELECT FROM: Mechanisms implemenng informaon ﬂow enforcement funcons].

INFORMATION FLOW ENFORCEMENT | PHYSICAL OR LOGICAL SEPARATION OF INFORMATION FLOWS ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

AC-04(21)_ODP[01]

mechanisms and/or techniques used to logically separate informaon ﬂows are deﬁned (if selected);

AC-04(21)_ODP[02]

mechanisms and/or techniques used to physically separate informaon ﬂows are deﬁned (if selected);

AC-04(21)_ODP[03]

required separaons by types of informaon are deﬁned;

AC-04(21)[01]

informaon ﬂows are separated logically using <AC-04(21)_ODP[01] mechanisms and/or techniques> to accomplish <AC-04(21)_ODP[03] required separaons>;

AC-04(21)[02]

informaon ﬂows are separated physically using <AC-04(21)_ODP[02] mechanisms and/or techniques> to accomplish <AC-04(21)_ODP[03] required separaons>.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 69

NIST SP 800-53A, REV. 5

AC-04(21)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

INFORMATION FLOW ENFORCEMENT | PHYSICAL OR LOGICAL SEPARATION OF INFORMATION FLOWS POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

AC-04(22)

AC-04(21)-Examine

[SELECT FROM: Informaon ﬂow enforcement policy; informaon ﬂow control policies; procedures addressing informaon ﬂow enforcement; system design documentaon; system conﬁguraon sengs and associated documentaon; list of required separaon of informaon ﬂows by informaon types; list of mechanisms and/or techniques used to logically or physically separate informaon ﬂows; system audit records; system security plan; other relevant documents or records].

AC-04(21)-Interview

AC-04(21)-Test

[SELECT FROM: Mechanisms implemenng informaon ﬂow enforcement funcons].

INFORMATION FLOW ENFORCEMENT | ACCESS ONLY ASSESSMENT OBJECTIVE: Determine if: AC-04(22)

access is provided from a single device to compung plaorms, applicaons, or data that reside in mulple diﬀerent security domains while prevenng informaon ﬂow between the diﬀerent security domains.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

AC-04(23)

AC-04(22)-Examine

[SELECT FROM: Informaon ﬂow enforcement policy; procedures addressing informaon ﬂow enforcement; system design documentaon; system conﬁguraon sengs and associated documentaon; system audit records; system security plan; other relevant documents or records].

AC-04(22)-Interview

[SELECT FROM: Organizaonal personnel with informaon ﬂow enforcement responsibilies; system/network administrators; organizaonal personnel with informaon security responsibilies].

AC-04(22)-Test

[SELECT FROM: Mechanisms implemenng informaon ﬂow enforcement funcons].

INFORMATION FLOW ENFORCEMENT | MODIFY NON-RELEASABLE INFORMATION ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

AC-04(23)_ODP

modiﬁcaon acon implemented on non-releasable informaon is deﬁned;

AC-04(23)

when transferring informaon between security domains, non-releasable informaon is modiﬁed by implemenng <AC-04(23)_ODP modiﬁcaon acon>.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 70

NIST SP 800-53A, REV. 5

AC-04(23)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

INFORMATION FLOW ENFORCEMENT | MODIFY NON-RELEASABLE INFORMATION POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

AC-04(24)

AC-04(23)-Examine

AC-04(23)-Interview

[SELECT FROM: Organizaonal personnel with informaon ﬂow enforcement responsibilies; system/network administrators; organizaonal personnel with informaon security responsibilies].

AC-04(23)-Test

[SELECT FROM: Mechanisms implemenng informaon ﬂow enforcement funcons].

INFORMATION FLOW ENFORCEMENT | INTERNAL NORMALIZED FORMAT ASSESSMENT OBJECTIVE: Determine if:

AC-04(24)[01]

when transferring informaon between diﬀerent security domains, incoming data is parsed into an internal, normalized format;

AC-04(24)[02]

when transferring informaon between diﬀerent security domains, the data is regenerated to be consistent with its intended speciﬁcaon.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

AC-04(25)

AC-04(24)-Examine

AC-04(24)-Interview

[SELECT FROM: Organizaonal personnel with informaon ﬂow enforcement responsibilies; system/network administrators; organizaonal personnel with informaon security responsibilies].

AC-04(24)-Test

[SELECT FROM: Mechanisms implemenng informaon ﬂow enforcement funcons].

INFORMATION FLOW ENFORCEMENT | DATA SANITIZATION ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

AC-04(25)_ODP[01]

one or more of the following PARAMETER VALUES is/are selected: {delivery of malicious content, command and control of malicious code, malicious code augmentaon, and steganography-encoded data; spillage of sensive informaon};

AC-04(25)_ODP[02]

policy for sanizing data is deﬁned;

AC-04(25)

when transferring informaon between diﬀerent security domains, data is sanized to minimize <AC-04(25)_ODP[01] SELECTED PARAMETER VALUE(S)> in accordance with <AC-04(25)_ODP[02] policy>.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 71

NIST SP 800-53A, REV. 5

AC-04(25)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

INFORMATION FLOW ENFORCEMENT | DATA SANITIZATION POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

AC-04(26)

AC-04(25)-Examine

AC-04(25)-Interview

[SELECT FROM: Organizaonal personnel with informaon ﬂow enforcement responsibilies; system/network administrators; organizaonal personnel with informaon security responsibilies].

AC-04(25)-Test

[SELECT FROM: Mechanisms implemenng informaon ﬂow enforcement funcons].

INFORMATION FLOW ENFORCEMENT | AUDIT FILTERING ACTIONS ASSESSMENT OBJECTIVE: Determine if:

AC-04(26)[01]

when transferring informaon between diﬀerent security domains, contentﬁltering acons are recorded and audited;

AC-04(26)[02]

when transferring informaon between diﬀerent security domains, results for the informaon being ﬁltered are recorded and audited.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

AC-04(27)

AC-04(26)-Examine

AC-04(26)-Interview

[SELECT FROM: Organizaonal personnel with informaon ﬂow enforcement responsibilies; system/network administrators; organizaonal personnel with informaon security responsibilies].

AC-04(26)-Test

[SELECT FROM: Mechanisms implemenng informaon ﬂow enforcement funcons; mechanisms implemenng content ﬁltering; mechanisms recording and auding content ﬁltering].

INFORMATION FLOW ENFORCEMENT | REDUNDANT/INDEPENDENT FILTERING MECHANISMS ASSESSMENT OBJECTIVE: Determine if: AC-04(27)

CHAPTER FOUR

when transferring informaon between security domains, implemented content ﬁltering soluons provide redundant and independent ﬁltering mechanisms for each data type.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 72

NIST SP 800-53A, REV. 5

AC-04(27)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

INFORMATION FLOW ENFORCEMENT | REDUNDANT/INDEPENDENT FILTERING MECHANISMS POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

AC-04(28)

AC-04(27)-Examine

AC-04(27)-Interview

[SELECT FROM: Organizaonal personnel with informaon ﬂow enforcement responsibilies; system/network administrators; organizaonal personnel with informaon security responsibilies].

AC-04(27)-Test

[SELECT FROM: Mechanisms implemenng informaon ﬂow enforcement funcons].

INFORMATION FLOW ENFORCEMENT | LINEAR FILTER PIPELINES ASSESSMENT OBJECTIVE: Determine if: AC-04(28)

when transferring informaon between security domains, a linear content ﬁlter pipeline is implemented that is enforced with discreonary and mandatory access controls.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

AC-04(29)

AC-04(28)-Examine

AC-04(28)-Interview

[SELECT FROM: Organizaonal personnel with informaon ﬂow enforcement responsibilies; system/network administrators; organizaonal personnel with informaon security responsibilies].

AC-04(28)-Test

[SELECT FROM: Mechanisms implemenng informaon ﬂow enforcement funcons; mechanisms implemenng linear content ﬁlters].

INFORMATION FLOW ENFORCEMENT | FILTER ORCHESTRATION ENGINES ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

AC-04(29)_ODP

policy for content-ﬁltering acons is deﬁned;

AC-04(29)(a)

when transferring informaon between security domains, content ﬁlter orchestraon engines are employed to ensure that content-ﬁltering mechanisms successfully complete execuon without errors;

AC-04(29)(b)[01]

when transferring informaon between security domains, content ﬁlter orchestraon engines are employed to ensure that content-ﬁltering acons occur in the correct order;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 73

NIST SP 800-53A, REV. 5

AC-04(29)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

INFORMATION FLOW ENFORCEMENT | FILTER ORCHESTRATION ENGINES AC-04(29)(b)[02]

when transferring informaon between security domains, content ﬁlter orchestraon engines are employed to ensure that content-ﬁltering acons comply with <AC-04(29)_ODP policy>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

AC-04(30)

AC-04(29)-Examine

AC-04(29)-Interview

[SELECT FROM: Organizaonal personnel with informaon ﬂow enforcement responsibilies; system/network administrators; organizaonal personnel with informaon security responsibilies].

AC-04(29)-Test

[SELECT FROM: Mechanisms implemenng informaon ﬂow enforcement funcons; mechanisms implemenng content ﬁlter orchestraon engines].

INFORMATION FLOW ENFORCEMENT | FILTER MECHANISMS USING MULTIPLE PROCESSES ASSESSMENT OBJECTIVE: Determine if: AC-04(30)

when transferring informaon between security domains, content-ﬁltering mechanisms using mulple processes are implemented.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

AC-04(31)

AC-04(30)-Examine

AC-04(30)-Interview

[SELECT FROM: Organizaonal personnel with informaon ﬂow enforcement responsibilies; system/network administrators; organizaonal personnel with informaon security responsibilies].

AC-04(30)-Test

[SELECT FROM: Mechanisms implemenng informaon ﬂow enforcement funcons; mechanisms implemenng content ﬁltering].

INFORMATION FLOW ENFORCEMENT | FAILED CONTENT TRANSFER PREVENTION ASSESSMENT OBJECTIVE: Determine if: AC-04(31)

CHAPTER FOUR

when transferring informaon between diﬀerent security domains, the transfer of failed content to the receiving domain is prevented.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 74

NIST SP 800-53A, REV. 5

AC-04(31)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

INFORMATION FLOW ENFORCEMENT | FAILED CONTENT TRANSFER PREVENTION POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

AC-04(32)

AC-04(31)-Examine

AC-04(31)-Interview

[SELECT FROM: Organizaonal personnel with informaon ﬂow enforcement responsibilies; system/network administrators; organizaonal personnel with informaon security responsibilies].

AC-04(31)-Test

[SELECT FROM: Mechanisms implemenng informaon ﬂow enforcement funcons].

INFORMATION FLOW ENFORCEMENT | PROCESS REQUIREMENTS FOR INFORMATION TRANSFER ASSESSMENT OBJECTIVE: Determine if: AC-04(32)(a)

when transferring informaon between diﬀerent security domains, the process that transfers informaon between ﬁlter pipelines does not ﬁlter message content;

AC-04(32)(b)

when transferring informaon between diﬀerent security domains, the process that transfers informaon between ﬁlter pipelines validates ﬁltering metadata;

AC-04(32)(c)

when transferring informaon between diﬀerent security domains, the process that transfers informaon between ﬁlter pipelines ensures that the content with the ﬁltering metadata has successfully completed ﬁltering;

AC-04(32)(d)

when transferring informaon between diﬀerent security domains, the process that transfers informaon between ﬁlter pipelines transfers the content to the desnaon ﬁlter pipeline.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

AC-05

AC-04(32)-Examine

AC-04(32)-Interview

[SELECT FROM: Organizaonal personnel with informaon ﬂow enforcement responsibilies; system/network administrators; organizaonal personnel with informaon security responsibilies].

AC-04(32)-Test

[SELECT FROM: Mechanisms implemenng informaon ﬂow enforcement funcons; mechanisms implemenng content ﬁltering].

SEPARATION OF DUTIES ASSESSMENT OBJECTIVE: Determine if: AC-05_ODP

CHAPTER FOUR

dues of individuals requiring separaon are deﬁned;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 75

NIST SP 800-53A, REV. 5

AC-05

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

SEPARATION OF DUTIES AC-05a.

<AC-05_ODP dues of individuals> are idenﬁed and documented;

AC-05b.

system access authorizaons to support separaon of dues are deﬁned.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

AC-06

AC-05-Examine

[SELECT FROM: Access control policy; procedures addressing divisions of responsibility and separaon of dues; system conﬁguraon sengs and associated documentaon; list of divisions of responsibility and separaon of dues; system access authorizaons; system audit records; system security plan; other relevant documents or records].

AC-05-Interview

[SELECT FROM: Organizaonal personnel with responsibilies for deﬁning appropriate divisions of responsibility and separaon of dues; organizaonal personnel with informaon security responsibilies; system/network administrators].

AC-05-Test

[SELECT FROM: Mechanisms implemenng separaon of dues policy].

LEAST PRIVILEGE ASSESSMENT OBJECTIVE: Determine if: AC-06

the principle of least privilege is employed, allowing only authorized accesses for users (or processes acng on behalf of users) that are necessary to accomplish assigned organizaonal tasks.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

AC-06(01)

AC-06-Examine

[SELECT FROM: Access control policy; procedures addressing least privilege; list of assigned access authorizaons (user privileges); system conﬁguraon sengs and associated documentaon; system audit records; system security plan; other relevant documents or records].

AC-06-Interview

[SELECT FROM: Organizaonal personnel with responsibilies for deﬁning least privileges necessary to accomplish speciﬁed tasks; organizaonal personnel with informaon security responsibilies; system/network administrators].

AC-06-Test

[SELECT FROM: Mechanisms implemenng least privilege funcons].

LEAST PRIVILEGE | AUTHORIZE ACCESS TO SECURITY FUNCTIONS ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

AC-06(01)_ODP[01]

individuals and roles with authorized access to security funcons and securityrelevant informaon are deﬁned;

AC-06(01)_ODP[02]

security funcons (deployed in hardware) for authorized access are deﬁned;

AC-06(01)_ODP[03]

security funcons (deployed in soware) for authorized access are deﬁned;

AC-06(01)_ODP[04]

security funcons (deployed in ﬁrmware) for authorized access are deﬁned;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 76

NIST SP 800-53A, REV. 5

AC-06(01)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

LEAST PRIVILEGE | AUTHORIZE ACCESS TO SECURITY FUNCTIONS

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

AC-06(01)_ODP[05]

security-relevant informaon for authorized access is deﬁned;

AC-06(01)(a)[01]

access is authorized for <AC-06(01)_ODP[01] individuals and roles> to <AC-06(01)_ODP[02] security funcons (deployed in hardware)>;

AC-06(01)(a)[02]

access is authorized for <AC-06(01)_ODP[01] individuals and roles> to <AC-06(01)_ODP[03] security funcons (deployed in soware)>;

AC-06(01)(a)[03]

access is authorized for <AC-06(01)_ODP[01] individuals and roles> to <AC-06(01)_ODP[04] security funcons (deployed in ﬁrmware)>;

AC-06(01)(b)

access is authorized for <AC-06(01)_ODP[01] individuals and roles> to <AC-06(01)_ODP[05] security-relevant informaon>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

AC-06(02)

AC-06(01)-Examine

[SELECT FROM: Access control policy; procedures addressing least privilege; list of security funcons (deployed in hardware, soware, and ﬁrmware) and security-relevant informaon for which access must be explicitly authorized; system conﬁguraon sengs and associated documentaon; system audit records; system security plan; other relevant documents or records].

AC-06(01)-Interview

AC-06(01)-Test

[SELECT FROM: Mechanisms implemenng least privilege funcons].

LEAST PRIVILEGE | NON-PRIVILEGED ACCESS FOR NONSECURITY FUNCTIONS ASSESSMENT OBJECTIVE: Determine if:

AC-06(02)_ODP

security funcons or security-relevant informaon, the access to which requires users to use non-privileged accounts to access non-security funcons, are deﬁned;

AC-06(02)

users of system accounts (or roles) with access to <AC-06(02)_ODP security funcons or security-relevant informaon> are required to use non-privileged accounts or roles when accessing non-security funcons.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

AC-06(02)-Examine

[SELECT FROM: Access control policy; procedures addressing least privilege; list of system-generated security funcons or security-relevant informaon assigned to system accounts or roles; system conﬁguraon sengs and associated documentaon; system audit records; system security plan; other relevant documents or records].

AC-06(02)-Interview

AC-06(02)-Test

[SELECT FROM: Mechanisms implemenng least privilege funcons].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 77

NIST SP 800-53A, REV. 5

AC-06(03)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

LEAST PRIVILEGE | NETWORK ACCESS TO PRIVILEGED COMMANDS ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

AC-06(03)_ODP[01]

privileged commands to which network access is to be authorized only for compelling operaonal needs are deﬁned;

AC-06(03)_ODP[02]

compelling operaonal needs necessitang network access to privileged commands are deﬁned;

AC-06(03)[01]

network access to <AC-06(03)_ODP[01] privileged commands> is authorized only for <AC-06(03)_ODP[02] compelling operaonal needs>;

AC-06(03)[02]

the raonale for authorizing network access to privileged commands is documented in the security plan for the system.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

AC-06(04)

AC-06(03)-Examine

[SELECT FROM: Access control policy; procedures addressing least privilege; system conﬁguraon sengs and associated documentaon; system audit records; list of operaonal needs for authorizing network access to privileged commands; system security plan; other relevant documents or records].

AC-06(03)-Interview

AC-06(03)-Test

[SELECT FROM: Mechanisms implemenng least privilege funcons].

LEAST PRIVILEGE | SEPARATE PROCESSING DOMAINS ASSESSMENT OBJECTIVE: Determine if: AC-06(04)

separate processing domains are provided to enable ﬁner-grain allocaon of user privileges.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

AC-06(04)-Examine

[SELECT FROM: Access control policy; procedures addressing least privilege; system design documentaon; system conﬁguraon sengs and associated documentaon; system audit records; system security plan; other relevant documents or records].

AC-06(04)-Interview

AC-06(04)-Test

[SELECT FROM: Mechanisms implemenng least privilege funcons].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 78

NIST SP 800-53A, REV. 5

AC-06(05)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

LEAST PRIVILEGE | PRIVILEGED ACCOUNTS ASSESSMENT OBJECTIVE: Determine if:

AC-06(05)_ODP

personnel or roles to which privileged accounts on the system are to be restricted is/are deﬁned;

AC-06(05)

privileged accounts on the system are restricted to <AC-06(05)_ODP personnel or roles>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

AC-06(06)

AC-06(05)-Examine

[SELECT FROM: Access control policy; procedures addressing least privilege; list of system-generated privileged accounts; list of system administraon personnel; system conﬁguraon sengs and associated documentaon; system audit records; system security plan; other relevant documents or records].

AC-06(05)-Interview

AC-06(05)-Test

[SELECT FROM: Mechanisms implemenng least privilege funcons].

LEAST PRIVILEGE | PRIVILEGED ACCESS BY NON-ORGANIZATIONAL USERS ASSESSMENT OBJECTIVE: Determine if: AC-06(06)

privileged access to the system by non-organizaonal users is prohibited.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

AC-06(07)

AC-06(06)-Examine

[SELECT FROM: Access control policy; procedures addressing least privilege; list of system-generated privileged accounts; list of non-organizaonal users; system conﬁguraon sengs and associated documentaon; audit records; system security plan; other relevant documents or records].

AC-06(06)-Interview

AC-06(06)-Test

[SELECT FROM: Mechanisms prohibing privileged access to the system].

LEAST PRIVILEGE | REVIEW OF USER PRIVILEGES ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

AC-06(07)_ODP[01]

the frequency at which to review the privileges assigned to roles or classes of users is deﬁned;

AC-06(07)_ODP[02]

roles or classes of users to which privileges are assigned are deﬁned;

AC-06(07)(a)

privileges assigned to <AC-06(07)_ODP[02] roles and classes> are reviewed <AC-06(07)_ODP[01] frequency> to validate the need for such privileges;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 79

NIST SP 800-53A, REV. 5

AC-06(07)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

LEAST PRIVILEGE | REVIEW OF USER PRIVILEGES AC-06(07)(b)

privileges are reassigned or removed, if necessary, to correctly reﬂect organizaonal mission and business needs.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

AC-06(08)

AC-06(07)-Examine

[SELECT FROM: Access control policy; procedures addressing least privilege; list of system-generated roles or classes of users and assigned privileges; system design documentaon; system conﬁguraon sengs and associated documentaon; validaon reviews of privileges assigned to roles or classes or users; records of privilege removals or reassignments for roles or classes of users; system audit records; system security plan; other relevant documents or records].

AC-06(07)-Interview

[SELECT FROM: Organizaonal personnel with responsibilies for reviewing least privileges necessary to accomplish speciﬁed tasks; organizaonal personnel with informaon security responsibilies; system/network administrators].

AC-06(07)-Test

[SELECT FROM: Mechanisms implemenng review of user privileges].

LEAST PRIVILEGE | PRIVILEGE LEVELS FOR CODE EXECUTION ASSESSMENT OBJECTIVE: Determine if:

AC-06(08)_ODP

soware to be prevented from execung at higher privilege levels than users execung the soware is deﬁned;

AC-06(08)

<AC-06(08)_ODP soware> is prevented from execung at higher privilege levels than users execung the soware.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

AC-06(09)

AC-06(08)-Examine

[SELECT FROM: Access control policy; procedures addressing least privilege; list of soware that should not execute at higher privilege levels than users execung soware; system design documentaon; system conﬁguraon sengs and associated documentaon; system audit records; system security plan; other relevant documents or records].

AC-06(08)-Interview

AC-06(08)-Test

[SELECT FROM: Mechanisms implemenng least privilege funcons for soware execuon].

LEAST PRIVILEGE | LOG USE OF PRIVILEGED FUNCTIONS ASSESSMENT OBJECTIVE: Determine if: AC-06(09)

CHAPTER FOUR

the execuon of privileged funcons is logged.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 80

NIST SP 800-53A, REV. 5

AC-06(09)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

LEAST PRIVILEGE | LOG USE OF PRIVILEGED FUNCTIONS POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

AC-06(10)

AC-06(09)-Examine

[SELECT FROM: Access control policy; procedures addressing least privilege; system design documentaon; system conﬁguraon sengs and associated documentaon; list of privileged funcons to be audited; list of audited events; system audit records; system security plan; other relevant documents or records].

AC-06(09)-Interview

AC-06(09)-Test

[SELECT FROM: Mechanisms auding the execuon of least privilege funcons].

LEAST PRIVILEGE | PROHIBIT NON-PRIVILEGED USERS FROM EXECUTING PRIVILEGED FUNCTIONS ASSESSMENT OBJECTIVE: Determine if: AC-06(10)

non-privileged users are prevented from execung privileged funcons.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

AC-07

AC-06(10)-Examine

[SELECT FROM: Access control policy; procedures addressing least privilege; system design documentaon; system conﬁguraon sengs and associated documentaon; list of privileged funcons and associated user account assignments; system audit records; system security plan; other relevant documents or records].

AC-06(10)-Interview

AC-06(10)-Test

[SELECT FROM: Mechanisms implemenng least privilege funcons for nonprivileged users].

UNSUCCESSFUL LOGON ATTEMPTS ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

AC-07_ODP[01]

the number of consecuve invalid logon aempts by a user allowed during a me period is deﬁned;

AC-07_ODP[02]

the me period to which the number of consecuve invalid logon aempts by a user is limited is deﬁned;

AC-07_ODP[03]

one or more of the following PARAMETER VALUES is/are selected: {lock the account or node for <AC-07_ODP[04] me period>; lock the account or node unl released by an administrator; delay next logon prompt per <AC-07_ODP[05] delay algorithm>; nofy system administrator; take other <AC-07_ODP[06] acon>};

AC-07_ODP[04]

me period for an account or node to be locked is deﬁned (if selected);

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 81

NIST SP 800-53A, REV. 5

AC-07

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

UNSUCCESSFUL LOGON ATTEMPTS AC-07_ODP[05]

delay algorithm for the next logon prompt is deﬁned (if selected);

AC-07_ODP[06]

other acon to be taken when the maximum number of unsuccessful aempts is exceeded is deﬁned (if selected);

AC-07a.

a limit of <AC-07_ODP[01] number> consecuve invalid logon aempts by a user during <AC-07_ODP[02] me period> is enforced;

AC-07b.

automacally <AC-07_ODP[03] SELECTED PARAMETER VALUE(S)> when the maximum number of unsuccessful aempts is exceeded.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

AC-07(01)

AC-07-Examine

[SELECT FROM: Access control policy; procedures addressing unsuccessful logon aempts; system design documentaon; system conﬁguraon sengs and associated documentaon; system audit records; system security plan; other relevant documents or records].

AC-07-Interview

[SELECT FROM: Organizaonal personnel with informaon security responsibilies; system developers; system/network administrators].

AC-07-Test

[SELECT FROM: Mechanisms implemenng access control policy for unsuccessful logon aempts].

UNSUCCESSFUL LOGON ATTEMPTS | AUTOMATIC ACCOUNT LOCK [WITHDRAWN: Incorporated into AC-07.]

AC-07(02)

UNSUCCESSFUL LOGON ATTEMPTS | PURGE OR WIPE MOBILE DEVICE ASSESSMENT OBJECTIVE: Determine if:

AC-07(02)_ODP[01]

mobile devices to be purged or wiped of informaon are deﬁned;

AC-07(02)_ODP[02]

purging or wiping requirements and techniques to be used when mobile devices are purged or wiped of informaon are deﬁned;

AC-07(02)_ODP[03]

the number of consecuve, unsuccessful logon aempts before the informaon is purged or wiped from mobile devices is deﬁned;

AC-07(02)

informaon is purged or wiped from <AC-07(02)_ODP[01] mobile devices> based on <AC-07(02)_ODP[02] purging or wiping requirements or techniques> aer <AC-07(02)_ODP[03] number> consecuve, unsuccessful device logon aempts.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: AC-07(02)-Examine

CHAPTER FOUR

[SELECT FROM: Access control policy; procedures addressing unsuccessful logon aempts on mobile devices; system design documentaon; system conﬁguraon sengs and associated documentaon; list of mobile devices to be purged/wiped aer organizaon-deﬁned consecuve, unsuccessful device logon aempts; list of purging/wiping requirements or techniques for mobile devices; system audit records; system security plan; other relevant documents or records].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 82

NIST SP 800-53A, REV. 5

AC-07(02)

AC-07(03)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

UNSUCCESSFUL LOGON ATTEMPTS | PURGE OR WIPE MOBILE DEVICE AC-07(02)-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies].

AC-07(02)-Test

[SELECT FROM: Mechanisms implemenng access control policy for unsuccessful device logon aempts].

UNSUCCESSFUL LOGON ATTEMPTS | BIOMETRIC ATTEMPT LIMITING

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

ASSESSMENT OBJECTIVE: Determine if:

AC-07(03)_ODP

the number of unsuccessful biometric logon aempts is deﬁned;

AC-07(03)

unsuccessful biometric logon aempts are limited to <AC-07(03)_ODP number>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

AC-07(04)

AC-07(03)-Examine

[SELECT FROM: Access control policy; procedures addressing unsuccessful logon aempts on biometric devices; system design documentaon; system conﬁguraon sengs and associated documentaon; system audit records; system security plan; other relevant documents or records].

AC-07(03)-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies].

AC-07(03)-Test

[SELECT FROM: Mechanisms implemenng access control policy for unsuccessful logon aempts].

UNSUCCESSFUL LOGON ATTEMPTS | USE OF ALTERNATE AUTHENTICATION FACTOR ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

AC-07(04)_ODP[01]

authencaon factors allowed to be used that are diﬀerent from the primary authencaon factors are deﬁned;

AC-07(04)_ODP[02]

the number of consecuve, invalid logon aempts through the use of alternave factors for which to enforce a limit by a user is deﬁned;

AC-07(04)_ODP[03]

me period during which a user can aempt logons through alternave factors is deﬁned;

AC-07(04)(a)

<AC-07(04)_ODP[01] authencaon factors> that are diﬀerent from the primary authencaon factors are allowed to be used aer the number of organizaondeﬁned consecuve invalid logon aempts have been exceeded;

AC-07(04)(b)

a limit of <AC-07(04)_ODP[02] number> consecuve invalid logon aempts through the use of the alternave factors by the user during a <AC-07(04)_ODP[03] me period> is enforced.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 83

NIST SP 800-53A, REV. 5

AC-07(04)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

UNSUCCESSFUL LOGON ATTEMPTS | USE OF ALTERNATE AUTHENTICATION FACTOR POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

AC-08

AC-07(04)-Examine

[SELECT FROM: Access control policy; procedures addressing unsuccessful logon aempts for primary and alternate authencaon factors; system design documentaon; system conﬁguraon sengs and associated documentaon; system audit records; system security plan; other relevant documents or records].

AC-07(04)-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies].

AC-07(04)-Test

[SELECT FROM: Mechanisms implemenng access control policy for unsuccessful logon aempts].

SYSTEM USE NOTIFICATION ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

AC-08_ODP[01]

system use noﬁcaon message or banner to be displayed by the system to users before granng access to the system is deﬁned;

AC-08_ODP[02]

condions for system use to be displayed by the system before granng further access are deﬁned;

AC-08a.

<AC-08_ODP[01] system use noﬁcaon> is displayed to users before granng access to the system that provides privacy and security noces consistent with applicable laws, Execuve Orders, direcves, regulaons, policies, standards, and guidelines;

AC-08a.01

the system use noﬁcaon states that users are accessing a U.S. Government system;

AC-08a.02

the system use noﬁcaon states that system usage may be monitored, recorded, and subject to audit;

AC-08a.03

the system use noﬁcaon states that unauthorized use of the system is prohibited and subject to criminal and civil penales; and

AC-08a.04

the system use noﬁcaon states that use of the system indicates consent to monitoring and recording;

AC-08b.

the noﬁcaon message or banner is retained on the screen unl users acknowledge the usage condions and take explicit acons to log on to or further access the system;

AC-08c.01

for publicly accessible systems, system use informaon <AC-08_ODP[02] condions> is displayed before granng further access to the publicly accessible system;

AC-08c.02

for publicly accessible systems, any references to monitoring, recording, or auding that are consistent with privacy accommodaons for such systems that generally prohibit those acvies are displayed;

AC-08c.03

for publicly accessible systems, a descripon of the authorized uses of the system is included.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 84

NIST SP 800-53A, REV. 5

AC-08

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

SYSTEM USE NOTIFICATION POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

AC-09

AC-08-Examine

[SELECT FROM: Access control policy; privacy and security policies, procedures addressing system use noﬁcaon; documented approval of system use noﬁcaon messages or banners; system audit records; user acknowledgements of noﬁcaon message or banner; system design documentaon; system conﬁguraon sengs and associated documentaon; system use noﬁcaon messages; system security plan; privacy plan; privacy impact assessment; privacy assessment report; other relevant documents or records].

AC-08-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security and privacy responsibilies; legal counsel; system developers].

AC-08-Test

[SELECT FROM: Mechanisms implemenng system use noﬁcaon].

PREVIOUS LOGON NOTIFICATION ASSESSMENT OBJECTIVE: Determine if: AC-09

the user is noﬁed, upon successful logon to the system, of the date and me of the last logon.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

AC-09(01)

AC-09-Examine

[SELECT FROM: Access control policy; procedures addressing previous logon noﬁcaon; system design documentaon; system conﬁguraon sengs and associated documentaon; system noﬁcaon messages; system security plan; other relevant documents or records].

AC-09-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies; system developers].

AC-09-Test

[SELECT FROM: Mechanisms implemenng access control policy for previous logon noﬁcaon].

PREVIOUS LOGON NOTIFICATION | UNSUCCESSFUL LOGONS ASSESSMENT OBJECTIVE: Determine if: AC-09(01)

the user is noﬁed, upon successful logon, of the number of unsuccessful logon aempts since the last successful logon.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

AC-09(01)-Examine

[SELECT FROM: Access control policy; procedures addressing previous logon noﬁcaon; system design documentaon; system conﬁguraon sengs and associated documentaon; system audit records; system security plan; other relevant documents or records].

AC-09(01)-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies; system developers].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 85

NIST SP 800-53A, REV. 5

AC-09(01)

PREVIOUS LOGON NOTIFICATION | UNSUCCESSFUL LOGONS AC-09(01)-Test

AC-09(02)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

[SELECT FROM: Mechanisms implemenng access control policy for previous logon noﬁcaon].

PREVIOUS LOGON NOTIFICATION | SUCCESSFUL AND UNSUCCESSFUL LOGONS ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

AC-09(02)_ODP[01]

one of the following PARAMETER VALUES is selected: {successful logons; unsuccessful logon aempts; both};

AC-09(02)_ODP[02]

the me period for which the system noﬁes the user of the number of successful logons, unsuccessful logon aempts, or both is deﬁned;

AC-09(02)

the user is noﬁed, upon successful logon, of the number of <AC-09(02)_ODP[01] SELECTED PARAMETER VALUE> during <AC-09(02)_ODP[02] me period>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

AC-09(03)

AC-09(02)-Examine

[SELECT FROM: Access control policy; procedures addressing previous logon noﬁcaon; system design documentaon; system conﬁguraon sengs and associated documentaon; system audit records; system security plan; other relevant documents or records].

AC-09(02)-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies; system developers].

AC-09(02)-Test

[SELECT FROM: Mechanisms implemenng access control policy for previous logon noﬁcaon].

PREVIOUS LOGON NOTIFICATION | NOTIFICATION OF ACCOUNT CHANGES ASSESSMENT OBJECTIVE: Determine if:

AC-09(03)_ODP[01]

changes to security-related characteriscs or parameters of the user’s account that require noﬁcaon are deﬁned;

AC-09(03)_ODP[02]

the me period for which the system noﬁes the user of changes to securityrelated characteriscs or parameters of the user’s account is deﬁned;

AC-09(03)

the user is noﬁed, upon successful logon, of changes to <AC-09(03)_ODP[01] security-related characteriscs or parameters> during <AC-09(03)_ODP[02] me period>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

AC-09(03)-Examine

[SELECT FROM: Access control policy; procedures addressing previous logon noﬁcaon; system design documentaon; system conﬁguraon sengs and associated documentaon; system audit records; system security plan; other relevant documents or records].

AC-09(03)-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies; system developers].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 86

NIST SP 800-53A, REV. 5

AC-09(03)

PREVIOUS LOGON NOTIFICATION | NOTIFICATION OF ACCOUNT CHANGES AC-09(03)-Test

AC-09(04)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

[SELECT FROM: Mechanisms implemenng access control policy for previous logon noﬁcaon].

PREVIOUS LOGON NOTIFICATION | ADDITIONAL LOGON INFORMATION ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

AC-09(04)_ODP

addional informaon about which to nofy the user is deﬁned;

AC-09(04)

the user is noﬁed, upon successful logon, of <AC-09(04)_ODP addional informaon>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

AC-10

AC-09(04)-Examine

[SELECT FROM: Access control policy; procedures addressing previous logon noﬁcaon; system design documentaon; system conﬁguraon sengs and associated documentaon; system audit records; system security plan; other relevant documents or records].

AC-09(04)-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies; system developers].

AC-09(04)-Test

[SELECT FROM: Mechanisms implemenng access control policy for previous logon noﬁcaon].

CONCURRENT SESSION CONTROL ASSESSMENT OBJECTIVE: Determine if:

AC-10_ODP[01]

accounts and/or account types for which to limit the number of concurrent sessions is deﬁned;

AC-10_ODP[02]

the number of concurrent sessions to be allowed for each account and/or account type is deﬁned;

AC-10

the number of concurrent sessions for each <AC-10_ODP[01] account and/or account types> is limited to <AC-10_ODP[02] number>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

AC-10-Examine

[SELECT FROM: Access control policy; procedures addressing concurrent session control; system design documentaon; system conﬁguraon sengs and associated documentaon; security plan; system security plan; other relevant documents or records].

AC-10-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies; system developers].

AC-10-Test

[SELECT FROM: Mechanisms implemenng access control policy for concurrent session control].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 87

NIST SP 800-53A, REV. 5

AC-11

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

DEVICE LOCK ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

AC-11_ODP[01]

one or more of the following PARAMETER VALUES is/are selected: {iniang a device lock aer <AC-11_ODP[02] me period> of inacvity; requiring the user to iniate a device lock before leaving the system unaended};

AC-11_ODP[02]

me period of inacvity aer which a device lock is iniated is deﬁned (if selected);

AC-11a.

further access to the system is prevented by <AC-11_ODP[01] SELECTED PARAMETER VALUE(S)>;

AC-11b.

device lock is retained unl the user re-establishes access using established idenﬁcaon and authencaon procedures.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

AC-11(01)

AC-11-Examine

[SELECT FROM: Access control policy; procedures addressing session lock; procedures addressing idenﬁcaon and authencaon; system design documentaon; system conﬁguraon sengs and associated documentaon; security plan; system security plan; other relevant documents or records].

AC-11-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies; system developers].

AC-11-Test

[SELECT FROM: Mechanisms implemenng access control policy for session lock].

DEVICE LOCK | PATTERN-HIDING DISPLAYS ASSESSMENT OBJECTIVE: Determine if: AC-11(01)

informaon previously visible on the display is concealed, via device lock, with a publicly viewable image.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

AC-12

AC-11(01)-Examine

[SELECT FROM: Access control policy; procedures addressing session lock; display screen with session lock acvated; system design documentaon; system conﬁguraon sengs and associated documentaon; system security plan; other relevant documents or records].

AC-11(01)-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies; system developers].

AC-11(01)-Test

[SELECT FROM: System session lock mechanisms].

SESSION TERMINATION ASSESSMENT OBJECTIVE: Determine if: AC-12_ODP

CHAPTER FOUR

condions or trigger events requiring session disconnect are deﬁned;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 88

NIST SP 800-53A, REV. 5

AC-12

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

SESSION TERMINATION AC-12

a user session is automacally terminated aer <AC-12_ODP condions or trigger events>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

AC-12(01)

AC-12-Examine

[SELECT FROM: Access control policy; procedures addressing session terminaon; system design documentaon; system conﬁguraon sengs and associated documentaon; list of condions or trigger events requiring session disconnect; system audit records; system security plan; other relevant documents or records].

AC-12-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies; system developers].

AC-12-Test

[SELECT FROM: Automated mechanisms implemenng user session terminaon].

SESSION TERMINATION | USER-INITIATED LOGOUTS ASSESSMENT OBJECTIVE: Determine if:

AC-12(01)_ODP

informaon resources for which a logout capability for user-iniated communicaons sessions is required are deﬁned;

AC-12(01)

a logout capability is provided for user-iniated communicaons sessions whenever authencaon is used to gain access to <AC-12(01)_ODP informaon resources>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

AC-12(02)

AC-12(01)-Examine

[SELECT FROM: Access control policy; procedures addressing session terminaon; user logout messages; system design documentaon; system conﬁguraon sengs and associated documentaon; system audit records; system security plan; other relevant documents or records].

AC-12(01)-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies; system developers].

AC-12(01)-Test

[SELECT FROM: System session terminaon mechanisms; logout capabilies for user-iniated communicaons sessions].

SESSION TERMINATION | TERMINATION MESSAGE ASSESSMENT OBJECTIVE: Determine if: AC-12(02)

an explicit logout message is displayed to users indicang the terminaon of authencated communicaon sessions.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: AC-12(02)-Examine

CHAPTER FOUR

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 89

NIST SP 800-53A, REV. 5

AC-12(02)

AC-12(03)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

SESSION TERMINATION | TERMINATION MESSAGE AC-12(02)-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies; system developers].

AC-12(02)-Test

[SELECT FROM: System session terminaon mechanisms; display of logout messages].

SESSION TERMINATION | TIMEOUT WARNING MESSAGE

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

ASSESSMENT OBJECTIVE: Determine if:

AC-12(03)_ODP

me unl the end of session for display to users is deﬁned;

AC-12(03)

an explicit message to users is displayed indicang that the session will end in <AC-12(03)_ODP me>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

AC-13

AC-12(03)-Examine

[SELECT FROM: Access control policy; procedures addressing session terminaon; me unl end of session messages; system design documentaon; system conﬁguraon sengs and associated documentaon; system audit records; system security plan; other relevant documents or records].

AC-12(03)-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies; system developers].

AC-12(03)-Test

[SELECT FROM: System session terminaon mechanisms; display of end of session me].

SUPERVISION AND REVIEW — ACCESS CONTROL [WITHDRAWN: Incorporated into AC-02, AU-06.]

AC-14

PERMITTED ACTIONS WITHOUT IDENTIFICATION OR AUTHENTICATION ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

AC-14_ODP

user acons that can be performed on the system without idenﬁcaon or authencaon are deﬁned;

AC-14a.

<AC-14_ODP user acons> that can be performed on the system without idenﬁcaon or authencaon consistent with organizaonal mission and business funcons are idenﬁed;

AC-14b.[01]

user acons not requiring idenﬁcaon or authencaon are documented in the security plan for the system;

AC-14b.[02]

a raonale for user acons not requiring idenﬁcaon or authencaon is provided in the security plan for the system.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 90

NIST SP 800-53A, REV. 5

AC-14

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

PERMITTED ACTIONS WITHOUT IDENTIFICATION OR AUTHENTICATION POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

AC-14(01)

AC-14-Examine

[SELECT FROM: Access control policy; procedures addressing permied acons without idenﬁcaon or authencaon; system conﬁguraon sengs and associated documentaon; security plan; list of user acons that can be performed without idenﬁcaon or authencaon; system audit records; system security plan; other relevant documents or records].

AC-14-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies].

PERMITTED ACTIONS WITHOUT IDENTIFICATION OR AUTHENTICATION | NECESSARY USES [WITHDRAWN: Incorporated into AC-14.]

AC-15

AUTOMATED MARKING [WITHDRAWN: Incorporated into MP-03.]

AC-16

SECURITY AND PRIVACY ATTRIBUTES ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

AC-16_ODP[01]

types of security aributes to be associated with informaon security aribute values for informaon in storage, in process, and/or in transmission are deﬁned;

AC-16_ODP[02]

types of privacy aributes to be associated with privacy aribute values for informaon in storage, in process, and/or in transmission are deﬁned;

AC-16_ODP[03]

security aribute values for types of security aributes are deﬁned;

AC-16_ODP[04]

privacy aribute values for types of privacy aributes are deﬁned;

AC-16_ODP[05]

systems for which permied security aributes are to be established are deﬁned;

AC-16_ODP[06]

systems for which permied privacy aributes are to be established are deﬁned;

AC-16_ODP[07]

security aributes deﬁned as part of AC-16a that are permied for systems are deﬁned;

AC-16_ODP[08]

privacy aributes deﬁned as part of AC-16a that are permied for systems are deﬁned;

AC-16_ODP[09]

aribute values or ranges for established aributes are deﬁned;

AC-16_ODP[10]

the frequency at which to review security aributes for applicability is deﬁned;

AC-16_ODP[11]

the frequency at which to review privacy aributes for applicability is deﬁned;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 91

NIST SP 800-53A, REV. 5

AC-16

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

SECURITY AND PRIVACY ATTRIBUTES

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

AC-16a.[01]

the means to associate <AC-16_ODP[01] types of security aributes> with <AC-16_ODP[03] security aribute values> for informaon in storage, in process, and/or in transmission are provided;

AC-16a.[02]

the means to associate <AC-16_ODP[02] types of privacy aributes> with <AC-16_ODP[04] privacy aribute values> for informaon in storage, in process, and/or in transmission are provided;

AC-16b.[01]

aribute associaons are made;

AC-16b.[02]

aribute associaons are retained with the informaon;

AC-16c.[01]

the following permied security aributes are established from the aributes deﬁned in AC-16_ODP[01] for <AC-16_ODP[05] systems>: <AC-16_ODP[07] security aributes>;

AC-16c.[02]

the following permied privacy aributes are established from the aributes deﬁned in AC-16_ODP[02] for <AC-16_ODP[06] systems>: <AC-16_ODP[08] privacy aributes>;

AC-16d.

the following permied aribute values or ranges for each of the established aributes are determined: <AC-16_ODP[09] aribute values or ranges>;

AC-16e.

changes to aributes are audited;

AC-16f.[01]

<AC-16_ODP[07] security aributes> are reviewed for applicability <AC-16_ODP[10] frequency>;

AC-16f.[02]

<AC-16_ODP[08] privacy aributes> are reviewed for applicability <AC-16_ODP[11] frequency>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

AC-16(01)

AC-16-Examine

[SELECT FROM: Access control policy; procedures addressing the associaon of security and privacy aributes to informaon in storage, in process, and in transmission; system design documentaon; system conﬁguraon sengs and associated documentaon; system audit records; system security plan; privacy plan; other relevant documents or records].

AC-16-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security and privacy responsibilies; system developers].

AC-16-Test

[SELECT FROM: Organizaonal capability supporng and maintaining the associaon of security and privacy aributes to informaon in storage, in process, and in transmission].

SECURITY AND PRIVACY ATTRIBUTES | DYNAMIC ATTRIBUTE ASSOCIATION ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

AC-16(01)_ODP[01]

subjects with which security aributes are to be dynamically associated as informaon is created and combined are deﬁned;

AC-16(01)_ODP[02]

objects with which security aributes are to be dynamically associated as informaon is created and combined are deﬁned;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 92

NIST SP 800-53A, REV. 5

AC-16(01)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

SECURITY AND PRIVACY ATTRIBUTES | DYNAMIC ATTRIBUTE ASSOCIATION

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

AC-16(01)_ODP[03]

subjects with which privacy aributes are to be dynamically associated as informaon is created and combined are deﬁned;

AC-16(01)_ODP[04]

objects with which privacy aributes are to be dynamically associated as informaon is created and combined are deﬁned;

AC-16(01)_ODP[05]

security policies requiring dynamic associaon of security aributes with subjects and objects are deﬁned;

AC-16(01)_ODP[06]

privacy policies requiring dynamic associaon of privacy aributes with subjects and objects are deﬁned;

AC-16(01)[01]

security aributes are dynamically associated with <AC-16(01)_ODP[01] subjects> in accordance with the following security policies as informaon is created and combined: <AC-16(01)_ODP[05] security policies>;

AC-16(01)[02]

security aributes are dynamically associated with <AC-16(01)_ODP[02] objects> in accordance with the following security policies as informaon is created and combined: <AC-16(01)_ODP[05] security policies>;

AC-16(01)[03]

privacy aributes are dynamically associated with <AC-16(01)_ODP[03] subjects> in accordance with the following privacy policies as informaon is created and combined: <AC-16(01)_ODP[06] privacy policies>;

AC-16(01)[04]

privacy aributes are dynamically associated with <AC-16(01)_ODP[04] objects> in accordance with the following privacy policies as informaon is created and combined: <AC-16(01)_ODP[06] privacy policies>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

AC-16(02)

AC-16(01)-Examine

[SELECT FROM: Access control policy; procedures addressing dynamic associaon of security and privacy aributes to informaon; system design documentaon; system conﬁguraon sengs and associated documentaon; system audit records; system security plan; privacy plan; other relevant documents or records].

AC-16(01)-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security and privacy responsibilies; system developers].

AC-16(01)-Test

[SELECT FROM: Automated mechanisms implemenng dynamic associaon of security and privacy aributes to informaon].

SECURITY AND PRIVACY ATTRIBUTES | ATTRIBUTE VALUE CHANGES BY AUTHORIZED INDIVIDUALS ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

AC-16(02)[01]

authorized individuals (or processes acng on behalf of individuals) are provided with the capability to deﬁne or change the value of associated security aributes;

AC-16(02)[02]

authorized individuals (or processes acng on behalf of individuals) are provided with the capability to deﬁne or change the value of associated privacy aributes.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 93

NIST SP 800-53A, REV. 5

AC-16(02)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

SECURITY AND PRIVACY ATTRIBUTES | ATTRIBUTE VALUE CHANGES BY AUTHORIZED INDIVIDUALS POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

AC-16(03)

AC-16(02)-Examine

[SELECT FROM: Access control policy; procedures addressing the change of security and privacy aribute values; system design documentaon; system conﬁguraon sengs and associated documentaon; list of individuals authorized to change security and privacy aributes; system audit records; system security plan; privacy plan; other relevant documents or records].

AC-16(02)-Interview

[SELECT FROM: Organizaonal personnel with responsibilies for changing values of security and privacy aributes; organizaonal personnel with informaon security and privacy responsibilies; system developers].

AC-16(02)-Test

[SELECT FROM: Mechanisms perming changes to values of security and privacy aributes].

SECURITY AND PRIVACY ATTRIBUTES | MAINTENANCE OF ATTRIBUTE ASSOCIATIONS BY SYSTEM ASSESSMENT OBJECTIVE: Determine if:

AC-16(03)_ODP[01]

security aributes that require associaon and integrity maintenance are deﬁned;

AC-16(03)_ODP[02]

privacy aributes that require associaon and integrity maintenance are deﬁned;

AC-16(03)_ODP[03]

subjects requiring the associaon and integrity of security aributes to such subjects to be maintained are deﬁned;

AC-16(03)_ODP[04]

objects requiring the associaon and integrity of security aributes to such objects to be maintained are deﬁned;

AC-16(03)_ODP[05]

subjects requiring the associaon and integrity of privacy aributes to such subjects to be maintained are deﬁned;

AC-16(03)_ODP[06]

objects requiring the associaon and integrity of privacy aributes to such objects to be maintained are deﬁned;

AC-16(03)[01]

the associaon and integrity of <AC-16(03)_ODP[01] security aributes> to <AC-16(03)_ODP[03] subjects> is maintained;

AC-16(03)[02]

the associaon and integrity of <AC-16(03)_ODP[01] security aributes> to <AC-16(03)_ODP[04] objects> is maintained.

AC-16(03)[03]

the associaon and integrity of <AC-16(03)_ODP[02] privacy aributes> to <AC-16(03)_ODP[05] subjects> is maintained;

AC-16(03)[04]

the associaon and integrity of <AC-16(03)_ODP[02] privacy aributes> to <AC-16(03)_ODP[06] objects> is maintained.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: AC-16(03)-Examine

CHAPTER FOUR

[SELECT FROM: Access control policy; procedures addressing the associaon of security and privacy aributes to informaon; procedures addressing labeling or marking; system design documentaon; system conﬁguraon sengs and associated documentaon; system security plan; privacy plan; other relevant documents or records].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 94

NIST SP 800-53A, REV. 5

AC-16(03)

AC-16(04)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

SECURITY AND PRIVACY ATTRIBUTES | MAINTENANCE OF ATTRIBUTE ASSOCIATIONS BY SYSTEM AC-16(03)-Interview

[SELECT FROM: Organizaonal personnel with informaon security and privacy responsibilies; system developers].

AC-16(03)-Test

[SELECT FROM: Mechanisms maintaining associaon and integrity of security and privacy aributes to informaon].

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SECURITY AND PRIVACY ATTRIBUTES | ASSOCIATION OF ATTRIBUTES BY AUTHORIZED INDIVIDUALS ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

AC-16(04)_ODP[01]

security aributes to be associated with subjects by authorized individuals (or processes acng on behalf of individuals) are deﬁned;

AC-16(04)_ODP[02]

security aributes to be associated with objects by authorized individuals (or processes acng on behalf of individuals) are deﬁned;

AC-16(04)_ODP[03]

privacy aributes to be associated with subjects by authorized individuals (or processes acng on behalf of individuals) are deﬁned;

AC-16(04)_ODP[04]

privacy aributes to be associated with objects by authorized individuals (or processes acng on behalf of individuals) are deﬁned;

AC-16(04)_ODP[05]

subjects requiring the associaon of security aributes by authorized individuals (or processes acng on behalf of individuals) are deﬁned;

AC-16(04)_ODP[06]

objects requiring the associaon of security aributes by authorized individuals (or processes acng on behalf of individuals) are deﬁned;

AC-16(04)_ODP[07]

subjects requiring the associaon of privacy aributes by authorized individuals (or processes acng on behalf of individuals) are deﬁned;

AC-16(04)_ODP[08]

objects requiring the associaon of privacy aributes by authorized individuals (or processes acng on behalf of individuals) are deﬁned;

AC-16(04)[01]

authorized individuals (or processes acng on behalf of individuals) are provided with the capability to associate <AC-16(04)_ODP[01] security aributes> with <AC-16(04)_ODP[05] subjects>;

AC-16(04)[02]

authorized individuals (or processes acng on behalf of individuals) are provided with the capability to associate <AC-16(04)_ODP[02] security aributes> with <AC-16(04)_ODP[06] objects>;

AC-16(04)[03]

authorized individuals (or processes acng on behalf of individuals) are provided with the capability to associate <AC-16(04)_ODP[03] privacy aributes> with <AC-16(04)_ODP[07] subjects>;

AC-16(04)[04]

authorized individuals (or processes acng on behalf of individuals) are provided with the capability to associate <AC-16(04)_ODP[04] privacy aributes> with <AC-16(04)_ODP[08] objects>.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 95

NIST SP 800-53A, REV. 5

AC-16(04)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

SECURITY AND PRIVACY ATTRIBUTES | ASSOCIATION OF ATTRIBUTES BY AUTHORIZED INDIVIDUALS POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

AC-16(05)

AC-16(04)-Examine

[SELECT FROM: Access control policy; procedures addressing the associaon of security and privacy aributes to informaon; system design documentaon; system conﬁguraon sengs and associated documentaon; list of users authorized to associate security and privacy aributes to informaon; system prompts for privileged users to select security and privacy aributes to be associated with informaon objects; system audit records; system security plan; privacy plan; other relevant documents or records].

AC-16(04)-Interview

[SELECT FROM: Organizaonal personnel with responsibilies for associang security and privacy aributes to informaon; organizaonal personnel with informaon security and privacy responsibilies; system developers].

AC-16(04)-Test

[SELECT FROM: Mechanisms supporng user associaons of security and privacy aributes to informaon].

SECURITY AND PRIVACY ATTRIBUTES | ATTRIBUTE DISPLAYS ON OBJECTS TO BE OUTPUT ASSESSMENT OBJECTIVE: Determine if:

AC-16(05)_ODP[01]

special disseminaon, handling, or distribuon instrucons to be used for each object that the system transmits to output devices are deﬁned;

AC-16(05)_ODP[02]

human-readable, standard naming convenons for the security and privacy aributes to be displayed in human-readable form on each object that the system transmits to output devices are deﬁned;

AC-16(05)[01]

security aributes are displayed in human-readable form on each object that the system transmits to output devices to idenfy <AC-16(05)_ODP[01] instrucons> using <AC-16(05)_ODP[02] naming convenons>;

AC-16(05)[02]

privacy aributes are displayed in human-readable form on each object that the system transmits to output devices to idenfy <AC-16(05)_ODP[01] instrucons> using <AC-16(05)_ODP[02] naming convenons>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

AC-16(05)-Examine

[SELECT FROM: Access control policy; procedures addressing display of security and privacy aributes in human-readable form; special disseminaon, handling, or distribuon instrucons; types of human-readable, standard naming convenons; system design documentaon; system conﬁguraon sengs and associated documentaon; system audit records; system security plan; privacy plan; other relevant documents or records].

AC-16(05)-Interview

[SELECT FROM: Organizaonal personnel with informaon security and privacy responsibilies; system developers].

AC-16(05)-Test

[SELECT FROM: System output devices displaying security and privacy aributes in human-readable form on each object].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 96

NIST SP 800-53A, REV. 5

AC-16(06)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

SECURITY AND PRIVACY ATTRIBUTES | MAINTENANCE OF ATTRIBUTE ASSOCIATION ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

AC-16(06)_ODP[01]

security aributes to be associated with subjects are deﬁned;

AC-16(06)_ODP[02]

security aributes to be associated with objects are deﬁned;

AC-16(06)_ODP[03]

privacy aributes to be associated with subjects are deﬁned;

AC-16(06)_ODP[04]

privacy aributes to be associated with objects are deﬁned;

AC-16(06)_ODP[05]

subjects to be associated with informaon security aributes are deﬁned;

AC-16(06)_ODP[06]

objects to be associated with informaon security aributes are deﬁned;

AC-16(06)_ODP[07]

subjects to be associated with privacy aributes are deﬁned;

AC-16(06)_ODP[08]

objects to be associated with privacy aributes are deﬁned;

AC-16(06)_ODP[09]

security policies that require personnel to associate and maintain the associaon of security and privacy aributes with subjects and objects;

AC-16(06)_ODP[10]

privacy policies that require personnel to associate and maintain the associaon of security and privacy aributes with subjects and objects;

AC-16(06)[01]

personnel are required to associate and maintain the associaon of <AC-16(06)_ODP[01] security aributes> with <AC-16(06)_ODP[05] subjects> in accordance with <AC-16(06)_ODP[09] security policies>;

AC-16(06)[02]

personnel are required to associate and maintain the associaon of <AC-16(06)_ODP[02] security aributes> with <AC-16(06)_ODP[06] objects> in accordance with <AC-16(06)_ODP[09] security policies>;

AC-16(06)[03]

personnel are required to associate and maintain the associaon of <AC-16(06)_ODP[03] privacy aributes> with <AC-16(06)_ODP[07] subjects> in accordance with <AC-16(06)_ODP[10] privacy policies>;

AC-16(06)[04]

personnel are required to associate and maintain the associaon of <AC-16(06)_ODP[04] privacy aributes> with <AC-16(06)_ODP[08] objects> in accordance with <AC-16(06)_ODP[10] privacy policies>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

AC-16(06)-Examine

[SELECT FROM: Access control policy; procedures addressing associaon of security and privacy aributes with subjects and objects; system security plan; privacy plan; other relevant documents or records].

AC-16(06)-Interview

[SELECT FROM: Organizaonal personnel with responsibilies for associang and maintaining associaon of security and privacy aributes with subjects and objects; organizaonal personnel with informaon security and privacy responsibilies; system developers].

AC-16(06)-Test

[SELECT FROM: Mechanisms supporng associaons of security and privacy aributes to subjects and objects].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 97

NIST SP 800-53A, REV. 5

AC-16(07)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

SECURITY AND PRIVACY ATTRIBUTES | CONSISTENT ATTRIBUTE INTERPRETATION ASSESSMENT OBJECTIVE: Determine if:

AC-16(07)[01]

a consistent interpretaon of security aributes transmied between distributed system components is provided;

AC-16(07)[02]

a consistent interpretaon of privacy aributes transmied between distributed system components is provided.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

AC-16(08)

AC-16(07)-Examine

[SELECT FROM: Access control policies and procedures; procedures addressing consistent interpretaon of security and privacy aributes transmied between distributed system components; procedures addressing access enforcement; procedures addressing informaon ﬂow enforcement; system design documentaon; system conﬁguraon sengs and associated documentaon; system audit records; system security plan; privacy access control policy; other relevant documents or records].

AC-16(07)-Interview

[SELECT FROM: Organizaonal personnel with responsibilies for providing consistent interpretaon of security and privacy aributes used in access enforcement and informaon ﬂow enforcement acons; organizaonal personnel with informaon security and privacy responsibilies; system developers].

AC-16(07)-Test

[SELECT FROM: Mechanisms implemenng access enforcement and informaon ﬂow enforcement funcons].

SECURITY AND PRIVACY ATTRIBUTES | ASSOCIATION TECHNIQUES AND TECHNOLOGIES ASSESSMENT OBJECTIVE: Determine if:

AC-16(08)_ODP[01]

techniques and technologies to be implemented in associang security aributes to informaon are deﬁned;

AC-16(08)_ODP[02]

techniques and technologies to be implemented in associang privacy aributes to informaon are deﬁned;

AC-16(08)[01]

<AC-16(08)_ODP[01] techniques and technologies> are implemented in associang security aributes to informaon;

AC-16(08)[02]

<AC-16(08)_ODP[02] techniques and technologies> are implemented in associang privacy aributes to informaon.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

AC-16(08)-Examine

[SELECT FROM: Access control policy; procedures addressing associaon of security and privacy aributes to informaon; system design documentaon; system conﬁguraon sengs and associated documentaon; system audit records; system security plan; privacy plan; other relevant documents or records].

AC-16(08)-Interview

AC-16(08)-Test

[SELECT FROM: Mechanisms implemenng techniques or technologies associang security and privacy aributes to informaon].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 98

NIST SP 800-53A, REV. 5

AC-16(09)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

SECURITY AND PRIVACY ATTRIBUTES | ATTRIBUTE REASSIGNMENT — REGRADING MECHANISMS ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

AC-16(09)_ODP[01]

techniques or procedures used to validate regrading mechanisms for security aributes are deﬁned;

AC-16(09)_ODP[02]

techniques or procedures used to validate regrading mechanisms for privacy aributes are deﬁned;

AC-16(09)[01]

security aributes associated with informaon are changed only via regrading mechanisms validated using <AC-16(09)_ODP[01] techniques or procedures>;

AC-16(09)[02]

privacy aributes associated with informaon are changed only via regrading mechanisms validated using <AC-16(09)_ODP[02] techniques or procedures>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

AC-16(10)

AC-16(09)-Examine

[SELECT FROM: Access control policy; procedures addressing reassignment of security aributes to informaon; system design documentaon; system conﬁguraon sengs and associated documentaon; system audit records; system security plan; privacy plan; other relevant documents or records].

AC-16(09)-Interview

[SELECT FROM: Organizaonal personnel with responsibilies for reassigning associaon of security and privacy aributes to informaon; organizaonal personnel with informaon security and privacy responsibilies; system developers].

AC-16(09)-Test

[SELECT FROM: Mechanisms implemenng techniques or procedures for reassigning associaon of security and privacy aributes to informaon].

SECURITY AND PRIVACY ATTRIBUTES | ATTRIBUTE CONFIGURATION BY AUTHORIZED INDIVIDUALS ASSESSMENT OBJECTIVE: Determine if:

AC-16(10)[01]

authorized individuals are provided with the capability to deﬁne or change the type and value of security aributes available for associaon with subjects and objects;

AC-16(10)[02]

authorized individuals are provided with the capability to deﬁne or change the type and value of privacy aributes available for associaon with subjects and objects.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

AC-16(10)-Examine

[SELECT FROM: Access control policy; procedures addressing conﬁguraon of security and privacy aributes by authorized individuals; system design documentaon; system conﬁguraon sengs and associated documentaon; system audit records; system security plan; privacy plan; other relevant documents or records].

AC-16(10)-Interview

[SELECT FROM: Organizaonal personnel with responsibilies for deﬁning or changing security and privacy aributes associated with informaon; organizaonal personnel with informaon security and privacy responsibilies; system developers].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 99

NIST SP 800-53A, REV. 5

AC-16(10)

SECURITY AND PRIVACY ATTRIBUTES | ATTRIBUTE CONFIGURATION BY AUTHORIZED INDIVIDUALS AC-16(10)-Test

AC-17

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

[SELECT FROM: Mechanisms implemenng capability for deﬁning or changing security and privacy aributes].

REMOTE ACCESS ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

AC-17a.[01]

usage restricons are established and documented for each type of remote access allowed;

AC-17a.[02]

conﬁguraon/connecon requirements are established and documented for each type of remote access allowed;

AC-17a.[03]

implementaon guidance is established and documented for each type of remote access allowed;

AC-17b.

each type of remote access to the system is authorized prior to allowing such connecons.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

AC-17(01)

AC-17-Examine

[SELECT FROM: Access control policy; procedures addressing remote access implementaon and usage (including restricons); conﬁguraon management plan; system conﬁguraon sengs and associated documentaon; remote access authorizaons; system audit records; system security plan; other relevant documents or records].

AC-17-Interview

[SELECT FROM: Organizaonal personnel with responsibilies for managing remote access connecons; system/network administrators; organizaonal personnel with informaon security responsibilies].

AC-17-Test

[SELECT FROM: Remote access management capability for the system].

REMOTE ACCESS | MONITORING AND CONTROL ASSESSMENT OBJECTIVE: Determine if:

AC-17(01)[01]

automated mechanisms are employed to monitor remote access methods;

AC-17(01)[02]

automated mechanisms are employed to control remote access methods.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

AC-17(01)-Examine

[SELECT FROM: Access control policy; procedures addressing remote access to the system; system design documentaon; system conﬁguraon sengs and associated documentaon; system audit records; system monitoring records; system security plan; other relevant documents or records].

AC-17(01)-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies; system developers].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 100

NIST SP 800-53A, REV. 5

AC-17(01)

REMOTE ACCESS | MONITORING AND CONTROL AC-17(01)-Test

AC-17(02)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

[SELECT FROM: Automated mechanisms monitoring and controlling remote access methods].

REMOTE ACCESS | PROTECTION OF CONFIDENTIALITY AND INTEGRITY USING ENCRYPTION ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

AC-17(02)

cryptographic mechanisms are implemented to protect the conﬁdenality and integrity of remote access sessions.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

AC-17(03)

AC-17(02)-Examine

[SELECT FROM: Access control policy; procedures addressing remote access to the system; system design documentaon; system conﬁguraon sengs and associated documentaon; cryptographic mechanisms and associated conﬁguraon documentaon; system audit records; system security plan; other relevant documents or records].

AC-17(02)-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies; system developers].

AC-17(02)-Test

[SELECT FROM: Cryptographic mechanisms protecng conﬁdenality and integrity of remote access sessions].

REMOTE ACCESS | MANAGED ACCESS CONTROL POINTS ASSESSMENT OBJECTIVE: Determine if: AC-17(03)

remote accesses are routed through authorized and managed network access control points.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

AC-17(03)-Examine

[SELECT FROM: Access control policy; procedures addressing remote access to the system; system design documentaon; list of all managed network access control points; system conﬁguraon sengs and associated documentaon; system audit records; system security plan; other relevant documents or records].

AC-17(03)-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies].

AC-17(03)-Test

[SELECT FROM: Mechanisms roung all remote accesses through managed network access control points].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 101

NIST SP 800-53A, REV. 5

AC-17(04)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

REMOTE ACCESS | PRIVILEGED COMMANDS AND ACCESS ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

AC-17(04)_ODP[01]

needs requiring execuon of privileged commands via remote access are deﬁned;

AC-17(04)_ODP[02]

needs requiring access to security-relevant informaon via remote access are deﬁned;

AC-17(04)(a)[01]

the execuon of privileged commands via remote access is authorized only in a format that provides assessable evidence;

AC-17(04)(a)[02]

access to security-relevant informaon via remote access is authorized only in a format that provides assessable evidence;

AC-17(04)(a)[03]

the execuon of privileged commands via remote access is authorized only for the following needs: <AC-17(04)_ODP[01] needs requiring remote access>;

AC-17(04)(a)[04]

access to security-relevant informaon via remote access is authorized only for the following needs: <AC-17(04)_ODP[02] needs requiring remote access>;

AC-17(04)(b)

the raonale for remote access is documented in the security plan for the system.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

AC-17(05)

AC-17(04)-Examine

[SELECT FROM: Access control policy; procedures addressing remote access to the system; system conﬁguraon sengs and associated documentaon; security plan; system audit records; system security plan; other relevant documents or records].

AC-17(04)-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies].

AC-17(04)-Test

[SELECT FROM: Mechanisms implemenng remote access management].

REMOTE ACCESS | MONITORING FOR UNAUTHORIZED CONNECTIONS [WITHDRAWN: Incorporated into SI-04.]

AC-17(06)

REMOTE ACCESS | PROTECTION OF MECHANISM INFORMATION ASSESSMENT OBJECTIVE: Determine if: AC-17(06)

informaon about remote access mechanisms is protected from unauthorized use and disclosure.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

AC-17(06)-Examine

[SELECT FROM: Access control policy; procedures addressing remote access to the system; system security plan; other relevant documents or records].

AC-17(06)-Interview

[SELECT FROM: Organizaonal personnel with responsibilies for implemenng or monitoring remote access to the system; system users with knowledge of informaon about remote access mechanisms; organizaonal personnel with informaon security responsibilies].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 102

NIST SP 800-53A, REV. 5

AC-17(07)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

REMOTE ACCESS | ADDITIONAL PROTECTION FOR SECURITY FUNCTION ACCESS [WITHDRAWN: Incorporated into AC-03(10).]

AC-17(08)

REMOTE ACCESS | DISABLE NONSECURE NETWORK PROTOCOLS [WITHDRAWN: Incorporated into CM-07.]

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

AC-17(09)

REMOTE ACCESS | DISCONNECT OR DISABLE ACCESS ASSESSMENT OBJECTIVE: Determine if:

AC-17(09)_ODP

the me period within which to disconnect or disable remote access to the system is deﬁned;

AC-17(09)

the capability to disconnect or disable remote access to the system within <AC-17(09)_ODP me period> is provided.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

AC-17(10)

AC-17(09)-Examine

[SELECT FROM: Access control policy; procedures addressing disconnecng or disabling remote access to the system; system design documentaon; system conﬁguraon sengs and associated documentaon; security plan, system audit records; system security plan; other relevant documents or records].

AC-17(09)-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies; system developers].

AC-17(09)-Test

[SELECT FROM: Mechanisms implemenng capability to disconnect or disable remote access to system].

REMOTE ACCESS | AUTHENTICATE REMOTE COMMANDS ASSESSMENT OBJECTIVE: Determine if:

AC-17(10)_ODP[01]

mechanisms implemented to authencate remote commands are deﬁned;

AC-17(10)_ODP[02]

remote commands to be authencated by mechanisms are deﬁned;

AC-17(10)

<AC-17(10)_ODP[01] mechanisms> are implemented to authencate <AC-17(10)_ODP[02] remote commands>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

AC-17(10)-Examine

[SELECT FROM: Access control policy; procedures addressing authencaon of remote commands; system design documentaon; system conﬁguraon sengs and associated documentaon; system audit records; system security plan; other relevant documents or records].

AC-17(10)-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies; system developers].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 103

NIST SP 800-53A, REV. 5

AC-17(10)

REMOTE ACCESS | AUTHENTICATE REMOTE COMMANDS AC-17(10)-Test

AC-18

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

[SELECT FROM: Mechanisms implemenng authencaon of remote commands].

WIRELESS ACCESS ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

AC-18a.[01]

conﬁguraon requirements are established for each type of wireless access;

AC-18a.[02]

connecon requirements are established for each type of wireless access;

AC-18a.[03]

implementaon guidance is established for each type of wireless access;

AC-18b.

each type of wireless access to the system is authorized prior to allowing such connecons.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

AC-18(01)

AC-18-Examine

[SELECT FROM: Access control policy; procedures addressing wireless access implementaon and usage (including restricons); conﬁguraon management plan; system design documentaon; system conﬁguraon sengs and associated documentaon; wireless access authorizaons; system audit records; system security plan; other relevant documents or records].

AC-18-Interview

[SELECT FROM: Organizaonal personnel with responsibilies for managing wireless access connecons; organizaonal personnel with informaon security responsibilies].

AC-18-Test

[SELECT FROM: Wireless access management capability for the system].

WIRELESS ACCESS | AUTHENTICATION AND ENCRYPTION ASSESSMENT OBJECTIVE: Determine if:

AC-18(01)_ODP

one or more of the following PARAMETER VALUES is/are selected: {users; devices};

AC-18(01)[01]

wireless access to the system is protected using authencaon of <AC-18(01)_ODP SELECTED PARAMETER VALUE(S)>;

AC-18(01)[02]

wireless access to the system is protected using encrypon.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

AC-18(01)-Examine

[SELECT FROM: Access control policy; procedures addressing wireless implementaon and usage (including restricons); system design documentaon; system conﬁguraon sengs and associated documentaon; system audit records; system security plan; other relevant documents or records].

AC-18(01)-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies; system developers].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 104

NIST SP 800-53A, REV. 5

AC-18(01)

WIRELESS ACCESS | AUTHENTICATION AND ENCRYPTION AC-18(01)-Test

AC-18(02)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

[SELECT FROM: Mechanisms implemenng wireless access protecons to the system].

WIRELESS ACCESS | MONITORING UNAUTHORIZED CONNECTIONS [WITHDRAWN: Incorporated into SI-04.]

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

AC-18(03)

WIRELESS ACCESS | DISABLE WIRELESS NETWORKING ASSESSMENT OBJECTIVE: Determine if: AC-18(03)

when not intended for use, wireless networking capabilies embedded within system components are disabled prior to issuance and deployment.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

AC-18(04)

AC-18(03)-Examine

AC-18(03)-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies].

AC-18(03)-Test

[SELECT FROM: Mechanisms managing the disabling of wireless networking capabilies internally embedded within system components].

WIRELESS ACCESS | RESTRICT CONFIGURATIONS BY USERS ASSESSMENT OBJECTIVE: Determine if:

AC-18(04)[01]

users allowed to independently conﬁgure wireless networking capabilies are idenﬁed;

AC-18(04)[02]

users allowed to independently conﬁgure wireless networking capabilies are explicitly authorized.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

AC-18(04)-Examine

AC-18(04)-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies].

AC-18(04)-Test

[SELECT FROM: Mechanisms authorizing independent user conﬁguraon of wireless networking capabilies].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 105

NIST SP 800-53A, REV. 5

AC-18(05)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

WIRELESS ACCESS | ANTENNAS AND TRANSMISSION POWER LEVELS ASSESSMENT OBJECTIVE: Determine if:

AC-18(05)[01]

radio antennas are selected to reduce the probability that signals from wireless access points can be received outside of organizaon-controlled boundaries;

AC-18(05)[02]

transmission power levels are calibrated to reduce the probability that signals from wireless access points can be received outside of organizaon-controlled boundaries.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

AC-19

AC-18(05)-Examine

AC-18(05)-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies].

AC-18(05)-Test

[SELECT FROM: Calibraon of transmission power levels for wireless access; radio antenna signals for wireless access; wireless access recepon outside of organizaon-controlled boundaries].

ACCESS CONTROL FOR MOBILE DEVICES ASSESSMENT OBJECTIVE: Determine if: AC-19a.[01]

conﬁguraon requirements are established for organizaon-controlled mobile devices, including when such devices are outside of the controlled area;

AC-19a.[02]

connecon requirements are established for organizaon-controlled mobile devices, including when such devices are outside of the controlled area;

AC-19a.[03]

implementaon guidance is established for organizaon-controlled mobile devices, including when such devices are outside of the controlled area;

AC-19b.

the connecon of mobile devices to organizaonal systems is authorized.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

AC-19-Examine

[SELECT FROM: Access control policy; procedures addressing access control for mobile device usage (including restricons); conﬁguraon management plan; system design documentaon; system conﬁguraon sengs and associated documentaon; authorizaons for mobile device connecons to organizaonal systems; system audit records; system security plan; other relevant documents or records].

AC-19-Interview

[SELECT FROM: Organizaonal personnel using mobile devices to access organizaonal systems; system/network administrators; organizaonal personnel with informaon security responsibilies].

AC-19-Test

[SELECT FROM: Access control capability for mobile device connecons to organizaonal systems; conﬁguraons of mobile devices].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 106

NIST SP 800-53A, REV. 5

AC-19(01)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

ACCESS CONTROL FOR MOBILE DEVICES | USE OF WRITABLE AND PORTABLE STORAGE DEVICES [WITHDRAWN: Incorporated into MP-07.]

AC-19(02)

ACCESS CONTROL FOR MOBILE DEVICES | USE OF PERSONALLY OWNED PORTABLE STORAGE DEVICES [WITHDRAWN: Incorporated into MP-07.]

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

AC-19(03)

ACCESS CONTROL FOR MOBILE DEVICES | USE OF PORTABLE STORAGE DEVICES WITH NO IDENTIFIABLE OWNER [WITHDRAWN: Incorporated into MP-07.]

AC-19(04)

ACCESS CONTROL FOR MOBILE DEVICES | RESTRICTIONS FOR CLASSIFIED INFORMATION ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

AC-19(04)_ODP[01]

security oﬃcials responsible for the review and inspecon of unclassiﬁed mobile devices and the informaon stored on those devices are deﬁned;

AC-19(04)_ODP[02]

security policies restricng the connecon of classiﬁed mobile devices to classiﬁed systems are deﬁned;

AC-19(04)(a)

the use of unclassiﬁed mobile devices in facilies containing systems processing, storing, or transming classiﬁed informaon is prohibited unless speciﬁcally permied by the authorizing oﬃcial;

AC-19(04)(b)(01)

prohibion of the connecon of unclassiﬁed mobile devices to classiﬁed systems is enforced on individuals permied by an authorizing oﬃcial to use unclassiﬁed mobile devices in facilies containing systems processing, storing, or transming classiﬁed informaon;

AC-19(04)(b)(02)

approval by the authorizing oﬃcial for the connecon of unclassiﬁed mobile devices to unclassiﬁed systems is enforced on individuals permied to use unclassiﬁed mobile devices in facilies containing systems processing, storing, or transming classiﬁed informaon;

AC-19(04)(b)(03)

prohibion of the use of internal or external modems or wireless interfaces within unclassiﬁed mobile devices is enforced on individuals permied by an authorizing oﬃcial to use unclassiﬁed mobile devices in facilies containing systems processing, storing, or transming classiﬁed informaon;

AC-19(04)(b)(04)[01]

random review and inspecon of unclassiﬁed mobile devices and the informaon stored on those devices by <AC-19(04)_ODP[01] security oﬃcials> are enforced;

AC-19(04)(b)(04)[02]

following of the incident handling policy is enforced if classiﬁed informaon is found during a random review and inspecon of unclassiﬁed mobile devices;

AC-19(04)(c)

the connecon of classiﬁed mobile devices to classiﬁed systems is restricted in accordance with <AC-19(04)_ODP[02] security policies>.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 107

NIST SP 800-53A, REV. 5

AC-19(04)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

ACCESS CONTROL FOR MOBILE DEVICES | RESTRICTIONS FOR CLASSIFIED INFORMATION POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

AC-19(05)

AC-19(04)-Examine

[SELECT FROM: Access control policy; incident handling policy; procedures addressing access control for mobile devices; system design documentaon; system conﬁguraon sengs and associated documentaon; evidenary documentaon for random inspecons and reviews of mobile devices; system audit records; system security plan; other relevant documents or records].

AC-19(04)-Interview

[SELECT FROM: Organizaonal personnel responsible for random reviews/ inspecons of mobile devices; organizaonal personnel using mobile devices in facilies containing systems processing, storing, or transming classiﬁed informaon; organizaonal personnel with incident response responsibilies; system/network administrators; organizaonal personnel with informaon security responsibilies].

AC-19(04)-Test

[SELECT FROM: Mechanisms prohibing the use of internal or external modems or wireless interfaces with mobile devices].

ACCESS CONTROL FOR MOBILE DEVICES | FULL DEVICE OR CONTAINER-BASED ENCRYPTION ASSESSMENT OBJECTIVE: Determine if:

AC-19(05)_ODP[01]

one of the following PARAMETER VALUES is selected: {full-device encrypon; container-based encrypon};

AC-19(05)_ODP[02]

mobile devices on which to employ encrypon are deﬁned;

AC-19(05)

<AC-19(05)_ODP[01] SELECTED PARAMETER VALUE> is employed to protect the conﬁdenality and integrity of informaon on <AC-19(05)_ODP[02] mobile devices>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

AC-19(05)-Examine

[SELECT FROM: Access control policy; procedures addressing access control for mobile devices; system design documentaon; system conﬁguraon sengs and associated documentaon; encrypon mechanisms and associated conﬁguraon documentaon; system audit records; system security plan; other relevant documents or records].

AC-19(05)-Interview

[SELECT FROM: Organizaonal personnel with access control responsibilies for mobile devices; system/network administrators; organizaonal personnel with informaon security responsibilies].

AC-19(05)-Test

[SELECT FROM: Encrypon mechanisms protecng conﬁdenality and integrity of informaon on mobile devices].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 108

NIST SP 800-53A, REV. 5

AC-20

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

USE OF EXTERNAL SYSTEMS ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

AC-20_ODP[01]

one or more of the following PARAMETER VALUES is/are selected: {establish <AC-20_ODP[02] terms and condions>; idenfy <AC-20_ODP[03] controls asserted>};

AC-20_ODP[02]

terms and condions consistent with the trust relaonships established with other organizaons owning, operang, and/or maintaining external systems are deﬁned (if selected);

AC-20_ODP[03]

controls asserted to be implemented on external systems consistent with the trust relaonships established with other organizaons owning, operang, and/or maintaining external systems are deﬁned (if selected);

AC-20_ODP[04]

types of external systems prohibited from use are deﬁned;

AC-20a.1

<AC-20_ODP[01] SELECTED PARAMETER VALUE(S)> is/are consistent with the trust relaonships established with other organizaons owning, operang, and/or maintaining external systems, allowing authorized individuals to access the system from external systems (if applicable);

AC-20a.2

<AC-20_ODP[01] SELECTED PARAMETER VALUE(S)> is/are consistent with the trust relaonships established with other organizaons owning, operang, and/or maintaining external systems, allowing authorized individuals to process, store, or transmit organizaon-controlled informaon using external systems (if applicable);

AC-20b.

the use of <AC-20_ODP[04] prohibited types of external systems> is prohibited (if applicable).

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

AC-20(01)

AC-20-Examine

[SELECT FROM: Access control policy; procedures addressing the use of external systems; external systems terms and condions; list of types of applicaons accessible from external systems; maximum security categorizaon for informaon processed, stored, or transmied on external systems; system conﬁguraon sengs and associated documentaon; system security plan; other relevant documents or records].

AC-20-Interview

[SELECT FROM: Organizaonal personnel with responsibilies for deﬁning terms and condions for use of external systems to access organizaonal systems; system/network administrators; organizaonal personnel with informaon security responsibilies].

AC-20-Test

[SELECT FROM: Mechanisms implemenng terms and condions on the use of external systems].

USE OF EXTERNAL SYSTEMS | LIMITS ON AUTHORIZED USE ASSESSMENT OBJECTIVE: Determine if: AC-20(01)(a)

CHAPTER FOUR

authorized individuals are permied to use an external system to access the system or to process, store, or transmit organizaon-controlled informaon only aer veriﬁcaon of the implementaon of controls on the external system as speciﬁed in the organizaon’s security and privacy policies and security and privacy plans (if applicable);

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 109

NIST SP 800-53A, REV. 5

AC-20(01)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

USE OF EXTERNAL SYSTEMS | LIMITS ON AUTHORIZED USE AC-20(01)(b)

authorized individuals are permied to use an external system to access the system or to process, store, or transmit organizaon-controlled informaon only aer retenon of approved system connecon or processing agreements with the organizaonal enty hosng the external system (if applicable).

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

AC-20(02)

AC-20(01)-Examine

[SELECT FROM: Access control policy; procedures addressing the use of external systems; system connecon or processing agreements; account management documents; system security plan; other relevant documents or records].

AC-20(01)-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies].

AC-20(01)-Test

[SELECT FROM: Mechanisms implemenng limits on use of external systems].

USE OF EXTERNAL SYSTEMS | PORTABLE STORAGE DEVICES — RESTRICTED USE ASSESSMENT OBJECTIVE: Determine if:

AC-20(02)_ODP

restricons on the use of organizaon-controlled portable storage devices by authorized individuals on external systems are deﬁned;

AC-20(02)

the use of organizaon-controlled portable storage devices by authorized individuals is restricted on external systems using <AC-20(02)_ODP restricons>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

AC-20(03)

AC-20(02)-Examine

[SELECT FROM: Access control policy; procedures addressing the use of external systems; system conﬁguraon sengs and associated documentaon; system connecon or processing agreements; account management documents; system security plan; other relevant documents or records].

AC-20(02)-Interview

[SELECT FROM: Organizaonal personnel with responsibilies for restricng or prohibing the use of organizaon-controlled storage devices on external systems; system/network administrators; organizaonal personnel with informaon security responsibilies].

AC-20(02)-Test

[SELECT FROM: Mechanisms implemenng restricons on the use of portable storage devices].

USE OF EXTERNAL SYSTEMS | NON-ORGANIZATIONALLY OWNED SYSTEMS — RESTRICTED USE ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

AC-20(03)_ODP

restricons on the use of non-organizaonally owned systems or system components to process, store, or transmit organizaonal informaon are deﬁned;

AC-20(03)

the use of non-organizaonally owned systems or system components to process, store, or transmit organizaonal informaon is restricted using <AC-20(03)_ODP restricons>.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 110

NIST SP 800-53A, REV. 5

AC-20(03)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

USE OF EXTERNAL SYSTEMS | NON-ORGANIZATIONALLY OWNED SYSTEMS — RESTRICTED USE POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

AC-20(04)

AC-20(03)-Examine

[SELECT FROM: Access control policy; procedures addressing the use of external systems; system design documentaon; system conﬁguraon sengs and associated documentaon; system connecon or processing agreements; account management documents; system audit records, other relevant documents or records].

AC-20(03)-Interview

[SELECT FROM: Organizaonal personnel with responsibilies for restricng or prohibing the use of non-organizaonally owned systems, system components, or devices; system/network administrators; organizaonal personnel with informaon security responsibilies].

AC-20(03)-Test

[SELECT FROM: Mechanisms implemenng restricons on the use of nonorganizaonally owned systems, components, or devices].

USE OF EXTERNAL SYSTEMS | NETWORK ACCESSIBLE STORAGE DEVICES — PROHIBITED USE ASSESSMENT OBJECTIVE: Determine if:

AC-20(04)_ODP

network-accessible storage devices prohibited from use in external systems are deﬁned;

AC-20(04)

the use of <AC-20(04)_ODP network-accessible storage devices> is prohibited in external systems.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

AC-20(05)

AC-20(04)-Examine

[SELECT FROM: Access control policy; procedures addressing use of networkaccessible storage devices in external systems; system design documentaon; system conﬁguraon sengs and associated documentaon; system connecon or processing agreements; list of network-accessible storage devices prohibited from use in external systems; system audit records; system security plan; other relevant documents or records].

AC-20(04)-Interview

[SELECT FROM: Organizaonal personnel with responsibilies for prohibing the use of network-accessible storage devices in external systems; system/network administrators; organizaonal personnel with informaon security responsibilies].

AC-20(04)-Test

[SELECT FROM: Mechanisms prohibing the use of network-accessible storage devices in external systems].

USE OF EXTERNAL SYSTEMS | PORTABLE STORAGE DEVICES — PROHIBITED USE ASSESSMENT OBJECTIVE: Determine if: AC-20(05)

CHAPTER FOUR

the use of organizaon-controlled portable storage devices by authorized individuals is prohibited on external systems.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 111

NIST SP 800-53A, REV. 5

AC-20(05)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

USE OF EXTERNAL SYSTEMS | PORTABLE STORAGE DEVICES — PROHIBITED USE POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

AC-21

AC-20(05)-Examine

[SELECT FROM: Access control policy; procedures addressing use of portable storage devices in external systems; system design documentaon; system conﬁguraon sengs and associated documentaon; system connecon or processing agreements; system audit records; system security plan; other relevant documents or records].

AC-20(05)-Interview

[SELECT FROM: Organizaonal personnel with responsibilies for prohibing the use of portable storage devices in external systems; system/network administrators; organizaonal personnel with informaon security responsibilies].

INFORMATION SHARING ASSESSMENT OBJECTIVE: Determine if:

AC-21_ODP[01]

informaon-sharing circumstances where user discreon is required to determine whether access authorizaons assigned to a sharing partner match the informaon’s access and use restricons are deﬁned;

AC-21_ODP[02]

automated mechanisms or manual processes that assist users in making informaon-sharing and collaboraon decisions are deﬁned;

AC-21a.

authorized users are enabled to determine whether access authorizaons assigned to a sharing partner match the informaon’s access and use restricons for <AC-21_ODP[01] informaon-sharing circumstances>;

AC-21b.

<AC-21_ODP[02] automated mechanisms> are employed to assist users in making informaon-sharing and collaboraon decisions.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

AC-21-Examine

[SELECT FROM: Access control policy; procedures addressing user-based collaboraon and informaon sharing (including restricons); system design documentaon; system conﬁguraon sengs and associated documentaon; list of users authorized to make informaon-sharing/collaboraon decisions; list of informaon-sharing circumstances requiring user discreon; non-disclosure agreements; acquisions/contractual agreements; system security plan; privacy plan; privacy impact assessment; security and privacy risk assessments; other relevant documents or records].

AC-21-Interview

[SELECT FROM: Organizaonal personnel responsible for informaonsharing/collaboraon decisions; organizaonal personnel with responsibility for acquisions/contractual agreements; system/network administrators; organizaonal personnel with informaon security and privacy responsibilies].

AC-21-Test

[SELECT FROM: Automated mechanisms or manual process implemenng access authorizaons supporng informaon-sharing/user collaboraon decisions].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 112

NIST SP 800-53A, REV. 5

AC-21(01)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

INFORMATION SHARING | AUTOMATED DECISION SUPPORT ASSESSMENT OBJECTIVE: Determine if:

AC-21(01)_ODP

automated mechanisms employed to enforce informaon-sharing decisions by authorized users are deﬁned;

AC-21(01)

<AC-21(01)_ODP automated mechanisms> are employed to enforce informaonsharing decisions by authorized users based on access authorizaons of sharing partners and access restricons on informaon to be shared.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

AC-21(02)

AC-21(01)-Examine

[SELECT FROM: Access control policy; procedures addressing user-based collaboraon and informaon sharing (including restricons); system design documentaon; system conﬁguraon sengs and associated documentaon; system-generated list of users authorized to make informaon-sharing/ collaboraon decisions; system-generated list of sharing partners and access authorizaons; system-generated list of access restricons regarding informaon to be shared; system security plan; other relevant documents or records].

AC-21(01)-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies; system developers].

AC-21(01)-Test

[SELECT FROM: Automated mechanisms implemenng access authorizaons supporng informaon-sharing/user collaboraon decisions].

INFORMATION SHARING | INFORMATION SEARCH AND RETRIEVAL ASSESSMENT OBJECTIVE: Determine if:

AC-21(02)_ODP

informaon-sharing restricons to be enforced by informaon search and retrieval services are deﬁned;

AC-21(02)

informaon search and retrieval services that enforce <AC-21(02)_ODP informaon-sharing restricons> are implemented.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

AC-21(02)-Examine

[SELECT FROM: Access control policy; procedures addressing user-based collaboraon and informaon sharing (including restricons); system design documentaon; system conﬁguraon sengs and associated documentaon; system-generated list of access restricons regarding informaon to be shared; informaon search and retrieval records; system audit records; system security plan; other relevant documents or records].

AC-21(02)-Interview

[SELECT FROM: Organizaonal personnel with access enforcement responsibilies for system search and retrieval services; system/network administrators; organizaonal personnel with informaon security responsibilies; system developers].

AC-21(02)-Test

[SELECT FROM: System search and retrieval services enforcing informaon-sharing restricons].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 113

NIST SP 800-53A, REV. 5

AC-22

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

PUBLICLY ACCESSIBLE CONTENT ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

AC-22_ODP

the frequency at which to review the content on the publicly accessible system for non-public informaon is deﬁned;

AC-22a.

designated individuals are authorized to make informaon publicly accessible;

AC-22b.

authorized individuals are trained to ensure that publicly accessible informaon does not contain non-public informaon;

AC-22c.

the proposed content of informaon is reviewed prior to posng onto the publicly accessible system to ensure that non-public informaon is not included;

AC-22d.[01]

the content on the publicly accessible system is reviewed for non-public informaon <AC-22_ODP frequency>;

AC-22d.[02]

non-public informaon is removed from the publicly accessible system, if discovered.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

AC-23

AC-22-Examine

[SELECT FROM: Access control policy; procedures addressing publicly accessible content; list of users authorized to post publicly accessible content on organizaonal systems; training materials and/or records; records of publicly accessible informaon reviews; records of response to non-public informaon on public websites; system audit logs; security awareness training records; system security plan; other relevant documents or records].

AC-22-Interview

[SELECT FROM: Organizaonal personnel with responsibilies for managing publicly accessible informaon posted on organizaonal systems; organizaonal personnel with informaon security responsibilies].

AC-22-Test

[SELECT FROM: Mechanisms implemenng management of publicly accessible content].

DATA MINING PROTECTION ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

AC-23_ODP[01]

data mining prevenon and detecon techniques are deﬁned;

AC-23_ODP[02]

data storage objects to be protected against unauthorized data mining are deﬁned;

AC-23

<AC-23_ODP[01] techniques> are employed for <AC-23_ODP[02] data storage objects> to detect and protect against unauthorized data mining.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 114

NIST SP 800-53A, REV. 5

AC-23

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

DATA MINING PROTECTION POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

AC-24

AC-23-Examine

[SELECT FROM: Access control policy; procedures for prevenng and detecng data mining; policies and procedures addressing authorized data mining techniques; procedures addressing protecon of data storage objects against data mining; system design documentaon; system conﬁguraon sengs and associated documentaon; system audit logs; system audit records; procedures addressing diﬀerenal privacy techniques; noﬁcaons of atypical database queries or accesses; documentaon or reports of insider threat program; system security plan; privacy plan; other relevant documents or records].

AC-23-Interview

[SELECT FROM: Organizaonal personnel with responsibilies for implemenng data mining detecon and prevenon techniques for data storage objects; legal counsel; organizaonal personnel with informaon security and privacy responsibilies; system developers].

AC-23-Test

[SELECT FROM: Mechanisms implemenng data mining prevenon and detecon].

ACCESS CONTROL DECISIONS ASSESSMENT OBJECTIVE: Determine if:

AC-24_ODP[01]

one or more of the following PARAMETER VALUES is/are selected: {establish procedures; implement mechanisms};

AC-24_ODP[02]

access control decisions applied to each access request prior to access enforcement are deﬁned;

AC-24

<AC-24_ODP[01] SELECTED PARAMETER VALUE(S)> are taken to ensure that <AC-24_ODP[02] access control decisions> are applied to each access request prior to access enforcement.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

AC-24(01)

AC-24-Examine

[SELECT FROM: Access control policy; procedures addressing access control decisions; system design documentaon; system conﬁguraon sengs and associated documentaon; system audit records; system security plan; other relevant documents or records].

AC-24-Interview

[SELECT FROM: Organizaonal personnel with responsibilies for establishing procedures regarding access control decisions to the system; organizaonal personnel with informaon security responsibilies].

AC-24-Test

[SELECT FROM: Mechanisms applying established access control decisions and procedures].

ACCESS CONTROL DECISIONS | TRANSMIT ACCESS AUTHORIZATION INFORMATION ASSESSMENT OBJECTIVE: Determine if:

AC-24(01)_ODP[01]

CHAPTER FOUR

access authorizaon informaon transmied to systems that enforce access control decisions is deﬁned;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 115

NIST SP 800-53A, REV. 5

AC-24(01)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

ACCESS CONTROL DECISIONS | TRANSMIT ACCESS AUTHORIZATION INFORMATION AC-24(01)_ODP[02]

controls to be used when authorizaon informaon is transmied to systems that enforce access control decisions are deﬁned;

AC-24(01)_ODP[03]

systems that enforce access control decisions are deﬁned;

AC-24(01)

<AC-24(01)_ODP[01] access authorizaon informaon> is transmied using <AC-24(01)_ODP[02] controls> to <AC-24(01)_ODP[03] systems> that enforce access control decisions.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

AC-24(02)

AC-24(01)-Examine

AC-24(01)-Interview

AC-24(01)-Test

[SELECT FROM: Mechanisms implemenng access enforcement funcons].

ACCESS CONTROL DECISIONS | NO USER OR PROCESS IDENTITY ASSESSMENT OBJECTIVE: Determine if:

AC-24(02)_ODP[01]

security aributes that do not include the identy of the user or process acng on behalf of the user are deﬁned (if selected);

AC-24(02)_ODP[02]

privacy aributes that do not include the identy of the user or process acng on behalf of the user are deﬁned (if selected);

AC-24(02)[01]

access control decisions are enforced based on <AC-24(02)_ODP[01] security aributes> that do not include the identy of the user or process acng on behalf of the user (if selected);

AC-24(02)[02]

access control decisions are enforced based on <AC-24(02)_ODP[02] privacy aributes> that do not include the identy of the user or process acng on behalf of the user (if selected).

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

AC-24(02)-Examine

AC-24(02)-Interview

AC-24(02)-Test

[SELECT FROM: Mechanisms implemenng access enforcement funcons].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 116

NIST SP 800-53A, REV. 5

AC-25

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

REFERENCE MONITOR ASSESSMENT OBJECTIVE: Determine if: AC-25_ODP

access control policies for which a reference monitor is implemented are deﬁned;

AC-25

a reference monitor is implemented for <AC-25_ODP access control policies> that is tamper-proof, always invoked, and small enough to be subject to analysis and tesng, the completeness of which can be assured.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5 CHAPTER FOUR

AC-25-Examine

AC-25-Interview

AC-25-Test

[SELECT FROM: Mechanisms implemenng access enforcement funcons].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 117

NIST SP 800-53A, REV. 5

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

4.2 AWARENESS AND TRAINING AT-01

POLICY AND PROCEDURES ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5 CHAPTER FOUR

AT-01_ODP[01]

personnel or roles to whom the awareness and training policy is to be disseminated is/are deﬁned;

AT-01_ODP[02]

personnel or roles to whom the awareness and training procedures are to be disseminated is/are deﬁned;

AT-01_ODP[03]

one or more of the following PARAMETER VALUES is/are selected: {organizaonlevel; mission/business process-level; system-level};

AT-01_ODP[04]

an oﬃcial to manage the awareness and training policy and procedures is deﬁned;

AT-01_ODP[05]

the frequency at which the current awareness and training policy is reviewed and updated is deﬁned;

AT-01_ODP[06]

events that would require the current awareness and training policy to be reviewed and updated are deﬁned;

AT-01_ODP[07]

the frequency at which the current awareness and training procedures are reviewed and updated is deﬁned;

AT-01_ODP[08]

events that would require procedures to be reviewed and updated are deﬁned;

AT-01a.[01]

an awareness and training policy is developed and documented;

AT-01a.[02]

the awareness and training policy is disseminated to <AT-01_ODP[01] personnel or roles>;

AT-01a.[03]

awareness and training procedures to facilitate the implementaon of the awareness and training policy and associated access controls are developed and documented;

AT-01a.[04]

the awareness and training procedures are disseminated to <AT-01_ODP[02] personnel or roles>.

AT-01a.01(a)[01]

the <AT-01_ODP[03] SELECTED PARAMETER VALUE(S)> awareness and training policy addresses purpose;

AT-01a.01(a)[02]

the <AT-01_ODP[03] SELECTED PARAMETER VALUE(S)> awareness and training policy addresses scope;

AT-01a.01(a)[03]

the <AT-01_ODP[03] SELECTED PARAMETER VALUE(S)> awareness and training policy addresses roles;

AT-01a.01(a)[04]

the <AT-01_ODP[03] SELECTED PARAMETER VALUE(S)> awareness and training policy addresses responsibilies;

AT-01a.01(a)[05]

the <AT-01_ODP[03] SELECTED PARAMETER VALUE(S)> awareness and training policy addresses management commitment;

AT-01a.01(a)[06]

the <AT-01_ODP[03] SELECTED PARAMETER VALUE(S)> awareness and training policy addresses coordinaon among organizaonal enes;

AT-01a.01(a)[07]

the <AT-01_ODP[03] SELECTED PARAMETER VALUE(S)> awareness and training policy addresses compliance; and

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 118

NIST SP 800-53A, REV. 5

AT-01

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

POLICY AND PROCEDURES

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

AT-01a.01(b)

the <AT-01_ODP[03] SELECTED PARAMETER VALUE(S)> awareness and training policy is consistent with applicable laws, Execuve Orders, direcves, regulaons, policies, standards, and guidelines; and

AT-01b.

the <AT-01_ODP[04] oﬃcial> is designated to manage the development, documentaon, and disseminaon of the awareness and training policy and procedures;

AT-01c.01[01]

the current awareness and training policy is reviewed and updated <AT-01_ODP[05] frequency>;

AT-01c.01[02]

the current awareness and training policy is reviewed and updated following <AT-01_ODP[06] events>;

AT-01c.02[01]

the current awareness and training procedures are reviewed and updated <AT-01_ODP[07] frequency>;

AT-01c.02[02]

the current awareness and training procedures are reviewed and updated following <AT-01_ODP[08] events>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

AT-02

AT-01-Examine

[SELECT FROM: System security plan; privacy plan; awareness and training policy and procedures; other relevant documents or records].

AT-01-Interview

[SELECT FROM: Organizaonal personnel with awareness and training responsibilies; organizaonal personnel with informaon security and privacy responsibilies].

LITERACY TRAINING AND AWARENESS ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

AT-02_ODP[01]

the frequency at which to provide security literacy training to system users (including managers, senior execuves, and contractors) aer inial training is deﬁned;

AT-02_ODP[02]

the frequency at which to provide privacy literacy training to system users (including managers, senior execuves, and contractors) aer inial training is deﬁned;

AT-02_ODP[03]

events that require security literacy training for system users are deﬁned;

AT-02_ODP[04]

events that require privacy literacy training for system users are deﬁned;

AT-02_ODP[05]

techniques to be employed to increase the security and privacy awareness of system users are deﬁned;

AT-02_ODP[06]

the frequency at which to update literacy training and awareness content is deﬁned;

AT-02_ODP[07]

events that would require literacy training and awareness content to be updated are deﬁned;

AT-02a.01[01]

security literacy training is provided to system users (including managers, senior execuves, and contractors) as part of inial training for new users;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 119

NIST SP 800-53A, REV. 5

AT-02

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

LITERACY TRAINING AND AWARENESS

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

AT-02a.01[02]

privacy literacy training is provided to system users (including managers, senior execuves, and contractors) as part of inial training for new users;

AT-02a.01[03]

security literacy training is provided to system users (including managers, senior execuves, and contractors) <AT-02_ODP[01] frequency> thereaer;

AT-02a.01[04]

privacy literacy training is provided to system users (including managers, senior execuves, and contractors) <AT-02_ODP[02] frequency> thereaer;

AT-02a.02[01]

security literacy training is provided to system users (including managers, senior execuves, and contractors) when required by system changes or following <AT-02_ODP[03] events>;

AT-02a.02[02]

privacy literacy training is provided to system users (including managers, senior execuves, and contractors) when required by system changes or following <AT-02_ODP[04] events>;

AT-02b.

<AT-02_ODP[05] awareness techniques> are employed to increase the security and privacy awareness of system users;

AT-02c.[01]

literacy training and awareness content is updated <AT-02_ODP[06] frequency>;

AT-02c.[02]

literacy training and awareness content is updated following <AT-02_ODP[07] events>;

AT-02d.

lessons learned from internal or external security incidents or breaches are incorporated into literacy training and awareness techniques.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

AT-02(01)

AT-02-Examine

[SELECT FROM: System security plan; privacy plan; literacy training and awareness policy; procedures addressing literacy training and awareness implementaon; appropriate codes of federal regulaons; security and privacy literacy training curriculum; security and privacy literacy training materials; training records; other relevant documents or records].

AT-02-Interview

[SELECT FROM: Organizaonal personnel with responsibilies for literacy training and awareness; organizaonal personnel with informaon security and privacy responsibilies; organizaonal personnel comprising the general system user community].

AT-02-Test

[SELECT FROM: Mechanisms managing informaon security and privacy literacy training].

LITERACY TRAINING AND AWARENESS | PRACTICAL EXERCISES ASSESSMENT OBJECTIVE: Determine if: AT-02(01)

praccal exercises in literacy training that simulate events and incidents are provided.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: AT-02(01)-Examine

CHAPTER FOUR

[SELECT FROM: System security plan; privacy plan; security awareness and training policy; procedures addressing security awareness training implementaon; security awareness training curriculum; security awareness training materials; other relevant documents or records].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 120

NIST SP 800-53A, REV. 5

AT-02(01)

AT-02(02)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

LITERACY TRAINING AND AWARENESS | PRACTICAL EXERCISES AT-02(01)-Interview

[SELECT FROM: Organizaonal personnel who receive literacy training and awareness; organizaonal personnel with responsibilies for security awareness training; organizaonal personnel with informaon security responsibilies].

AT-02(01)-Test

[SELECT FROM: Mechanisms implemenng cyber-aack simulaons in praccal exercises].

LITERACY TRAINING AND AWARENESS | INSIDER THREAT

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

ASSESSMENT OBJECTIVE: Determine if:

AT-02(02)[01]

literacy training on recognizing potenal indicators of insider threat is provided;

AT-02(02)[02]

literacy training on reporng potenal indicators of insider threat is provided.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

AT-02(03)

AT-02(02)-Examine

[SELECT FROM: System security plan; privacy plan; literacy training and awareness policy; procedures addressing literacy training and awareness implementaon; literacy training and awareness curriculum; literacy training and awareness materials; other relevant documents or records].

AT-02(02)-Interview

[SELECT FROM: Organizaonal personnel who receive literacy training and awareness; organizaonal personnel with responsibilies for literacy training and awareness; organizaonal personnel with informaon security and privacy responsibilies].

LITERACY TRAINING AND AWARENESS | SOCIAL ENGINEERING AND MINING ASSESSMENT OBJECTIVE: Determine if:

AT-02(03)[01]

literacy training on recognizing potenal and actual instances of social engineering is provided;

AT-02(03)[02]

literacy training on reporng potenal and actual instances of social engineering is provided;

AT-02(03)[03]

literacy training on recognizing potenal and actual instances of social mining is provided;

AT-02(03)[04]

literacy training on reporng potenal and actual instances of social mining is provided.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: AT-02(03)-Examine

CHAPTER FOUR

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 121

NIST SP 800-53A, REV. 5

AT-02(03)

LITERACY TRAINING AND AWARENESS | SOCIAL ENGINEERING AND MINING AT-02(03)-Interview

AT-02(04)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

LITERACY TRAINING AND AWARENESS | SUSPICIOUS COMMUNICATIONS AND ANOMALOUS SYSTEM BEHAVIOR

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

ASSESSMENT OBJECTIVE: Determine if:

AT-02(04)_ODP

indicators of malicious code are deﬁned;

AT-02(04)

literacy training on recognizing suspicious communicaons and anomalous behavior in organizaonal systems using <AT-02(04)_ODP indicators of malicious code> is provided.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

AT-02(05)

AT-02(04)-Examine

AT-02(04)-Interview

[SELECT FROM: Organizaonal personnel who receive literacy training and awareness; organizaonal personnel with responsibilies for basic literacy training and awareness; organizaonal personnel with informaon security and privacy responsibilies].

LITERACY TRAINING AND AWARENESS | ADVANCED PERSISTENT THREAT ASSESSMENT OBJECTIVE: Determine if: AT-02(05)

literacy training on the advanced persistent threat is provided.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

AT-02(05)-Examine

AT-02(05)-Interview

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 122

NIST SP 800-53A, REV. 5

AT-02(06)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

LITERACY TRAINING AND AWARENESS | CYBER THREAT ENVIRONMENT ASSESSMENT OBJECTIVE: Determine if: AT-02(06)(a)

literacy training on the cyber threat environment is provided;

AT-02(06)(b)

system operaons reﬂects current cyber threat informaon.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

AT-03

AT-02(06)-Examine

[SELECT FROM: System security plan; privacy plan; literacy training and awareness policy; procedures addressing literacy training and awareness training implementaon; literacy training and awareness curriculum; literacy training and awareness materials; other relevant documents or records].

AT-02(06)-Interview

ROLE-BASED TRAINING ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

AT-03_ODP[01]

roles and responsibilies for role-based security training are deﬁned;

AT-03_ODP[02]

roles and responsibilies for role-based privacy training are deﬁned;

AT-03_ODP[03]

the frequency at which to provide role-based security and privacy training to assigned personnel aer inial training is deﬁned;

AT-03_ODP[04]

the frequency at which to update role-based training content is deﬁned;

AT-03_ODP[05]

events that require role-based training content to be updated are deﬁned;

AT-03a.01[01]

role-based security training is provided to <AT-03_ODP[01] roles and responsibilies> before authorizing access to the system, informaon, or performing assigned dues;

AT-03a.01[02]

role-based privacy training is provided to <AT-03_ODP[02] roles and responsibilies> before authorizing access to the system, informaon, or performing assigned dues;

AT-03a.01[03]

role-based security training is provided to <AT-03_ODP[01] roles and responsibilies> <AT-03_ODP[03] frequency> thereaer;

AT-03a.01[04]

role-based privacy training is provided to <AT-03_ODP[02] roles and responsibilies> <AT-03_ODP[03] frequency> thereaer;

AT-03a.02[01]

role-based security training is provided to personnel with assigned security roles and responsibilies when required by system changes;

AT-03a.02[02]

role-based privacy training is provided to personnel with assigned security roles and responsibilies when required by system changes;

AT-03b.[01]

role-based training content is updated <AT-03_ODP[04] frequency>;

AT-03b.[02]

role-based training content is updated following <AT-03_ODP[05] events>;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 123

NIST SP 800-53A, REV. 5

AT-03

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

ROLE-BASED TRAINING AT-03c.

lessons learned from internal or external security incidents or breaches are incorporated into role-based training.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

AT-03(01)

AT-03-Examine

[SELECT FROM: System security plan; privacy plan; security and privacy awareness and training policy; procedures addressing security and privacy training implementaon; codes of federal regulaons; security and privacy training curriculum; security and privacy training materials; training records; other relevant documents or records].

AT-03-Interview

[SELECT FROM: Organizaonal personnel with responsibilies for role-based security and privacy training; organizaonal personnel with assigned system security and privacy roles and responsibilies].

AT-03-Test

[SELECT FROM: Mechanisms managing role-based security and privacy training].

ROLE-BASED TRAINING | ENVIRONMENTAL CONTROLS ASSESSMENT OBJECTIVE: Determine if:

AT-03(01)_ODP[01]

personnel or roles to be provided with inial and refresher training in the employment and operaon of environmental controls are deﬁned;

AT-03(01)_ODP[02]

the frequency at which to provide refresher training in the employment and operaon of environmental controls is deﬁned;

AT-03(01)

<AT-03(01)_ODP[01] personnel or roles> are provided with inial and refresher training <AT-03(01)_ODP[02] frequency> in the employment and operaon of environmental controls.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

AT-03(02)

AT-03(01)-Examine

[SELECT FROM: Security and privacy awareness and training policy; procedures addressing security and privacy training implementaon; security and privacy training curriculum; security and privacy training materials; system security plan; privacy plan; training records; other relevant documents or records].

AT-03(01)-Interview

[SELECT FROM: Organizaonal personnel with responsibilies for role-based security and privacy training; organizaonal personnel with responsibilies for employing and operang environmental controls].

ROLE-BASED TRAINING | PHYSICAL SECURITY CONTROLS ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

AT-03(02)_ODP[01]

personnel or roles to be provided with inial and refresher training in the employment and operaon of physical security controls is/are deﬁned;

AT-03(02)_ODP[02]

the frequency at which to provide refresher training in the employment and operaon of physical security controls is deﬁned;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 124

NIST SP 800-53A, REV. 5

AT-03(02)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

ROLE-BASED TRAINING | PHYSICAL SECURITY CONTROLS AT-03(02)

<AT-03(02)_ODP[01] personnel or roles> is/are provided with inial and refresher training <AT-03(02)_ODP[02] frequency> in the employment and operaon of physical security controls.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

AT-03(03)

AT-03(02)-Examine

AT-03(02)-Interview

ROLE-BASED TRAINING | PRACTICAL EXERCISES ASSESSMENT OBJECTIVE: Determine if:

AT-03(03)[01]

praccal exercises in security training that reinforce training objecves are provided;

AT-03(03)[02]

praccal exercises in privacy training that reinforce training objecves are provided.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

AT-03(04)

AT-03(03)-Examine

[SELECT FROM: Security and privacy awareness and training policy; procedures addressing security and privacy awareness training implementaon; security and privacy awareness training curriculum; security and privacy awareness training materials; security and privacy awareness training reports and results; system security plan; privacy plan; other relevant documents or records].

AT-03(03)-Interview

[SELECT FROM: Organizaonal personnel with responsibilies for role-based security and privacy training; organizaonal personnel who parcipate in security and privacy awareness training].

ROLE-BASED TRAINING | SUSPICIOUS COMMUNICATIONS AND ANOMALOUS SYSTEM BEHAVIOR [WITHDRAWN: Moved to AT-02(04).]

AT-03(05)

ROLE-BASED TRAINING | PROCESSING PERSONALLY IDENTIFIABLE INFORMATION ASSESSMENT OBJECTIVE: Determine if:

AT-03(05)_ODP[01]

CHAPTER FOUR

personnel or roles to be provided with inial and refresher training in the employment and operaon of personally idenﬁable informaon processing and transparency controls is/are deﬁned;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 125

NIST SP 800-53A, REV. 5

AT-03(05)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

ROLE-BASED TRAINING | PROCESSING PERSONALLY IDENTIFIABLE INFORMATION AT-03(05)_ODP[02]

the frequency at which to provide refresher training in the employment and operaon of personally idenﬁable informaon processing and transparency controls is deﬁned;

AT-03(05)

<AT-03(05)_ODP[01] personnel or roles> are provided with inial and refresher training <AT-03(05)_ODP[02] frequency> in the employment and operaon of personally idenﬁable informaon processing and transparency controls.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

AT-04

AT-03(05)-Examine

[SELECT FROM: Security and privacy awareness and training policy; procedures addressing security and privacy awareness training implementaon; security and privacy awareness training curriculum; security and privacy awareness training materials; system security plan; privacy plan; organizaonal privacy noces; organizaonal policies; system of records noces; Privacy Act statements; computer matching agreements and noces; privacy impact assessments; informaon sharing agreements; other relevant documents or records].

AT-03(05)-Interview

[SELECT FROM: Organizaonal personnel with responsibilies for role-based security and privacy training; organizaonal personnel who parcipate in security and privacy awareness training].

TRAINING RECORDS ASSESSMENT OBJECTIVE: Determine if: AT-04_ODP

me period for retaining individual training records is deﬁned;

AT-04a.[01]

informaon security and privacy training acvies, including security and privacy awareness training and speciﬁc role-based security and privacy training, are documented;

AT-04a.[02]

informaon security and privacy training acvies, including security and privacy awareness training and speciﬁc role-based security and privacy training, are monitored;

AT-04b.

individual training records are retained for <AT-04_ODP me period>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

AT-04-Examine

[SELECT FROM: Security and privacy awareness and training policy; procedures addressing security and privacy training records; security and privacy awareness and training records; system security plan; privacy plan; other relevant documents or records].

AT-04-Interview

[SELECT FROM: Organizaonal personnel with informaon security and privacy training record retenon responsibilies].

AT-04-Test

[SELECT FROM: Mechanisms supporng the management of security and privacy training records].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 126

NIST SP 800-53A, REV. 5

AT-05

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

CONTACTS WITH SECURITY GROUPS AND ASSOCIATIONS [WITHDRAWN: Incorporated into PM-15.]

AT-06

TRAINING FEEDBACK ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

AT-06_ODP[01]

frequency at which to provide feedback on organizaonal training results is deﬁned;

AT-06_ODP[02]

personnel to whom feedback on organizaonal training results will be provided is/are assigned;

AT-06

feedback on organizaonal training results is provided <AT-06_ODP[01] frequency> to <AT-06_ODP[02] personnel>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

AT-06-Examine

[SELECT FROM: Security awareness and training policy; procedures addressing security training records; security awareness and training records; security plan; other relevant documents or records].

AT-06-Interview

[SELECT FROM: Organizaonal personnel with informaon security training record retenon responsibilies].

AT-06-Test

[SELECT FROM: Mechanisms supporng the management of security training records].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 127

NIST SP 800-53A, REV. 5

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

4.3 AUDIT AND ACCOUNTABILITY AU-01

POLICY AND PROCEDURES ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5 CHAPTER FOUR

AU-01_ODP[01]

personnel or roles to whom the audit and accountability policy is to be disseminated is/are deﬁned;

AU-01_ODP[02]

personnel or roles to whom the audit and accountability procedures are to be disseminated is/are deﬁned;

AU-01_ODP[03]

one or more of the following PARAMETER VALUES is/are selected: {organizaonlevel; mission/business process-level; system-level};

AU-01_ODP[04]

an oﬃcial to manage the audit and accountability policy and procedures is deﬁned;

AU-01_ODP[05]

the frequency at which the current audit and accountability policy is reviewed and updated is deﬁned;

AU-01_ODP[06]

events that would require the current audit and accountability policy to be reviewed and updated are deﬁned;

AU-01_ODP[07]

the frequency at which the current audit and accountability procedures are reviewed and updated is deﬁned;

AU-01_ODP[08]

events that would require audit and accountability procedures to be reviewed and updated are deﬁned;

AU-01a.[01]

an audit and accountability policy is developed and documented;

AU-01a.[02]

the audit and accountability policy is disseminated to <AU-01_ODP[01] personnel or roles>;

AU-01a.[03]

audit and accountability procedures to facilitate the implementaon of the audit and accountability policy and associated audit and accountability controls are developed and documented;

AU-01a.[04]

the audit and accountability procedures are disseminated to <AU-01_ODP[02] personnel or roles>;

AU-01a.01(a)[01]

the <AU-01_ODP[03] SELECTED PARAMETER VALUE(S)> of the audit and accountability policy addresses purpose;

AU-01a.01(a)[02]

the <AU-01_ODP[03] SELECTED PARAMETER VALUE(S)> of the audit and accountability policy addresses scope;

AU-01a.01(a)[03]

the <AU-01_ODP[03] SELECTED PARAMETER VALUE(S)> of the audit and accountability policy addresses roles;

AU-01a.01(a)[04]

the <AU-01_ODP[03] SELECTED PARAMETER VALUE(S)> of the audit and accountability policy addresses responsibilies;

AU-01a.01(a)[05]

the <AU-01_ODP[03] SELECTED PARAMETER VALUE(S)> of the audit and accountability policy addresses management commitment;

AU-01a.01(a)[06]

the <AU-01_ODP[03] SELECTED PARAMETER VALUE(S)> of the audit and accountability policy addresses coordinaon among organizaonal enes;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 128

NIST SP 800-53A, REV. 5

AU-01

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

POLICY AND PROCEDURES

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

AU-01a.01(a)[07]

the <AU-01_ODP[03] SELECTED PARAMETER VALUE(S)> of the audit and accountability policy addresses compliance;

AU-01a.01(b)

the <AU-01_ODP[03] SELECTED PARAMETER VALUE(S)> of the audit and accountability policy is consistent with applicable laws, execuve orders, direcves, regulaons, policies, standards, and guidelines;

AU-01b.

the <AU-01_ODP[04] oﬃcial> is designated to manage the development, documentaon, and disseminaon of the audit and accountability policy and procedures;

AU-01c.01[01]

the current audit and accountability policy is reviewed and updated <AU-01_ODP[05] frequency>;

AU-01c.01[02]

the current audit and accountability policy is reviewed and updated following <AU-01_ODP[06] events>;

AU-01c.02[01]

the current audit and accountability procedures are reviewed and updated <AU-01_ODP[07] frequency>;

AU-01c.02[02]

the current audit and accountability procedures are reviewed and updated following <AU-01_ODP[08] events>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

AU-02

AU-01-Examine

[SELECT FROM: Audit and accountability policy and procedures; system security plan; privacy plan; other relevant documents or records].

AU-01-Interview

[SELECT FROM: Organizaonal personnel with audit and accountability responsibilies; organizaonal personnel with informaon security and privacy responsibilies].

EVENT LOGGING ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

AU-02_ODP[01]

the event types that the system is capable of logging in support of the audit funcon are deﬁned;

AU-02_ODP[02]

the event types (subset of AU-02_ODP[01]) for logging within the system are deﬁned;

AU-02_ODP[03]

the frequency or situaon requiring logging for each speciﬁed event type is deﬁned;

AU-02_ODP[04]

the frequency of event types selected for logging are reviewed and updated;

AU-02a.

<AU-02_ODP[01] event types> that the system is capable of logging are idenﬁed in support of the audit logging funcon;

AU-02b.

the event logging funcon is coordinated with other organizaonal enes requiring audit-related informaon to guide and inform the selecon criteria for events to be logged;

AU-02c.[01]

<AU-02_ODP[02] event types (subset of AU-02_ODP[01])> are speciﬁed for logging within the system;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 129

NIST SP 800-53A, REV. 5

AU-02

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

EVENT LOGGING AU-02c.[02]

the speciﬁed event types are logged within the system <AU-02_ODP[03] frequency or situaon>;

AU-02d.

a raonale is provided for why the event types selected for logging are deemed to be adequate to support aer-the-fact invesgaons of incidents;

AU-02e.

the event types selected for logging are reviewed and updated <AU-02_ODP[04] frequency>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

AU-02(01)

AU-02-Examine

[SELECT FROM: Audit and accountability policy; procedures addressing auditable events; system security plan; privacy plan; system design documentaon; system conﬁguraon sengs and associated documentaon; system audit records; system auditable events; other relevant documents or records].

AU-02-Interview

[SELECT FROM: Organizaonal personnel with audit and accountability responsibilies; organizaonal personnel with informaon security and privacy responsibilies; system/network administrators].

AU-02-Test

[SELECT FROM: Mechanisms implemenng system auding].

EVENT LOGGING | COMPILATION OF AUDIT RECORDS FROM MULTIPLE SOURCES [WITHDRAWN: Incorporated into AU-12.]

AU-02(02)

EVENT LOGGING | SELECTION OF AUDIT EVENTS BY COMPONENT [WITHDRAWN: Incorporated into AU-12.]

AU-02(03)

EVENT LOGGING | REVIEWS AND UPDATES [WITHDRAWN: Incorporated into AU-02.]

AU-02(04)

EVENT LOGGING | PRIVILEGED FUNCTIONS [WITHDRAWN: Incorporated into AC-06(09).]

AU-03

CONTENT OF AUDIT RECORDS ASSESSMENT OBJECTIVE: Determine if: AU-03a.

CHAPTER FOUR

audit records contain informaon that establishes what type of event occurred;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 130

NIST SP 800-53A, REV. 5

AU-03

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

CONTENT OF AUDIT RECORDS AU-03b.

audit records contain informaon that establishes when the event occurred;

AU-03c.

audit records contain informaon that establishes where the event occurred;

AU-03d.

audit records contain informaon that establishes the source of the event;

AU-03e.

audit records contain informaon that establishes the outcome of the event;

AU-03f.

audit records contain informaon that establishes the identy of any individuals, subjects, or objects/enes associated with the event.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

AU-03(01)

AU-03-Examine

[SELECT FROM: Audit and accountability policy; system security plan; privacy plan; procedures addressing content of audit records; system design documentaon; system conﬁguraon sengs and associated documentaon; list of organizaondeﬁned auditable events; system audit records; system incident reports; other relevant documents or records].

AU-03-Interview

AU-03-Test

[SELECT FROM: Mechanisms implemenng system auding of auditable events].

CONTENT OF AUDIT RECORDS | ADDITIONAL AUDIT INFORMATION ASSESSMENT OBJECTIVE: Determine if:

AU-03(01)_ODP

addional informaon to be included in audit records is deﬁned;

AU-03(01)

generated audit records contain the following <AU-03(01)_ODP addional informaon>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

AU-03(02)

AU-03(01)-Examine

[SELECT FROM: Audit and accountability policy; procedures addressing content of audit records; system security plan; privacy plan; system design documentaon; system conﬁguraon sengs and associated documentaon; list of organizaondeﬁned auditable events; system audit records; other relevant documents or records].

AU-03(01)-Interview

AU-03(01)-Test

[SELECT FROM: system audit capability].

CONTENT OF AUDIT RECORDS | CENTRALIZED MANAGEMENT OF PLANNED AUDIT RECORD CONTENT [WITHDRAWN: Incorporated into PL-09.]

CHAPTER FOUR

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 131

NIST SP 800-53A, REV. 5

AU-03(03)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

CONTENT OF AUDIT RECORDS | LIMIT PERSONALLY IDENTIFIABLE INFORMATION ELEMENTS ASSESSMENT OBJECTIVE: Determine if:

AU-03(03)_ODP

elements idenﬁed in the privacy risk assessment are deﬁned;

AU-03(03)

personally idenﬁable informaon contained in audit records is limited to <AU-03(03)_ODP elements> idenﬁed in the privacy risk assessment.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

AU-04

AU-03(03)-Examine

[SELECT FROM: Audit and accountability policy; system security plan; privacy plan; privacy risk assessment; privacy risk assessment results; procedures addressing content of audit records; system design documentaon; system conﬁguraon sengs and associated documentaon; list of organizaon-deﬁned auditable events; system audit records; third party contracts; other relevant documents or records].

AU-03(03)-Interview

AU-03(03)-Test

[SELECT FROM: system audit capability].

AUDIT LOG STORAGE CAPACITY ASSESSMENT OBJECTIVE: Determine if: AU-04_ODP

audit log retenon requirements are deﬁned;

AU-04

audit log storage capacity is allocated to accommodate <AU-04_ODP audit log retenon requirements>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

AU-04-Examine

[SELECT FROM: Audit and accountability policy; procedures addressing audit storage capacity; system security plan; privacy plan; system design documentaon; system conﬁguraon sengs and associated documentaon; audit record storage requirements; audit record storage capability for system components; system audit records; other relevant documents or records].

AU-04-Interview

AU-04-Test

[SELECT FROM: Audit record storage capacity and related conﬁguraon sengs].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 132

NIST SP 800-53A, REV. 5

AU-04(01)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

AUDIT LOG STORAGE CAPACITY | TRANSFER TO ALTERNATE STORAGE ASSESSMENT OBJECTIVE: Determine if:

AU-04(01)_ODP

the frequency of audit logs transferred to a diﬀerent system, system component, or media other than the system or system component conducng the logging is deﬁned;

AU-04(01)

audit logs are transferred <AU-04(01)_ODP frequency> to a diﬀerent system, system component, or media other than the system or system component conducng the logging.

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

AU-05

AU-04(01)-Examine

[SELECT FROM: Audit and accountability policy; system security plan; privacy plan; procedures addressing audit storage capacity; procedures addressing transfer of system audit records to secondary or alternate systems; system design documentaon; system conﬁguraon sengs and associated documentaon; logs of audit record transfers to secondary or alternate systems; system audit records transferred to secondary or alternate systems; other relevant documents or records].

AU-04(01)-Interview

[SELECT FROM: Organizaonal personnel with audit storage capacity planning responsibilies; organizaonal personnel with informaon security and privacy responsibilies; system/network administrators].

AU-04(01)-Test

[SELECT FROM: Mechanisms supporng the transfer of audit records onto a diﬀerent system].

RESPONSE TO AUDIT LOGGING PROCESS FAILURES ASSESSMENT OBJECTIVE: Determine if:

AU-05_ODP[01]

personnel or roles receiving audit logging process failure alerts are deﬁned;

AU-05_ODP[02]

me period for personnel or roles receiving audit logging process failure alerts is deﬁned;

AU-05_ODP[03]

addional acons to be taken in the event of an audit logging process failure are deﬁned;

AU-05a.

<AU-05_ODP[01] personnel or roles> are alerted in the event of an audit logging process failure within <AU-05_ODP[02] me period>;

AU-05b.

<AU-05_ODP[03] addional acons> are taken in the event of an audit logging process failure.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: AU-05-Examine

CHAPTER FOUR

[SELECT FROM: Audit and accountability policy; procedures addressing response to audit processing failures; system design documentaon; system security plan; privacy plan; system conﬁguraon sengs and associated documentaon; list of personnel to be noﬁed in case of an audit processing failure; system audit records; other relevant documents or records].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 133

NIST SP 800-53A, REV. 5

AU-05

AU-05(01)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

RESPONSE TO AUDIT LOGGING PROCESS FAILURES AU-05-Interview

AU-05-Test

[SELECT FROM: Mechanisms implemenng system response to audit processing failures].

RESPONSE TO AUDIT LOGGING PROCESS FAILURES | STORAGE CAPACITY WARNING

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

ASSESSMENT OBJECTIVE: Determine if:

AU-05(01)_ODP[01]

personnel, roles, and/or locaons to be warned when allocated audit log storage volume reaches a percentage of repository maximum audit log storage capacity.

AU-05(01)_ODP[02]

me period for deﬁned personnel, roles, and/or locaons to be warned when allocated audit log storage volume reaches a percentage of repository maximum audit log storage capacity is deﬁned;

AU-05(01)_ODP[03]

percentage of repository maximum audit log storage capacity is deﬁned;

AU-05(01)

a warning is provided to <AU-05(01)_ODP[01] personnel, roles, and/or locaons> within <AU-05(01)_ODP[02] me period> when allocated audit log storage volume reaches <AU-05(01)_ODP[03] percentage> of repository maximum audit log storage capacity.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

AU-05(02)

AU-05(01)-Examine

[SELECT FROM: Audit and accountability policy; procedures addressing response to audit processing failures; system design documentaon; system security plan; privacy system conﬁguraon sengs and associated documentaon; system audit records; other relevant documents or records].

AU-05(01)-Interview

AU-05(01)-Test

[SELECT FROM: Mechanisms implemenng audit storage limit warnings].

RESPONSE TO AUDIT LOGGING PROCESS FAILURES | REAL-TIME ALERTS ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

AU-05(02)_ODP[01]

real-me period requiring alerts when audit failure events (deﬁned in AU-05(02)_ODP[03]) occur is deﬁned;

AU-05(02)_ODP[02]

personnel, roles, and/or locaons to be alerted in real me when audit failure events (deﬁned in AU-05(02)_ODP[03]) occur is/are deﬁned;

AU-05(02)_ODP[03]

audit logging failure events requiring real-me alerts are deﬁned;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 134

NIST SP 800-53A, REV. 5

AU-05(02)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

RESPONSE TO AUDIT LOGGING PROCESS FAILURES | REAL-TIME ALERTS AU-05(02)

an alert is provided within <AU-05(02)_ODP[01] real-me period> to <AU-05(02)_ODP[02] personnel, roles, and/or locaons> when <AU-05(02)_ODP[03] audit logging failure events requiring real-me alerts> occur.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

AU-05(03)

AU-05(02)-Examine

[SELECT FROM: Audit and accountability policy; procedures addressing response to audit processing failures; system design documentaon; system security plan; privacy plan; system conﬁguraon sengs and associated documentaon; system audit records; other relevant documents or records].

AU-05(02)-Interview

RESPONSE TO AUDIT LOGGING PROCESS FAILURES | CONFIGURABLE TRAFFIC VOLUME THRESHOLDS ASSESSMENT OBJECTIVE: Determine if:

AU-05(03)_ODP

one or more of the following PARAMETER VALUES is/are selected: {reject; delay};

AU-05(03)[01]

conﬁgurable network communicaons traﬃc volume thresholds reﬂecng limits on audit log storage capacity are enforced;

AU-05(03)[02]

network traﬃc is <AU-05(03)_ODP SELECTED PARAMETER VALUE(S)> if network traﬃc volume is above conﬁgured thresholds.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

AU-05(04)

AU-05(03)-Examine

[SELECT FROM: Audit and accountability policy; procedures addressing response to audit processing failures; system design documentaon; system security plan; privacy plan; system conﬁguraon sengs and associated documentaon; system audit records; other relevant documents or records].

AU-05(03)-Interview

RESPONSE TO AUDIT LOGGING PROCESS FAILURES | SHUTDOWN ON FAILURE ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

AU-05(04)_ODP[01]

one or more of the following PARAMETER VALUES is/are selected: {full system shutdown; paral system shutdown; degraded operaonal mode with limited mission or business funconality available};

AU-05(04)_ODP[02]

audit logging failures that trigger a change in operaonal mode are deﬁned;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 135

NIST SP 800-53A, REV. 5

AU-05(04)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

RESPONSE TO AUDIT LOGGING PROCESS FAILURES | SHUTDOWN ON FAILURE AU-05(04)

<AU-05(04)_ODP[01] SELECTED PARAMETER VALUE(S)> is/are invoked in the event of <AU-05(04)_ODP[02] audit logging failures> , unless an alternate audit logging capability exists.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

AU-05(05)

AU-05(04)-Examine

[SELECT FROM: Audit and accountability policy; procedures addressing response to audit processing failures; system design documentaon; system security plan; privacy plan; system conﬁguraon sengs and associated documentaon; system audit records; other relevant documents or records].

AU-05(04)-Interview

AU-05(04)-Test

[SELECT FROM: System capability invoking system shutdown or degraded operaonal mode in the event of an audit processing failure].

RESPONSE TO AUDIT LOGGING PROCESS FAILURES | ALTERNATE AUDIT LOGGING CAPABILITY ASSESSMENT OBJECTIVE: Determine if:

AU-05(05)_ODP

an alternate audit logging funconality in the event of a failure in primary audit logging capability is deﬁned;

AU-05(05)

an alternate audit logging capability is provided in the event of a failure in primary audit logging capability that implements <AU-05(05)_ODP alternate audit logging funconality>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

AU-06

AU-05(05)-Examine

[SELECT FROM: Audit and accountability policy; procedures addressing response to audit processing failures; system design documentaon; system security plan; privacy plan; system conﬁguraon sengs and associated documentaon; system audit records; other relevant documents or records].

AU-05(05)-Interview

AU-05(05)-Test

[SELECT FROM: Alternate audit logging capability].

AUDIT RECORD REVIEW, ANALYSIS, AND REPORTING ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

AU-06_ODP[01]

frequency at which system audit records are reviewed and analyzed is deﬁned;

AU-06_ODP[02]

inappropriate or unusual acvity is deﬁned;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 136

NIST SP 800-53A, REV. 5

AU-06

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

AUDIT RECORD REVIEW, ANALYSIS, AND REPORTING AU-06_ODP[03]

personnel or roles to receive ﬁndings from reviews and analyses of system records is/are deﬁned;

AU-06a.

system audit records are reviewed and analyzed <AU-06_ODP[01] frequency> for indicaons of <AU-06_ODP[02] inappropriate or unusual acvity> and the potenal impact of the inappropriate or unusual acvity;

AU-06b.

ﬁndings are reported to <AU-06_ODP[03] personnel or roles>;

AU-06c.

the level of audit record review, analysis, and reporng within the system is adjusted when there is a change in risk based on law enforcement informaon, intelligence informaon, or other credible sources of informaon.

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

AU-06(01)

AU-06-Examine

[SELECT FROM: Audit and accountability policy; system security plan; privacy plan; procedures addressing audit review, analysis, and reporng; reports of audit ﬁndings; records of acons taken in response to reviews/analyses of audit records; other relevant documents or records].

AU-06-Interview

[SELECT FROM: Organizaonal personnel with audit review, analysis, and reporng responsibilies; organizaonal personnel with informaon security and privacy responsibilies].

AUDIT RECORD REVIEW, ANALYSIS, AND REPORTING | AUTOMATED PROCESS INTEGRATION ASSESSMENT OBJECTIVE: Determine if:

AU-06(01)_ODP

automated mechanisms used for integrang audit record review, analysis, and reporng processes are deﬁned;

AU-06(01)

audit record review, analysis, and reporng processes are integrated using <AU-06(01)_ODP automated mechanisms>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

AU-06(02)

AU-06(01)-Examine

[SELECT FROM: Audit and accountability policy; system security plan; privacy plan; procedures addressing audit review, analysis, and reporng; procedures addressing invesgaon and response to suspicious acvies; system design documentaon; system conﬁguraon sengs and associated documentaon; system audit records; other relevant documents or records].

AU-06(01)-Interview

[SELECT FROM: Organizaonal personnel with audit review, analysis, and reporng responsibilies; organizaonal personnel with informaon security and privacy responsibilies].

AU-06(01)-Test

[SELECT FROM: Automated mechanisms integrang audit review, analysis, and reporng processes].

AUDIT RECORD REVIEW, ANALYSIS, AND REPORTING | AUTOMATED SECURITY ALERTS [WITHDRAWN: Incorporated into SI-04.]

CHAPTER FOUR

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 137

NIST SP 800-53A, REV. 5

AU-06(03)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

AUDIT RECORD REVIEW, ANALYSIS, AND REPORTING | CORRELATE AUDIT RECORD REPOSITORIES ASSESSMENT OBJECTIVE: Determine if: AU-06(03)

audit records across diﬀerent repositories are analyzed and correlated to gain organizaon-wide situaonal awareness.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

AU-06(04)

AU-06(03)-Examine

[SELECT FROM: Audit and accountability policy; system security plan; privacy plan; procedures addressing audit review, analysis, and reporng; system design documentaon; system conﬁguraon sengs and associated documentaon; system audit records across diﬀerent repositories; other relevant documents or records].

AU-06(03)-Interview

[SELECT FROM: Organizaonal personnel with audit review, analysis, and reporng responsibilies; organizaonal personnel with informaon security and privacy responsibilies].

AU-06(03)-Test

[SELECT FROM: Mechanisms supporng the analysis and correlaon of audit records].

AUDIT RECORD REVIEW, ANALYSIS, AND REPORTING | CENTRAL REVIEW AND ANALYSIS ASSESSMENT OBJECTIVE: Determine if:

AU-06(04)[01]

the capability to centrally review and analyze audit records from mulple components within the system is provided;

AU-06(04)[02]

the capability to centrally review and analyze audit records from mulple components within the system is implemented.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

AU-06(04)-Examine

[SELECT FROM: Audit and accountability policy; procedures addressing audit review, analysis, and reporng; system design documentaon; system conﬁguraon sengs and associated documentaon; system security plan; privacy plan; system audit records; other relevant documents or records].

AU-06(04)-Interview

[SELECT FROM: Organizaonal personnel with audit review, analysis, and reporng responsibilies; organizaonal personnel with informaon security and privacy responsibilies; system developers].

AU-06(04)-Test

[SELECT FROM: System capability to centralize review and analysis of audit records].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 138

NIST SP 800-53A, REV. 5

AU-06(05)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

AUDIT RECORD REVIEW, ANALYSIS, AND REPORTING | INTEGRATED ANALYSIS OF AUDIT RECORDS ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

AU-06(05)_ODP[01]

one or more of the following PARAMETER VALUES is/are selected: {vulnerability scanning informaon; performance data; system monitoring informaon; <AU-06(05)_ODP[02] data/informaon collected from other sources>};

AU-06(05)_ODP[02]

data/informaon collected from other sources to be analyzed is deﬁned (if selected);

AU-06(05)

analysis of audit records is integrated with analysis of <AU-06(05)_ODP[01] SELECTED PARAMETER VALUE(S)> to further enhance the ability to idenfy inappropriate or unusual acvity.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

AU-06(06)

AU-06(05)-Examine

[SELECT FROM: Audit and accountability policy; system security plan; privacy plan; procedures addressing audit review, analysis, and reporng; system design documentaon; system conﬁguraon sengs and associated documentaon; integrated analysis of audit records, vulnerability scanning informaon, performance data, network monitoring informaon, and associated documentaon; other relevant documents or records].

AU-06(05)-Interview

[SELECT FROM: Organizaonal personnel with audit review, analysis, and reporng responsibilies; organizaonal personnel with informaon security and privacy responsibilies].

AU-06(05)-Test

[SELECT FROM: Mechanisms implemenng the capability to integrate analysis of audit records with analysis of data/informaon sources].

AUDIT RECORD REVIEW, ANALYSIS, AND REPORTING | CORRELATION WITH PHYSICAL MONITORING ASSESSMENT OBJECTIVE: Determine if: AU-06(06)

informaon from audit records is correlated with informaon obtained from monitoring physical access to further enhance the ability to idenfy suspicious, inappropriate, unusual, or malevolent acvity.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

AU-06(06)-Examine

[SELECT FROM: Audit and accountability policy; procedures addressing audit review, analysis, and reporng; procedures addressing physical access monitoring; system design documentaon; system conﬁguraon sengs and associated documentaon; documentaon providing evidence of correlated informaon obtained from audit records and physical access monitoring records; system security plan; privacy plan; other relevant documents or records].

AU-06(06)-Interview

[SELECT FROM: Organizaonal personnel with audit review, analysis, and reporng responsibilies; organizaonal personnel with physical access monitoring responsibilies; organizaonal personnel with informaon security and privacy responsibilies].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 139

NIST SP 800-53A, REV. 5

AU-06(06)

AUDIT RECORD REVIEW, ANALYSIS, AND REPORTING | CORRELATION WITH PHYSICAL MONITORING AU-06(06)-Test

AU-06(07)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

[SELECT FROM: Mechanisms implemenng the capability to correlate informaon from audit records with informaon from monitoring physical access].

AUDIT RECORD REVIEW, ANALYSIS, AND REPORTING | PERMITTED ACTIONS ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

AU-06(07)_ODP

one or more of the following PARAMETER VALUES is/are selected: {system process; role; user};

AU-06(07)

the permied acons for each <AU-06(07)_ODP SELECTED PARAMETER VALUE(S)> associated with the review, analysis, and reporng of audit record informaon are speciﬁed.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

AU-06(08)

AU-06(07)-Examine

[SELECT FROM: Audit and accountability policy; procedures addressing process, role and/or user permied acons from audit review, analysis, and reporng; system security plan; privacy plan; other relevant documents or records].

AU-06(07)-Interview

[SELECT FROM: Organizaonal personnel with audit review, analysis, and reporng responsibilies; organizaonal personnel with informaon security and privacy responsibilies].

AU-06(07)-Test

[SELECT FROM: Mechanisms supporng permied acons for the review, analysis, and reporng of audit informaon].

AUDIT RECORD REVIEW, ANALYSIS, AND REPORTING | FULL TEXT ANALYSIS OF PRIVILEGED COMMANDS ASSESSMENT OBJECTIVE: Determine if: AU-06(08)

a full text analysis of logged privileged commands in a physically disnct component or subsystem of the system or other system that is dedicated to that analysis is performed.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

AU-06(08)-Examine

[SELECT FROM: Audit and accountability policy; procedures addressing audit review, analysis, and reporng; system design documentaon; system conﬁguraon sengs and associated documentaon; text analysis tools and techniques; text analysis documentaon of audited privileged commands; system security plan; privacy plan; other relevant documents or records].

AU-06(08)-Interview

[SELECT FROM: Organizaonal personnel with audit review, analysis, and reporng responsibilies; organizaonal personnel with informaon security and privacy responsibilies].

AU-06(08)-Test

[SELECT FROM: Mechanisms implemenng the capability to perform a full text analysis of audited privilege commands].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 140

NIST SP 800-53A, REV. 5

AU-06(09)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

AUDIT RECORD REVIEW, ANALYSIS, AND REPORTING | CORRELATION WITH INFORMATION FROM NONTECHNICAL SOURCES ASSESSMENT OBJECTIVE: Determine if: AU-06(09)

informaon from non-technical sources is correlated with audit record informaon to enhance organizaon-wide situaonal awareness.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

AU-06(10)

AU-06(09)-Examine

[SELECT FROM: Audit and accountability policy; system security plan; privacy plan; procedures addressing audit review, analysis, and reporng; system design documentaon; system conﬁguraon sengs and associated documentaon; documentaon providing evidence of correlated informaon obtained from audit records and organizaon-deﬁned non-technical sources; list of informaon types from non-technical sources for correlaon with audit informaon; other relevant documents or records].

AU-06(09)-Interview

[SELECT FROM: Organizaonal personnel with audit review, analysis, and reporng responsibilies; organizaonal personnel with informaon security and privacy responsibilies].

AU-06(09)-Test

[SELECT FROM: Mechanisms implemenng capability to correlate informaon from non-technical sources].

AUDIT RECORD REVIEW, ANALYSIS, AND REPORTING | AUDIT LEVEL ADJUSTMENT [WITHDRAWN: Incorporated into AU-06.]

AU-07

AUDIT RECORD REDUCTION AND REPORT GENERATION ASSESSMENT OBJECTIVE: Determine if: AU-07a.[01]

an audit record reducon and report generaon capability is provided that supports on-demand audit record review, analysis, and reporng requirements and aer-the-fact invesgaons of incidents;

AU-07a.[02]

an audit record reducon and report generaon capability is implemented that supports on-demand audit record review, analysis, and reporng requirements and aer-the-fact invesgaons of incidents;

AU-07b.[01]

an audit record reducon and report generaon capability is provided that does not alter the original content or me ordering of audit records;

AU-07b.[02]

an audit record reducon and report generaon capability is implemented that does not alter the original content or me ordering of audit records.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: AU-07-Examine

CHAPTER FOUR

[SELECT FROM: Audit and accountability policy; system security plan; privacy plan; procedures addressing audit reducon and report generaon; system design documentaon; system conﬁguraon sengs and associated documentaon; audit reducon, review, analysis, and reporng tools; system audit records; other relevant documents or records].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 141

NIST SP 800-53A, REV. 5

AU-07

AU-07(01)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

AUDIT RECORD REDUCTION AND REPORT GENERATION AU-07-Interview

[SELECT FROM: Organizaonal personnel with audit reducon and report generaon responsibilies; organizaonal personnel with informaon security and privacy responsibilies].

AU-07-Test

[SELECT FROM: Audit reducon and report generaon capability].

AUDIT RECORD REDUCTION AND REPORT GENERATION | AUTOMATIC PROCESSING

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

ASSESSMENT OBJECTIVE: Determine if:

AU-07(01)_ODP

ﬁelds within audit records that can be processed, sorted, or searched are deﬁned;

AU-07(01)[01]

the capability to process, sort, and search audit records for events of interest based on <AU-07(01)_ODP ﬁelds within audit records> are provided;

AU-07(01)[02]

the capability to process, sort, and search audit records for events of interest based on <AU-07(01)_ODP ﬁelds within audit records> are implemented.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

AU-07(02)

AU-07(01)-Examine

[SELECT FROM: Audit and accountability policy; system security plan; privacy plan; procedures addressing audit reducon and report generaon; system design documentaon; system conﬁguraon sengs and associated documentaon; audit reducon, review, analysis, and reporng tools; audit record criteria (ﬁelds) establishing events of interest; system audit records; other relevant documents or records].

AU-07(01)-Interview

[SELECT FROM: Organizaonal personnel with audit reducon and report generaon responsibilies; organizaonal personnel with informaon security and privacy responsibilies; system developers].

AU-07(01)-Test

[SELECT FROM: Audit reducon and report generaon capability].

AUDIT RECORD REDUCTION AND REPORT GENERATION | AUTOMATIC SORT AND SEARCH [WITHDRAWN: Incorporated into AU-07(01).]

AU-08

TIME STAMPS ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

AU-08_ODP

granularity of me measurement for audit record mestamps is deﬁned;

AU-08a.

internal system clocks are used to generate mestamps for audit records;

AU-08b.

mestamps are recorded for audit records that meet <AU-08_ODP granularity of me measurement> and that use Coordinated Universal Time, have a ﬁxed local me oﬀset from Coordinated Universal Time, or include the local me oﬀset as part of the mestamp.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 142

NIST SP 800-53A, REV. 5

AU-08

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

TIME STAMPS POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

AU-08(01)

AU-08-Examine

[SELECT FROM: Audit and accountability policy; system security plan; privacy plan; procedures addressing mestamp generaon; system design documentaon; system conﬁguraon sengs and associated documentaon; system audit records; other relevant documents or records].

AU-08-Interview

[SELECT FROM: Organizaonal personnel with informaon security and privacy responsibilies; system/network administrators; system developers].

AU-08-Test

[SELECT FROM: Mechanisms implemenng mestamp generaon].

TIME STAMPS | SYNCHRONIZATION WITH AUTHORITATIVE TIME SOURCE [WITHDRAWN: Moved to SC-45(01).]

AU-08(02)

TIME STAMPS | SECONDARY AUTHORITATIVE TIME SOURCE [WITHDRAWN: Moved to SC-45(02).]

AU-09

PROTECTION OF AUDIT INFORMATION ASSESSMENT OBJECTIVE: Determine if: AU-09_ODP

personnel or roles to be alerted upon detecon of unauthorized access, modiﬁcaon, or deleon of audit informaon is/are deﬁned;

AU-09a.

audit informaon and audit logging tools are protected from unauthorized access, modiﬁcaon, and deleon;

AU-09b.

<AU-09_ODP personnel or roles> are alerted upon detecon of unauthorized access, modiﬁcaon, or deleon of audit informaon.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

AU-09-Examine

[SELECT FROM: Audit and accountability policy; system security plan; privacy plan; access control policy and procedures; procedures addressing protecon of audit informaon; system design documentaon; system conﬁguraon sengs and associated documentaon; system audit records; audit tools; other relevant documents or records].

AU-09-Interview

AU-09-Test

[SELECT FROM: Mechanisms implemenng audit informaon protecon].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 143

NIST SP 800-53A, REV. 5

AU-09(01)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

PROTECTION OF AUDIT INFORMATION | HARDWARE WRITE-ONCE MEDIA ASSESSMENT OBJECTIVE: Determine if: AU-09(01)

audit trails are wrien to hardware-enforced, write-once media.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

AU-09(02)

AU-09(01)-Examine

[SELECT FROM: Audit and accountability policy; system security plan; privacy plan; access control policy and procedures; procedures addressing protecon of audit informaon; system design documentaon; system hardware sengs; system conﬁguraon sengs and associated documentaon; system storage media; system audit records; other relevant documents or records].

AU-09(01)-Interview

AU-09(01)-Test

[SELECT FROM: System media storing audit trails].

PROTECTION OF AUDIT INFORMATION | STORE ON SEPARATE PHYSICAL SYSTEMS OR COMPONENTS ASSESSMENT OBJECTIVE: Determine if:

AU-09(02)_ODP

the frequency of storing audit records in a repository is deﬁned;

AU-09(02)

audit records are stored <AU-09(02)_ODP frequency> in a repository that is part of a physically diﬀerent system or system component than the system or component being audited.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

AU-09(03)

AU-09(02)-Examine

[SELECT FROM: Audit and accountability policy; system security plan; privacy plan; procedures addressing protecon of audit informaon; system design documentaon; system conﬁguraon sengs and associated documentaon; system or media storing backups of system audit records; system audit records; other relevant documents or records].

AU-09(02)-Interview

AU-09(02)-Test

[SELECT FROM: Mechanisms implemenng the backing up of audit records].

PROTECTION OF AUDIT INFORMATION | CRYPTOGRAPHIC PROTECTION ASSESSMENT OBJECTIVE: Determine if: AU-09(03)

CHAPTER FOUR

cryptographic mechanisms to protect the integrity of audit informaon and audit tools are implemented.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 144

NIST SP 800-53A, REV. 5

AU-09(03)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

PROTECTION OF AUDIT INFORMATION | CRYPTOGRAPHIC PROTECTION POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

AU-09(04)

AU-09(03)-Examine

[SELECT FROM: Audit and accountability policy; system security plan; privacy plan; access control policy and procedures; procedures addressing protecon of audit informaon; system design documentaon; system hardware sengs; system conﬁguraon sengs and associated documentaon; system audit records; other relevant documents or records].

AU-09(03)-Interview

AU-09(03)-Test

[SELECT FROM: Cryptographic mechanisms protecng the integrity of audit informaon and tools].

PROTECTION OF AUDIT INFORMATION | ACCESS BY SUBSET OF PRIVILEGED USERS ASSESSMENT OBJECTIVE: Determine if:

AU-09(04)_ODP

a subset of privileged users or roles authorized to access management of audit logging funconality is deﬁned;

AU-09(04)

access to management of audit logging funconality is authorized only to <AU-09(04)_ODP subset of privileged users or roles>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

AU-09(05)

AU-09(04)-Examine

[SELECT FROM: Audit and accountability policy; system security plan; privacy plan; access control policy and procedures; procedures addressing protecon of audit informaon; system design documentaon; system conﬁguraon sengs and associated documentaon; system-generated list of privileged users with access to management of audit funconality; access authorizaons; access control list; system audit records; other relevant documents or records].

AU-09(04)-Interview

AU-09(04)-Test

[SELECT FROM: Mechanisms managing access to audit funconality].

PROTECTION OF AUDIT INFORMATION | DUAL AUTHORIZATION ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

AU-09(05)_ODP[01]

one or more of the following PARAMETER VALUES is/are selected: {movement; deleon};

AU-09(05)_ODP[02]

audit informaon for which dual authorizaon is to be enforced is deﬁned;

AU-09(05)

dual authorizaon is enforced for the <AU-09(05)_ODP[01] SELECTED PARAMETER VALUE(S)> of <AU-09(05)_ODP[02] audit informaon>.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 145

NIST SP 800-53A, REV. 5

AU-09(05)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

PROTECTION OF AUDIT INFORMATION | DUAL AUTHORIZATION POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

AU-09(06)

AU-09(05)-Examine

[SELECT FROM: Audit and accountability policy; system security plan; privacy plan; access control policy and procedures; procedures addressing protecon of audit informaon; system design documentaon; system conﬁguraon sengs and associated documentaon; access authorizaons; system audit records; other relevant documents or records].

AU-09(05)-Interview

AU-09(05)-Test

[SELECT FROM: Mechanisms implemenng the enforcement of dual authorizaon].

PROTECTION OF AUDIT INFORMATION | READ-ONLY ACCESS ASSESSMENT OBJECTIVE: Determine if:

AU-09(06)_ODP

a subset of privileged users or roles with authorized read-only access to audit informaon is deﬁned;

AU-09(06)

read-only access to audit informaon is authorized to <AU-09(06)_ODP subset of privileged users or roles>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

AU-09(07)

AU-09(06)-Examine

[SELECT FROM: Audit and accountability policy; system security plan; privacy plan; access control policy and procedures; procedures addressing protecon of audit informaon; system design documentaon; system conﬁguraon sengs and associated documentaon; system-generated list of privileged users with read-only access to audit informaon; access authorizaons; access control list; system audit records; other relevant documents or records].

AU-09(06)-Interview

AU-09(06)-Test

[SELECT FROM: Mechanisms managing access to audit informaon].

PROTECTION OF AUDIT INFORMATION | STORE ON COMPONENT WITH DIFFERENT OPERATING SYSTEM ASSESSMENT OBJECTIVE: Determine if: AU-09(07)

CHAPTER FOUR

audit informaon is stored on a component running a diﬀerent operang system than the system or component being audited.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 146

NIST SP 800-53A, REV. 5

AU-09(07)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

PROTECTION OF AUDIT INFORMATION | STORE ON COMPONENT WITH DIFFERENT OPERATING SYSTEM POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

AU-10

AU-09(07)-Examine

AU-09(07)-Interview

AU-09(07)-Test

[SELECT FROM: Mechanisms implemenng operang system veriﬁcaon capability; mechanisms verifying audit informaon storage locaon].

NON-REPUDIATION ASSESSMENT OBJECTIVE: Determine if: AU-10_ODP

acons to be covered by non-repudiaon are deﬁned;

AU-10

irrefutable evidence is provided that an individual (or process acng on behalf of an individual) has performed <AU-10_ODP acons>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

AU-10(01)

AU-10-Examine

[SELECT FROM: Audit and accountability policy; system security plan; privacy plan; procedures addressing non-repudiaon; system design documentaon; system conﬁguraon sengs and associated documentaon; system audit records; other relevant documents or records].

AU-10-Interview

[SELECT FROM: Organizaonal personnel with informaon security and privacy responsibilies; system/network administrators; system developers].

AU-10-Test

[SELECT FROM: Mechanisms implemenng non-repudiaon capability].

NON-REPUDIATION | ASSOCIATION OF IDENTITIES ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

AU-10(01)_ODP

the strength of binding between the identy of the informaon producer and the informaon is deﬁned;

AU-10(01)(a)

the identy of the informaon producer is bound with the informaon to <AU-10(01)_ODP strength of binding>;

AU-10(01)(b)

the means for authorized individuals to determine the identy of the producer of the informaon is provided.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 147

NIST SP 800-53A, REV. 5

AU-10(01)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

NON-REPUDIATION | ASSOCIATION OF IDENTITIES POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

AU-10(02)

AU-10(01)-Examine

AU-10(01)-Interview

[SELECT FROM: Organizaonal personnel with informaon security and privacy responsibilies; system/network administrators; system developers].

AU-10(01)-Test

[SELECT FROM: Mechanisms implemenng non-repudiaon capability].

NON-REPUDIATION | VALIDATE BINDING OF INFORMATION PRODUCER IDENTITY ASSESSMENT OBJECTIVE: Determine if:

AU-10(02)_ODP[01]

the frequency at which to validate the binding of the informaon producer identy to the informaon is deﬁned;

AU-10(02)_ODP[02]

the acons to be performed in the event of a validaon error are deﬁned;

AU-10(02)(a)

the binding of the informaon producer identy to the informaon is validated at <AU-10(02)_ODP[01] frequency>;

AU-10(02)(b)

<AU-10(02)_ODP[02] acons> in the event of a validaon error are performed.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

AU-10(03)

AU-10(02)-Examine

[SELECT FROM: Audit and accountability policy; system security plan; privacy plan; procedures addressing non-repudiaon; system design documentaon; system conﬁguraon sengs and associated documentaon; validaon records; system audit records; other relevant documents or records].

AU-10(02)-Interview

[SELECT FROM: Organizaonal personnel with informaon security and privacy responsibilies; system/network administrators; system developers].

AU-10(02)-Test

[SELECT FROM: Mechanisms implemenng non-repudiaon capability].

NON-REPUDIATION | CHAIN OF CUSTODY ASSESSMENT OBJECTIVE: Determine if: AU-10(03)

reviewer or releaser credenals are maintained within the established chain of custody for informaon reviewed or released.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: AU-10(03)-Examine

CHAPTER FOUR

[SELECT FROM: Audit and accountability policy; system security plan; privacy plan; procedures addressing non-repudiaon; system design documentaon; system conﬁguraon sengs and associated documentaon; records of informaon reviews and releases; system audit records; other relevant documents or records].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 148

NIST SP 800-53A, REV. 5

AU-10(03)

AU-10(04)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

NON-REPUDIATION | CHAIN OF CUSTODY AU-10(03)-Interview

[SELECT FROM: Organizaonal personnel with informaon security and privacy responsibilies; system/network administrators; system developers].

AU-10(03)-Test

[SELECT FROM: Automated mechanisms implemenng non-repudiaon capability].

NON-REPUDIATION | VALIDATE BINDING OF INFORMATION REVIEWER IDENTITY ASSESSMENT OBJECTIVE:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

Determine if:

AU-10(04)_ODP[01]

security domains for which the binding of the informaon reviewer identy to the informaon is to be validated at transfer or release are deﬁned;

AU-10(04)_ODP[02]

acons to be performed in the event of a validaon error are deﬁned;

AU-10(04)(a)

the binding of the informaon reviewer identy to the informaon at the transfer or release points prior to release or transfer between <AU-10(04)_ODP[01] security domains> is validated;

AU-10(04)(b)

<AU-10(04)_ODP[02] acons> are performed in the event of a validaon error.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

AU-10(05)

AU-10(04)-Examine

[SELECT FROM: Audit and accountability policy; system security plan; privacy plan; procedures addressing non-repudiaon; system design documentaon; system conﬁguraon sengs and associated documentaon; validaon records; system audit records; other relevant documents or records].

AU-10(04)-Interview

[SELECT FROM: Organizaonal personnel with informaon security and privacy responsibilies; system/network administrators; system developers].

AU-10(04)-Test

[SELECT FROM: Mechanisms implemenng non-repudiaon capability].

NON-REPUDIATION | DIGITAL SIGNATURES [WITHDRAWN: Incorporated into SI-07.]

AU-11

AUDIT RECORD RETENTION ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

AU-11_ODP

a me period to retain audit records that is consistent with the records retenon policy is deﬁned;

AU-11

audit records are retained for <AU-11_ODP me period> to provide support for aer-the-fact invesgaons of incidents and to meet regulatory and organizaonal informaon retenon requirements.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 149

NIST SP 800-53A, REV. 5

AU-11

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

AUDIT RECORD RETENTION POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

AU-11(01)

AU-11-Examine

[SELECT FROM: Audit and accountability policy; system security plan; privacy plan; audit record retenon policy and procedures; security plan; organizaon-deﬁned retenon period for audit records; audit record archives; audit logs; audit records; other relevant documents or records].

AU-11-Interview

[SELECT FROM: Organizaonal personnel with audit record retenon responsibilies; organizaonal personnel with informaon security and privacy responsibilies; system/network administrators].

AUDIT RECORD RETENTION | LONG-TERM RETRIEVAL CAPABILITY ASSESSMENT OBJECTIVE: Determine if:

AU-11(01)_ODP

measures to be employed to ensure that long-term audit records generated by the system can be retrieved are deﬁned;

AU-11(01)

<AU-11(01)_ODP measures> are employed to ensure that long-term audit records generated by the system can be retrieved.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

AU-12

AU-11(01)-Examine

[SELECT FROM: Audit and accountability policy; system security plan; privacy plan; audit record retenon policy and procedures; system design documentaon; system conﬁguraon sengs and associated documentaon; audit record archives; audit logs; audit records; other relevant documents or records].

AU-11(01)-Interview

AU-11(01)-Test

[SELECT FROM: Mechanisms implemenng audit record retenon capability].

AUDIT RECORD GENERATION ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

AU-12_ODP[01]

system components that provide an audit record generaon capability for the events types (deﬁned in AU-02_ODP[02]) are deﬁned;

AU-12_ODP[02]

personnel or roles allowed to select the event types that are to be logged by speciﬁc components of the system is/are deﬁned;

AU-12a.

audit record generaon capability for the event types the system is capable of auding (deﬁned in AU-02_ODP[01]) is provided by <AU-12_ODP[01] system components>;

AU-12b.

<AU-12_ODP[02] personnel or roles> is/are allowed to select the event types that are to be logged by speciﬁc components of the system;

AU-12c.

audit records for the event types deﬁned in AU-02_ODP[02] that include the audit record content deﬁned in AU-03 are generated.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 150

NIST SP 800-53A, REV. 5

AU-12

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

AUDIT RECORD GENERATION POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

AU-12(01)

AU-12-Examine

[SELECT FROM: Audit and accountability policy; procedures addressing audit record generaon; system security plan; privacy plan; system design documentaon; system conﬁguraon sengs and associated documentaon; list of auditable events; system audit records; other relevant documents or records].

AU-12-Interview

[SELECT FROM: Organizaonal personnel with audit record generaon responsibilies; organizaonal personnel with informaon security and privacy responsibilies; system/network administrators; system developers].

AU-12-Test

[SELECT FROM: Mechanisms implemenng audit record generaon capability].

AUDIT RECORD GENERATION | SYSTEM-WIDE AND TIME-CORRELATED AUDIT TRAIL ASSESSMENT OBJECTIVE: Determine if:

AU-12(01)_ODP[01]

system components from which audit records are to be compiled into a systemwide (logical or physical) audit trail are deﬁned;

AU-12(01)_ODP[02]

level of tolerance for the relaonship between mestamps of individual records in the audit trail is deﬁned;

AU-12(01)

audit records from <AU-12(01)_ODP[01] system components> are compiled into a system-wide (logical or physical) audit trail that is me-correlated to within <AU-12(01)_ODP[02] level of tolerance>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

AU-12(02)

AU-12(01)-Examine

[SELECT FROM: Audit and accountability policy; system security plan; privacy plan; procedures addressing audit record generaon; system design documentaon; system conﬁguraon sengs and associated documentaon; system-wide audit trail (logical or physical); system audit records; other relevant documents or records].

AU-12(01)-Interview

AU-12(01)-Test

[SELECT FROM: Mechanisms implemenng audit record generaon capability].

AUDIT RECORD GENERATION | STANDARDIZED FORMATS ASSESSMENT OBJECTIVE: Determine if: AU-12(02)

CHAPTER FOUR

a system-wide (logical or physical) audit trail composed of audit records is produced in a standardized format.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 151

NIST SP 800-53A, REV. 5

AU-12(02)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

AUDIT RECORD GENERATION | STANDARDIZED FORMATS POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

AU-12(03)

AU-12(02)-Examine

AU-12(02)-Interview

[SELECT FROM: Organizaonal personnel with audit record generaon responsibilies; organizaonal personnel with security responsibilies; system/ network administrators; system developers].

AU-12(02)-Test

[SELECT FROM: Mechanisms implemenng audit record generaon capability].

AUDIT RECORD GENERATION | CHANGES BY AUTHORIZED INDIVIDUALS ASSESSMENT OBJECTIVE: Determine if:

AU-12(03)_ODP[01]

individuals or roles authorized to change the logging on system components are deﬁned;

AU-12(03)_ODP[02]

system components on which logging is to be performed are deﬁned;

AU-12(03)_ODP[03]

selectable event criteria with which change logging is to be performed are deﬁned;

AU-12(03)_ODP[04]

me thresholds in which logging acons are to change is deﬁned;

AU-12(03)[01]

the capability for <AU-12(03)_ODP[01] individuals or roles> to change the logging to be performed on <AU-12(03)_ODP[02] system components> based on <AU-12(03)_ODP[03] selectable event criteria> within <AU-12(03)_ODP[04] me thresholds> is provided;

AU-12(03)[02]

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

AU-12(03)-Examine

[SELECT FROM: Audit and accountability policy; system security plan; privacy plan; procedures addressing audit record generaon; system design documentaon; system conﬁguraon sengs and associated documentaon; system-generated list of individuals or roles authorized to change auding to be performed; system audit records; other relevant documents or records].

AU-12(03)-Interview

AU-12(03)-Test

[SELECT FROM: Mechanisms implemenng audit record generaon capability].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 152

NIST SP 800-53A, REV. 5

AU-12(04)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

AUDIT RECORD GENERATION | QUERY PARAMETER AUDITS OF PERSONALLY IDENTIFIABLE INFORMATION ASSESSMENT OBJECTIVE: Determine if:

AU-12(04)[01]

the capability to audit the parameters of user query events for data sets containing personally idenﬁable informaon is provided;

AU-12(04)[02]

the capability to audit the parameters of user query events for data sets containing personally idenﬁable informaon is implemented.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

AU-13

AU-12(04)-Examine

[SELECT FROM: Audit and accountability policy; system security plan; privacy plan; procedures addressing audit record generaon; query event records; system design documentaon; system conﬁguraon sengs and associated documentaon; map of system data acons; system audit records; other relevant documents or records].

AU-12(04)-Interview

AU-12(04)-Test

[SELECT FROM: Mechanisms implemenng audit record generaon capability].

MONITORING FOR INFORMATION DISCLOSURE ASSESSMENT OBJECTIVE: Determine if:

AU-13_ODP[01]

open-source informaon and/or informaon sites to be monitored for evidence of unauthorized disclosure of organizaonal informaon is/are deﬁned;

AU-13_ODP[02]

the frequency with which open-source informaon and/or informaon sites are monitored for evidence of unauthorized disclosure of organizaonal informaon is deﬁned;

AU-13_ODP[03]

personnel or roles to be noﬁed if an informaon disclosure is discovered is/are deﬁned;

AU-13_ODP[04]

addional acons to be taken if an informaon disclosure is discovered are deﬁned;

AU-13a.

<AU-13_ODP[01] open-source informaon and/or informaon sites> is/are monitored <AU-13_ODP[02] frequency> for evidence of unauthorized disclosure of organizaonal informaon;

AU-13b.01

<AU-13_ODP[03] personnel or roles> are noﬁed if an informaon disclosure is discovered;

AU-13b.02

<AU-13_ODP[04] addional acons> are taken if an informaon disclosure is discovered.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: AU-13-Examine

CHAPTER FOUR

[SELECT FROM: Audit and accountability policy; system security plan; privacy plan; procedures addressing informaon disclosure monitoring; system design documentaon; system conﬁguraon sengs and associated documentaon; monitoring records; system audit records; other relevant documents or records].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 153

NIST SP 800-53A, REV. 5

AU-13

AU-13(01)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

MONITORING FOR INFORMATION DISCLOSURE AU-13-Interview

[SELECT FROM: Organizaonal personnel with responsibilies for monitoring opensource informaon and/or informaon sites; organizaonal personnel with security and privacy responsibilies].

AU-13-Test

[SELECT FROM: Mechanisms implemenng monitoring for informaon disclosure].

MONITORING FOR INFORMATION DISCLOSURE | USE OF AUTOMATED TOOLS

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

ASSESSMENT OBJECTIVE: Determine if:

AU-13(01)_ODP

automated mechanisms for monitoring open-source informaon and informaon sites are deﬁned;

AU-13(01)

open-source informaon and informaon sites are monitored using <AU-13(01)_ODP automated mechanisms>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

AU-13(02)

AU-13(01)-Examine

[SELECT FROM: Audit and accountability policy; system security plan; privacy plan; procedures addressing informaon disclosure monitoring; system design documentaon; system conﬁguraon sengs and associated documentaon; automated monitoring tools; system audit records; other relevant documents or records].

AU-13(01)-Interview

[SELECT FROM: Organizaonal personnel with responsibilies for monitoring informaon disclosures; organizaonal personnel with informaon security and privacy responsibilies].

AU-13(01)-Test

[SELECT FROM: Automated mechanisms implemenng monitoring for informaon disclosure].

MONITORING FOR INFORMATION DISCLOSURE | REVIEW OF MONITORED SITES ASSESSMENT OBJECTIVE: Determine if:

AU-13(02)_ODP

the frequency at which to review the open-source informaon sites being monitored is deﬁned;

AU-13(02)

the list of open-source informaon sites being monitored is reviewed <AU-13(02)_ODP frequency>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

AU-13(02)-Examine

[SELECT FROM: Audit and accountability policy; system security plan; privacy plan; procedures addressing informaon disclosure monitoring; system design documentaon; system conﬁguraon sengs and associated documentaon; reviews for open-source informaon sites being monitored; system audit records; other relevant documents or records].

AU-13(02)-Interview

[SELECT FROM: Organizaonal personnel with responsibilies for monitoring opensource informaon sites; organizaonal personnel with informaon security and privacy responsibilies].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 154

NIST SP 800-53A, REV. 5

AU-13(02)

MONITORING FOR INFORMATION DISCLOSURE | REVIEW OF MONITORED SITES AU-13(02)-Test

AU-13(03)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

[SELECT FROM: Mechanisms implemenng monitoring for informaon disclosure].

MONITORING FOR INFORMATION DISCLOSURE | UNAUTHORIZED REPLICATION OF INFORMATION ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

AU-13(03)

discovery techniques, processes, and tools are employed to determine if external enes are replicang organizaonal informaon in an unauthorized manner.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

AU-14

AU-13(03)-Examine

[SELECT FROM: Audit and accountability policy; system security plan; privacy plan; procedures addressing informaon disclosure monitoring; procedures addressing informaon replicaon; system design documentaon; system conﬁguraon sengs and associated documentaon; system audit records; training resources for staﬀ to recognize the unauthorized use of organizaonal informaon; other relevant documents or records].

AU-13(03)-Interview

[SELECT FROM: Organizaonal personnel with responsibilies for monitoring unauthorized replicaon of informaon; organizaonal personnel with informaon security and privacy responsibilies].

AU-13(03)-Test

[SELECT FROM: Discovery tools for idenfying unauthorized informaon replicaon].

SESSION AUDIT ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

AU-14_ODP[01]

users or roles who can audit the content of a user session are deﬁned;

AU-14_ODP[02]

one or more of the following PARAMETER VALUES is/are selected: {record; view; hear; log};

AU-14_ODP[03]

circumstances under which the content of a user session can be audited are deﬁned;

AU-14a.[01]

<AU-14_ODP[01] users or roles> are provided with the capability to <AU-14_ODP[02] SELECTED PARAMETER VALUE(S)> the content of a user session under <AU-14_ODP[03] circumstances>;

AU-14a.[02]

the capability for <AU-14_ODP[01] users or roles> to <AU-14_ODP[02] SELECTED PARAMETER VALUE(S)> the content of a user session under <AU-14_ODP[03] circumstances> is implemented;

AU-14b.[01]

session auding acvies are developed in consultaon with legal counsel and in accordance with applicable laws, execuve orders, direcves, regulaons, policies, standards, and guidelines;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 155

NIST SP 800-53A, REV. 5

AU-14

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

SESSION AUDIT AU-14b.[02]

session auding acvies are integrated in consultaon with legal counsel and in accordance with applicable laws, execuve orders, direcves, regulaons, policies, standards, and guidelines;

AU-14b.[03]

session auding acvies are used in consultaon with legal counsel and in accordance with applicable laws, execuve orders, direcves, regulaons, policies, standards, and guidelines;

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

AU-14(01)

AU-14-Examine

[SELECT FROM: Audit and accountability policy; system security plan; privacy plan; procedures addressing user session auding; system design documentaon; system conﬁguraon sengs and associated documentaon; system audit records; other relevant documents or records].

AU-14-Interview

[SELECT FROM: Organizaonal personnel with informaon security and privacy responsibilies; system/network administrators; system developers; legal counsel; personnel with civil liberes responsibilies].

AU-14-Test

[SELECT FROM: Mechanisms implemenng user session auding capability].

SESSION AUDIT | SYSTEM START-UP ASSESSMENT OBJECTIVE: Determine if: AU-14(01)

session audits are iniated automacally at system start-up.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

AU-14(02)

AU-14(01)-Examine

AU-14(01)-Interview

[SELECT FROM: Organizaonal personnel with informaon security and privacy responsibilies; system/network administrators; system developers].

AU-14(01)-Test

[SELECT FROM: Mechanisms implemenng user session auding capability].

SESSION AUDIT | CAPTURE AND RECORD CONTENT [WITHDRAWN: Incorporated into AU-14.]

AU-14(03)

SESSION AUDIT | REMOTE VIEWING AND LISTENING ASSESSMENT OBJECTIVE: Determine if:

AU-14(03)[01]

CHAPTER FOUR

the capability for authorized users to remotely view and hear content related to an established user session in real me is provided;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 156

NIST SP 800-53A, REV. 5

AU-14(03)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

SESSION AUDIT | REMOTE VIEWING AND LISTENING AU-14(03)[02]

the capability for authorized users to remotely view and hear content related to an established user session in real me is implemented.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

AU-15

AU-14(03)-Examine

AU-14(03)-Interview

AU-14(03)-Test

[SELECT FROM: Mechanisms implemenng user session auding capability].

ALTERNATE AUDIT LOGGING CAPABILITY [WITHDRAWN: Moved to AU-05(05).]

AU-16

CROSS-ORGANIZATIONAL AUDIT LOGGING ASSESSMENT OBJECTIVE: Determine if:

AU-16_ODP[01]

methods for coordinang audit informaon among external organizaons when audit informaon is transmied across organizaonal boundaries are deﬁned;

AU-16_ODP[02]

audit informaon to be coordinated among external organizaons when audit informaon is transmied across organizaonal boundaries is deﬁned;

AU-16

<AU-16_ODP[01] methods> for coordinang <AU-16_ODP[02] audit informaon> among external organizaons when audit informaon is transmied across organizaonal boundaries are employed.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

AU-16-Examine

[SELECT FROM: Audit and accountability policy; system security plan; privacy plan; procedures addressing methods for coordinang audit informaon among external organizaons; system design documentaon; system conﬁguraon sengs and associated documentaon; system audit records; other relevant documents or records].

AU-16-Interview

[SELECT FROM: Organizaonal personnel with responsibilies for coordinang audit informaon among external organizaons; organizaonal personnel with informaon security and privacy responsibilies].

AU-16-Test

[SELECT FROM: Mechanisms implemenng cross-organizaonal auding].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 157

NIST SP 800-53A, REV. 5

AU-16(01)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

CROSS-ORGANIZATIONAL AUDIT LOGGING | IDENTITY PRESERVATION ASSESSMENT OBJECTIVE: Determine if: AU-16(01)

the identy of individuals in cross-organizaonal audit trails is preserved.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

AU-16(02)

AU-16(01)-Examine

[SELECT FROM: Audit and accountability policy; system security plan; privacy plan; procedures addressing cross-organizaonal audit trails; system design documentaon; system conﬁguraon sengs and associated documentaon; system audit records; other relevant documents or records].

AU-16(01)-Interview

[SELECT FROM: Organizaonal personnel with cross-organizaonal audit responsibilies; organizaonal personnel with informaon security and privacy responsibilies].

AU-16(01)-Test

[SELECT FROM: Mechanisms implemenng cross-organizaonal auding (if applicable)].

CROSS-ORGANIZATIONAL AUDIT LOGGING | SHARING OF AUDIT INFORMATION ASSESSMENT OBJECTIVE: Determine if:

AU-16(02)_ODP[01]

organizaons with which cross-organizaonal audit informaon is to be shared are deﬁned;

AU-16(02)_ODP[02]

cross-organizaonal sharing agreements to be used when providing crossorganizaonal audit informaon to organizaons are deﬁned;

AU-16(02)

cross-organizaonal audit informaon is provided to <AU-16(02)_ODP[01] organizaons> based on <AU-16(02)_ODP[02] cross-organizaonal sharing agreements>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

AU-16(03)

AU-16(02)-Examine

[SELECT FROM: Audit and accountability policy; system security plan; privacy plan; procedures addressing cross-organizaonal sharing of audit informaon; informaon sharing agreements; other relevant documents or records].

AU-16(02)-Interview

[SELECT FROM: Organizaonal personnel with responsibilies for sharing crossorganizaonal audit informaon; organizaonal personnel with informaon security and privacy responsibilies].

CROSS-ORGANIZATIONAL AUDIT LOGGING | DISASSOCIABILITY ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

AU-16(03)_ODP

measures to disassociate individuals from audit informaon transmied across organizaonal boundaries are deﬁned;

AU-16(03)

<AU-16(03)_ODP measures> are implemented to disassociate individuals from audit informaon transmied across organizaonal boundaries.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 158

NIST SP 800-53A, REV. 5

AU-16(03)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

CROSS-ORGANIZATIONAL AUDIT LOGGING | DISASSOCIABILITY POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5 CHAPTER FOUR

AU-16(03)-Examine

[SELECT FROM: Audit and accountability policy; system security plan; privacy plan; procedures addressing cross-organizaonal sharing of audit informaon; policy and/or procedures regarding the deidenﬁcaon of PII; system design documentaon; system conﬁguraon sengs and associated documentaon; system audit records; other relevant documents or records].

AU-16(03)-Interview

AU-16(03)-Test

[SELECT FROM: Mechanisms implemenng disassociability].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 159

NIST SP 800-53A, REV. 5

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

4.4 ASSESSMENT, AUTHORIZATION, AND MONITORING CA-01

POLICY AND PROCEDURES ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5 CHAPTER FOUR

CA-01_ODP[01]

personnel or roles to whom the assessment, authorizaon, and monitoring policy is to be disseminated is/are deﬁned;

CA-01_ODP[02]

personnel or roles to whom the assessment, authorizaon, and monitoring procedures are to be disseminated is/are deﬁned;

CA-01_ODP[03]

one or more of the following PARAMETER VALUES is/are selected: {organizaonlevel; mission/business process-level; system-level};

CA-01_ODP[04]

an oﬃcial to manage the assessment, authorizaon, and monitoring policy and procedures is deﬁned;

CA-01_ODP[05]

the frequency at which the current assessment, authorizaon, and monitoring policy is reviewed and updated is deﬁned;

CA-01_ODP[06]

events that would require the current assessment, authorizaon, and monitoring policy to be reviewed and updated are deﬁned;

CA-01_ODP[07]

the frequency at which the current assessment, authorizaon, and monitoring procedures are reviewed and updated is deﬁned;

CA-01_ODP[08]

events that would require assessment, authorizaon, and monitoring procedures to be reviewed and updated are deﬁned;

CA-01a.[01]

an assessment, authorizaon, and monitoring policy is developed and documented;

CA-01a.[02]

the assessment, authorizaon, and monitoring policy is disseminated to <CA-01_ODP[01] personnel or roles>;

CA-01a.[03]

assessment, authorizaon, and monitoring procedures to facilitate the implementaon of the assessment, authorizaon, and monitoring policy and associated assessment, authorizaon, and monitoring controls are developed and documented;

CA-01a.[04]

the assessment, authorizaon, and monitoring procedures are disseminated to <CA-01_ODP[02] personnel or roles>;

CA-01a.01(a)[01]

the <CA-01_ODP[03] SELECTED PARAMETER VALUE(S)> assessment, authorizaon, and monitoring policy addresses purpose;

CA-01a.01(a)[02]

the <CA-01_ODP[03] SELECTED PARAMETER VALUE(S)> assessment, authorizaon, and monitoring policy addresses scope;[03] SELECTED PARAMETER(S)> assessment, authorizaon, and monitoring policy addresses scope;

CA-01a.01(a)[03]

the <CA-01_ODP[03] SELECTED PARAMETER VALUE(S)> assessment, authorizaon, and monitoring policy addresses roles;[03] SELECTED PARAMETER(S)> assessment, authorizaon, and monitoring policy addresses roles;

CA-01a.01(a)[04]

the <CA-01_ODP[03] SELECTED PARAMETER VALUE(S)> assessment, authorizaon, and monitoring policy addresses responsibilies;

CA-01a.01(a)[05]

the <CA-01_ODP[03] SELECTED PARAMETER VALUE(S)> assessment, authorizaon, and monitoring policy addresses management commitment;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 160

NIST SP 800-53A, REV. 5

CA-01

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

POLICY AND PROCEDURES

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

CA-01a.01(a)[06]

the <CA-01_ODP[03] SELECTED PARAMETER VALUE(S)> assessment, authorizaon, and monitoring policy addresses coordinaon among organizaonal enes;

CA-01a.01(a)[07]

the <CA-01_ODP[03] SELECTED PARAMETER VALUE(S)> assessment, authorizaon, and monitoring policy addresses compliance;

CA-01a.01(b)

the <CA-01_ODP[03] SELECTED PARAMETER VALUE(S)> assessment, authorizaon, and monitoring policy is consistent with applicable laws, execuve orders, direcves, regulaons, policies, standards, and guidelines;

CA-01b.

the <CA-01_ODP[04] oﬃcial> is designated to manage the development, documentaon, and disseminaon of the assessment, authorizaon, and monitoring policy and procedures;

CA-01c.01[01]

the current assessment, authorizaon, and monitoring policy is reviewed and updated <CA-01_ODP[05] frequency>;

CA-01c.01[02]

the current assessment, authorizaon, and monitoring policy is reviewed and updated following <CA-01_ODP[06] events>;

CA-01c.02[01]

the current assessment, authorizaon, and monitoring procedures are reviewed and updated <CA-01_ODP[07] frequency>;

CA-01c.02[02]

the current assessment, authorizaon, and monitoring procedures are reviewed and updated following <CA-01_ODP[08] events>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CA-02

CA-01-Examine

[SELECT FROM: Assessment, authorizaon, and monitoring policy and procedures; system security plan; privacy plan; other relevant documents or records].

CA-01-Interview

[SELECT FROM: Organizaonal personnel with assessment, authorizaon, and monitoring policy responsibilies; organizaonal personnel with informaon security and privacy responsibilies].

CONTROL ASSESSMENTS ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

CA-02_ODP[01]

the frequency at which to assess controls in the system and its environment of operaon is deﬁned;

CA-02_ODP[02]

individuals or roles to whom control assessment results are to be provided are deﬁned;

CA-02a.

an appropriate assessor or assessment team is selected for the type of assessment to be conducted;

CA-02b.01

a control assessment plan is developed that describes the scope of the assessment, including controls and control enhancements under assessment;

CA-02b.02

a control assessment plan is developed that describes the scope of the assessment, including assessment procedures to be used to determine control eﬀecveness;

CA-02b.03[01]

a control assessment plan is developed that describes the scope of the assessment, including the assessment environment;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 161

NIST SP 800-53A, REV. 5

CA-02

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

CONTROL ASSESSMENTS

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

CA-02b.03[02]

a control assessment plan is developed that describes the scope of the assessment, including the assessment team;

CA-02b.03[03]

a control assessment plan is developed that describes the scope of the assessment, including assessment roles and responsibilies;

CA-02c.

the control assessment plan is reviewed and approved by the authorizing oﬃcial or designated representave prior to conducng the assessment;

CA-02d.[01]

controls are assessed in the system and its environment of operaon <CA-02_ODP[01] assessment frequency> to determine the extent to which the controls are implemented correctly, operang as intended, and producing the desired outcome with respect to meeng established security requirements;

CA-02d.[02]

CA-02e.

a control assessment report is produced that documents the results of the assessment;

CA-02f.

the results of the control assessment are provided to <CA-02_ODP[02] individuals or roles>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CA-02(01)

CA-02-Examine

[SELECT FROM: Assessment, authorizaon, and monitoring policy; procedures addressing assessment planning; procedures addressing control assessments; control assessment plan; control assessment report; system security plan; privacy plan; other relevant documents or records].

CA-02-Interview

[SELECT FROM: Organizaonal personnel with control assessment responsibilies; organizaonal personnel with informaon security and privacy responsibilies].

CA-02-Test

[SELECT FROM: Mechanisms supporng control assessment, control assessment plan development, and/or control assessment reporng].

CONTROL ASSESSMENTS | INDEPENDENT ASSESSORS ASSESSMENT OBJECTIVE: Determine if: CA-02(01)

independent assessors or assessment teams are employed to conduct control assessments.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

CA-02(01)-Examine

[SELECT FROM: Assessment, authorizaon, and monitoring policy; procedures addressing control assessments; previous control assessment plan; previous control assessment report; plan of acon and milestones; exisng authorizaon statement; system security plan; privacy plan; other relevant documents or records].

CA-02(01)-Interview

[SELECT FROM: Organizaonal personnel with security assessment responsibilies; organizaonal personnel with informaon security and privacy responsibilies].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 162

NIST SP 800-53A, REV. 5

CA-02(02)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

CONTROL ASSESSMENTS | SPECIALIZED ASSESSMENTS ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

CA-02(02)_ODP[01]

frequency at which to include specialized assessments as part of the control assessment is deﬁned;

CA-02(02)_ODP[02]

one of the following PARAMETER VALUES is selected: {announced; unannounced};

CA-02(02)_ODP[03]

one or more of the following PARAMETER VALUES is/are selected: {in-depth monitoring; security instrumentaon; automated security test cases; vulnerability scanning; malicious user tesng; insider threat assessment; performance and load tesng; data leakage or data loss assessment; <CA-02(02)_ODP[04] other forms of assessment>};

CA-02(02)_ODP[04]

other forms of assessment are deﬁned (if selected);

CA-02(02)

<CA-02(02)_ODP[01] specialized assessment frequency> <CA-02(02)_ODP[02] SELECTED PARAMETER VALUE> <CA-02(02)_ODP[03] SELECTED PARAMETER VALUE(S)> are included as part of control assessments.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CA-02(03)

CA-02(02)-Examine

[SELECT FROM: Assessment, authorizaon, and monitoring policy; procedures addressing control assessments; control assessment plan; control assessment report; control assessment evidence; system security plan; privacy plan; other relevant documents or records].

CA-02(02)-Interview

[SELECT FROM: Organizaonal personnel with control assessment responsibilies; organizaonal personnel with informaon security and privacy responsibilies].

CA-02(02)-Test

[SELECT FROM: Mechanisms supporng control assessment].

CONTROL ASSESSMENTS | LEVERAGING RESULTS FROM EXTERNAL ORGANIZATIONS ASSESSMENT OBJECTIVE: Determine if:

CA-02(03)_ODP[01]

external organizaons from which the results of control assessments are leveraged are deﬁned;

CA-02(03)_ODP[02]

system on which a control assessment was performed by an external organizaon is deﬁned;

CA-02(03)_ODP[03]

requirements to be met by the control assessment performed by an external organizaon on the system are deﬁned;

CA-02(03)

the results of control assessments performed by <CA-02(03)_ODP[01] external organizaons> on <CA-02(03)_ODP[02] system> are leveraged when the assessment meets <CA-02(03)_ODP[03] requirements>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: CA-02(03)-Examine

CHAPTER FOUR

[SELECT FROM: Assessment, authorizaon, and monitoring policy; procedures addressing control assessments; control assessment requirements; control assessment plan; control assessment report; control assessment evidence; plan of acon and milestones; system security plan; privacy plan; other relevant documents or records].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 163

NIST SP 800-53A, REV. 5

CA-02(03)

CONTROL ASSESSMENTS | LEVERAGING RESULTS FROM EXTERNAL ORGANIZATIONS CA-02(03)-Interview

CA-03

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

[SELECT FROM: Organizaonal personnel with control assessment responsibilies; organizaonal personnel with informaon security and privacy responsibilies; personnel performing control assessments for the speciﬁed external organizaon].

INFORMATION EXCHANGE ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

CA-03_ODP[01]

one or more of the following PARAMETER VALUES is/are selected: {interconnecon security agreements; informaon exchange security agreements; memoranda of understanding or agreement; service level agreements; user agreements; non-disclosure agreements; <CA-03_ODP[02] type of agreement>};

CA-03_ODP[02]

the type of agreement used to approve and manage the exchange of informaon is deﬁned (if selected);

CA-03_ODP[03]

the frequency at which to review and update agreements is deﬁned;

CA-03a.

the exchange of informaon between the system and other systems is approved and managed using <CA-03_ODP[01] SELECTED PARAMETER VALUE(S)>;

CA-03b.[01]

the interface characteriscs are documented as part of each exchange agreement;

CA-03b.[02]

security requirements are documented as part of each exchange agreement;

CA-03b.[03]

privacy requirements are documented as part of each exchange agreement;

CA-03b.[04]

controls are documented as part of each exchange agreement;

CA-03b.[05]

responsibilies for each system are documented as part of each exchange agreement;

CA-03b.[06]

the impact level of the informaon communicated is documented as part of each exchange agreement;

CA-03c.

agreements are reviewed and updated <CA-03_ODP[03] frequency>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

CA-03-Examine

[SELECT FROM: Access control policy; procedures addressing system connecons; system and communicaons protecon policy; system interconnecon security agreements; informaon exchange security agreements; memoranda of understanding or agreements; service level agreements; non-disclosure agreements; system design documentaon; enterprise architecture; system architecture; system conﬁguraon sengs and associated documentaon; system security plan; privacy plan; other relevant documents or records].

CA-03-Interview

[SELECT FROM: Organizaonal personnel with responsibilies for developing, implemenng, or approving system interconnecon agreements; organizaonal personnel with informaon security and privacy responsibilies; personnel managing the system(s) to which the interconnecon security agreement applies].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 164

NIST SP 800-53A, REV. 5

CA-03(01)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

INFORMATION EXCHANGE | UNCLASSIFIED NATIONAL SECURITY SYSTEM CONNECTIONS [WITHDRAWN: Moved to SC-07(25).]

CA-03(02)

INFORMATION EXCHANGE | CLASSIFIED NATIONAL SECURITY SYSTEM CONNECTIONS [WITHDRAWN: Moved to SC-07(26).]

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

CA-03(03)

INFORMATION EXCHANGE | UNCLASSIFIED NON-NATIONAL SECURITY SYSTEM CONNECTIONS [WITHDRAWN: Moved to SC-07(27).]

CA-03(04)

INFORMATION EXCHANGE | CONNECTIONS TO PUBLIC NETWORKS [WITHDRAWN: Moved to SC-07(28).]

CA-03(05)

INFORMATION EXCHANGE | RESTRICTIONS ON EXTERNAL SYSTEM CONNECTIONS [WITHDRAWN: Moved to SC-07(05).]

CA-03(06)

INFORMATION EXCHANGE | TRANSFER AUTHORIZATIONS ASSESSMENT OBJECTIVE: Determine if: CA-03(06)

individuals or systems transferring data between interconnecng systems have the requisite authorizaons (i.e., write permissions or privileges) prior to accepng such data.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

CA-03(06)-Examine

[SELECT FROM: Access control policy; procedures addressing system connecons; system and communicaons protecon policy; system interconnecon agreements; informaon exchange security agreements; memoranda of understanding or agreements; service level agreements; non-disclosure agreements; system design documentaon; system conﬁguraon sengs and associated documentaon; control assessment report; system audit records; system security plan; privacy plan; other relevant documents or records].

CA-03(06)-Interview

[SELECT FROM: Organizaonal personnel with responsibilies for managing connecons to external systems; network administrators; organizaonal personnel with informaon security and privacy responsibilies].

CA-03(06)-Test

[SELECT FROM: Mechanisms implemenng restricons on external system connecons].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 165

NIST SP 800-53A, REV. 5

CA-03(07)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

INFORMATION EXCHANGE | TRANSITIVE INFORMATION EXCHANGES ASSESSMENT OBJECTIVE: Determine if: CA-03(07)(a)

transive (downstream) informaon exchanges with other systems through the systems idenﬁed in CA-03a are idenﬁed;

CA-03(07)(b)

measures are taken to ensure that transive (downstream) informaon exchanges cease when the controls on idenﬁed transive (downstream) systems cannot be veriﬁed or validated.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

CA-04

CA-03(07)-Examine

CA-03(07)-Interview

CA-03(07)-Test

[SELECT FROM: Mechanisms implemenng restricons on external system connecons].

SECURITY CERTIFICATION [WITHDRAWN: Incorporated into CA-02.]

CA-05

PLAN OF ACTION AND MILESTONES ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

CA-05_ODP

the frequency at which to update an exisng plan of acon and milestones based on the ﬁndings from control assessments, independent audits or reviews, and connuous monitoring acvies is deﬁned;

CA-05a.

a plan of acon and milestones for the system is developed to document the planned remediaon acons of the organizaon to correct weaknesses or deﬁciencies noted during the assessment of the controls and to reduce or eliminate known vulnerabilies in the system;

CA-05b.

exisng plan of acon and milestones are updated <CA-05_ODP frequency> based on the ﬁndings from control assessments, independent audits or reviews, and connuous monitoring acvies.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 166

NIST SP 800-53A, REV. 5

CA-05

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

PLAN OF ACTION AND MILESTONES POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

CA-05(01)

CA-05-Examine

[SELECT FROM: Assessment, authorizaon, and monitoring policy; procedures addressing plan of acon and milestones; control assessment plan; control assessment report; control assessment evidence; plan of acon and milestones; system security plan; privacy plan; other relevant documents or records].

CA-05-Interview

[SELECT FROM: Organizaonal personnel with plan of acon and milestones development and implementaon responsibilies; organizaonal personnel with informaon security and privacy responsibilies].

CA-05-Test

[SELECT FROM: Mechanisms for developing, implemenng, and maintaining plan of acon and milestones].

PLAN OF ACTION AND MILESTONES | AUTOMATION SUPPORT FOR ACCURACY AND CURRENCY ASSESSMENT OBJECTIVE: Determine if:

CA-05(01)_ODP

automated mechanisms used to ensure the accuracy, currency, and availability of the plan of acon and milestones for the system are deﬁned;

CA-05(01)

<CA-05(01)_ODP automated mechanisms> are used to ensure the accuracy, currency, and availability of the plan of acon and milestones for the system.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CA-06

CA-05(01)-Examine

[SELECT FROM: Assessment, authorizaon, and monitoring policy; procedures addressing plan of acon and milestones; system design documentaon; system conﬁguraon sengs and associated documentaon; system audit records; plan of acon and milestones; system security plan; privacy plan; other relevant documents or records].

CA-05(01)-Interview

CA-05(01)-Test

[SELECT FROM: Automated mechanisms for developing, implemenng, and maintaining a plan of acon and milestones].

AUTHORIZATION ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

CA-06_ODP

frequency at which to update the authorizaons is deﬁned;

CA-06a.

a senior oﬃcial is assigned as the authorizing oﬃcial for the system;

CA-06b.

a senior oﬃcial is assigned as the authorizing oﬃcial for common controls available for inheritance by organizaonal systems;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 167

NIST SP 800-53A, REV. 5

CA-06

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

AUTHORIZATION CA-06c.01

before commencing operaons, the authorizing oﬃcial for the system accepts the use of common controls inherited by the system;

CA-06c.02

before commencing operaons, the authorizing oﬃcial for the system authorizes the system to operate;

CA-06d.

the authorizing oﬃcial for common controls authorizes the use of those controls for inheritance by organizaonal systems;

CA-06e.

the authorizaons are updated <CA-06_ODP frequency>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

CA-06(01)

CA-06-Examine

[SELECT FROM: Assessment, authorizaon, and monitoring policy; procedures addressing authorizaon; system security plan, privacy plan, assessment report, plan of acon and milestones; authorizaon statement; other relevant documents or records].

CA-06-Interview

[SELECT FROM: Organizaonal personnel with authorizaon responsibilies; organizaonal personnel with informaon security and privacy responsibilies].

CA-06-Test

[SELECT FROM: Mechanisms that facilitate authorizaons and updates].

AUTHORIZATION | JOINT AUTHORIZATION — INTRA-ORGANIZATION ASSESSMENT OBJECTIVE: Determine if:

CA-06(01)[01]

a joint authorizaon process is employed for the system;

CA-06(01)[02]

the joint authorizaon process employed for the system includes mulple authorizing oﬃcials from the same organizaon conducng the authorizaon.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CA-06(02)

CA-06(01)-Examine

[SELECT FROM: Assessment, authorizaon, and monitoring policy; procedures addressing authorizaon; system security plan; privacy plan; assessment report; plan of acon and milestones; authorizaon statement; other relevant documents or records].

CA-06(01)-Interview

[SELECT FROM: Organizaonal personnel with authorizaon responsibilies; organizaonal personnel with informaon security and privacy responsibilies].

CA-06(01)-Test

[SELECT FROM: Mechanisms that facilitate authorizaons and updates].

AUTHORIZATION | JOINT AUTHORIZATION — INTER-ORGANIZATION ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

CA-06(02)[01]

a joint authorizaon process is employed for the system;

CA-06(02)[02]

the joint authorizaon process employed for the system includes mulple authorizing oﬃcials with at least one authorizing oﬃcial from an organizaon external to the organizaon conducng the authorizaon.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 168

NIST SP 800-53A, REV. 5

CA-06(02)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

AUTHORIZATION | JOINT AUTHORIZATION — INTER-ORGANIZATION POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

CA-07

CA-06(02)-Examine

CA-06(02)-Interview

[SELECT FROM: Organizaonal personnel with authorizaon responsibilies; organizaonal personnel with informaon security and privacy responsibilies].

CA-06(02)-Test

[SELECT FROM: Mechanisms that facilitate authorizaons and updates].

CONTINUOUS MONITORING ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

CA-07_ODP[01]

system-level metrics to be monitored are deﬁned;

CA-07_ODP[02]

frequencies at which to monitor control eﬀecveness are deﬁned;

CA-07_ODP[03]

frequencies at which to assess control eﬀecveness are deﬁned;

CA-07_ODP[04]

personnel or roles to whom the security status of the system is reported are deﬁned;

CA-07_ODP[05]

frequency at which the security status of the system is reported is deﬁned;

CA-07_ODP[06]

personnel or roles to whom the privacy status of the system is reported are deﬁned;

CA-07_ODP[07]

frequency at which the privacy status of the system is reported is deﬁned;

CA-07[01]

a system-level connuous monitoring strategy is developed;

CA-07[02]

system-level connuous monitoring is implemented in accordance with the organizaon-level connuous monitoring strategy;

CA-07a.

system-level connuous monitoring includes establishment of the following system-level metrics to be monitored: <CA-07_ODP[01] system-level metrics>;

CA-07b.[01]

system-level connuous monitoring includes established <CA-07_ODP[02] frequencies> for monitoring;

CA-07b.[02]

system-level connuous monitoring includes established <CA-07_ODP[03] frequencies> for assessment of control eﬀecveness;

CA-07c.

system-level connuous monitoring includes ongoing control assessments in accordance with the connuous monitoring strategy;

CA-07d.

system-level connuous monitoring includes ongoing monitoring of system and organizaon-deﬁned metrics in accordance with the connuous monitoring strategy;

CA-07e.

system-level connuous monitoring includes correlaon and analysis of informaon generated by control assessments and monitoring;

CA-07f.

system-level connuous monitoring includes response acons to address the results of the analysis of control assessment and monitoring informaon;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 169

NIST SP 800-53A, REV. 5

CA-07

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

CONTINUOUS MONITORING CA-07g.[01]

system-level connuous monitoring includes reporng the security status of the system to <CA-07_ODP[04] personnel or roles> <CA-07_ODP[05] frequency>;

CA-07g.[02]

system-level connuous monitoring includes reporng the privacy status of the system to <CA-07_ODP[06] personnel or roles> <CA-07_ODP[07] frequency>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

CA-07(01)

CA-07-Examine

[SELECT FROM: Assessment, authorizaon, and monitoring policy; organizaonal connuous monitoring strategy; system-level connuous monitoring strategy; procedures addressing connuous monitoring of system controls; procedures addressing conﬁguraon management; control assessment report; plan of acon and milestones; system monitoring records; conﬁguraon management records; impact analyses; status reports; system security plan; privacy plan; other relevant documents or records].

CA-07-Interview

[SELECT FROM: Organizaonal personnel with connuous monitoring responsibilies; organizaonal personnel with informaon security and privacy responsibilies; system/network administrators].

CA-07-Test

[SELECT FROM: Mechanisms implemenng connuous monitoring; mechanisms supporng response acons to address assessment and monitoring results; mechanisms supporng security and privacy status reporng].

CONTINUOUS MONITORING | INDEPENDENT ASSESSMENT ASSESSMENT OBJECTIVE: Determine if: CA-07(01)

independent assessors or assessment teams are employed to monitor the controls in the system on an ongoing basis.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CA-07(02)

CA-07(01)-Examine

[SELECT FROM: Assessment, authorizaon, and monitoring policy; organizaonal connuous monitoring strategy; system-level connuous monitoring strategy; procedures addressing connuous monitoring of system controls; control assessment report; plan of acon and milestones; system monitoring records; impact analyses; status reports; system security plan; privacy plan; other relevant documents or records].

CA-07(01)-Interview

[SELECT FROM: Organizaonal personnel with connuous monitoring responsibilies; organizaonal personnel with informaon security and privacy responsibilies].

CONTINUOUS MONITORING | TYPES OF ASSESSMENTS [WITHDRAWN: Incorporated into CA-02.]

CHAPTER FOUR

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 170

NIST SP 800-53A, REV. 5

CA-07(03)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

CONTINUOUS MONITORING | TREND ANALYSES ASSESSMENT OBJECTIVE: Determine if:

CA-07(03)[01]

trend analysis is employed to determine if control implementaons used in the connuous monitoring process need to be modiﬁed based on empirical data;

CA-07(03)[02]

trend analysis is employed to determine if the frequency of connuous monitoring acvies used in the connuous monitoring process needs to be modiﬁed based on empirical data;

CA-07(03)[03]

trend analysis is employed to determine if the types of acvies used in the connuous monitoring process need to be modiﬁed based on empirical data.

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CA-07(04)

CA-07(03)-Examine

[SELECT FROM: Organizaonal connuous monitoring strategy; system-level connuous monitoring strategy; assessment, authorizaon, and monitoring policy; procedures addressing connuous monitoring of system controls; privacy controls; assessment report; plan of acon and milestones; system monitoring records; impact analyses; status reports; system security plan; privacy plan; other relevant documents or records].

CA-07(03)-Interview

[SELECT FROM: Organizaonal personnel with connuous monitoring responsibilies; organizaonal personnel with informaon security and privacy responsibilies].

CA-07(03)-Test

[SELECT FROM: Mechanisms supporng trend analyses].

CONTINUOUS MONITORING | RISK MONITORING ASSESSMENT OBJECTIVE: Determine if: CA-07(04)

risk monitoring is an integral part of the connuous monitoring strategy;

CA-07(04)(a)

eﬀecveness monitoring is included in risk monitoring;

CA-07(04)(b)

compliance monitoring is included in risk monitoring;

CA-07(04)(c)

change monitoring is included in risk monitoring.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

CA-07(04)-Examine

[SELECT FROM: Assessment, authorizaon, and monitoring policy; organizaonal connuous monitoring strategy; system-level connuous monitoring strategy; procedures addressing connuous monitoring of system controls; assessment report; plan of acon and milestones; system monitoring records; impact analyses; status reports; system security plan; privacy plan; other relevant documents or records].

CA-07(04)-Interview

[SELECT FROM: Organizaonal personnel with connuous monitoring responsibilies; organizaonal personnel with informaon security and privacy responsibilies].

CA-07(04)-Test

[SELECT FROM: Mechanisms supporng risk monitoring].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 171

NIST SP 800-53A, REV. 5

CA-07(05)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

CONTINUOUS MONITORING | CONSISTENCY ANALYSIS ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

CA-07(05)_ODP[01]

acons to validate that policies are established are deﬁned;

CA-07(05)_ODP[02]

acons to validate that implemented controls are operang in a consistent manner are deﬁned;

CA-07(05)[01]

<CA-07(05)_ODP[01] acons> are employed to validate that policies are established;

CA-07(05)[02]

<CA-07(05)_ODP[02] acons> are employed to validate that implemented controls are operang in a consistent manner.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CA-07(06)

CA-07(05)-Examine

[SELECT FROM: Assessment, authorizaon, and monitoring policy; organizaonal connuous monitoring strategy; system-level connuous monitoring strategy; procedures addressing connuous monitoring of system security controls; assessment report; plan of acon and milestones; system monitoring records; security impact analyses; status reports; system security plan; other relevant documents or records].

CA-07(05)-Interview

[SELECT FROM: Organizaonal personnel with connuous monitoring responsibilies; organizaonal personnel with informaon security and privacy responsibilies].

CA-07(05)-Test

[SELECT FROM: Mechanisms supporng consistency analyses].

CONTINUOUS MONITORING | AUTOMATION SUPPORT FOR MONITORING ASSESSMENT OBJECTIVE: Determine if:

CA-07(06)_ODP

automated mechanisms used to ensure the accuracy, currency, and availability of monitoring results for the system are deﬁned;

CA-07(06)

<CA-07(06)_ODP automated mechanisms> are used to ensure the accuracy, currency, and availability of monitoring results for the system.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

CA-07(06)-Examine

[SELECT FROM: Assessment, authorizaon, and monitoring policy; organizaonal connuous monitoring strategy; system-level connuous monitoring strategy; procedures addressing connuous monitoring of system controls; assessment report; plan of acon and milestones; system monitoring records; impact analyses; status reports; system security plan; privacy plan; other relevant documents or records].

CA-07(06)-Interview

[SELECT FROM: Organizaonal personnel with connuous monitoring responsibilies; organizaonal personnel with informaon security and privacy responsibilies].

CA-07(06)-Test

[SELECT FROM: Mechanisms supporng automated monitoring].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 172

NIST SP 800-53A, REV. 5

CA-08

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

PENETRATION TESTING ASSESSMENT OBJECTIVE: Determine if:

CA-08_ODP[01]

frequency at which to conduct penetraon tesng on systems or system components is deﬁned;

CA-08_ODP[02]

systems or system components on which penetraon tesng is to be conducted are deﬁned;

CA-08

penetraon tesng is conducted <CA-08_ODP[01] frequency> on <CA-08_ODP[02] system(s) or system components>.

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CA-08(01)

CA-08-Examine

[SELECT FROM: Assessment, authorizaon, and monitoring policy; procedures addressing penetraon tesng; assessment plan; penetraon test report; assessment report; assessment evidence; system security plan; privacy plan; other relevant documents or records].

CA-08-Interview

[SELECT FROM: Organizaonal personnel with control assessment responsibilies; organizaonal personnel with informaon security and privacy responsibilies; system/network administrators].

CA-08-Test

[SELECT FROM: Mechanisms supporng penetraon tesng].

PENETRATION TESTING | INDEPENDENT PENETRATION TESTING AGENT OR TEAM ASSESSMENT OBJECTIVE: Determine if: CA-08(01)

an independent penetraon tesng agent or team is employed to perform penetraon tesng on the system or system components.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CA-08(02)

CA-08(01)-Examine

[SELECT FROM: Assessment, authorizaon, and monitoring policy; procedures addressing penetraon tesng; assessment plan; penetraon test report; assessment report; security assessment evidence; system security plan; privacy plan; other relevant documents or records].

CA-08(01)-Interview

[SELECT FROM: Organizaonal personnel with assessment responsibilies; organizaonal personnel with informaon security and privacy responsibilies].

PENETRATION TESTING | RED TEAM EXERCISES ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

CA-08(02)_ODP

red team exercises to simulate aempts by adversaries to compromise organizaonal systems are deﬁned;

CA-08(02)

<CA-08(02)_ODP red team exercises> are employed to simulate aempts by adversaries to compromise organizaonal systems in accordance with applicable rules of engagement.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 173

NIST SP 800-53A, REV. 5

CA-08(02)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

PENETRATION TESTING | RED TEAM EXERCISES POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

CA-08(03)

CA-08(02)-Examine

[SELECT FROM: Assessment, authorizaon, and monitoring policy; procedures addressing penetraon tesng; procedures addressing red team exercises; assessment plan; results of red team exercises; penetraon test report; assessment report; rules of engagement; assessment evidence; system security plan; privacy plan; other relevant documents or records].

CA-08(02)-Interview

[SELECT FROM: Organizaonal personnel with assessment responsibilies; organizaonal personnel with informaon security and privacy responsibilies; system/network administrators].

CA-08(02)-Test

[SELECT FROM: Mechanisms supporng the employment of red team exercises].

PENETRATION TESTING | FACILITY PENETRATION TESTING ASSESSMENT OBJECTIVE: Determine if:

CA-08(03)_ODP[01]

frequency at which to employ penetraon tesng that aempts to bypass or circumvent controls associated with physical access points to the facility is deﬁned;

CA-08(03)_ODP[02]

one or more of the following PARAMETER VALUES is/are selected: {announced; unannounced};

CA-08(03)

the penetraon tesng process includes <CA-08(03)_ODP[01] frequency> <CA-08(03)_ODP[02] SELECTED PARAMETER VALUE(S)> aempts to bypass or circumvent controls associated with physical access points to facility.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CA-09

CA-08(03)-Examine

CA-08(03)-Interview

[SELECT FROM: Organizaonal personnel with assessment responsibilies; organizaonal personnel with informaon security and privacy responsibilies; system/network administrators].

CA-08(03)-Test

[SELECT FROM: Automated mechanisms supporng the employment of red team exercises].

INTERNAL SYSTEM CONNECTIONS ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

CA-09_ODP[01]

system components or classes of components requiring internal connecons to the system are deﬁned;

CA-09_ODP[02]

condions requiring terminaon of internal connecons are deﬁned;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 174

NIST SP 800-53A, REV. 5

CA-09

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

INTERNAL SYSTEM CONNECTIONS

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

CA-09_ODP[03]

frequency at which to review the connued need for each internal connecon is deﬁned;

CA-09a.

internal connecons of <CA-09_ODP[01] system components> to the system are authorized;

CA-09b.[01]

for each internal connecon, the interface characteriscs are documented;

CA-09b.[02]

for each internal connecon, the security requirements are documented;

CA-09b.[03]

for each internal connecon, the privacy requirements are documented;

CA-09b.[04]

for each internal connecon, the nature of the informaon communicated is documented;

CA-09c.

internal system connecons are terminated aer <CA-09_ODP[02] condions>;

CA-09d.

the connued need for each internal connecon is reviewed <CA-09_ODP[03] frequency>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CA-09(01)

CA-09-Examine

[SELECT FROM: Assessment, authorizaon, and monitoring policy; access control policy; procedures addressing system connecons; system and communicaons protecon policy; system design documentaon; system conﬁguraon sengs and associated documentaon; list of components or classes of components authorized as internal system connecons; assessment report; system audit records; system security plan; privacy plan; other relevant documents or records].

CA-09-Interview

[SELECT FROM: Organizaonal personnel with responsibilies for developing, implemenng, or authorizing internal system connecons; organizaonal personnel with informaon security and privacy responsibilies].

CA-09-Test

[SELECT FROM: Mechanisms supporng internal system connecons].

INTERNAL SYSTEM CONNECTIONS | COMPLIANCE CHECKS ASSESSMENT OBJECTIVE: Determine if:

CA-09(01)[01]

security compliance checks are performed on constuent system components prior to the establishment of the internal connecon;

CA-09(01)[02]

privacy compliance checks are performed on constuent system components prior to the establishment of the internal connecon.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

CA-09(01)-Examine

CA-09(01)-Interview

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 175

NIST SP 800-53A, REV. 5

CA-09(01)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

INTERNAL SYSTEM CONNECTIONS | COMPLIANCE CHECKS CA-09(01)-Test

[SELECT FROM: Mechanisms supporng compliance checks].

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5 CHAPTER FOUR

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 176

NIST SP 800-53A, REV. 5

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

4.5 CONFIGURATION MANAGEMENT CM-01

POLICY AND PROCEDURES ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5 CHAPTER FOUR

CM-01_ODP[01]

personnel or roles to whom the conﬁguraon management policy is to be disseminated is/are deﬁned;

CM-01_ODP[02]

personnel or roles to whom the conﬁguraon management procedures are to be disseminated is/are deﬁned;

CM-01_ODP[03]

one or more of the following PARAMETER VALUES is/are selected: {organizaonlevel; mission/business process-level; system-level};

CM-01_ODP[04]

an oﬃcial to manage the conﬁguraon management policy and procedures is deﬁned;

CM-01_ODP[05]

the frequency at which the current conﬁguraon management policy is reviewed and updated is deﬁned;

CM-01_ODP[06]

events that would require the current conﬁguraon management policy to be reviewed and updated are deﬁned;

CM-01_ODP[07]

the frequency at which the current conﬁguraon management procedures are reviewed and updated is deﬁned;

CM-01_ODP[08]

events that would require conﬁguraon management procedures to be reviewed and updated are deﬁned;

CM-01a.[01]

a conﬁguraon management policy is developed and documented;

CM-01a.[02]

the conﬁguraon management policy is disseminated to <CM-01_ODP[01] personnel or roles>;

CM-01a.[03]

conﬁguraon management procedures to facilitate the implementaon of the conﬁguraon management policy and associated conﬁguraon management controls are developed and documented;

CM-01a.[04]

the conﬁguraon management procedures are disseminated to <CM-01_ODP[02] personnel or roles>;

CM-01a.01(a)[01]

the <CM-01_ODP[03] SELECTED PARAMETER VALUE(S)> of the conﬁguraon management policy addresses purpose;

CM-01a.01(a)[02]

the <CM-01_ODP[03] SELECTED PARAMETER VALUE(S)> of the conﬁguraon management policy addresses scope;

CM-01a.01(a)[03]

the <CM-01_ODP[03] SELECTED PARAMETER VALUE(S)> of the conﬁguraon management policy addresses roles;

CM-01a.01(a)[04]

the <CM-01_ODP[03] SELECTED PARAMETER VALUE(S)> of the conﬁguraon management policy addresses responsibilies;

CM-01a.01(a)[05]

the <CM-01_ODP[03] SELECTED PARAMETER VALUE(S)> of the conﬁguraon management policy addresses management commitment;

CM-01a.01(a)[06]

the <CM-01_ODP[03] SELECTED PARAMETER VALUE(S)> of the conﬁguraon management policy addresses coordinaon among organizaonal enes;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 177

NIST SP 800-53A, REV. 5

CM-01

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

POLICY AND PROCEDURES

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

CM-01a.01(a)[07]

the <CM-01_ODP[03] SELECTED PARAMETER VALUE(S)> of the conﬁguraon management policy addresses compliance;

CM-01a.01(b)

the conﬁguraon management policy is consistent with applicable laws, Execuve Orders, direcves, regulaons, policies, standards, and guidelines;

CM-01b.

the <CM-01_ODP[04] oﬃcial> is designated to manage the development, documentaon, and disseminaon of the conﬁguraon management policy and procedures;

CM-01c.01[01]

the current conﬁguraon management policy is reviewed and updated <CM-01_ODP[05] frequency>;

CM-01c.01[02]

the current conﬁguraon management policy is reviewed and updated following <CM-01_ODP[06] events>;

CM-01c.02[01]

the current conﬁguraon management procedures are reviewed and updated <CM-01_ODP[07] frequency>;

CM-01c.02[02]

the current conﬁguraon management procedures are reviewed and updated following <CM-01_ODP[08] events>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CM-02

CM-01-Examine

[SELECT FROM: Conﬁguraon management policy and procedures; security and privacy program policies and procedures; assessment or audit ﬁndings; documentaon of security incidents or breaches; system security plan; privacy plan; risk management strategy; other relevant arfacts, documents, or records].

CM-01-Interview

[SELECT FROM: Organizaonal personnel with conﬁguraon management responsibilies; organizaonal personnel with informaon security and privacy responsibilies].

BASELINE CONFIGURATION ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

CM-02_ODP[01]

the frequency of baseline conﬁguraon review and update is deﬁned;

CM-02_ODP[02]

the circumstances requiring baseline conﬁguraon review and update are deﬁned;

CM-02a.[01]

a current baseline conﬁguraon of the system is developed and documented;

CM-02a.[02]

a current baseline conﬁguraon of the system is maintained under conﬁguraon control;

CM-02b.01

the baseline conﬁguraon of the system is reviewed and updated <CM-02_ODP[01] frequency>;

CM-02b.02

the baseline conﬁguraon of the system is reviewed and updated when required due to <CM-02_ODP[02] circumstances>;

CM-02b.03

the baseline conﬁguraon of the system is reviewed and updated when system components are installed or upgraded.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 178

NIST SP 800-53A, REV. 5

CM-02

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

BASELINE CONFIGURATION POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

CM-02(01)

CM-02-Examine

[SELECT FROM: Conﬁguraon management policy; procedures addressing the baseline conﬁguraon of the system; conﬁguraon management plan; enterprise architecture documentaon; system design documentaon; system security plan; privacy plan; system architecture and conﬁguraon documentaon; system conﬁguraon sengs and associated documentaon; system component inventory; change control records; other relevant documents or records].

CM-02-Interview

[SELECT FROM: Organizaonal personnel with conﬁguraon management responsibilies; organizaonal personnel with informaon security and privacy responsibilies; system/network administrators].

CM-02-Test

[SELECT FROM: Organizaonal processes for managing baseline conﬁguraons; mechanisms supporng conﬁguraon control of the baseline conﬁguraon].

BASELINE CONFIGURATION | REVIEWS AND UPDATES [WITHDRAWN: Incorporated into CM-02.]

CM-02(02)

BASELINE CONFIGURATION | AUTOMATION SUPPORT FOR ACCURACY AND CURRENCY ASSESSMENT OBJECTIVE: Determine if:

CM-02(02)_ODP

automated mechanisms for maintaining baseline conﬁguraon of the system are deﬁned;

CM-02(02)[01]

the currency of the baseline conﬁguraon of the system is maintained using <CM-02(02)_ODP automated mechanisms>;

CM-02(02)[02]

the completeness of the baseline conﬁguraon of the system is maintained using <CM-02(02)_ODP automated mechanisms>;

CM-02(02)[03]

the accuracy of the baseline conﬁguraon of the system is maintained using <CM-02(02)_ODP automated mechanisms>;

CM-02(02)[04]

the availability of the baseline conﬁguraon of the system is maintained using <CM-02(02)_ODP automated mechanisms>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

CM-02(02)-Examine

[SELECT FROM: Conﬁguraon management policy; procedures addressing the baseline conﬁguraon of the system; conﬁguraon management plan; system design documentaon; system architecture and conﬁguraon documentaon; system conﬁguraon sengs and associated documentaon; system component inventory; conﬁguraon change control records; system security plan; other relevant documents or records].

CM-02(02)-Interview

[SELECT FROM: Organizaonal personnel with conﬁguraon management responsibilies; organizaonal personnel with informaon security responsibilies; system/network administrators].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 179

NIST SP 800-53A, REV. 5

CM-02(02)

BASELINE CONFIGURATION | AUTOMATION SUPPORT FOR ACCURACY AND CURRENCY CM-02(02)-Test

CM-02(03)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

[SELECT FROM: Organizaonal processes for managing baseline conﬁguraons; automated mechanisms implemenng baseline conﬁguraon maintenance].

BASELINE CONFIGURATION | RETENTION OF PREVIOUS CONFIGURATIONS ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

CM-02(03)_ODP

the number of previous baseline conﬁguraon versions to be retained is deﬁned;

CM-02(03)

<CM-02(03)_ODP number> of previous baseline conﬁguraon version(s) of the system is/are retained to support rollback.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CM-02(04)

CM-02(03)-Examine

[SELECT FROM: Conﬁguraon management policy; procedures addressing the baseline conﬁguraon of the system; conﬁguraon management plan; system architecture and conﬁguraon documentaon; system conﬁguraon sengs and associated documentaon; copies of previous baseline conﬁguraon versions; system security plan; other relevant documents or records].

CM-02(03)-Interview

[SELECT FROM: Organizaonal personnel with conﬁguraon management responsibilies; organizaonal personnel with informaon security responsibilies; system/network administrators].

CM-02(03)-Test

[SELECT FROM: Organizaonal processes for managing baseline conﬁguraons].

BASELINE CONFIGURATION | UNAUTHORIZED SOFTWARE [WITHDRAWN: Incorporated into CM-07(04).]

CM-02(05)

BASELINE CONFIGURATION | AUTHORIZED SOFTWARE [WITHDRAWN: Incorporated into CM-07(05).]

CM-02(06)

BASELINE CONFIGURATION | DEVELOPMENT AND TEST ENVIRONMENTS ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

CM-02(06)[01]

a baseline conﬁguraon for system development environments that is managed separately from the operaonal baseline conﬁguraon is maintained;

CM-02(06)[02]

a baseline conﬁguraon for test environments that is managed separately from the operaonal baseline conﬁguraon is maintained.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 180

NIST SP 800-53A, REV. 5

CM-02(06)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

BASELINE CONFIGURATION | DEVELOPMENT AND TEST ENVIRONMENTS POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

CM-02(07)

CM-02(06)-Examine

[SELECT FROM: Conﬁguraon management policy; procedures addressing the baseline conﬁguraon of the system; conﬁguraon management plan; system design documentaon; system architecture and conﬁguraon documentaon; system conﬁguraon sengs and associated documentaon; system security plan; other relevant documents or records].

CM-02(06)-Interview

[SELECT FROM: Organizaonal personnel with conﬁguraon management responsibilies; organizaonal personnel with informaon security responsibilies; system/network administrators].

CM-02(06)-Test

[SELECT FROM: Organizaonal processes for managing baseline conﬁguraons; mechanisms implemenng separate baseline conﬁguraons for development, test, and operaonal environments].

BASELINE CONFIGURATION | CONFIGURE SYSTEMS AND COMPONENTS FOR HIGH-RISK AREAS ASSESSMENT OBJECTIVE: Determine if:

CM-02(07)_ODP[01]

the systems or system components to be issued when individuals travel to highrisk areas are deﬁned;

CM-02(07)_ODP[02]

conﬁguraons for systems or system components to be issued when individuals travel to high-risk areas are deﬁned;

CM-02(07)_ODP[03]

the controls to be applied when the individuals return from travel are deﬁned;

CM-02(07)(a)

<CM-02(07)_ODP[01] systems or system components> with <CM-02(07)_ODP[02] conﬁguraons> are issued to individuals traveling to locaons that the organizaon deems to be of signiﬁcant risk;

CM-02(07)(b)

<CM-02(07)_ODP[03] controls> are applied to the systems or system components when the individuals return from travel.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

CM-02(07)-Examine

[SELECT FROM: Conﬁguraon management policy; conﬁguraon management plan; procedures addressing the baseline conﬁguraon of the system; procedures addressing system component installaons and upgrades; system architecture and conﬁguraon documentaon; system conﬁguraon sengs and associated documentaon; system component inventory; records of system baseline conﬁguraon reviews and updates; system component installaons/upgrades and associated records; change control records; system security plan; other relevant documents or records].

CM-02(07)-Interview

[SELECT FROM: Organizaonal personnel with conﬁguraon management responsibilies; organizaonal personnel with informaon security responsibilies; system/network administrators].

CM-02(07)-Test

[SELECT FROM: Organizaonal processes for managing baseline conﬁguraons].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 181

NIST SP 800-53A, REV. 5

CM-03

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

CONFIGURATION CHANGE CONTROL ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

CM-03_ODP[01]

the me period to retain records of conﬁguraon-controlled changes is deﬁned;

CM-03_ODP[02]

the conﬁguraon change control element responsible for coordinang and overseeing change control acvies is deﬁned;

CM-03_ODP[03]

one or more of the following PARAMETER VALUES is/are selected: {<CM-03_ODP[04] frequency>; when <CM-03_ODP[05] conﬁguraon change condions>};

CM-03_ODP[04]

the frequency at which the conﬁguraon control element convenes is deﬁned (if selected);

CM-03_ODP[05]

conﬁguraon change condions that prompt the conﬁguraon control element to convene are deﬁned (if selected);

CM-03a.

the types of changes to the system that are conﬁguraon-controlled are determined and documented;

CM-03b.[01]

proposed conﬁguraon-controlled changes to the system are reviewed;

CM-03b.[02]

proposed conﬁguraon-controlled changes to the system are approved or disapproved with explicit consideraon for security and privacy impact analyses;

CM-03c.

conﬁguraon change decisions associated with the system are documented;

CM-03d.

approved conﬁguraon-controlled changes to the system are implemented;

CM-03e.

records of conﬁguraon-controlled changes to the system are retained for <CM-03_ODP[01] me period>;

CM-03f.[01]

acvies associated with conﬁguraon-controlled changes to the system are monitored;

CM-03f.[02]

acvies associated with conﬁguraon-controlled changes to the system are reviewed;

CM-03g.[01]

conﬁguraon change control acvies are coordinated and overseen by <CM-03_ODP[02] conﬁguraon change control element>;

CM-03g.[02]

the conﬁguraon control element convenes <CM-03_ODP[03] SELECTED PARAMETER VALUE(S)>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

CM-03-Examine

[SELECT FROM: Conﬁguraon management policy; procedures addressing system conﬁguraon change control; conﬁguraon management plan; system architecture and conﬁguraon documentaon; change control records; system audit records; change control audit and review reports; agenda/minutes/documentaon from conﬁguraon change control oversight meengs; system security plan; privacy plan; privacy impact assessments; system of records noces; other relevant documents or records].

CM-03-Interview

[SELECT FROM: Organizaonal personnel with conﬁguraon change control responsibilies; organizaonal personnel with informaon security and privacy responsibilies; system/network administrators; members of change control board or similar].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 182

NIST SP 800-53A, REV. 5

CM-03

CONFIGURATION CHANGE CONTROL CM-03-Test

CM-03(01)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

[SELECT FROM: Organizaonal processes for conﬁguraon change control; mechanisms that implement conﬁguraon change control].

CONFIGURATION CHANGE CONTROL | AUTOMATED DOCUMENTATION, NOTIFICATION, AND PROHIBITION OF CHANGES ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

CM-03(01)_ODP[01]

mechanisms used to automate conﬁguraon change control are deﬁned;

CM-03(01)_ODP[02]

approval authories to be noﬁed of and request approval for proposed changes to the system are deﬁned;

CM-03(01)_ODP[03]

the me period aer which to highlight changes that have not been approved or disapproved is deﬁned;

CM-03(01)_ODP[04]

personnel to be noﬁed when approved changes are complete is/are deﬁned;

CM-03(01)(a)

<CM-03(01)_ODP[01] automated mechanisms> are used to document proposed changes to the system;

CM-03(01)(b)

<CM-03(01)_ODP[01] automated mechanisms> are used to nofy <CM-03(01)_ODP[02] approval authories> of proposed changes to the system and request change approval;

CM-03(01)(c)

<CM-03(01)_ODP[01] automated mechanisms> are used to highlight proposed changes to the system that have not been approved or disapproved within <CM-03(01)_ODP[03] me period>;

CM-03(01)(d)

<CM-03(01)_ODP[01] automated mechanisms> are used to prohibit changes to the system unl designated approvals are received;

CM-03(01)(e)

<CM-03(01)_ODP[01] automated mechanisms> are used to document all changes to the system;

CM-03(01)(f)

<CM-03(01)_ODP[01] automated mechanisms> are used to nofy <CM-03(01)_ODP[04] personnel> when approved changes to the system are completed.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

CM-03(01)-Examine

[SELECT FROM: Conﬁguraon management policy; procedures addressing system conﬁguraon change control; conﬁguraon management plan; system design documentaon; system architecture and conﬁguraon documentaon; automated conﬁguraon control mechanisms; system conﬁguraon sengs and associated documentaon; change control records; system audit records; change approval requests; change approvals; system security plan; other relevant documents or records].

CM-03(01)-Interview

[SELECT FROM: Organizaonal personnel with conﬁguraon change control responsibilies; organizaonal personnel with informaon security responsibilies; system/network administrators; system developers; members of change control board or similar].

CM-03(01)-Test

[SELECT FROM: Organizaonal processes for conﬁguraon change control; automated mechanisms implemenng conﬁguraon change control acvies].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 183

NIST SP 800-53A, REV. 5

CM-03(02)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

CONFIGURATION CHANGE CONTROL | TESTING, VALIDATION, AND DOCUMENTATION OF CHANGES ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

CM-03(02)[01]

changes to the system are tested before ﬁnalizing the implementaon of the changes;

CM-03(02)[02]

changes to the system are validated before ﬁnalizing the implementaon of the changes;

CM-03(02)[03]

changes to the system are documented before ﬁnalizing the implementaon of the changes.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CM-03(03)

CM-03(02)-Examine

[SELECT FROM: Conﬁguraon management policy; conﬁguraon management plan; procedures addressing system conﬁguraon change control; system design documentaon; system architecture and conﬁguraon documentaon; system conﬁguraon sengs and associated documentaon; test records; validaon records; change control records; system audit records; system security plan; other relevant documents or records].

CM-03(02)-Interview

CM-03(02)-Test

[SELECT FROM: Organizaonal processes for conﬁguraon change control; mechanisms supporng and/or implemenng, tesng, validang, and documenng system changes].

CONFIGURATION CHANGE CONTROL | AUTOMATED CHANGE IMPLEMENTATION ASSESSMENT OBJECTIVE: Determine if:

CM-03(03)_ODP

mechanisms used to automate the implementaon of changes and deployment of the updated baseline across the installed base are deﬁned;

CM-03(03)[01]

changes to the current system baseline are implemented using <CM-03(03)_ODP automated mechanisms>;

CM-03(03)[02]

the updated baseline is deployed across the installed base using <CM-03(03)_ODP automated mechanisms>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: CM-03(03)-Examine

CHAPTER FOUR

[SELECT FROM: Conﬁguraon management policy; conﬁguraon management plan; procedures addressing system conﬁguraon change control; system design documentaon; system architecture and conﬁguraon documentaon; automated conﬁguraon control mechanisms; change control records; system component inventory; system audit records; system security plan; other relevant documents or records].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 184

NIST SP 800-53A, REV. 5

CM-03(03)

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

CM-03(04)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

CONFIGURATION CHANGE CONTROL | AUTOMATED CHANGE IMPLEMENTATION CM-03(03)-Interview

CM-03(03)-Test

[SELECT FROM: Organizaonal processes for conﬁguraon change control; automated mechanisms implemenng changes to current system baseline].

CONFIGURATION CHANGE CONTROL | SECURITY AND PRIVACY REPRESENTATIVES ASSESSMENT OBJECTIVE: Determine if:

CM-03(04)_ODP[01]

security representaves required to be members of the change control element are deﬁned;

CM-03(04)_ODP[02]

privacy representaves required to be members of the change control element are deﬁned;

CM-03(04)_ODP[03]

the conﬁguraon change control element of which the security and privacy representaves are to be members is deﬁned;

CM-03(04)[01]

<CM-03(04)_ODP[01] security representaves> are required to be members of the <CM-03(04)_ODP[03] conﬁguraon change control element>;

CM-03(04)[02]

<CM-03(04)_ODP[02] privacy representaves> are required to be members of the <CM-03(04)_ODP[03] conﬁguraon change control element>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CM-03(05)

CM-03(04)-Examine

[SELECT FROM: Conﬁguraon management policy; procedures addressing system conﬁguraon change control; conﬁguraon management plan; system security plan; privacy plan; other relevant documents or records].

CM-03(04)-Interview

[SELECT FROM: Organizaonal personnel with conﬁguraon change control responsibilies; organizaonal personnel with informaon security and privacy responsibilies; members of change control board or similar].

CM-03(04)-Test

[SELECT FROM: Organizaonal processes for conﬁguraon change control].

CONFIGURATION CHANGE CONTROL | AUTOMATED SECURITY RESPONSE ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

CM-03(05)_ODP

security responses to be automacally implemented are deﬁned;

CM-03(05)

<CM-03(05)_ODP security responses> are automacally implemented if baseline conﬁguraons are changed in an unauthorized manner.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 185

NIST SP 800-53A, REV. 5

CM-03(05)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

CONFIGURATION CHANGE CONTROL | AUTOMATED SECURITY RESPONSE POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

CM-03(06)

CM-03(05)-Examine

[SELECT FROM: System security plan; conﬁguraon management policy; procedures addressing system conﬁguraon change control; conﬁguraon management plan; system design documentaon; system architecture and conﬁguraon documentaon; system conﬁguraon sengs and associated documentaon; alerts/noﬁcaons of unauthorized baseline conﬁguraon changes; system audit records; other relevant documents or records].

CM-03(05)-Interview

CM-03(05)-Test

[SELECT FROM: Organizaonal processes for conﬁguraon change control; automated mechanisms implemenng security responses to unauthorized changes to the baseline conﬁguraons].

CONFIGURATION CHANGE CONTROL | CRYPTOGRAPHY MANAGEMENT ASSESSMENT OBJECTIVE: Determine if:

CM-03(06)_ODP

controls provided by cryptographic mechanisms that are to be under conﬁguraon management are deﬁned;

CM-03(06)

cryptographic mechanisms used to provide <CM-03(06)_ODP controls> are under conﬁguraon management.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CM-03(07)

CM-03(06)-Examine

[SELECT FROM: Conﬁguraon management policy; procedures addressing system conﬁguraon change control; conﬁguraon management plan; system design documentaon; system architecture and conﬁguraon documentaon; system conﬁguraon sengs and associated documentaon; system security plan; other relevant documents or records].

CM-03(06)-Interview

CM-03(06)-Test

[SELECT FROM: Organizaonal processes for conﬁguraon change control; cryptographic mechanisms implemenng organizaonal security safeguards (controls)].

CONFIGURATION CHANGE CONTROL | REVIEW SYSTEM CHANGES ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

CM-03(07)_ODP[01]

the frequency at which changes are to be reviewed is deﬁned;

CM-03(07)_ODP[02]

the circumstances under which changes are to be reviewed are deﬁned;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 186

NIST SP 800-53A, REV. 5

CM-03(07)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

CONFIGURATION CHANGE CONTROL | REVIEW SYSTEM CHANGES CM-03(07)

changes to the system are reviewed <CM-03(07)_ODP[01] frequency> or when <CM-03(07)_ODP[02] circumstances> to determine whether unauthorized changes have occurred.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

CM-03(08)

CM-03(07)-Examine

[SELECT FROM: Conﬁguraon management policy; procedures addressing system conﬁguraon change control; conﬁguraon management plan; change control records; system architecture and conﬁguraon documentaon; system conﬁguraon sengs and associated documentaon; system audit records; system component inventory; system security plan; other relevant documents or records].

CM-03(07)-Interview

[SELECT FROM: Organizaonal personnel with conﬁguraon change control responsibilies; organizaonal personnel with security responsibilies; system/ network administrators; members of change control board or similar].

CM-03(07)-Test

[SELECT FROM: Organizaonal processes for conﬁguraon change control; mechanisms implemenng audit records for changes].

CONFIGURATION CHANGE CONTROL | PREVENT OR RESTRICT CONFIGURATION CHANGES ASSESSMENT OBJECTIVE: Determine if:

CM-03(08)_ODP

the circumstances under which changes are to be prevented or restricted are deﬁned;

CM-03(08)

changes to the conﬁguraon of the system are prevented or restricted under <CM-03(08)_ODP circumstances>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: CM-03(08)-Examine

CM-04

[SELECT FROM: Conﬁguraon management policy; procedures addressing system conﬁguraon change control; conﬁguraon management plan; change control records; system architecture and conﬁguraon documentaon; system conﬁguraon sengs and associated documentaon; system component inventory; system audit records; system security plan; other relevant documents or records].

IMPACT ANALYSES ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

CM-04[01]

changes to the system are analyzed to determine potenal security impacts prior to change implementaon;

CM-04[02]

changes to the system are analyzed to determine potenal privacy impacts prior to change implementaon.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 187

NIST SP 800-53A, REV. 5

CM-04

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

IMPACT ANALYSES POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

CM-04(01)

CM-04-Examine

[SELECT FROM: Conﬁguraon management policy; procedures addressing security impact analyses for changes to the system; procedures addressing privacy impact analyses for changes to the system; conﬁguraon management plan; security impact analysis documentaon; privacy impact analysis documentaon; privacy impact assessment; privacy risk assessment documentaon, system design documentaon; analysis tools and associated outputs; change control records; system audit records; system security plan; privacy plan; other relevant documents or records].

CM-04-Interview

[SELECT FROM: Organizaonal personnel with responsibility for conducng security impact analyses; organizaonal personnel with responsibility for conducng privacy impact analyses; organizaonal personnel with informaon security and privacy responsibilies; system developer; system/network administrators; members of change control board or similar].

CM-04-Test

[SELECT FROM: Organizaonal processes for security impact analyses; organizaonal processes for privacy impact analyses].

IMPACT ANALYSES | SEPARATE TEST ENVIRONMENTS ASSESSMENT OBJECTIVE: Determine if:

CM-04(01)[01]

changes to the system are analyzed in a separate test environment before implementaon in an operaonal environment;

CM-04(01)[02]

changes to the system are analyzed for security impacts due to ﬂaws;

CM-04(01)[03]

changes to the system are analyzed for privacy impacts due to ﬂaws;

CM-04(01)[04]

changes to the system are analyzed for security impacts due to weaknesses;

CM-04(01)[05]

changes to the system are analyzed for privacy impacts due to weaknesses;

CM-04(01)[06]

changes to the system are analyzed for security impacts due to incompability;

CM-04(01)[07]

changes to the system are analyzed for privacy impacts due to incompability;

CM-04(01)[08]

changes to the system are analyzed for security impacts due to intenonal malice;

CM-04(01)[09]

changes to the system are analyzed for privacy impacts due to intenonal malice.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: CM-04(01)-Examine

CHAPTER FOUR

[SELECT FROM: Conﬁguraon management policy; procedures addressing security impact analyses for changes to the system; procedures addressing privacy impact analyses for changes to the system; conﬁguraon management plan; security impact analysis documentaon; privacy impact analysis documentaon; privacy impact assessment; privacy risk assessment documentaon; analysis tools and associated outputs system design documentaon; system architecture and conﬁguraon documentaon; change control records; procedures addressing the authority to test with PII; system audit records; documentaon of separate test and operaonal environments; system security plan; privacy plan; other relevant documents or records].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 188

NIST SP 800-53A, REV. 5

CM-04(01)

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

CM-04(02)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

IMPACT ANALYSES | SEPARATE TEST ENVIRONMENTS CM-04(01)-Interview

[SELECT FROM: Organizaonal personnel with responsibility for conducng security and privacy impact analyses; organizaonal personnel with informaon security and privacy responsibilies; system/network administrators; members of change control board or similar].

CM-04(01)-Test

[SELECT FROM: Organizaonal processes for security and privacy impact analyses; mechanisms supporng and/or implemenng security and privacy impact analyses of changes].

IMPACT ANALYSES | VERIFICATION OF CONTROLS ASSESSMENT OBJECTIVE: Determine if:

CM-04(02)[01]

the impacted controls are implemented correctly with regard to meeng the security requirements for the system aer system changes;

CM-04(02)[02]

the impacted controls are implemented correctly with regard to meeng the privacy requirements for the system aer system changes;

CM-04(02)[03]

the impacted controls are operang as intended with regard to meeng the security requirements for the system aer system changes;

CM-04(02)[04]

the impacted controls are operang as intended with regard to meeng the privacy requirements for the system aer system changes;

CM-04(02)[05]

the impacted controls are producing the desired outcome with regard to meeng the security requirements for the system aer system changes;

CM-04(02)[06]

the impacted controls are producing the desired outcome with regard to meeng the privacy requirements for the system aer system changes.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

CM-04(02)-Examine

[SELECT FROM: Conﬁguraon management policy; procedures addressing security impact analyses for changes to the system; procedures addressing privacy impact analyses for changes to the system; privacy risk assessment documentaon; conﬁguraon management plan; security and privacy impact analysis documentaon; privacy impact assessment; analysis tools and associated outputs; change control records; control assessment results; system audit records; system component inventory; system security plan; privacy plan; other relevant documents or records].

CM-04(02)-Interview

CM-04(02)-Test

[SELECT FROM: Organizaonal processes for security and privacy impact analyses; mechanisms supporng and/or implemenng security and privacy impact analyses of changes].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 189

NIST SP 800-53A, REV. 5

CM-05

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

ACCESS RESTRICTIONS FOR CHANGE ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

CM-05[01]

physical access restricons associated with changes to the system are deﬁned and documented;

CM-05[02]

physical access restricons associated with changes to the system are approved;

CM-05[03]

physical access restricons associated with changes to the system are enforced;

CM-05[04]

logical access restricons associated with changes to the system are deﬁned and documented;

CM-05[05]

logical access restricons associated with changes to the system are approved;

CM-05[06]

logical access restricons associated with changes to the system are enforced.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CM-05(01)

CM-05-Examine

[SELECT FROM: Conﬁguraon management policy; procedures addressing access restricons for changes to the system; conﬁguraon management plan; system design documentaon; system architecture and conﬁguraon documentaon; system conﬁguraon sengs and associated documentaon; logical access approvals; physical access approvals; access credenals; change control records; system audit records; system security plan; other relevant documents or records].

CM-05-Interview

[SELECT FROM: Organizaonal personnel with logical access control responsibilies; organizaonal personnel with physical access control responsibilies; organizaonal personnel with informaon security responsibilies; system/network administrators].

CM-05-Test

[SELECT FROM: Organizaonal processes for managing access restricons to change; mechanisms supporng, implemenng, or enforcing access restricons associated with changes to the system].

ACCESS RESTRICTIONS FOR CHANGE | AUTOMATED ACCESS ENFORCEMENT AND AUDIT RECORDS ASSESSMENT OBJECTIVE: Determine if:

CM-05(01)_ODP

mechanisms used to automate the enforcement of access restricons are deﬁned;

CM-05(01)(a)

access restricons for change are enforced using <CM-05(01)_ODP automated mechanisms>;

CM-05(01)(b)

audit records of enforcement acons are automacally generated.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: CM-05(01)-Examine

CHAPTER FOUR

[SELECT FROM: Conﬁguraon management policy; procedures addressing access restricons for changes to the system; system design documentaon; system architecture and conﬁguraon documentaon; system conﬁguraon sengs and associated documentaon; change control records; system audit records; system security plan; other relevant documents or records].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 190

NIST SP 800-53A, REV. 5

CM-05(01)

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

CM-05(02)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

ACCESS RESTRICTIONS FOR CHANGE | AUTOMATED ACCESS ENFORCEMENT AND AUDIT RECORDS CM-05(01)-Interview

CM-05(01)-Test

[SELECT FROM: Organizaonal processes for managing access restricons to change; automated mechanisms implemenng the enforcement of access restricons for changes to the system; automated mechanisms supporng auding of enforcement acons].

ACCESS RESTRICTIONS FOR CHANGE | REVIEW SYSTEM CHANGES [WITHDRAWN: Incorporated into CM-03(07).]

CM-05(03)

ACCESS RESTRICTIONS FOR CHANGE | SIGNED COMPONENTS [WITHDRAWN: Moved to CM-14.]

CM-05(04)

ACCESS RESTRICTIONS FOR CHANGE | DUAL AUTHORIZATION ASSESSMENT OBJECTIVE: Determine if:

CM-05(04)_ODP[01]

system components requiring dual authorizaon for changes are deﬁned;

CM-05(04)_ODP[02]

system-level informaon requiring dual authorizaon for changes is deﬁned;

CM-05(04)[01]

dual authorizaon for implemenng changes to <CM-05(04)_ODP[01] system components> is enforced;

CM-05(04)[02]

dual authorizaon for implemenng changes to <CM-05(04)_ODP[02] system-level informaon> is enforced.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

CM-05(04)-Examine

[SELECT FROM: Conﬁguraon management policy; procedures addressing access restricons for changes to the system; conﬁguraon management plan; system design documentaon; system architecture and conﬁguraon documentaon; system conﬁguraon sengs and associated documentaon; change control records; system audit records; system component inventory; system informaon types informaon; system security plan; other relevant documents or records].

CM-05(04)-Interview

[SELECT FROM: Organizaonal personnel with dual authorizaon enforcement responsibilies for implemenng system changes; organizaonal personnel with informaon security responsibilies; system/network administrators].

CM-05(04)-Test

[SELECT FROM: Organizaonal processes for managing access restricons to change; mechanisms implemenng dual authorizaon enforcement].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 191

NIST SP 800-53A, REV. 5

CM-05(05)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

ACCESS RESTRICTIONS FOR CHANGE | PRIVILEGE LIMITATION FOR PRODUCTION AND OPERATION ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

CM-05(05)_ODP[01]

frequency at which to review privileges is deﬁned;

CM-05(05)_ODP[02]

frequency at which to reevaluate privileges is deﬁned;

CM-05(05)(a)[01]

privileges to change system components within a producon or operaonal environment are limited;

CM-05(05)(a)[02]

privileges to change system-related informaon within a producon or operaonal environment are limited;

CM-05(05)(b)[01]

privileges are reviewed <CM-05(05)_ODP[01] frequency>;

CM-05(05)(b)[02]

privileges are reevaluated <CM-05(05)_ODP[02] frequency>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CM-05(06)

CM-05(05)-Examine

[SELECT FROM: Conﬁguraon management policy; procedures addressing access restricons for changes to the system; conﬁguraon management plan; system design documentaon; system architecture and conﬁguraon documentaon; system conﬁguraon sengs and associated documentaon; user privilege reviews; user privilege recerﬁcaons; system component inventory; change control records; system audit records; system security plan; other relevant documents or records].

CM-05(05)-Interview

[SELECT FROM: Organizaonal personnel with informaon security responsibilies; system/network administrators].

CM-05(05)-Test

[SELECT FROM: Organizaonal processes for managing access restricons to change; mechanisms supporng and/or implemenng access restricons for change].

ACCESS RESTRICTIONS FOR CHANGE | LIMIT LIBRARY PRIVILEGES ASSESSMENT OBJECTIVE: Determine if: CM-05(06)

privileges to change soware resident within soware libraries are limited.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

CM-05(06)-Examine

[SELECT FROM: Conﬁguraon management policy; procedures addressing access restricons for changes to the system; conﬁguraon management plan; system design documentaon; system architecture and conﬁguraon documentaon; system conﬁguraon sengs and associated documentaon; system component inventory; change control records; system audit records; system security plan; other relevant documents or records].

CM-05(06)-Interview

[SELECT FROM: Organizaonal personnel with informaon security responsibilies; system/network administrators].

CM-05(06)-Test

[SELECT FROM: Organizaonal processes for managing access restricons to change; mechanisms supporng and/or implemenng access restricons for change].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 192

NIST SP 800-53A, REV. 5

CM-05(07)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

ACCESS RESTRICTIONS FOR CHANGE | AUTOMATIC IMPLEMENTATION OF SECURITY SAFEGUARDS [WITHDRAWN: Incorporated into SI-07.]

CM-06

CONFIGURATION SETTINGS ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

CM-06_ODP[01]

common secure conﬁguraons to establish and document conﬁguraon sengs for components employed within the system are deﬁned;

CM-06_ODP[02]

system components for which approval of deviaons is needed are deﬁned;

CM-06_ODP[03]

operaonal requirements necessitang approval of deviaons are deﬁned;

CM-06a.

conﬁguraon sengs that reﬂect the most restricve mode consistent with operaonal requirements are established and documented for components employed within the system using <CM-06_ODP[01] common secure conﬁguraons>;

CM-06b.

the conﬁguraon sengs documented in CM-06a are implemented;

CM-06c.[01]

any deviaons from established conﬁguraon sengs for <CM-06_ODP[02] system components> are idenﬁed and documented based on <CM-06_ODP[03] operaonal requirements>;

CM-06c.[02]

any deviaons from established conﬁguraon sengs for <CM-06_ODP[02] system components> are approved;

CM-06d.[01]

changes to the conﬁguraon sengs are monitored in accordance with organizaonal policies and procedures;

CM-06d.[02]

changes to the conﬁguraon sengs are controlled in accordance with organizaonal policies and procedures.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

CM-06-Examine

[SELECT FROM: Conﬁguraon management policy; procedures addressing conﬁguraon sengs for the system; conﬁguraon management plan; system design documentaon; system conﬁguraon sengs and associated documentaon; common secure conﬁguraon checklists; system component inventory; evidence supporng approved deviaons from established conﬁguraon sengs; change control records; system data processing and retenon permissions; system audit records; system security plan; privacy plan; other relevant documents or records].

CM-06-Interview

[SELECT FROM: Organizaonal personnel with security conﬁguraon management responsibilies; organizaonal personnel with privacy conﬁguraon management responsibilies; organizaonal personnel with informaon security and privacy responsibilies; system/network administrators].

CM-06-Test

[SELECT FROM: Organizaonal processes for managing conﬁguraon sengs; mechanisms that implement, monitor, and/or control system conﬁguraon sengs; mechanisms that idenfy and/or document deviaons from established conﬁguraon sengs].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 193

NIST SP 800-53A, REV. 5

CM-06(01)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

CONFIGURATION SETTINGS | AUTOMATED MANAGEMENT, APPLICATION, AND VERIFICATION ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

CM-06(01)_ODP[01]

system components for which to manage, apply, and verify conﬁguraon sengs are deﬁned;

CM-06(01)_ODP[02]

automated mechanisms to manage conﬁguraon sengs are deﬁned;

CM-06(01)_ODP[03]

automated mechanisms to apply conﬁguraon sengs are deﬁned;

CM-06(01)_ODP[04]

automated mechanisms to verify conﬁguraon sengs are deﬁned;

CM-06(01)[01]

conﬁguraon sengs for <CM-06(01)_ODP[01] system components> are managed using <CM-06(01)_ODP[02] automated mechanisms>;

CM-06(01)[02]

conﬁguraon sengs for <CM-06(01)_ODP[01] system components> are applied using <CM-06(01)_ODP[03] automated mechanisms>;

CM-06(01)[03]

conﬁguraon sengs for <CM-06(01)_ODP[01] system components> are veriﬁed using <CM-06(01)_ODP[04] automated mechanisms>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CM-06(02)

CM-06(01)-Examine

[SELECT FROM: Conﬁguraon management policy; procedures addressing conﬁguraon sengs for the system; conﬁguraon management plan; system design documentaon; system conﬁguraon sengs and associated documentaon; system component inventory; common secure conﬁguraon checklists; change control records; system audit records; system security plan; privacy plan; other relevant documents or records].

CM-06(01)-Interview

[SELECT FROM: Organizaonal personnel with security conﬁguraon management responsibilies; organizaonal personnel with informaon security and privacy responsibilies; system/network administrators; system developers].

CM-06(01)-Test

[SELECT FROM: Organizaonal processes for managing conﬁguraon sengs; automated mechanisms implemented to manage, apply, and verify system conﬁguraon sengs].

CONFIGURATION SETTINGS | RESPOND TO UNAUTHORIZED CHANGES ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

CM-06(02)_ODP[01]

acons to be taken upon an unauthorized change are deﬁned;

CM-06(02)_ODP[02]

conﬁguraon sengs requiring acon upon an unauthorized change are deﬁned;

CM-06(02)

<CM-06(02)_ODP[01] acons> are taken in response to unauthorized changes to <CM-06(02)_ODP[02] conﬁguraon sengs>.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 194

NIST SP 800-53A, REV. 5

CM-06(02)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

CONFIGURATION SETTINGS | RESPOND TO UNAUTHORIZED CHANGES POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

CM-06(03)

CM-06(02)-Examine

[SELECT FROM: System security plan; privacy plan; conﬁguraon management policy; procedures addressing conﬁguraon sengs for the system; conﬁguraon management plan; system design documentaon; system conﬁguraon sengs and associated documentaon; alerts/noﬁcaons of unauthorized changes to system conﬁguraon sengs; system component inventory; documented responses to unauthorized changes to system conﬁguraon sengs; change control records; system audit records; other relevant documents or records].

CM-06(02)-Interview

[SELECT FROM: Organizaonal personnel with security conﬁguraon management responsibilies; organizaonal personnel with security and privacy responsibilies; system/network administrators].

CM-06(02)-Test

[SELECT FROM: Organizaonal process for responding to unauthorized changes to system conﬁguraon sengs; mechanisms supporng and/or implemenng acons in response to unauthorized changes].

CONFIGURATION SETTINGS | UNAUTHORIZED CHANGE DETECTION [WITHDRAWN: Incorporated into SI-07.]

CM-06(04)

CONFIGURATION SETTINGS | CONFORMANCE DEMONSTRATION [WITHDRAWN: Incorporated into CM-04.]

CM-07

LEAST FUNCTIONALITY ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

CM-07_ODP[01]

mission-essenal capabilies for the system are deﬁned;

CM-07_ODP[02]

funcons to be prohibited or restricted are deﬁned;

CM-07_ODP[03]

ports to be prohibited or restricted are deﬁned;

CM-07_ODP[04]

protocols to be prohibited or restricted are deﬁned;

CM-07_ODP[05]

soware to be prohibited or restricted is deﬁned;

CM-07_ODP[06]

services to be prohibited or restricted are deﬁned;

CM-07a.

the system is conﬁgured to provide only <CM-07_ODP[01] mission-essenal capabilies>;

CM-07b.[01]

the use of <CM-07_ODP[02] funcons> is prohibited or restricted;

CM-07b.[02]

the use of <CM-07_ODP[03] ports> is prohibited or restricted;

CM-07b.[03]

the use of <CM-07_ODP[04] protocols> is prohibited or restricted;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 195

NIST SP 800-53A, REV. 5

CM-07

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

LEAST FUNCTIONALITY CM-07b.[04]

the use of <CM-07_ODP[05] soware> is prohibited or restricted;

CM-07b.[05]

the use of <CM-07_ODP[06] services> is prohibited or restricted.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

CM-07(01)

CM-07-Examine

[SELECT FROM: Conﬁguraon management policy; procedures addressing least funconality in the system; conﬁguraon management plan; system design documentaon; system conﬁguraon sengs and associated documentaon; system component inventory; common secure conﬁguraon checklists; system security plan; other relevant documents or records].

CM-07-Interview

[SELECT FROM: Organizaonal personnel with security conﬁguraon management responsibilies; organizaonal personnel with informaon security responsibilies; system/network administrators; system developers].

CM-07-Test

[SELECT FROM: Organizaonal processes prohibing or restricng funcons, ports, protocols, soware, and/or services; mechanisms implemenng restricons or prohibion of funcons, ports, protocols, soware, and/or services].

LEAST FUNCTIONALITY | PERIODIC REVIEW ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

CM-07(01)_ODP[01]

the frequency at which to review the system to idenfy unnecessary and/or nonsecure funcons, ports, protocols, soware, and/or services is deﬁned;

CM-07(01)_ODP[02]

funcons to be disabled or removed when deemed unnecessary or non-secure are deﬁned;

CM-07(01)_ODP[03]

ports to be disabled or removed when deemed unnecessary or non-secure are deﬁned;

CM-07(01)_ODP[04]

protocols to be disabled or removed when deemed unnecessary or non-secure are deﬁned;

CM-07(01)_ODP[05]

soware to be disabled or removed when deemed unnecessary or non-secure is deﬁned;

CM-07(01)_ODP[06]

services to be disabled or removed when deemed unnecessary or non-secure are deﬁned;

CM-07(01)(a)

the system is reviewed <CM-07(01)_ODP[01] frequency> to idenfy unnecessary and/or non-secure funcons, ports, protocols, soware, and services:

CM-07(01)(b)[01]

<CM-07(01)_ODP[02] funcons> deemed to be unnecessary and/or non-secure are disabled or removed;

CM-07(01)(b)[02]

<CM-07(01)_ODP[03] ports> deemed to be unnecessary and/or non-secure are disabled or removed;

CM-07(01)(b)[03]

<CM-07(01)_ODP[04] protocols> deemed to be unnecessary and/or non-secure are disabled or removed;

CM-07(01)(b)[04]

<CM-07(01)_ODP[05] soware> deemed to be unnecessary and/or non-secure is disabled or removed;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 196

NIST SP 800-53A, REV. 5

CM-07(01)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

LEAST FUNCTIONALITY | PERIODIC REVIEW CM-07(01)(b)[05]

<CM-07(01)_ODP[06] services> deemed to be unnecessary and/or non-secure are disabled or removed.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

CM-07(02)

CM-07(01)-Examine

[SELECT FROM: Conﬁguraon management policy; procedures addressing least funconality in the system; conﬁguraon management plan; system design documentaon; system conﬁguraon sengs and associated documentaon; common secure conﬁguraon checklists; documented reviews of funcons, ports, protocols, and/or services; change control records; system audit records; system security plan; other relevant documents or records].

CM-07(01)-Interview

[SELECT FROM: Organizaonal personnel with responsibilies for reviewing funcons, ports, protocols, and services on the system; organizaonal personnel with informaon security responsibilies; system/network administrators; system developers].

CM-07(01)-Test

[SELECT FROM: Organizaonal processes for reviewing or disabling funcons, ports, protocols, and services on the system; mechanisms implemenng review and disabling of funcons, ports, protocols, and/or services].

LEAST FUNCTIONALITY | PREVENT PROGRAM EXECUTION ASSESSMENT OBJECTIVE: Determine if:

CM-07(02)_ODP[01]

one or more of the following PARAMETER VALUES is/are selected: {<CM-07(02)_ODP[02] policies, rules of behavior, and/or access agreements regarding soware program usage and restricons>; rules authorizing the terms and condions of soware program usage};

CM-07(02)_ODP[02]

policies, rules of behavior, and/or access agreements regarding soware program usage and restricons are deﬁned (if selected);

CM-07(02)

program execuon is prevented in accordance with <CM-07(02)_ODP[01] SELECTED PARAMETER VALUE(S)>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

CM-07(02)-Examine

[SELECT FROM: Conﬁguraon management policy; procedures addressing least funconality in the system; conﬁguraon management plan; system design documentaon; system conﬁguraon sengs and associated documentaon; system component inventory; common secure conﬁguraon checklists; speciﬁcaons for prevenng soware program execuon; change control records; system audit records; system security plan; other relevant documents or records].

CM-07(02)-Interview

[SELECT FROM: Organizaonal personnel with informaon security responsibilies; system/network administrators; system developers].

CM-07(02)-Test

[SELECT FROM: Organizaonal processes prevenng program execuon on the system; organizaonal processes for soware program usage and restricons; mechanisms prevenng program execuon on the system; mechanisms supporng and/or implemenng soware program usage and restricons].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 197

NIST SP 800-53A, REV. 5

CM-07(03)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

LEAST FUNCTIONALITY | REGISTRATION COMPLIANCE ASSESSMENT OBJECTIVE: Determine if:

CM-07(03)_ODP

registraon requirements for funcons, ports, protocols, and services are deﬁned;

CM-07(03)

<CM-07(03)_ODP registraon requirements> are complied with.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

CM-07(04)

CM-07(03)-Examine

[SELECT FROM: System security plan; conﬁguraon management policy; procedures addressing least funconality in the system; conﬁguraon management plan; system conﬁguraon sengs and associated documentaon; system component inventory; audit and compliance reviews; system audit records; other relevant documents or records].

CM-07(03)-Interview

[SELECT FROM: Organizaonal personnel with security responsibilies; system/ network administrators; system developers].

CM-07(03)-Test

[SELECT FROM: Organizaonal processes ensuring compliance with registraon requirements for funcons, ports, protocols, and/or services; mechanisms implemenng compliance with registraon requirements for funcons, ports, protocols, and/or services].

LEAST FUNCTIONALITY | UNAUTHORIZED SOFTWARE — DENY-BY-EXCEPTION ASSESSMENT OBJECTIVE: Determine if:

CM-07(04)_ODP[01]

soware programs not authorized to execute on the system are deﬁned;

CM-07(04)_ODP[02]

frequency at which to review and update the list of unauthorized soware programs is deﬁned;

CM-07(04)(a)

<CM-07(04)_ODP[01] soware programs> are idenﬁed;

CM-07(04)(b)

an allow-all, deny-by-excepon policy is employed to prohibit the execuon of unauthorized soware programs on the system;

CM-07(04)(c)

the list of unauthorized soware programs is reviewed and updated <CM-07(04)_ODP[02] frequency>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

CM-07(04)-Examine

[SELECT FROM: Conﬁguraon management policy; procedures addressing least funconality in the system; conﬁguraon management plan; system design documentaon; system conﬁguraon sengs and associated documentaon; list of soware programs not authorized to execute on the system; system component inventory; common secure conﬁguraon checklists; review and update records associated with list of unauthorized soware programs; change control records; system audit records; system security plan; other relevant documents or records].

CM-07(04)-Interview

[SELECT FROM: Organizaonal personnel with responsibilies for idenfying soware not authorized to execute on the system; organizaonal personnel with informaon security responsibilies; system/network administrators].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 198

NIST SP 800-53A, REV. 5

CM-07(04)

LEAST FUNCTIONALITY | UNAUTHORIZED SOFTWARE — DENY-BY-EXCEPTION CM-07(04)-Test

CM-07(05)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

[SELECT FROM: Organizaonal process for idenfying, reviewing, and updang programs not authorized to execute on the system; organizaonal process for implemenng unauthorized soware policy; mechanisms supporng and/or implemenng unauthorized soware policy].

LEAST FUNCTIONALITY | AUTHORIZED SOFTWARE — ALLOW-BY-EXCEPTION ASSESSMENT OBJECTIVE:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

Determine if:

CM-07(05)_ODP[01]

soware programs authorized to execute on the system are deﬁned;

CM-07(05)_ODP[02]

frequency at which to review and update the list of authorized soware programs is deﬁned;

CM-07(05)(a)

<CM-07(05)_ODP[01] soware programs> are idenﬁed;

CM-07(05)(b)

a deny-all, permit-by-excepon policy to allow the execuon of authorized soware programs on the system is employed;

CM-07(05)(c)

the list of authorized soware programs is reviewed and updated <CM-07(05)_ODP[02] frequency>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CM-07(06)

CM-07(05)-Examine

[SELECT FROM: Conﬁguraon management policy; procedures addressing least funconality in the system; conﬁguraon management plan; system design documentaon; system conﬁguraon sengs and associated documentaon; list of soware programs authorized to execute on the system; system component inventory; common secure conﬁguraon checklists; review and update records associated with list of authorized soware programs; change control records; system audit records; system security plan; other relevant documents or records].

CM-07(05)-Interview

[SELECT FROM: Organizaonal personnel with responsibilies for idenfying soware authorized to execute on the system; organizaonal personnel with informaon security responsibilies; system/network administrators].

CM-07(05)-Test

[SELECT FROM: Organizaonal process for idenfying, reviewing, and updang programs authorized to execute on the system; organizaonal process for implemenng authorized soware policy; mechanisms supporng and/or implemenng authorized soware policy].

LEAST FUNCTIONALITY | CONFINED ENVIRONMENTS WITH LIMITED PRIVILEGES ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

CM-07(06)_ODP

user-installed soware required to be executed in a conﬁned environment is deﬁned;

CM-07(06)

<CM-07(06)_ODP user-installed soware> is required to be executed in a conﬁned physical or virtual machine environment with limited privileges.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 199

NIST SP 800-53A, REV. 5

CM-07(06)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

LEAST FUNCTIONALITY | CONFINED ENVIRONMENTS WITH LIMITED PRIVILEGES POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

CM-07(07)

CM-07(06)-Examine

[SELECT FROM: Conﬁguraon management policy; procedures addressing least funconality in the system; conﬁguraon management plan; system design documentaon; system conﬁguraon sengs and associated documentaon; list or record of soware required to execute in a conﬁned environment; system component inventory; common secure conﬁguraon checklists; system audit records; system security plan; other relevant documents or records].

CM-07(06)-Interview

[SELECT FROM: Organizaonal personnel with responsibilies for idenfying and/ or managing user-installed soware and associated privileges; organizaonal personnel with informaon security responsibilies; system/network administrators].

CM-07(06)-Test

[SELECT FROM: Organizaonal process for idenfying user-installed soware required to execute in a conﬁned environment; mechanisms supporng and/or implemenng the conﬁnement of user-installed soware to physical or virtual machine environments; mechanisms supporng and/or implemenng privilege limitaons on user-installed soware].

LEAST FUNCTIONALITY | CODE EXECUTION IN PROTECTED ENVIRONMENTS ASSESSMENT OBJECTIVE: Determine if:

CM-07(07)_ODP

personnel or roles to explicitly approve execuon of binary or machine-executable code is/are deﬁned;

CM-07(07)

the execuon of binary or machine-executable code is only allowed in conﬁned physical or virtual machine environments;

CM-07(07)(a)

the execuon of binary or machine-executable code obtained from sources with limited or no warranty is only allowed with the explicit approval of <CM-07(07)_ODP personnel or roles>;

CM-07(07)(b)

the execuon of binary or machine-executable code without the provision of source code is only allowed with the explicit approval of <CM-07(07)_ODP personnel or roles>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

CM-07(07)-Examine

[SELECT FROM: Conﬁguraon management policy; procedures addressing least funconality in the system; conﬁguraon management plan; system design documentaon; system conﬁguraon sengs and associated documentaon; list or record of binary or machine-executable code; system component inventory; common secure conﬁguraon checklists; system audit records; system security plan; other relevant documents or records].

CM-07(07)-Interview

[SELECT FROM: Organizaonal personnel with responsibilies for approving execuon of binary or machine-executable code; organizaonal personnel with informaon security responsibilies; organizaonal personnel with soware management responsibilies; system/network administrators; system developers].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 200

NIST SP 800-53A, REV. 5

CM-07(07)

LEAST FUNCTIONALITY | CODE EXECUTION IN PROTECTED ENVIRONMENTS CM-07(07)-Test

CM-07(08)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

[SELECT FROM: Organizaonal process for approving execuon of binary or machine-executable code; organizaonal process for conﬁning binary or machineexecutable code to physical or virtual machine environments; mechanisms supporng and/or implemenng the conﬁnement of binary or machine-executable code to physical or virtual machine environments].

LEAST FUNCTIONALITY | BINARY OR MACHINE EXECUTABLE CODE

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

ASSESSMENT OBJECTIVE: Determine if:

CM-07(08)(a)

the use of binary or machine-executable code is prohibited when it originates from sources with limited or no warranty or without the provision of source code;

CM-07(08)(b)[01]

excepons to the prohibion of binary or machine-executable code from sources with limited or no warranty or without the provision of source code are allowed only for compelling mission or operaonal requirements;

CM-07(08)(b)[02]

excepons to the prohibion of binary or machine-executable code from sources with limited or no warranty or without the provision of source code are allowed only with the approval of the authorizing oﬃcial.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CM-07(09)

CM-07(08)-Examine

[SELECT FROM: Conﬁguraon management policy; procedures addressing least funconality in the system; conﬁguraon management plan; system security plan; system design documentaon; system conﬁguraon sengs and associated documentaon; list or record of binary or machine-executable code; system component inventory; common secure conﬁguraon checklists; system audit records; system security plan; other relevant documents or records].

CM-07(08)-Interview

[SELECT FROM: Organizaonal personnel with responsibilies for determining mission and operaonal requirements; authorizing oﬃcial for the system; organizaonal personnel with informaon security responsibilies; organizaonal personnel with soware management responsibilies; system/network administrators].

CM-07(08)-Test

[SELECT FROM: Organizaonal process for approving execuon of binary or machine-executable code; mechanisms supporng and/or implemenng the prohibion of binary or machine-executable code].

LEAST FUNCTIONALITY | PROHIBITING THE USE OF UNAUTHORIZED HARDWARE ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

CM-07(09)_ODP[01]

hardware components authorized for system use are deﬁned;

CM-07(09)_ODP[02]

frequency at which to review and update the list of authorized hardware components is deﬁned;

CM-07(09)(a)

<CM-07(09)_ODP[01] hardware components> are idenﬁed;

CM-07(09)(b)

the use or connecon of unauthorized hardware components is prohibited;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 201

NIST SP 800-53A, REV. 5

CM-07(09)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

LEAST FUNCTIONALITY | PROHIBITING THE USE OF UNAUTHORIZED HARDWARE CM-07(09)(c)

the list of authorized hardware components is reviewed and updated <CM-07(09)_ODP[02] frequency>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

CM-08

CM-07(09)-Examine

[SELECT FROM: Conﬁguraon management policy; network connecon policy and procedures; conﬁguraon management plan; system security plan; system design documentaon; system component inventory; system audit records; system security plan; other relevant documents or records].

CM-07(09)-Interview

[SELECT FROM: Organizaonal personnel with system hardware management responsibilies; organizaonal personnel with informaon security responsibilies; system/network administrators].

CM-07(09)-Test

SYSTEM COMPONENT INVENTORY ASSESSMENT OBJECTIVE: Determine if:

CM-08_ODP[01]

informaon deemed necessary to achieve eﬀecve system component accountability is deﬁned;

CM-08_ODP[02]

frequency at which to review and update the system component inventory is deﬁned;

CM-08a.01

an inventory of system components that accurately reﬂects the system is developed and documented;

CM-08a.02

an inventory of system components that includes all components within the system is developed and documented;

CM-08a.03

an inventory of system components that does not include duplicate accounng of components or components assigned to any other system is developed and documented;

CM-08a.04

an inventory of system components that is at the level of granularity deemed necessary for tracking and reporng is developed and documented;

CM-08a.05

an inventory of system components that includes <CM-08_ODP[01] informaon> is developed and documented;

CM-08b.

the system component inventory is reviewed and updated <CM-08_ODP[02] frequency>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

CM-08-Examine

[SELECT FROM: Conﬁguraon management policy; procedures addressing system component inventory; conﬁguraon management plan; system security plan; system design documentaon; system component inventory; inventory reviews and update records; system security plan; other relevant documents or records].

CM-08-Interview

[SELECT FROM: Organizaonal personnel with component inventory management responsibilies; organizaonal personnel with informaon security responsibilies; system/network administrators].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 202

NIST SP 800-53A, REV. 5

CM-08

SYSTEM COMPONENT INVENTORY CM-08-Test

CM-08(01)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

[SELECT FROM: Organizaonal processes for managing the system component inventory; mechanisms supporng and/or implemenng system component inventory].

SYSTEM COMPONENT INVENTORY | UPDATES DURING INSTALLATION AND REMOVAL ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

CM-08(01)[01]

the inventory of system components is updated as part of component installaons;

CM-08(01)[02]

the inventory of system components is updated as part of component removals;

CM-08(01)[03]

the inventory of system components is updated as part of system updates.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CM-08(02)

CM-08(01)-Examine

[SELECT FROM: Conﬁguraon management policy; procedures addressing system component inventory; conﬁguraon management plan; system security plan; system component inventory; inventory reviews and update records; change control records; component installaon records; component removal records; system security plan; other relevant documents or records].

CM-08(01)-Interview

[SELECT FROM: Organizaonal personnel with component inventory updang responsibilies; organizaonal personnel with informaon security responsibilies; system/network administrators].

CM-08(01)-Test

[SELECT FROM: Organizaonal processes for updang the system component inventory; mechanisms supporng and/or implemenng system component inventory updates].

SYSTEM COMPONENT INVENTORY | AUTOMATED MAINTENANCE ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

CM-08(02)_ODP[01]

automated mechanisms used to maintain the currency of the system component inventory are deﬁned;

CM-08(02)_ODP[02]

automated mechanisms used to maintain the completeness of the system component inventory are deﬁned;

CM-08(02)_ODP[03]

automated mechanisms used to maintain the accuracy of the system component inventory are deﬁned;

CM-08(02)_ODP[04]

automated mechanisms used to maintain the availability of the system component inventory are deﬁned;

CM-08(02)[01]

<CM-08(02)_ODP[01] automated mechanisms> are used to maintain the currency of the system component inventory;

CM-08(02)[02]

<CM-08(02)_ODP[02] automated mechanisms> are used to maintain the completeness of the system component inventory;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 203

NIST SP 800-53A, REV. 5

CM-08(02)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

SYSTEM COMPONENT INVENTORY | AUTOMATED MAINTENANCE CM-08(02)[03]

<CM-08(02)_ODP[03] automated mechanisms> are used to maintain the accuracy of the system component inventory;

CM-08(02)[04]

<CM-08(02)_ODP[04] automated mechanisms> are used to maintain the availability of the system component inventory.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

CM-08(03)

CM-08(02)-Examine

[SELECT FROM: Conﬁguraon management policy; procedures addressing system component inventory; conﬁguraon management plan; system design documentaon; system security plan; system component inventory; change control records; system maintenance records; system audit records; system security plan; other relevant documents or records].

CM-08(02)-Interview

[SELECT FROM: Organizaonal personnel with component inventory management responsibilies; organizaonal personnel with informaon security responsibilies; system/network administrators; system developers].

CM-08(02)-Test

[SELECT FROM: Organizaonal processes for maintaining the system component inventory; automated mechanisms supporng and/or implemenng the system component inventory].

SYSTEM COMPONENT INVENTORY | AUTOMATED UNAUTHORIZED COMPONENT DETECTION ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

CM-08(03)_ODP[01]

automated mechanisms used to detect the presence of unauthorized hardware within the system are deﬁned;

CM-08(03)_ODP[02]

automated mechanisms used to detect the presence of unauthorized soware within the system are deﬁned;

CM-08(03)_ODP[03]

automated mechanisms used to detect the presence of unauthorized ﬁrmware within the system are deﬁned;

CM-08(03)_ODP[04]

frequency at which automated mechanisms are used to detect the presence of unauthorized system components within the system is deﬁned;

CM-08(03)_ODP[05]

one or more of the following PARAMETER VALUES is/are selected: {disable network access by unauthorized components; isolate unauthorized components; nofy <CM-08(03)_ODP[06] personnel or roles>};

CM-08(03)_ODP[06]

personnel or roles to be noﬁed when unauthorized components are detected is/ are deﬁned (if selected);

CM-08(03)(a)[01]

the presence of unauthorized hardware within the system is detected using <CM-08(03)_ODP[01] automated mechanisms> <CM-08(03)_ODP[04] frequency>;

CM-08(03)(a)[02]

the presence of unauthorized soware within the system is detected using <CM-08(03)_ODP[02] automated mechanisms> <CM-08(03)_ODP[04] frequency>;

CM-08(03)(a)[03]

the presence of unauthorized ﬁrmware within the system is detected using <CM-08(03)_ODP[03] automated mechanisms> <CM-08(03)_ODP[04] frequency>;

CM-08(03)(b)[01]

<CM-08(03)_ODP[05] SELECTED PARAMETER VALUE(S)> are taken when unauthorized hardware is detected;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 204

NIST SP 800-53A, REV. 5

CM-08(03)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

SYSTEM COMPONENT INVENTORY | AUTOMATED UNAUTHORIZED COMPONENT DETECTION CM-08(03)(b)[02]

<CM-08(03)_ODP[05] SELECTED PARAMETER VALUE(S)> are taken when unauthorized soware is detected;

CM-08(03)(b)[03]

<CM-08(03)_ODP[05] SELECTED PARAMETER VALUE(S)> are taken when unauthorized ﬁrmware is detected.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

CM-08(04)

CM-08(03)-Examine

[SELECT FROM: Conﬁguraon management policy; procedures addressing system component inventory; conﬁguraon management plan; system design documentaon; system security plan; system component inventory; change control records; alerts/noﬁcaons of unauthorized components within the system; system monitoring records; system maintenance records; system audit records; system security plan; other relevant documents or records].

CM-08(03)-Interview

[SELECT FROM: Organizaonal personnel with component inventory management responsibilies; organizaonal personnel with responsibilies for managing the automated mechanisms implemenng unauthorized system component detecon; organizaonal personnel with informaon security responsibilies; system/network administrators; system developers].

CM-08(03)-Test

[SELECT FROM: Organizaonal processes for detecon of unauthorized system components; organizaonal processes for taking acon when unauthorized system components are detected; automated mechanisms supporng and/or implemenng the detecon of unauthorized system components; automated mechanisms supporng and/or implemenng acons taken when unauthorized system components are detected].

SYSTEM COMPONENT INVENTORY | ACCOUNTABILITY INFORMATION ASSESSMENT OBJECTIVE: Determine if:

CM-08(04)_ODP

one or more of the following PARAMETER VALUES is/are selected: {name; posion; role};

CM-08(04)

individuals responsible and accountable for administering system components are idenﬁed by <CM-08(04)_ODP SELECTED PARAMETER VALUE(S)> in the system component inventory.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

CM-08(04)-Examine

CM-08(04)-Interview

[SELECT FROM: Organizaonal personnel with component inventory management responsibilies; organizaonal personnel with informaon security responsibilies; system/network administrators].

CM-08(04)-Test

[SELECT FROM: Organizaonal processes for managing the system component inventory; mechanisms supporng and/or implemenng the system component inventory].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 205

NIST SP 800-53A, REV. 5

CM-08(05)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

SYSTEM COMPONENT INVENTORY | NO DUPLICATE ACCOUNTING OF COMPONENTS [WITHDRAWN: Incorporated into CM-08.]

CM-08(06)

SYSTEM COMPONENT INVENTORY | ASSESSED CONFIGURATIONS AND APPROVED DEVIATIONS ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

CM-08(06)[01]

assessed component conﬁguraons are included in the system component inventory;

CM-08(06)[02]

any approved deviaons to current deployed conﬁguraons are included in the system component inventory.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CM-08(07)

CM-08(06)-Examine

[SELECT FROM: Conﬁguraon management policy; procedures addressing system component inventory; conﬁguraon management plan; system security plan; system design documentaon; system component inventory; system conﬁguraon sengs and associated documentaon; change control records; system security plan; other relevant documents or records].

CM-08(06)-Interview

[SELECT FROM: Organizaonal personnel with component inventory management responsibilies; organizaonal personnel with assessment responsibilies; organizaonal personnel with informaon security responsibilies; system/network administrators].

CM-08(06)-Test

[SELECT FROM: Organizaonal processes for managing the system component inventory; mechanisms supporng and/or implemenng system component inventory].

SYSTEM COMPONENT INVENTORY | CENTRALIZED REPOSITORY ASSESSMENT OBJECTIVE: Determine if: CM-08(07)

a centralized repository for the system component inventory is provided.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

CM-08(07)-Examine

[SELECT FROM: Conﬁguraon management policy; procedures addressing system component inventory; conﬁguraon management plan; system design documentaon; system security plan; system component inventory; system conﬁguraon sengs and associated documentaon; change control records; system security plan; other relevant documents or records].

CM-08(07)-Interview

[SELECT FROM: Organizaonal personnel with component inventory management responsibilies; organizaonal personnel with security responsibilies; ].

CM-08(07)-Test

[SELECT FROM: Organizaonal processes for managing the system component inventory; mechanisms supporng and/or implemenng system component inventory].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 206

NIST SP 800-53A, REV. 5

CM-08(08)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

SYSTEM COMPONENT INVENTORY | AUTOMATED LOCATION TRACKING ASSESSMENT OBJECTIVE: Determine if:

CM-08(08)_ODP

automated mechanisms for tracking components are deﬁned;

CM-08(08)

<CM-08(08)_ODP automated mechanisms> are used to support the tracking of system components by geographic locaon.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

CM-08(09)

CM-08(08)-Examine

[SELECT FROM: Conﬁguraon management policy; procedures addressing system component inventory; conﬁguraon management plan; system design documentaon; system component inventory; system conﬁguraon sengs and associated documentaon; system audit records; system security plan; privacy plan; other relevant documents or records].

CM-08(08)-Interview

[SELECT FROM: Organizaonal personnel with component inventory management responsibilies; organizaonal personnel with informaon security and privacy responsibilies; system/network administrators; system developers].

CM-08(08)-Test

[SELECT FROM: Organizaonal processes for managing the system component inventory; automated mechanisms supporng and/or implemenng system component inventory; automated mechanisms supporng and/or implemenng tracking of components by geographic locaons].

SYSTEM COMPONENT INVENTORY | ASSIGNMENT OF COMPONENTS TO SYSTEMS ASSESSMENT OBJECTIVE: Determine if:

CM-08(09)_ODP

personnel or roles from which to receive an acknowledgement is/are deﬁned;

CM-08(09)(a)

system components are assigned to a system;

CM-08(09)(b)

an acknowledgement of the component assignment is received from <CM-08(09)_ODP personnel or roles>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

CM-08(09)-Examine

[SELECT FROM: Conﬁguraon management policy; procedures addressing system component inventory; conﬁguraon management plan; system security plan; system design documentaon; system component inventory; change control records; acknowledgements of system component assignments; system security plan; other relevant documents or records].

CM-08(09)-Interview

[SELECT FROM: Organizaonal personnel with component inventory management responsibilies; system owner; organizaonal personnel with informaon security responsibilies; system/network administrators].

CM-08(09)-Test

[SELECT FROM: Organizaonal processes for assigning components to systems; organizaonal processes for acknowledging assignment of components to systems; mechanisms implemenng assignment of components to the system; mechanisms implemenng acknowledgment of assignment of components to the system].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 207

NIST SP 800-53A, REV. 5

CM-09

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

CONFIGURATION MANAGEMENT PLAN ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

CM-09_ODP

personnel or roles to review and approve the conﬁguraon management plan is/ are deﬁned;

CM-09[01]

a conﬁguraon management plan for the system is developed and documented;

CM-09[02]

a conﬁguraon management plan for the system is implemented;

CM-09a.[01]

the conﬁguraon management plan addresses roles;

CM-09a.[02]

the conﬁguraon management plan addresses responsibilies;

CM-09a.[03]

the conﬁguraon management plan addresses conﬁguraon management processes and procedures;

CM-09b.[01]

the conﬁguraon management plan establishes a process for idenfying conﬁguraon items throughout the system development life cycle;

CM-09b.[02]

the conﬁguraon management plan establishes a process for managing the conﬁguraon of the conﬁguraon items;

CM-09c.[01]

the conﬁguraon management plan deﬁnes the conﬁguraon items for the system;

CM-09c.[02]

the conﬁguraon management plan places the conﬁguraon items under conﬁguraon management;

CM-09d.

the conﬁguraon management plan is reviewed and approved by <CM-09_ODP personnel or roles>;

CM-09e.[01]

the conﬁguraon management plan is protected from unauthorized disclosure;

CM-09e.[02]

the conﬁguraon management plan is protected from unauthorized modiﬁcaon.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

CM-09-Examine

[SELECT FROM: Conﬁguraon management policy; procedures addressing conﬁguraon management planning; conﬁguraon management plan; system design documentaon; system security plan; privacy plan; other relevant documents or records].

CM-09-Interview

[SELECT FROM: Organizaonal personnel with responsibilies for developing the conﬁguraon management plan; organizaonal personnel with responsibilies for implemenng and managing processes deﬁned in the conﬁguraon management plan; organizaonal personnel with responsibilies for protecng the conﬁguraon management plan; organizaonal personnel with informaon security and privacy responsibilies; system/network administrators].

CM-09-Test

[SELECT FROM: Organizaonal processes for developing and documenng the conﬁguraon management plan; organizaonal processes for idenfying and managing conﬁguraon items; organizaonal processes for protecng the conﬁguraon management plan; mechanisms implemenng the conﬁguraon management plan; mechanisms for managing conﬁguraon items; mechanisms for protecng the conﬁguraon management plan].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 208

NIST SP 800-53A, REV. 5

CM-09(01)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

CONFIGURATION MANAGEMENT PLAN | ASSIGNMENT OF RESPONSIBILITY ASSESSMENT OBJECTIVE: Determine if: CM-09(01)

the responsibility for developing the conﬁguraon management process is assigned to organizaonal personnel who are not directly involved in system development.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

CM-10

CM-09(01)-Examine

[SELECT FROM: Conﬁguraon management policy; procedures addressing responsibilies for conﬁguraon management process development; conﬁguraon management plan; system security plan; system security plan; other relevant documents or records].

CM-09(01)-Interview

[SELECT FROM: Organizaonal personnel with responsibilies for conﬁguraon management process development; organizaonal personnel with informaon security responsibilies].

SOFTWARE USAGE RESTRICTIONS ASSESSMENT OBJECTIVE: Determine if: CM-10a.

soware and associated documentaon are used in accordance with contract agreements and copyright laws;

CM-10b.

the use of soware and associated documentaon protected by quanty licenses is tracked to control copying and distribuon;

CM-10c.

the use of peer-to-peer ﬁle sharing technology is controlled and documented to ensure that peer-to-peer ﬁle sharing is not used for the unauthorized distribuon, display, performance, or reproducon of copyrighted work.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

CM-10-Examine

[SELECT FROM: Conﬁguraon management policy; soware usage restricons; soware contract agreements and copyright laws; site license documentaon; list of soware usage restricons; soware license tracking reports; conﬁguraon management plan; system security plan; system security plan; other relevant documents or records].

CM-10-Interview

[SELECT FROM: Organizaonal personnel operang, using, and/or maintaining the system; organizaonal personnel with soware license management responsibilies; organizaonal personnel with informaon security responsibilies; system/network administrators].

CM-10-Test

[SELECT FROM: Organizaonal processes for tracking the use of soware protected by quanty licenses; organizaonal processes for controlling/documenng the use of peer-to-peer ﬁle sharing technology; mechanisms implemenng soware license tracking; mechanisms implemenng and controlling the use of peer-to-peer ﬁles sharing technology].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 209

NIST SP 800-53A, REV. 5

CM-10(01)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

SOFTWARE USAGE RESTRICTIONS | OPEN-SOURCE SOFTWARE ASSESSMENT OBJECTIVE: Determine if:

CM-10(01)_ODP

restricons on the use of open-source soware are deﬁned;

CM-10(01)

<CM-10(01)_ODP restricons> are established for the use of open-source soware.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

CM-11

CM-10(01)-Examine

CM-10(01)-Interview

CM-10(01)-Test

USER-INSTALLED SOFTWARE ASSESSMENT OBJECTIVE: Determine if:

CM-11_ODP[01]

policies governing the installaon of soware by users are deﬁned;

CM-11_ODP[02]

methods used to enforce soware installaon policies are deﬁned;

CM-11_ODP[03]

frequency with which to monitor compliance is deﬁned;

CM-11a.

<CM-11_ODP[01] policies> governing the installaon of soware by users are established;

CM-11b.

soware installaon policies are enforced through <CM-11_ODP[02] methods>;

CM-11c.

compliance with <CM-11_ODP[01] policies> is monitored <CM-11_ODP[03] frequency>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: CM-11-Examine

CHAPTER FOUR

[SELECT FROM: Conﬁguraon management policy; procedures addressing user-installed soware; conﬁguraon management plan; system security plan; system design documentaon; system conﬁguraon sengs and associated documentaon; list of rules governing user installed soware; system monitoring records; system audit records; connuous monitoring strategy; system security plan; other relevant documents or records].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 210

NIST SP 800-53A, REV. 5

CM-11

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

CM-11(01)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

USER-INSTALLED SOFTWARE CM-11-Interview

[SELECT FROM: Organizaonal personnel with responsibilies for governing userinstalled soware; organizaonal personnel operang, using, and/or maintaining the system; organizaonal personnel monitoring compliance with user-installed soware policy; organizaonal personnel with informaon security responsibilies; system/network administrators].

CM-11-Test

[SELECT FROM: Organizaonal processes governing user-installed soware on the system; mechanisms enforcing policies and methods for governing the installaon of soware by users; mechanisms monitoring policy compliance].

USER-INSTALLED SOFTWARE | ALERTS FOR UNAUTHORIZED INSTALLATIONS [WITHDRAWN: Incorporated into CM-08(03).]

CM-11(02)

USER-INSTALLED SOFTWARE | SOFTWARE INSTALLATION WITH PRIVILEGED STATUS ASSESSMENT OBJECTIVE: Determine if: CM-11(02)

user installaon of soware is allowed only with explicit privileged status.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CM-11(03)

CM-11(02)-Examine

[SELECT FROM: Conﬁguraon management policy; procedures addressing user-installed soware; conﬁguraon management plan; system security plan; system design documentaon; system conﬁguraon sengs and associated documentaon; alerts/noﬁcaons of unauthorized soware installaons; system audit records; connuous monitoring strategy; system security plan; other relevant documents or records].

CM-11(02)-Interview

[SELECT FROM: Organizaonal personnel with responsibilies for governing userinstalled soware; organizaonal personnel operang, using, and/or maintaining the system; organizaonal personnel with informaon security responsibilies; system/network administrators].

CM-11(02)-Test

[SELECT FROM: Organizaonal processes governing user-installed soware on the system; mechanisms for prohibing installaon of soware without privileged status (e.g., access controls)].

USER-INSTALLED SOFTWARE | AUTOMATED ENFORCEMENT AND MONITORING ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

CM-11(03)_ODP[01]

automated mechanisms used to enforce compliance are deﬁned;

CM-11(03)_ODP[02]

automated mechanisms used to monitor compliance are deﬁned;

CM-11(03)[01]

compliance with soware installaon policies is enforced using <CM-11(03)_ODP[01] automated mechanisms>;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 211

NIST SP 800-53A, REV. 5

CM-11(03)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

USER-INSTALLED SOFTWARE | AUTOMATED ENFORCEMENT AND MONITORING CM-11(03)[02]

compliance with soware installaon policies is monitored using <CM-11(03)_ODP[02] automated mechanisms>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

CM-12

CM-11(03)-Examine

CM-11(03)-Interview

CM-11(03)-Test

[SELECT FROM: Organizaonal processes governing user-installed soware on the system; automated mechanisms enforcing policies on installaon of soware by users; automated mechanisms monitoring policy compliance].

INFORMATION LOCATION ASSESSMENT OBJECTIVE: Determine if: CM-12_ODP

informaon for which the locaon is to be idenﬁed and documented is deﬁned;

CM-12a.[01]

the locaon of <CM-12_ODP informaon> is idenﬁed and documented;

CM-12a.[02]

the speciﬁc system components on which <CM-12_ODP informaon> is processed are idenﬁed and documented;

CM-12a.[03]

the speciﬁc system components on which <CM-12_ODP informaon> is stored are idenﬁed and documented;

CM-12b.[01]

the users who have access to the system and system components where <CM-12_ODP informaon> is processed are idenﬁed and documented;

CM-12b.[02]

the users who have access to the system and system components where <CM-12_ODP informaon> is stored are idenﬁed and documented;

CM-12c.[01]

changes to the locaon (i.e., system or system components) where <CM-12_ODP informaon> is processed are documented;

CM-12c.[02]

changes to the locaon (i.e., system or system components) where <CM-12_ODP informaon> is stored are documented.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: CM-12-Examine

CHAPTER FOUR

[SELECT FROM: Conﬁguraon management policy; procedures addressing idenﬁcaon and documentaon of informaon locaon; conﬁguraon management plan; system design documentaon; system architecture documentaon; PII inventory documentaon; data mapping documentaon; audit records; list of users with system and system component access; change control records; system component inventory; system security plan; privacy plan; other relevant documents or records].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 212

NIST SP 800-53A, REV. 5

CM-12

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

CM-12(01)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

INFORMATION LOCATION CM-12-Interview

[SELECT FROM: Organizaonal personnel with responsibilies for managing informaon locaon and user access to informaon; organizaonal personnel with responsibilies for operang, using, and/or maintaining the system; organizaonal personnel with informaon security and privacy responsibilies; system/network administrators; system developers].

CM-12-Test

[SELECT FROM: Organizaonal processes governing informaon locaon; mechanisms enforcing policies and methods for governing informaon locaon].

INFORMATION LOCATION | AUTOMATED TOOLS TO SUPPORT INFORMATION LOCATION ASSESSMENT OBJECTIVE: Determine if:

CM-12(01)_ODP[01]

informaon to be protected is deﬁned by informaon type;

CM-12(01)_ODP[02]

system components where the informaon is located are deﬁned;

CM-12(01)

automated tools are used to idenfy <CM-12(01)_ODP[01] informaon by informaon type> on <CM-12(01)_ODP[02] system components> to ensure that controls are in place to protect organizaonal informaon and individual privacy.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CM-13

CM-12(01)-Examine

[SELECT FROM: Conﬁguraon management policy; procedures addressing idenﬁcaon and documentaon of informaon locaon; conﬁguraon management plan; system design documentaon; PII inventory documentaon; data mapping documentaon; change control records; system component inventory; system security plan; privacy plan; other relevant documents or records].

CM-12(01)-Interview

[SELECT FROM: Organizaonal personnel with responsibilies for managing informaon locaon; organizaonal personnel with informaon security responsibilies; system/network administrators; system developers].

CM-12(01)-Test

[SELECT FROM: Organizaonal processes governing informaon locaon; automated mechanisms enforcing policies and methods for governing informaon locaon; automated tools used to idenfy informaon on system components].

DATA ACTION MAPPING ASSESSMENT OBJECTIVE: Determine if: CM-13

a map of system data acons is developed and documented.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: CM-13-Examine

CHAPTER FOUR

[SELECT FROM: Conﬁguraon management policy; procedures for idenﬁcaon and documentaon of informaon locaon; procedures for mapping data acons; conﬁguraon management plan; system security plan; privacy plan; system design documentaon; PII inventory documentaon; data mapping documentaon; change control records; system component inventory; other relevant documents or records].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 213

NIST SP 800-53A, REV. 5

CM-13

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

CM-14

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

DATA ACTION MAPPING CM-13-Interview

[SELECT FROM: Organizaonal personnel with responsibilies for managing informaon locaon; organizaonal personnel responsible for data acon mapping; organizaonal personnel with informaon security and privacy responsibilies; system/network administrators; system developers].

CM-13-Test

[SELECT FROM: Organizaonal processes governing informaon locaon; mechanisms supporng or implemenng data acon mapping].

SIGNED COMPONENTS ASSESSMENT OBJECTIVE: Determine if:

CM-14_ODP[01]

soware components requiring veriﬁcaon of a digitally signed cerﬁcate before installaon are deﬁned;

CM-14_ODP[02]

ﬁrmware components requiring veriﬁcaon of a digitally signed cerﬁcate before installaon are deﬁned;

CM-14[01]

the installaon of <CM-14_ODP[01] soware components> is prevented unless it is veriﬁed that the soware has been digitally signed using a cerﬁcate recognized and approved by the organizaon;

CM-14[02]

the installaon of <CM-14_ODP[02] ﬁrmware components> is prevented unless it is veriﬁed that the ﬁrmware has been digitally signed using a cerﬁcate recognized and approved by the organizaon.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

CM-14-Examine

[SELECT FROM: Conﬁguraon management policy; procedures addressing digitally signed cerﬁcates for soware and ﬁrmware components; conﬁguraon management plan; system security plan; system design documentaon; change control records; system component inventory; system security plan; other relevant documents or records].

CM-14-Interview

[SELECT FROM: Organizaonal personnel with responsibilies for verifying digitally signed cerﬁcates for soware and ﬁrmware component installaon; organizaonal personnel with informaon security responsibilies; system/network administrators; system developers].

CM-14-Test

[SELECT FROM: Organizaonal processes governing informaon locaon; mechanisms enforcing policies and methods for governing informaon locaon; automated tools supporng or implemenng digitally signatures for soware and ﬁrmware components; automated tools supporng or implemenng veriﬁcaon of digital signatures for soware and ﬁrmware component installaon].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 214

NIST SP 800-53A, REV. 5

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

4.6 CONTINGENCY PLANNING CP-01

POLICY AND PROCEDURES ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5 CHAPTER FOUR

CP-01_ODP[01]

personnel or roles to whom the conngency planning policy is to be disseminated is/are deﬁned;

CP-01_ODP[02]

personnel or roles to whom the conngency planning procedures are to be disseminated is/are deﬁned;

CP-01_ODP[03]

one or more of the following PARAMETER VALUES is/are selected: {organizaonlevel; mission/business process-level; system-level};

CP-01_ODP[04]

an oﬃcial to manage the conngency planning policy and procedures is deﬁned;

CP-01_ODP[05]

the frequency at which the current conngency planning policy is reviewed and updated is deﬁned;

CP-01_ODP[06]

events that would require the current conngency planning policy to be reviewed and updated are deﬁned;

CP-01_ODP[07]

the frequency at which the current conngency planning procedures are reviewed and updated is deﬁned;

CP-01_ODP[08]

events that would require procedures to be reviewed and updated are deﬁned;

CP-01a.[01]

a conngency planning policy is developed and documented;

CP-01a.[02]

the conngency planning policy is disseminated to <CP-01_ODP[01] personnel or roles>;

CP-01a.[03]

conngency planning procedures to facilitate the implementaon of the conngency planning policy and associated conngency planning controls are developed and documented;

CP-01a.[04]

the conngency planning procedures are disseminated to <CP-01_ODP[02] personnel or roles>;

CP-01a.01(a)[01]

the <CP-01_ODP[03] SELECTED PARAMETER VALUE(S)> conngency planning policy addresses purpose;

CP-01a.01(a)[02]

the <CP-01_ODP[03] SELECTED PARAMETER VALUE(S)> conngency planning policy addresses scope;

CP-01a.01(a)[03]

the <CP-01_ODP[03] SELECTED PARAMETER VALUE(S)> conngency planning policy addresses roles;

CP-01a.01(a)[04]

the <CP-01_ODP[03] SELECTED PARAMETER VALUE(S)> conngency planning policy addresses responsibilies;

CP-01a.01(a)[05]

the <CP-01_ODP[03] SELECTED PARAMETER VALUE(S)> conngency planning policy addresses management commitment;

CP-01a.01(a)[06]

the <CP-01_ODP[03] SELECTED PARAMETER VALUE(S)> conngency planning policy addresses coordinaon among organizaonal enes;

CP-01a.01(a)[07]

the <CP-01_ODP[03] SELECTED PARAMETER VALUE(S)> conngency planning policy addresses compliance;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 215

NIST SP 800-53A, REV. 5

CP-01

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

POLICY AND PROCEDURES

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

CP-01a.01(b)

the <CP-01_ODP[03] SELECTED PARAMETER VALUE(S)> conngency planning policy is consistent with applicable laws, Execuve Orders, direcves, regulaons, policies, standards, and guidelines;

CP-01b.

the <CP-01_ODP[04] oﬃcial> is designated to manage the development, documentaon, and disseminaon of the conngency planning policy and procedures;

CP-01c.01[01]

the current conngency planning policy is reviewed and updated <CP-01_ODP[05] frequency>;

CP-01c.01[02]

the current conngency planning policy is reviewed and updated following <CP-01_ODP[06] events>;

CP-01c.02[01]

the current conngency planning procedures are reviewed and updated <CP-01_ODP[07] frequency>;

CP-01c.02[02]

the current conngency planning procedures are reviewed and updated following <CP-01_ODP[08] events>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CP-02

CP-01-Examine

[SELECT FROM: Conngency planning policy and procedures; system security plan; privacy plan; other relevant documents or records].

CP-01-Interview

[SELECT FROM: Organizaonal personnel with conngency planning responsibilies; organizaonal personnel with informaon security and privacy responsibilies].

CONTINGENCY PLAN ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

CP-02_ODP[01]

personnel or roles to review a conngency plan is/are deﬁned;

CP-02_ODP[02]

personnel or roles to approve a conngency plan is/are deﬁned;

CP-02_ODP[03]

key conngency personnel (idenﬁed by name and/or by role) to whom copies of the conngency plan are distributed are deﬁned;

CP-02_ODP[04]

key conngency organizaonal elements to which copies of the conngency plan are distributed are deﬁned;

CP-02_ODP[05]

frequency of conngency plan review is deﬁned;

CP-02_ODP[06]

key conngency personnel (idenﬁed by name and/or by role) to communicate changes to are deﬁned;

CP-02_ODP[07]

key conngency organizaonal elements to communicate changes to are deﬁned;

CP-02a.01

a conngency plan for the system is developed that idenﬁes essenal mission and business funcons and associated conngency requirements;

CP-02a.02[01]

a conngency plan for the system is developed that provides recovery objecves;

CP-02a.02[02]

a conngency plan for the system is developed that provides restoraon priories;

CP-02a.02[03]

a conngency plan for the system is developed that provides metrics;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 216

NIST SP 800-53A, REV. 5

CP-02

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

CONTINGENCY PLAN

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

CP-02a.03[01]

a conngency plan for the system is developed that addresses conngency roles;

CP-02a.03[02]

a conngency plan for the system is developed that addresses conngency responsibilies;

CP-02a.03[03]

a conngency plan for the system is developed that addresses assigned individuals with contact informaon;

CP-02a.04

a conngency plan for the system is developed that addresses maintaining essenal mission and business funcons despite a system disrupon, compromise, or failure;

CP-02a.05

a conngency plan for the system is developed that addresses eventual, fullsystem restoraon without deterioraon of the controls originally planned and implemented;

CP-02a.06

a conngency plan for the system is developed that addresses the sharing of conngency informaon;

CP-02a.07[01]

a conngency plan for the system is developed that is reviewed by <CP-02_ODP[01] personnel or roles>;

CP-02a.07[02]

a conngency plan for the system is developed that is approved by <CP-02_ODP[02] personnel or roles>;

CP-02b.[01]

copies of the conngency plan are distributed to <CP-02_ODP[03] key conngency personnel>;

CP-02b.[02]

copies of the conngency plan are distributed to <CP-02_ODP[04] organizaonal elements>;

CP-02c.

conngency planning acvies are coordinated with incident handling acvies;

CP-02d.

the conngency plan for the system is reviewed <CP-02_ODP[05] frequency>;

CP-02e.[01]

the conngency plan is updated to address changes to the organizaon, system, or environment of operaon;

CP-02e.[02]

the conngency plan is updated to address problems encountered during conngency plan implementaon, execuon, or tesng;

CP-02f.[01]

conngency plan changes are communicated to <CP-02_ODP[06] key conngency personnel>;

CP-02f.[02]

conngency plan changes are communicated to <CP-02_ODP[07] organizaonal elements>;

CP-02g.[01]

lessons learned from conngency plan tesng or actual conngency acvies are incorporated into conngency tesng;

CP-02g.[02]

lessons learned from conngency plan training or actual conngency acvies are incorporated into conngency tesng and training;

CP-02h.[01]

the conngency plan is protected from unauthorized disclosure;

CP-02h.[02]

the conngency plan is protected from unauthorized modiﬁcaon.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: CP-02-Examine

CHAPTER FOUR

[SELECT FROM: Conngency planning policy; procedures addressing conngency operaons for the system; conngency plan; evidence of conngency plan reviews and updates; system security plan; other relevant documents or records].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 217

NIST SP 800-53A, REV. 5

CP-02

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

CP-02(01)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

CONTINGENCY PLAN CP-02-Interview

[SELECT FROM: Organizaonal personnel with conngency planning and plan implementaon responsibilies; organizaonal personnel with incident handling responsibilies; organizaonal personnel with knowledge of requirements for mission and business funcons; organizaonal personnel with informaon security responsibilies].

CP-02-Test

[SELECT FROM: Organizaonal processes for conngency plan development, review, update, and protecon; mechanisms for developing, reviewing, updang, and/or protecng the conngency plan].

CONTINGENCY PLAN | COORDINATE WITH RELATED PLANS ASSESSMENT OBJECTIVE: Determine if: CP-02(01)

conngency plan development is coordinated with organizaonal elements responsible for related plans.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CP-02(02)

CP-02(01)-Examine

[SELECT FROM: Conngency planning policy; procedures addressing conngency operaons for the system; conngency plan; business conngency plans; disaster recovery plans; connuity of operaons plans; crisis communicaons plans; crical infrastructure plans; cyber incident response plan; insider threat implementaon plans; occupant emergency plans; system security plan; other relevant documents or records].

CP-02(01)-Interview

[SELECT FROM: Organizaonal personnel with conngency planning and plan implementaon responsibilies; organizaonal personnel with informaon security responsibilies; personnel with responsibility for related plans].

CONTINGENCY PLAN | CAPACITY PLANNING ASSESSMENT OBJECTIVE: Determine if:

CP-02(02)[01]

capacity planning is conducted so that the necessary capacity exists during conngency operaons for informaon processing;

CP-02(02)[02]

capacity planning is conducted so that the necessary capacity exists during conngency operaons for telecommunicaons;

CP-02(02)[03]

capacity planning is conducted so that the necessary capacity exists during conngency operaons for environmental support.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: CP-02(02)-Examine

CHAPTER FOUR

[SELECT FROM: Conngency planning policy; procedures addressing conngency operaons for the system; conngency plan; capacity planning documents; system security plan; other relevant documents or records].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 218

NIST SP 800-53A, REV. 5

CP-02(02)

CONTINGENCY PLAN | CAPACITY PLANNING CP-02(02)-Interview

CP-02(03)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

[SELECT FROM: Organizaonal personnel with conngency planning and plan implementaon responsibilies; organizaonal personnel responsible for capacity planning; organizaonal personnel with informaon security responsibilies].

CONTINGENCY PLAN | RESUME MISSION AND BUSINESS FUNCTIONS ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

CP-02(03)_ODP[01]

one of the following PARAMETER VALUES is selected: {all; essenal};

CP-02(03)_ODP[02]

the conngency plan acvaon me period within which to resume mission and business funcons is deﬁned;

CP-02(03)

the resumpon of <CP-02(03)_ODP[01] SELECTED PARAMETER VALUE> mission and business funcons are planned for within <CP-02(03)_ODP[02] me period> of conngency plan acvaon.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CP-02(04)

CP-02(03)-Examine

[SELECT FROM: Conngency planning policy; procedures addressing conngency operaons for the system; conngency plan; business impact assessment; system security plan; privacy plan; other related plans; system security plan; other relevant documents or records].

CP-02(03)-Interview

[SELECT FROM: Organizaonal personnel with conngency planning and plan implementaon responsibilies; organizaonal personnel with informaon security and privacy responsibilies; organizaonal personnel with knowledge of requirements for mission and business funcons].

CP-02(03)-Test

[SELECT FROM: Organizaonal processes for resumpon of missions and business funcons].

CONTINGENCY PLAN | RESUME ALL MISSION AND BUSINESS FUNCTIONS [WITHDRAWN: Incorporated into CP-02(03).]

CP-02(05)

CONTINGENCY PLAN | CONTINUE MISSION AND BUSINESS FUNCTIONS ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

CP-02(05)_ODP

one of the following PARAMETER VALUES is selected: {all; essenal};

CP-02(05)[01]

the connuance of <CP-02(05)_ODP SELECTED PARAMETER VALUE> mission and business funcons with minimal or no loss of operaonal connuity is planned for;

CP-02(05)[02]

connuity is sustained unl full system restoraon at primary processing and/or storage sites.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 219

NIST SP 800-53A, REV. 5

CP-02(05)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

CONTINGENCY PLAN | CONTINUE MISSION AND BUSINESS FUNCTIONS POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

CP-02(06)

CP-02(05)-Examine

[SELECT FROM: Conngency planning policy; procedures addressing conngency operaons for the system; conngency plan; business impact assessment; primary processing site agreements; primary storage site agreements; alternate processing site agreements; alternate storage site agreements; conngency plan test documentaon; conngency plan test results; system security plan; other relevant documents or records].

CP-02(05)-Interview

[SELECT FROM: Organizaonal personnel with conngency planning and plan implementaon responsibilies; organizaonal personnel with knowledge of requirements for mission and business funcons; organizaonal personnel with informaon security responsibilies].

CP-02(05)-Test

[SELECT FROM: Organizaonal processes for connuing missions and business funcons].

CONTINGENCY PLAN | ALTERNATE PROCESSING AND STORAGE SITES ASSESSMENT OBJECTIVE: Determine if:

CP-02(06)_ODP

one of the following PARAMETER VALUES is selected: {all; essenal};

CP-02(06)[01]

the transfer of <CP-02(06)_ODP SELECTED PARAMETER VALUE> mission and business funcons to alternate processing and/or storage sites with minimal or no loss of operaonal connuity is planned for;

CP-02(06)[02]

operaonal connuity is sustained unl full system restoraon at primary processing and/or storage sites.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CP-02(07)

CP-02(06)-Examine

[SELECT FROM: Conngency planning policy; procedures addressing conngency operaons for the system; conngency plan; business impact assessment; alternate processing site agreements; alternate storage site agreements; conngency plan tesng documentaon; conngency plan test results; system security plan; other relevant documents or records].

CP-02(06)-Interview

CP-02(06)-Test

[SELECT FROM: Organizaonal processes for transfer of essenal mission and business funcons to alternate processing/storage sites].

CONTINGENCY PLAN | COORDINATE WITH EXTERNAL SERVICE PROVIDERS ASSESSMENT OBJECTIVE: Determine if: CP-02(07)

CHAPTER FOUR

the conngency plan is coordinated with the conngency plans of external service providers to ensure that conngency requirements can be sasﬁed.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 220

NIST SP 800-53A, REV. 5

CP-02(07)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

CONTINGENCY PLAN | COORDINATE WITH EXTERNAL SERVICE PROVIDERS POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

CP-02(08)

CP-02(07)-Examine

[SELECT FROM: Conngency planning policy; procedures addressing conngency operaons for the system; conngency plan; conngency plans of external; service providers; service level agreements; conngency plan requirements; system security plan; other relevant documents or records].

CP-02(07)-Interview

[SELECT FROM: Organizaonal personnel with conngency planning and plan implementaon responsibilies; external service providers; organizaonal personnel with informaon security responsibilies].

CONTINGENCY PLAN | IDENTIFY CRITICAL ASSETS ASSESSMENT OBJECTIVE: Determine if:

CP-02(08)_ODP

one of the following PARAMETER VALUES is selected: {all; essenal};

CP-02(08)

crical system assets supporng <CP-02(08)_ODP SELECTED PARAMETER VALUE> mission and business funcons are idenﬁed.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CP-03

CP-02(08)-Examine

[SELECT FROM: Conngency planning policy; procedures addressing conngency operaons for the system; conngency plan; business impact assessment; system security plan; other relevant documents or records].

CP-02(08)-Interview

CONTINGENCY TRAINING ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

CP-03_ODP[01]

the me period within which to provide conngency training aer assuming a conngency role or responsibility is deﬁned;

CP-03_ODP[02]

frequency at which to provide training to system users with a conngency role or responsibility is deﬁned;

CP-03_ODP[03]

frequency at which to review and update conngency training content is deﬁned;

CP-03_ODP[04]

events necessitang review and update of conngency training are deﬁned;

CP-03a.01

conngency training is provided to system users consistent with assigned roles and responsibilies within <CP-03_ODP[01] me period> of assuming a conngency role or responsibility;

CP-03a.02

conngency training is provided to system users consistent with assigned roles and responsibilies when required by system changes;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 221

NIST SP 800-53A, REV. 5

CP-03

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

CONTINGENCY TRAINING CP-03a.03

conngency training is provided to system users consistent with assigned roles and responsibilies <CP-03_ODP[02] frequency> thereaer;

CP-03b.[01]

the conngency plan training content is reviewed and updated <CP-03_ODP[03] frequency>;

CP-03b.[02]

the conngency plan training content is reviewed and updated following <CP-03_ODP[04] events>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

CP-03(01)

CP-03-Examine

[SELECT FROM: Conngency planning policy; procedures addressing conngency training; conngency plan; conngency training curriculum; conngency training material; conngency training records; system security plan; other relevant documents or records].

CP-03-Interview

[SELECT FROM: Organizaonal personnel with conngency planning, plan implementaon, and training responsibilies; organizaonal personnel with informaon security responsibilies].

CP-03-Test

[SELECT FROM: Organizaonal processes for conngency training].

CONTINGENCY TRAINING | SIMULATED EVENTS ASSESSMENT OBJECTIVE: Determine if: CP-03(01)

simulated events are incorporated into conngency training to facilitate eﬀecve response by personnel in crisis situaons.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CP-03(02)

CP-03(01)-Examine

[SELECT FROM: Conngency planning policy; procedures addressing conngency training; conngency plan; conngency training curriculum; conngency training material; system security plan; other relevant documents or records].

CP-03(01)-Interview

[SELECT FROM: Organizaonal personnel with conngency planning, plan implementaon, and training responsibilies; organizaonal personnel with informaon security responsibilies].

CP-03(01)-Test

[SELECT FROM: Organizaonal processes for conngency training; mechanisms for simulang conngency events].

CONTINGENCY TRAINING | MECHANISMS USED IN TRAINING ENVIRONMENTS ASSESSMENT OBJECTIVE: Determine if: CP-03(02)

CHAPTER FOUR

mechanisms used in operaons are employed to provide a more thorough and realisc conngency training environment.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 222

NIST SP 800-53A, REV. 5

CP-03(02)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

CONTINGENCY TRAINING | MECHANISMS USED IN TRAINING ENVIRONMENTS POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

CP-04

CP-03(02)-Examine

CP-03(02)-Interview

[SELECT FROM: Organizaonal personnel with conngency planning, plan implementaon, and training responsibilies; organizaonal personnel with informaon security responsibilies].

CP-03(02)-Test

[SELECT FROM: Organizaonal processes for conngency training; mechanisms for providing conngency training environments].

CONTINGENCY PLAN TESTING ASSESSMENT OBJECTIVE: Determine if:

CP-04_ODP[01]

frequency of tesng the conngency plan for the system is deﬁned;

CP-04_ODP[02]

tests for determining the eﬀecveness of the conngency plan are deﬁned;

CP-04_ODP[03]

tests for determining readiness to execute the conngency plan are deﬁned;

CP-04a.[01]

the conngency plan for the system is tested <CP-04_ODP[01] frequency>;

CP-04a.[02]

<CP-04_ODP[02] tests> are used to determine the eﬀecveness of the plan;

CP-04a.[03]

<CP-04_ODP[03] tests> are used to determine the readiness to execute the plan;

CP-04b.

the conngency plan test results are reviewed;

CP-04c.

correcve acons are iniated, if needed.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CP-04(01)

CP-04-Examine

[SELECT FROM: Conngency planning policy; procedures addressing conngency plan tesng; conngency plan; conngency plan test documentaon; conngency plan test results; system security plan; other relevant documents or records].

CP-04-Interview

[SELECT FROM: Organizaonal personnel with responsibilies for conngency plan tesng, reviewing, or responding to conngency plan tests; organizaonal personnel with informaon security responsibilies].

CP-04-Test

[SELECT FROM: Organizaonal processes for conngency plan tesng; mechanisms supporng the conngency plan and/or conngency plan tesng].

CONTINGENCY PLAN TESTING | COORDINATE WITH RELATED PLANS ASSESSMENT OBJECTIVE: Determine if: CP-04(01)

CHAPTER FOUR

conngency plan tesng is coordinated with organizaonal elements responsible for related plans.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 223

NIST SP 800-53A, REV. 5

CP-04(01)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

CONTINGENCY PLAN TESTING | COORDINATE WITH RELATED PLANS POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

CP-04(02)

CP-04(01)-Examine

[SELECT FROM: Conngency planning policy; incident response policy; procedures addressing conngency plan tesng; conngency plan tesng documentaon; conngency plan; business connuity plans; disaster recovery plans; connuity of operaons plans; crisis communicaons plans; crical infrastructure plans; cyber incident response plans; occupant emergency plans; system security plan; other relevant documents or records].

CP-04(01)-Interview

[SELECT FROM: Organizaonal personnel with conngency plan tesng responsibilies; personnel with responsibilies for related plans; organizaonal personnel with informaon security responsibilies].

CONTINGENCY PLAN TESTING | ALTERNATE PROCESSING SITE ASSESSMENT OBJECTIVE: Determine if: CP-04(02)(a)

the conngency plan is tested at the alternate processing site to familiarize conngency personnel with the facility and available resources;

CP-04(02)(b)

the conngency plan is tested at the alternate processing site to evaluate the capabilies of the alternate processing site to support conngency operaons.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CP-04(03)

CP-04(02)-Examine

[SELECT FROM: Conngency planning policy; procedures addressing conngency plan tesng; conngency plan; conngency plan test documentaon; conngency plan test results; alternate processing site agreements; service-level agreements; system security plan; other relevant documents or records].

CP-04(02)-Interview

[SELECT FROM: Organizaonal personnel with conngency planning and plan implementaon responsibilies; organizaonal personnel with informaon security responsibilies].

CP-04(02)-Test

[SELECT FROM: Organizaonal processes for conngency plan tesng; mechanisms supporng the conngency plan and/or conngency plan tesng].

CONTINGENCY PLAN TESTING | AUTOMATED TESTING ASSESSMENT OBJECTIVE: Determine if:

CP-04(03)_ODP

automated mechanisms for conngency plan tesng are deﬁned;

CP-04(03)

the conngency plan is tested using <CP-04(03)_ODP automated mechanisms>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: CP-04(03)-Examine

CHAPTER FOUR

[SELECT FROM: Conngency planning policy; procedures addressing conngency plan tesng; conngency plan; automated mechanisms supporng conngency plan tesng; conngency plan test documentaon; conngency plan test results; system security plan; other relevant documents or records].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 224

NIST SP 800-53A, REV. 5

CP-04(03)

CP-04(04)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

CONTINGENCY PLAN TESTING | AUTOMATED TESTING CP-04(03)-Interview

[SELECT FROM: Organizaonal personnel with conngency plan tesng responsibilies; organizaonal personnel with informaon security responsibilies].

CP-04(03)-Test

[SELECT FROM: Organizaonal processes for conngency plan tesng; automated mechanisms supporng conngency plan tesng].

CONTINGENCY PLAN TESTING | FULL RECOVERY AND RECONSTITUTION

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

ASSESSMENT OBJECTIVE: Determine if:

CP-04(04)[01]

a full recovery of the system to a known state is included as part of conngency plan tesng;

CP-04(04)[02]

a full reconstuon of the system to a known state is included as part of conngency plan tesng.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CP-04(05)

CP-04(04)-Examine

[SELECT FROM: Conngency planning policy; procedures addressing system recovery and reconstuon; conngency plan; conngency plan test documentaon; conngency plan test results; system security plan; other relevant documents or records].

CP-04(04)-Interview

[SELECT FROM: Organizaonal personnel with conngency plan tesng responsibilies; organizaonal personnel with system recovery and reconstuon responsibilies; organizaonal personnel with informaon security responsibilies].

CP-04(04)-Test

[SELECT FROM: Organizaonal processes for conngency plan tesng; mechanisms supporng conngency plan tesng; mechanisms supporng recovery and reconstuon of the system].

CONTINGENCY PLAN TESTING | SELF-CHALLENGE ASSESSMENT OBJECTIVE: Determine if:

CP-04(05)_ODP[01]

mechanisms employed to disrupt and adversely aﬀect the system or system component are deﬁned;

CP-04(05)_ODP[02]

system or system component on which to apply disrupon mechanisms are deﬁned;

CP-04(05)

<CP-04(05)_ODP[01] mechanisms> are employed to disrupt and adversely aﬀect the <CP-04(05)_ODP[02] system or system component>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: CP-04(05)-Examine

CHAPTER FOUR

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 225

NIST SP 800-53A, REV. 5

CP-04(05)

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

CP-05

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

CONTINGENCY PLAN TESTING | SELF-CHALLENGE CP-04(05)-Interview

CP-04(05)-Test

[SELECT FROM: Organizaonal processes for conngency plan tesng; mechanisms supporng conngency plan tesng].

CONTINGENCY PLAN UPDATE [WITHDRAWN: Incorporated into CP-02.]

CP-06

ALTERNATE STORAGE SITE ASSESSMENT OBJECTIVE: Determine if: CP-06a.[01]

an alternate storage site is established;

CP-06a.[02]

establishment of the alternate storage site includes necessary agreements to permit the storage and retrieval of system backup informaon;

CP-06b.

the alternate storage site provides controls equivalent to that of the primary site.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CP-06(01)

CP-06-Examine

[SELECT FROM: Conngency planning policy; procedures addressing alternate storage sites; conngency plan; alternate storage site agreements; primary storage site agreements; system security plan; other relevant documents or records].

CP-06-Interview

[SELECT FROM: Organizaonal personnel with conngency plan alternate storage site responsibilies; organizaonal personnel with system recovery responsibilies; organizaonal personnel with informaon security responsibilies].

CP-06-Test

[SELECT FROM: Organizaonal processes for storing and retrieving system backup informaon at the alternate storage site; mechanisms supporng and/ or implemenng the storage and retrieval of system backup informaon at the alternate storage site].

ALTERNATE STORAGE SITE | SEPARATION FROM PRIMARY SITE ASSESSMENT OBJECTIVE: Determine if: CP-06(01)

CHAPTER FOUR

an alternate storage site that is suﬃciently separated from the primary storage site is idenﬁed to reduce suscepbility to the same threats.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 226

NIST SP 800-53A, REV. 5

CP-06(01)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

ALTERNATE STORAGE SITE | SEPARATION FROM PRIMARY SITE POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

CP-06(02)

CP-06(01)-Examine

[SELECT FROM: Conngency planning policy; procedures addressing alternate storage sites; conngency plan; alternate storage site; alternate storage site agreements; primary storage site agreements; system security plan; other relevant documents or records].

CP-06(01)-Interview

ALTERNATE STORAGE SITE | RECOVERY TIME AND RECOVERY POINT OBJECTIVES ASSESSMENT OBJECTIVE: Determine if:

CP-06(02)[01]

the alternate storage site is conﬁgured to facilitate recovery operaons in accordance with recovery me objecves;

CP-06(02)[02]

the alternate storage site is conﬁgured to facilitate recovery operaons in accordance with recovery point objecves.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CP-06(03)

CP-06(02)-Examine

[SELECT FROM: Conngency planning policy; procedures addressing alternate storage sites; conngency plan; alternate storage site; alternate storage site agreements; alternate storage site conﬁguraons; system security plan; other relevant documents or records].

CP-06(02)-Interview

[SELECT FROM: Organizaonal personnel with conngency plan tesng responsibilies; organizaonal personnel with responsibilies for tesng related plans; organizaonal personnel with informaon security responsibilies].

CP-06(02)-Test

[SELECT FROM: Organizaonal processes for conngency plan tesng; mechanisms supporng recovery me and point objecves].

ALTERNATE STORAGE SITE | ACCESSIBILITY ASSESSMENT OBJECTIVE: Determine if:

CP-06(03)[01]

potenal accessibility problems to the alternate storage site in the event of an area-wide disrupon or disaster are idenﬁed;

CP-06(03)[02]

explicit migaon acons to address idenﬁed accessibility problems are outlined.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: CP-06(03)-Examine

CHAPTER FOUR

[SELECT FROM: Conngency planning policy; procedures addressing alternate storage sites; conngency plan; alternate storage site; list of potenal accessibility problems to alternate storage site; migaon acons for accessibility problems to alternate storage site; organizaonal risk assessments; system security plan; other relevant documents or records].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 227

NIST SP 800-53A, REV. 5

CP-06(03)

ALTERNATE STORAGE SITE | ACCESSIBILITY CP-06(03)-Interview

CP-07

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

ALTERNATE PROCESSING SITE ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

CP-07_ODP[01]

system operaons for essenal mission and business funcons are deﬁned;

CP-07_ODP[02]

me period consistent with recovery me and recovery point objecves is deﬁned;

CP-07a.

an alternate processing site, including necessary agreements to permit the transfer and resumpon of <CP-07_ODP[01] system operaons> for essenal mission and business funcons, is established within <CP-07_ODP[02] me period> when the primary processing capabilies are unavailable;

CP-07b.[01]

the equipment and supplies required to transfer operaons are made available at the alternate processing site or if contracts are in place to support delivery to the site within <CP-07_ODP[02] me period> for transfer;

CP-07b.[02]

the equipment and supplies required to resume operaons are made available at the alternate processing site or if contracts are in place to support delivery to the site within <CP-07_ODP[02] me period> for resumpon;

CP-07c.

controls provided at the alternate processing site are equivalent to those at the primary site.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CP-07(01)

CP-07-Examine

[SELECT FROM: Conngency planning policy; procedures addressing alternate processing sites; conngency plan; alternate processing site agreements; primary processing site agreements; spare equipment and supplies inventory at alternate processing site; equipment and supply contracts; service-level agreements; system security plan; other relevant documents or records].

CP-07-Interview

[SELECT FROM: Organizaonal personnel with responsibilies for conngency planning and/or alternate site arrangements; organizaonal personnel with informaon security responsibilies].

CP-07-Test

[SELECT FROM: Organizaonal processes for recovery at the alternate site; mechanisms supporng and/or implemenng recovery at the alternate processing site].

ALTERNATE PROCESSING SITE | SEPARATION FROM PRIMARY SITE ASSESSMENT OBJECTIVE: Determine if: CP-07(01)

CHAPTER FOUR

an alternate processing site that is suﬃciently separated from the primary processing site to reduce suscepbility to the same threats is idenﬁed.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 228

NIST SP 800-53A, REV. 5

CP-07(01)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

ALTERNATE PROCESSING SITE | SEPARATION FROM PRIMARY SITE POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

CP-07(02)

CP-07(01)-Examine

[SELECT FROM: Conngency planning policy; procedures addressing alternate processing sites; conngency plan; alternate processing site; alternate processing site agreements; primary processing site agreements; system security plan; other relevant documents or records].

CP-07(01)-Interview

[SELECT FROM: Organizaonal personnel with conngency plan alternate processing site responsibilies; organizaonal personnel with system recovery responsibilies; organizaonal personnel with informaon security responsibilies].

ALTERNATE PROCESSING SITE | ACCESSIBILITY ASSESSMENT OBJECTIVE: Determine if:

CP-07(02)[01]

potenal accessibility problems to alternate processing sites in the event of an area-wide disrupon or disaster are idenﬁed;

CP-07(02)[02]

explicit migaon acons to address idenﬁed accessibility problems are outlined.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CP-07(03)

CP-07(02)-Examine

CP-07(02)-Interview

ALTERNATE PROCESSING SITE | PRIORITY OF SERVICE ASSESSMENT OBJECTIVE: Determine if: CP-07(03)

alternate processing site agreements that contain priority-of-service provisions in accordance with availability requirements (including recovery me objecves) are developed.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: CP-07(03)-Examine

CHAPTER FOUR

[SELECT FROM: Conngency planning policy; procedures addressing alternate processing sites; conngency plan; alternate processing site agreements; servicelevel agreements; system security plan; other relevant documents or records].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 229

NIST SP 800-53A, REV. 5

CP-07(03)

ALTERNATE PROCESSING SITE | PRIORITY OF SERVICE CP-07(03)-Interview

CP-07(04)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

ALTERNATE PROCESSING SITE | PREPARATION FOR USE

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

ASSESSMENT OBJECTIVE: Determine if: CP-07(04)

the alternate processing site is prepared so that the site can serve as the operaonal site supporng essenal mission and business funcons.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CP-07(05)

CP-07(04)-Examine

[SELECT FROM: Conngency planning policy; procedures addressing alternate processing sites; conngency plan; alternate processing site; alternate processing site agreements; alternate processing site conﬁguraons; system security plan; other relevant documents or records].

CP-07(04)-Interview

CP-07(04)-Test

[SELECT FROM: Mechanisms supporng and/or implemenng recovery at the alternate processing site].

ALTERNATE PROCESSING SITE | EQUIVALENT INFORMATION SECURITY SAFEGUARDS [WITHDRAWN: Incorporated into CP-07.]

CP-07(06)

ALTERNATE PROCESSING SITE | INABILITY TO RETURN TO PRIMARY SITE ASSESSMENT OBJECTIVE: Determine if:

CP-07(06)[01]

circumstances that preclude returning to the primary processing site are planned for;

CP-07(06)[02]

circumstances that preclude returning to the primary processing site are prepared for.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: CP-07(06)-Examine

CHAPTER FOUR

[SELECT FROM: Conngency planning policy; procedures addressing alternate processing sites; conngency plan; alternate processing site; alternate processing site agreements; alternate processing site conﬁguraons; system security plan; other relevant documents or records].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 230

NIST SP 800-53A, REV. 5

CP-07(06)

ALTERNATE PROCESSING SITE | INABILITY TO RETURN TO PRIMARY SITE CP-07(06)-Interview

CP-08

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

[SELECT FROM: Organizaonal personnel with system reconstuon responsibilies; organizaonal personnel with informaon security responsibilies].

TELECOMMUNICATIONS SERVICES ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

CP-08_ODP[01]

system operaons to be resumed for essenal mission and business funcons are deﬁned;

CP-08_ODP[02]

me period within which to resume essenal mission and business funcons when the primary telecommunicaons capabilies are unavailable is deﬁned;

CP-08

alternate telecommunicaons services, including necessary agreements to permit the resumpon of <CP-08_ODP[01] system operaons> , are established for essenal mission and business funcons within <CP-08_ODP[02] me period> when the primary telecommunicaons capabilies are unavailable at either the primary or alternate processing or storage sites.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CP-08(01)

CP-08-Examine

[SELECT FROM: Conngency planning policy; procedures addressing alternate telecommunicaons services; conngency plan; primary and alternate telecommunicaons service agreements; system security plan; other relevant documents or records].

CP-08-Interview

[SELECT FROM: Organizaonal personnel with conngency plan telecommunicaons responsibilies; organizaonal personnel with system recovery responsibilies; organizaonal personnel with knowledge of requirements for mission and business funcons; organizaonal personnel with informaon security responsibilies; organizaonal personnel with responsibility for acquisions/ contractual agreements].

CP-08-Test

[SELECT FROM: Mechanisms supporng telecommunicaons].

TELECOMMUNICATIONS SERVICES | PRIORITY OF SERVICE PROVISIONS ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

CP-08(01)(a)[01]

primary telecommunicaons service agreements that contain priority-of-service provisions in accordance with availability requirements (including recovery me objecves) are developed;

CP-08(01)(a)[02]

alternate telecommunicaons service agreements that contain priority-of-service provisions in accordance with availability requirements (including recovery me objecves) are developed;

CP-08(01)(b)

Telecommunicaons Service Priority is requested for all telecommunicaons services used for naonal security emergency preparedness if the primary and/or alternate telecommunicaons services are provided by a common carrier.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 231

NIST SP 800-53A, REV. 5

CP-08(01)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

TELECOMMUNICATIONS SERVICES | PRIORITY OF SERVICE PROVISIONS POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

CP-08(02)

CP-08(01)-Examine

[SELECT FROM: Conngency planning policy; procedures addressing primary and alternate telecommunicaons services; conngency plan; primary and alternate telecommunicaons service agreements; Telecommunicaons Service Priority documentaon; system security plan; other relevant documents or records].

CP-08(01)-Interview

[SELECT FROM: Organizaonal personnel with conngency plan telecommunicaons responsibilies; organizaonal personnel with system recovery responsibilies; organizaonal personnel with informaon security responsibilies; organizaonal personnel with responsibility for acquisions/ contractual agreements].

CP-08(01)-Test

[SELECT FROM: Mechanisms supporng telecommunicaons].

TELECOMMUNICATIONS SERVICES | SINGLE POINTS OF FAILURE ASSESSMENT OBJECTIVE: Determine if: CP-08(02)

alternate telecommunicaons services to reduce the likelihood of sharing a single point of failure with primary telecommunicaons services are obtained.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CP-08(03)

CP-08(02)-Examine

[SELECT FROM: Conngency planning policy; procedures addressing primary and alternate telecommunicaons services; conngency plan; primary and alternate telecommunicaons service agreements; system security plan; other relevant documents or records].

CP-08(02)-Interview

[SELECT FROM: Organizaonal personnel with conngency plan telecommunicaons responsibilies; organizaonal personnel with system recovery responsibilies; primary and alternate telecommunicaons service providers; organizaonal personnel with informaon security responsibilies].

TELECOMMUNICATIONS SERVICES | SEPARATION OF PRIMARY AND ALTERNATE PROVIDERS ASSESSMENT OBJECTIVE: Determine if: CP-08(03)

alternate telecommunicaons services from providers that are separated from primary service providers are obtained to reduce suscepbility to the same threats.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: CP-08(03)-Examine

CHAPTER FOUR

[SELECT FROM: Conngency planning policy; procedures addressing primary and alternate telecommunicaons services; conngency plan; primary and alternate telecommunicaons service agreements; alternate telecommunicaons service provider site; primary telecommunicaons service provider site; other relevant documents or records].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 232

NIST SP 800-53A, REV. 5

CP-08(03)

TELECOMMUNICATIONS SERVICES | SEPARATION OF PRIMARY AND ALTERNATE PROVIDERS CP-08(03)-Interview

CP-08(04)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

TELECOMMUNICATIONS SERVICES | PROVIDER CONTINGENCY PLAN

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

ASSESSMENT OBJECTIVE: Determine if:

CP-08(04)_ODP[01]

frequency at which to obtain evidence of conngency tesng by providers is deﬁned;

CP-08(04)_ODP[02]

frequency at which to obtain evidence of conngency training by providers is deﬁned;

CP-08(04)(a)[01]

primary telecommunicaons service providers are required to have conngency plans;

CP-08(04)(a)[02]

alternate telecommunicaons service providers are required to have conngency plans;

CP-08(04)(b)

provider conngency plans are reviewed to ensure that the plans meet organizaonal conngency requirements;

CP-08(04)(c)[01]

evidence of conngency tesng by providers is obtained <CP-08(04)_ODP[01] frequency>.

CP-08(04)(c)[02]

evidence of conngency training by providers is obtained <CP-08(04)_ODP[02] frequency>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CP-08(05)

CP-08(04)-Examine

[SELECT FROM: Conngency planning policy; procedures addressing primary and alternate telecommunicaons services; conngency plan; provider conngency plans; evidence of conngency tesng/training by providers; primary and alternate telecommunicaons service agreements; system security plan; other relevant documents or records].

CP-08(04)-Interview

[SELECT FROM: Organizaonal personnel with conngency planning, plan implementaon, and tesng responsibilies; primary and alternate telecommunicaons service providers; organizaonal personnel with informaon security responsibilies; organizaonal personnel with responsibility for acquisions/contractual agreements].

TELECOMMUNICATIONS SERVICES | ALTERNATE TELECOMMUNICATION SERVICE TESTING ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

CP-08(05)_ODP

frequency at which alternate telecommunicaons services are tested is deﬁned;

CP-08(05)

alternate telecommunicaons services are tested <CP-08(05)_ODP frequency>.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 233

NIST SP 800-53A, REV. 5

CP-08(05)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

TELECOMMUNICATIONS SERVICES | ALTERNATE TELECOMMUNICATION SERVICE TESTING POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

CP-09

CP-08(05)-Examine

[SELECT FROM: Conngency planning policy; procedures addressing alternate telecommunicaons services; conngency plan; evidence of tesng alternate telecommunicaons services; alternate telecommunicaons service agreements; system security plan; other relevant documents or records].

CP-08(05)-Interview

[SELECT FROM: Organizaonal personnel with conngency planning, plan implementaon, and tesng responsibilies; alternate telecommunicaons service providers; organizaonal personnel with informaon security responsibilies].

CP-08(05)-Test

[SELECT FROM: Mechanisms supporng tesng alternate telecommunicaons services].

SYSTEM BACKUP ASSESSMENT OBJECTIVE: Determine if:

CP-09_ODP[01]

system components for which to conduct backups of user-level informaon is deﬁned;

CP-09_ODP[02]

frequency at which to conduct backups of user-level informaon consistent with recovery me and recovery point objecves is deﬁned;

CP-09_ODP[03]

frequency at which to conduct backups of system-level informaon consistent with recovery me and recovery point objecves is deﬁned;

CP-09_ODP[04]

frequency at which to conduct backups of system documentaon consistent with recovery me and recovery point objecves is deﬁned;

CP-09a.

backups of user-level informaon contained in <CP-09_ODP[01] system components> are conducted <CP-09_ODP[02] frequency>;

CP-09b.

backups of system-level informaon contained in the system are conducted <CP-09_ODP[03] frequency>;

CP-09c.

backups of system documentaon, including security- and privacy-related documentaon are conducted <CP-09_ODP[04] frequency>;

CP-09d.[01]

the conﬁdenality of backup informaon is protected;

CP-09d.[02]

the integrity of backup informaon is protected;

CP-09d.[03]

the availability of backup informaon is protected.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

CP-09-Examine

[SELECT FROM: Conngency planning policy; procedures addressing system backup; conngency plan; backup storage locaon(s); system backup logs or records; system security plan; privacy plan; other relevant documents or records].

CP-09-Interview

[SELECT FROM: Organizaonal personnel with system backup responsibilies; organizaonal personnel with informaon security and privacy responsibilies].

CP-09-Test

[SELECT FROM: Organizaonal processes for conducng system backups; mechanisms supporng and/or implemenng system backups].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 234

NIST SP 800-53A, REV. 5

CP-09(01)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

SYSTEM BACKUP | TESTING FOR RELIABILITY AND INTEGRITY ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

CP-09(01)_ODP[01]

frequency at which to test backup informaon for media reliability is deﬁned;

CP-09(01)_ODP[02]

frequency at which to test backup informaon for informaon integrity is deﬁned;

CP-09(01)[01]

backup informaon is tested <CP-09(01)_ODP[01] frequency> to verify media reliability;

CP-09(01)[02]

backup informaon is tested <CP-09(01)_ODP[02] frequency> to verify informaon integrity.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CP-09(02)

CP-09(01)-Examine

[SELECT FROM: Conngency planning policy; procedures addressing system backup; conngency plan; system backup test results; conngency plan test documentaon; conngency plan test results; system security plan; other relevant documents or records].

CP-09(01)-Interview

[SELECT FROM: Organizaonal personnel with system backup responsibilies; organizaonal personnel with informaon security responsibilies].

CP-09(01)-Test

[SELECT FROM: Organizaonal processes for conducng system backups; mechanisms supporng and/or implemenng system backups].

SYSTEM BACKUP | TEST RESTORATION USING SAMPLING ASSESSMENT OBJECTIVE: Determine if: CP-09(02)

a sample of backup informaon in the restoraon of selected system funcons is used as part of conngency plan tesng.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

CP-09(02)-Examine

CP-09(02)-Interview

[SELECT FROM: Organizaonal personnel with system backup responsibilies; organizaonal personnel with conngency planning/conngency plan tesng responsibilies; organizaonal personnel with informaon security responsibilies].

CP-09(02)-Test

[SELECT FROM: Organizaonal processes for conducng system backups; mechanisms supporng and/or implemenng system backups].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 235

NIST SP 800-53A, REV. 5

CP-09(03)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

SYSTEM BACKUP | SEPARATE STORAGE FOR CRITICAL INFORMATION ASSESSMENT OBJECTIVE: Determine if:

CP-09(03)_ODP

crical system soware and other security-related informaon backups to be stored in a separate facility are deﬁned;

CP-09(03)

backup copies of <CP-09(03)_ODP crical system soware and other securityrelated informaon> are stored in a separate facility or in a ﬁre rated container that is not collocated with the operaonal system.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

CP-09(04)

CP-09(03)-Examine

[SELECT FROM: Conngency planning policy; procedures addressing system backup; conngency plan; backup storage locaon(s); system backup conﬁguraons and associated documentaon; system backup logs or records; system security plan; other relevant documents or records].

CP-09(03)-Interview

[SELECT FROM: Organizaonal personnel with conngency planning and plan implementaon responsibilies; organizaonal personnel with system backup responsibilies; organizaonal personnel with informaon security responsibilies].

SYSTEM BACKUP | PROTECTION FROM UNAUTHORIZED MODIFICATION [WITHDRAWN: Incorporated into CP-09.]

CP-09(05)

SYSTEM BACKUP | TRANSFER TO ALTERNATE STORAGE SITE ASSESSMENT OBJECTIVE: Determine if:

CP-09(05)_ODP[01]

me period consistent with recovery me and recovery point objecves is deﬁned;

CP-09(05)_ODP[02]

transfer rate consistent with recovery me and recovery point objecves is deﬁned;

CP-09(05)[01]

system backup informaon is transferred to the alternate storage site for <CP-09(05)_ODP[01] me period>;

CP-09(05)[02]

system backup informaon is transferred to the alternate storage site <CP-09(05)_ODP[02] transfer rate>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

CP-09(05)-Examine

[SELECT FROM: Conngency planning policy; procedures addressing system backup; conngency plan; system backup logs or records; evidence of system backup informaon transferred to alternate storage site; alternate storage site agreements; system security plan; other relevant documents or records].

CP-09(05)-Interview

[SELECT FROM: Organizaonal personnel with system backup responsibilies; organizaonal personnel with informaon security responsibilies].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 236

NIST SP 800-53A, REV. 5

CP-09(05)

SYSTEM BACKUP | TRANSFER TO ALTERNATE STORAGE SITE CP-09(05)-Test

CP-09(06)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

[SELECT FROM: Organizaonal processes for transferring system backups to the alternate storage site; mechanisms supporng and/or implemenng system backups; mechanisms supporng and/or implemenng informaon transfer to the alternate storage site].

SYSTEM BACKUP | REDUNDANT SECONDARY SYSTEM ASSESSMENT OBJECTIVE:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

Determine if:

CP-09(06)[01]

system backup is conducted by maintaining a redundant secondary system that is not collocated with the primary system;

CP-09(06)[02]

system backup is conducted by maintaining a redundant secondary system that can be acvated without loss of informaon or disrupon to operaons.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CP-09(07)

CP-09(06)-Examine

[SELECT FROM: Conngency planning policy; procedures addressing system backup; conngency plan; system backup test results; conngency plan test results; conngency plan test documentaon; redundant secondary system for system backups; locaon(s) of redundant secondary backup system(s); system security plan; other relevant documents or records].

CP-09(06)-Interview

[SELECT FROM: Organizaonal personnel with system backup responsibilies; organizaonal personnel with informaon security responsibilies; organizaonal personnel with responsibility for the redundant secondary system].

CP-09(06)-Test

[SELECT FROM: Organizaonal processes for maintaining redundant secondary systems; mechanisms supporng and/or implemenng system backups; mechanisms supporng and/or implemenng informaon transfer to a redundant secondary system].

SYSTEM BACKUP | DUAL AUTHORIZATION FOR DELETION OR DESTRUCTION ASSESSMENT OBJECTIVE: Determine if:

CP-09(07)_ODP

backup informaon for which to enforce dual authorizaon in order to delete or destroy is deﬁned;

CP-09(07)

dual authorizaon for the deleon or destrucon of <CP-09(07)_ODP backup informaon> is enforced.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

CP-09(07)-Examine

[SELECT FROM: Conngency planning policy; procedures addressing system backup; conngency plan; system design documentaon; system conﬁguraon sengs and associated documentaon; system generated list of dual authorizaon credenals or rules; logs or records of deleon or destrucon of backup informaon; system security plan; other relevant documents or records].

CP-09(07)-Interview

[SELECT FROM: Organizaonal personnel with system backup responsibilies; organizaonal personnel with informaon security responsibilies].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 237

NIST SP 800-53A, REV. 5

CP-09(07)

SYSTEM BACKUP | DUAL AUTHORIZATION FOR DELETION OR DESTRUCTION CP-09(07)-Test

CP-09(08)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

[SELECT FROM: Mechanisms supporng and/or implemenng dual authorizaon; mechanisms supporng and/or implemenng the deleon/destrucon of backup informaon].

SYSTEM BACKUP | CRYPTOGRAPHIC PROTECTION ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

CP-09(08)_ODP

backup informaon to protect against unauthorized disclosure and modiﬁcaon is deﬁned;

CP-09(08)

cryptographic mechanisms are implemented to prevent unauthorized disclosure and modiﬁcaon of <CP-09(08)_ODP backup informaon>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CP-10

CP-09(08)-Examine

CP-09(08)-Interview

[SELECT FROM: Organizaonal personnel with system backup responsibilies; organizaonal personnel with informaon security responsibilies].

CP-09(08)-Test

[SELECT FROM: Mechanisms supporng and/or implemenng cryptographic protecon of backup informaon].

SYSTEM RECOVERY AND RECONSTITUTION ASSESSMENT OBJECTIVE: Determine if:

CP-10_ODP[01]

me period consistent with recovery me and recovery point objecves for the recovery of the system is determined;

CP-10_ODP[02]

me period consistent with recovery me and recovery point objecves for the reconstuon of the system is determined;

CP-10[01]

the recovery of the system to a known state is provided within <CP-10_ODP[01] me period> aer a disrupon, compromise, or failure;

CP-10[02]

a reconstuon of the system to a known state is provided within <CP-10_ODP[02] me period> aer a disrupon, compromise, or failure.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: CP-10-Examine

CHAPTER FOUR

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 238

NIST SP 800-53A, REV. 5

CP-10

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

CP-10(01)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

SYSTEM RECOVERY AND RECONSTITUTION CP-10-Interview

[SELECT FROM: Organizaonal personnel with conngency planning, recovery, and/or reconstuon responsibilies; organizaonal personnel with informaon security responsibilies].

CP-10-Test

[SELECT FROM: Organizaonal processes implemenng system recovery and reconstuon operaons; mechanisms supporng and/or implemenng system recovery and reconstuon operaons].

SYSTEM RECOVERY AND RECONSTITUTION | CONTINGENCY PLAN TESTING [WITHDRAWN: Incorporated into CP-04.]

CP-10(02)

SYSTEM RECOVERY AND RECONSTITUTION | TRANSACTION RECOVERY ASSESSMENT OBJECTIVE: Determine if: CP-10(02)

transacon recovery is implemented for systems that are transacon-based.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CP-10(03)

CP-10(02)-Examine

[SELECT FROM: Conngency planning policy; procedures addressing system recovery and reconstuon; conngency plan; system design documentaon; system conﬁguraon sengs and associated documentaon; conngency plan test documentaon; conngency plan test results; system transacon recovery records; system audit records; system security plan; other relevant documents or records].

CP-10(02)-Interview

[SELECT FROM: Organizaonal personnel with responsibility for transacon recovery; organizaonal personnel with informaon security responsibilies].

CP-10(02)-Test

[SELECT FROM: Mechanisms supporng and/or implemenng transacon recovery capability].

SYSTEM RECOVERY AND RECONSTITUTION | COMPENSATING SECURITY CONTROLS [WITHDRAWN. Addressed through tailoring.]

CP-10(04)

SYSTEM RECOVERY AND RECONSTITUTION | RESTORE WITHIN TIME PERIOD ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

CP-10(04)_ODP

restoraon me period within which to restore system components to a known, operaonal state is deﬁned;

CP-10(04)

the capability to restore system components within <CP-10(04)_ODP restoraon me periods> from conﬁguraon-controlled and integrity-protected informaon represenng a known, operaonal state for the components is provided.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 239

NIST SP 800-53A, REV. 5

CP-10(04)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

SYSTEM RECOVERY AND RECONSTITUTION | RESTORE WITHIN TIME PERIOD POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

CP-10(05)

CP-10(04)-Examine

[SELECT FROM: Conngency planning policy; procedures addressing system recovery and reconstuon; conngency plan; system design documentaon; system conﬁguraon sengs and associated documentaon; conngency plan test documentaon; conngency plan test results; evidence of system recovery and reconstuon operaons; system security plan; other relevant documents or records].

CP-10(04)-Interview

[SELECT FROM: Organizaonal personnel with system recovery and reconstuon responsibilies; organizaonal personnel with informaon security responsibilies].

CP-10(04)-Test

[SELECT FROM: Mechanisms supporng and/or implemenng the recovery/ reconstuon of system informaon].

SYSTEM RECOVERY AND RECONSTITUTION | FAILOVER CAPABILITY [WITHDRAWN: Incorporated into SI-13.]

CP-10(06)

SYSTEM RECOVERY AND RECONSTITUTION | COMPONENT PROTECTION ASSESSMENT OBJECTIVE: Determine if: CP-10(06)

system components used for recovery and reconstuon are protected.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CP-11

CP-10(06)-Examine

[SELECT FROM: Conngency planning policy; procedures addressing system recovery and reconstuon; conngency plan; system design documentaon; system conﬁguraon sengs and associated documentaon; logical access credenals; physical access credenals; logical access authorizaon records; physical access authorizaon records; system security plan; other relevant documents or records].

CP-10(06)-Interview

[SELECT FROM: Organizaonal personnel with system recovery and reconstuon responsibilies; organizaonal personnel with informaon security responsibilies].

CP-10(06)-Test

[SELECT FROM: Organizaonal processes for protecng backup and restoraon of hardware, ﬁrmware, and soware; mechanisms supporng and/or implemenng protecon of backups and restoraon of hardware, ﬁrmware, and soware].

ALTERNATE COMMUNICATIONS PROTOCOLS ASSESSMENT OBJECTIVE: Determine if: CP-11_ODP

CHAPTER FOUR

alternave communicaons protocols in support of maintaining connuity of operaons are deﬁned;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 240

NIST SP 800-53A, REV. 5

CP-11

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

ALTERNATE COMMUNICATIONS PROTOCOLS CP-11

the capability to employ <CP-11_ODP alternave communicaons protocols> are provided in support of maintaining connuity of operaons.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

CP-12

CP-11-Examine

[SELECT FROM: Conngency planning policy; procedures addressing alternave communicaons protocols; conngency plan; connuity of operaons plan; system design documentaon; system conﬁguraon sengs and associated documentaon; list of alternave communicaons protocols supporng connuity of operaons; system security plan; other relevant documents or records].

CP-11-Interview

[SELECT FROM: Organizaonal personnel with conngency planning and plan implementaon responsibilies; organizaonal personnel with connuity of operaons planning and plan implementaon responsibilies; organizaonal personnel with informaon security responsibilies; system/network administrators; system developers].

CP-11-Test

[SELECT FROM: Mechanisms employing alternave communicaons protocols].

SAFE MODE ASSESSMENT OBJECTIVE: Determine if:

CP-12_ODP[01]

restricons for safe mode of operaon are deﬁned;

CP-12_ODP[02]

condions detected to enter a safe mode of operaon are deﬁned;

CP-12

a safe mode of operaon is entered with <CP-12_ODP[01] restricons> when <CP-12_ODP[02] condions> are detected.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CP-13

CP-12-Examine

[SELECT FROM: Conngency planning policy; procedures addressing safe mode of operaon for the system; conngency plan; system design documentaon; system conﬁguraon sengs and associated documentaon; system administraon manuals; system operaon manuals; system installaon manuals; conngency plan test records; incident handling records; system audit records; system security plan; other relevant documents or records].

CP-12-Interview

[SELECT FROM: Organizaonal personnel with system operaon responsibilies; organizaonal personnel with informaon security responsibilies; system/network administrators; system developers].

CP-12-Test

[SELECT FROM: Mechanisms implemenng safe mode of operaon].

ALTERNATIVE SECURITY MECHANISMS ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

CP-13_ODP[01]

alternave or supplemental security mechanisms are deﬁned;

CP-13_ODP[02]

security funcons are deﬁned;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 241

NIST SP 800-53A, REV. 5

CP-13

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

ALTERNATIVE SECURITY MECHANISMS CP-13

<CP-13_ODP[01] alternave or supplemental security mechanisms> are employed for sasfying <CP-13_ODP[02] security funcons> when the primary means of implemenng the security funcon is unavailable or compromised.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5 CHAPTER FOUR

CP-13-Examine

[SELECT FROM: Conngency planning policy; procedures addressing alternate security mechanisms; conngency plan; connuity of operaons plan; system design documentaon; system conﬁguraon sengs and associated documentaon; conngency plan test records; conngency plan test results; system security plan; other relevant documents or records].

CP-13-Interview

[SELECT FROM: Organizaonal personnel with system operaon responsibilies; organizaonal personnel with informaon security responsibilies].

CP-13-Test

[SELECT FROM: system capability implemenng alternave security mechanisms].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 242

NIST SP 800-53A, REV. 5

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

4.7 IDENTIFICATION AND AUTHENTICATION IA-01

POLICY AND PROCEDURES ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5 CHAPTER FOUR

IA-01_ODP[01]

personnel or roles to whom the idenﬁcaon and authencaon policy is to be disseminated are deﬁned;

IA-01_ODP[02]

personnel or roles to whom the idenﬁcaon and authencaon procedures are to be disseminated is/are deﬁned;

IA-01_ODP[03]

one or more of the following PARAMETER VALUES is/are selected: {organizaonlevel; mission/business process-level; system-level};

IA-01_ODP[04]

an oﬃcial to manage the idenﬁcaon and authencaon policy and procedures is deﬁned;

IA-01_ODP[05]

the frequency at which the current idenﬁcaon and authencaon policy is reviewed and updated is deﬁned;

IA-01_ODP[06]

events that would require the current idenﬁcaon and authencaon policy to be reviewed and updated are deﬁned;

IA-01_ODP[07]

the frequency at which the current idenﬁcaon and authencaon procedures are reviewed and updated is deﬁned;

IA-01_ODP[08]

events that would require idenﬁcaon and authencaon procedures to be reviewed and updated are deﬁned;

IA-01a.[01]

an idenﬁcaon and authencaon policy is developed and documented;

IA-01a.[02]

the idenﬁcaon and authencaon policy is disseminated to <IA-01_ODP[01] personnel or roles>;

IA-01a.[03]

idenﬁcaon and authencaon procedures to facilitate the implementaon of the idenﬁcaon and authencaon policy and associated idenﬁcaon and authencaon controls are developed and documented;

IA-01a.[04]

the idenﬁcaon and authencaon procedures are disseminated to <IA-01_ODP[02] personnel or roles>;

IA-01a.01(a)[01]

the <IA-01_ODP[03] SELECTED PARAMETER VALUE(S)> idenﬁcaon and authencaon policy addresses purpose;

IA-01a.01(a)[02]

the <IA-01_ODP[03] SELECTED PARAMETER VALUE(S)> idenﬁcaon and authencaon policy addresses scope;

IA-01a.01(a)[03]

the <IA-01_ODP[03] SELECTED PARAMETER VALUE(S)> idenﬁcaon and authencaon policy addresses roles;

IA-01a.01(a)[04]

the <IA-01_ODP[03] SELECTED PARAMETER VALUE(S)> idenﬁcaon and authencaon policy addresses responsibilies;

IA-01a.01(a)[05]

the <IA-01_ODP[03] SELECTED PARAMETER VALUE(S)> idenﬁcaon and authencaon policy addresses management commitment;

IA-01a.01(a)[06]

the <IA-01_ODP[03] SELECTED PARAMETER VALUE(S)> idenﬁcaon and authencaon policy addresses coordinaon among organizaonal enes;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 243

NIST SP 800-53A, REV. 5

IA-01

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

POLICY AND PROCEDURES

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

IA-01a.01(a)[07]

the <IA-01_ODP[03] SELECTED PARAMETER VALUE(S)> idenﬁcaon and authencaon policy addresses compliance;

IA-01a.01(b)

the <IA-01_ODP[03] SELECTED PARAMETER VALUE(S)> idenﬁcaon and authencaon policy is consistent with applicable laws, execuve orders, direcves, regulaons, policies, standards, and guidelines;

IA-01b.

the <IA-01_ODP[04] oﬃcial> is designated to manage the development, documentaon, and disseminaon of the idenﬁcaon and authencaon policy and procedures;

IA-01c.01[01]

the current idenﬁcaon and authencaon policy is reviewed and updated <IA-01_ODP[05] frequency>;

IA-01c.01[02]

the current idenﬁcaon and authencaon policy is reviewed and updated following <IA-01_ODP[06] events>;

IA-01c.02[01]

the current idenﬁcaon and authencaon procedures are reviewed and updated <IA-01_ODP[07] frequency>;

IA-01c.02[02]

the current idenﬁcaon and authencaon procedures are reviewed and updated following <IA-01_ODP[08] events>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

IA-02

IA-01-Examine

[SELECT FROM: Idenﬁcaon and authencaon policy and procedures; system security plan; privacy plan; risk management strategy documentaon; list of events requiring idenﬁcaon and authencaon procedures to be reviewed and updated (e.g., audit ﬁndings); other relevant documents or records].

IA-01-Interview

[SELECT FROM: Organizaonal personnel with idenﬁcaon and authencaon responsibilies; organizaonal personnel with informaon security and privacy responsibilies].

IDENTIFICATION AND AUTHENTICATION (ORGANIZATIONAL USERS) ASSESSMENT OBJECTIVE: Determine if: IA-02[01]

organizaonal users are uniquely idenﬁed and authencated;

IA-02[02]

the unique idenﬁcaon of authencated organizaonal users is associated with processes acng on behalf of those users.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

IA-02-Examine

[SELECT FROM: Idenﬁcaon and authencaon policy; procedures addressing user idenﬁcaon and authencaon; system security plan, system design documentaon; system conﬁguraon sengs and associated documentaon; system audit records; list of system accounts; other relevant documents or records].

IA-02-Interview

[SELECT FROM: Organizaonal personnel with system operaons responsibilies; organizaonal personnel with informaon security responsibilies; system/ network administrators; organizaonal personnel with account management responsibilies; system developers].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 244

NIST SP 800-53A, REV. 5

IA-02

IDENTIFICATION AND AUTHENTICATION (ORGANIZATIONAL USERS) IA-02-Test

IA-02(01)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

[SELECT FROM: Organizaonal processes for uniquely idenfying and authencang users; mechanisms supporng and/or implemenng idenﬁcaon and authencaon capabilies].

IDENTIFICATION AND AUTHENTICATION (ORGANIZATIONAL USERS) | MULTI-FACTOR AUTHENTICATION TO PRIVILEGED ACCOUNTS ASSESSMENT OBJECTIVE:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

Determine if: IA-02(01)

mul-factor authencaon is implemented for access to privileged accounts.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

IA-02(02)

IA-02(01)-Examine

[SELECT FROM: Idenﬁcaon and authencaon policy; procedures addressing user idenﬁcaon and authencaon; system security plan; system design documentaon; system conﬁguraon sengs and associated documentaon; system audit records; list of system accounts; other relevant documents or records].

IA-02(01)-Interview

[SELECT FROM: Organizaonal personnel with system operaons responsibilies; organizaonal personnel with account management responsibilies; organizaonal personnel with informaon security responsibilies; system/network administrators; system developers].

IA-02(01)-Test

[SELECT FROM: Mechanisms supporng and/or implemenng a mul-factor authencaon capability].

IDENTIFICATION AND AUTHENTICATION (ORGANIZATIONAL USERS) | MULTI-FACTOR AUTHENTICATION TO NON-PRIVILEGED ACCOUNTS ASSESSMENT OBJECTIVE: Determine if: IA-02(02)

mul-factor authencaon for access to non-privileged accounts is implemented.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

IA-02(02)-Examine

IA-02(02)-Interview

IA-02(02)-Test

[SELECT FROM: Mechanisms supporng and/or implemenng a mul-factor authencaon capability].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 245

NIST SP 800-53A, REV. 5

IA-02(03)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

IDENTIFICATION AND AUTHENTICATION (ORGANIZATIONAL USERS) | LOCAL ACCESS TO PRIVILEGED ACCOUNTS [WITHDRAWN: Incorporated into IA-02(01).]

IA-02(04)

IDENTIFICATION AND AUTHENTICATION (ORGANIZATIONAL USERS) | LOCAL ACCESS TO NON-PRIVILEGED ACCOUNTS [WITHDRAWN: Incorporated into IA-02(02).]

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

IA-02(05)

IDENTIFICATION AND AUTHENTICATION (ORGANIZATIONAL USERS) | INDIVIDUAL AUTHENTICATION WITH GROUP AUTHENTICATION ASSESSMENT OBJECTIVE: Determine if: IA-02(05)

users are required to be individually authencated before granng access to the shared accounts or resources when shared accounts or authencators are employed.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

IA-02(06)

IA-02(05)-Examine

IA-02(05)-Interview

IA-02(05)-Test

[SELECT FROM: Mechanisms supporng and/or implemenng an authencaon capability for group accounts].

IDENTIFICATION AND AUTHENTICATION (ORGANIZATIONAL USERS) | ACCESS TO ACCOUNTS —SEPARATE DEVICE ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

IA-02(06)_ODP[01]

one or more of the following PARAMETER VALUES is/are selected: {local; network; remote};

IA-02(06)_ODP[02]

one or more of the following PARAMETER VALUES is/are selected: {privileged accounts; non-privileged accounts};

IA-02(06)_ODP[03]

the strength of mechanism requirements to be enforced by a device separate from the system gaining access to accounts is deﬁned;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 246

NIST SP 800-53A, REV. 5

IA-02(06)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

IDENTIFICATION AND AUTHENTICATION (ORGANIZATIONAL USERS) | ACCESS TO ACCOUNTS —SEPARATE DEVICE IA-02(06)(a)

mul-factor authencaon is implemented for <IA-02(06)_ODP[01] SELECTED PARAMETER VALUE(S)> access to <IA-02(06)_ODP[02] SELECTED PARAMETER VALUE(S)> such that one of the factors is provided by a device separate from the system gaining access;

IA-02(06)(b)

mul-factor authencaon is implemented for <IA-02(06)_ODP[01] SELECTED PARAMETER VALUE(S)> access to <IA-02(06)_ODP[02] SELECTED PARAMETER VALUE(S)> such that the device meets <IA-02(06)_ODP[03] strength of mechanism requirements>.

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

IA-02(07)

IA-02(06)-Examine

IA-02(06)-Interview

IA-02(06)-Test

[SELECT FROM: Mechanisms supporng and/or implemenng mul-factor authencaon capability].

IDENTIFICATION AND AUTHENTICATION (ORGANIZATIONAL USERS) | NETWORK ACCESS TO NON-PRIVILEGED ACCOUNTS — SEPARATE DEVICE [WITHDRAWN: Incorporated into IA-02(06).]

IA-02(08)

IDENTIFICATION AND AUTHENTICATION (ORGANIZATIONAL USERS) | ACCESS TO ACCOUNTS — REPLAY RESISTANT ASSESSMENT OBJECTIVE: Determine if:

IA-02(08)_ODP

one or more of the following PARAMETER VALUES is/are selected: {privileged accounts; non-privileged accounts};

IA-02(08)

replay-resistant authencaon mechanisms for access to <IA-02(08)_ODP SELECTED PARAMETER VALUE(S)> are implemented.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: IA-02(08)-Examine

CHAPTER FOUR

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 247

NIST SP 800-53A, REV. 5

IA-02(08)

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

IA-02(09)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

IDENTIFICATION AND AUTHENTICATION (ORGANIZATIONAL USERS) | ACCESS TO ACCOUNTS — REPLAY RESISTANT IA-02(08)-Interview

IA-02(08)-Test

[SELECT FROM: Mechanisms supporng and/or implemenng idenﬁcaon and authencaon capabilies; Mechanisms supporng and/or implemenng replayresistant authencaon mechanisms].

IDENTIFICATION AND AUTHENTICATION (ORGANIZATIONAL USERS) | NETWORK ACCESS TO NON-PRIVILEGED ACCOUNTS — REPLAY RESISTANT [WITHDRAWN: Incorporated into IA-02(08).]

IA-02(10)

IDENTIFICATION AND AUTHENTICATION (ORGANIZATIONAL USERS) | SINGLE SIGN-ON ASSESSMENT OBJECTIVE: Determine if:

IA-02(10)_ODP

system accounts and services for which a single sign-on capability must be provided are deﬁned;

IA-02(10)

a single sign-on capability is provided for <IA-02(10)_ODP system accounts and services>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

IA-02(11)

IA-02(10)-Examine

[SELECT FROM: Idenﬁcaon and authencaon policy; system security plan; procedures addressing single sign-on capability for system accounts and services; procedures addressing idenﬁcaon and authencaon; system design documentaon; system conﬁguraon sengs and associated documentaon; system audit records; list of system accounts and services requiring single sign-on capability; other relevant documents or records].

IA-02(10)-Interview

IA-02(10)-Test

[SELECT FROM: Mechanisms supporng and/or implemenng idenﬁcaon and authencaon capabilies; mechanisms supporng and/or implemenng single sign-on capability for system accounts and services].

IDENTIFICATION AND AUTHENTICATION (ORGANIZATIONAL USERS) | REMOTE ACCESS — SEPARATE DEVICE [WITHDRAWN: Incorporated into IA-02(06).]

CHAPTER FOUR

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 248

NIST SP 800-53A, REV. 5

IA-02(12)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

IDENTIFICATION AND AUTHENTICATION (ORGANIZATIONAL USERS) | ACCEPTANCE OF PIV CREDENTIALS ASSESSMENT OBJECTIVE: Determine if: IA-02(12)

Personal Identy Veriﬁcaon-compliant credenals are accepted and electronically veriﬁed.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

IA-02(13)

IA-02(12)-Examine

[SELECT FROM: Idenﬁcaon and authencaon policy; system security plan; procedures addressing user idenﬁcaon and authencaon; system design documentaon; system conﬁguraon sengs and associated documentaon; system audit records; PIV veriﬁcaon records; evidence of PIV credenals; PIV credenal authorizaons; other relevant documents or records].

IA-02(12)-Interview

IA-02(12)-Test

[SELECT FROM: Mechanisms supporng and/or implemenng acceptance and veriﬁcaon of PIV credenals].

IDENTIFICATION AND AUTHENTICATION (ORGANIZATIONAL USERS) | OUT-OF-BAND AUTHENTICATION ASSESSMENT OBJECTIVE: Determine if:

IA-02(13)_ODP[01]

out-of-band authencaon mechanisms to be implemented are deﬁned;

IA-02(13)_ODP[02]

condions under which out-of-band authencaon is to be implemented are deﬁned;

IA-02(13)

<IA-02(13)_ODP[01] out-of-band authencaon> mechanisms are implemented under <IA-02(13)_ODP[02] condions>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

IA-02(13)-Examine

IA-02(13)-Interview

IA-02(13)-Test

[SELECT FROM: Mechanisms supporng and/or implemenng out-of-band authencaon capability].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 249

NIST SP 800-53A, REV. 5

IA-03

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

DEVICE IDENTIFICATION AND AUTHENTICATION ASSESSMENT OBJECTIVE: Determine if:

IA-03_ODP[01]

devices and/or types of devices to be uniquely idenﬁed and authencated before establishing a connecon are deﬁned;

IA-03_ODP[02]

one or more of the following PARAMETER VALUES is/are selected: {local; remote; network};

IA-03

<IA-03_ODP[01] devices and/or types of devices> are uniquely idenﬁed and authencated before establishing a <IA-03_ODP[02] SELECTED PARAMETER VALUE(S)> connecon.

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

IA-03(01)

IA-03-Examine

[SELECT FROM: Idenﬁcaon and authencaon policy; system security plan; procedures addressing device idenﬁcaon and authencaon; system design documentaon; list of devices requiring unique idenﬁcaon and authencaon; device connecon reports; system conﬁguraon sengs and associated documentaon; other relevant documents or records].

IA-03-Interview

[SELECT FROM: Organizaonal personnel with operaonal responsibilies for device idenﬁcaon and authencaon; organizaonal personnel with informaon security responsibilies; system/network administrators; system developers].

IA-03-Test

[SELECT FROM: Mechanisms supporng and/or implemenng device idenﬁcaon and authencaon capabilies].

DEVICE IDENTIFICATION AND AUTHENTICATION | CRYPTOGRAPHIC BIDIRECTIONAL AUTHENTICATION ASSESSMENT OBJECTIVE: Determine if:

IA-03(01)_ODP[01]

devices and/or types of devices requiring use of cryptographically based, bidireconal authencaon to authencate before establishing one or more connecons are deﬁned;

IA-03(01)_ODP[02]

one or more of the following PARAMETER VALUES is/are selected: {local; remote; network};

IA-03(01)

<IA-03(01)_ODP[01] devices and/or types of devices> are authencated before establishing <IA-03(01)_ODP[02] SELECTED PARAMETER VALUE(S)> connecon using bidireconal authencaon that is cryptographically based.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

IA-03(01)-Examine

IA-03(01)-Interview

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 250

NIST SP 800-53A, REV. 5

IA-03(01)

DEVICE IDENTIFICATION AND AUTHENTICATION | CRYPTOGRAPHIC BIDIRECTIONAL AUTHENTICATION IA-03(01)-Test

IA-03(02)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

[SELECT FROM: Mechanisms supporng and/or implemenng device authencaon capability; cryptographically based bidireconal authencaon mechanisms].

DEVICE IDENTIFICATION AND AUTHENTICATION | CRYPTOGRAPHIC BIDIRECTIONAL NETWORK AUTHENTICATION

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

[WITHDRAWN: Incorporated into IA-03(01).]

IA-03(03)

DEVICE IDENTIFICATION AND AUTHENTICATION | DYNAMIC ADDRESS ALLOCATION ASSESSMENT OBJECTIVE: Determine if:

IA-03(03)_ODP[01]

lease informaon to be employed to standardize dynamic address allocaon for devices is deﬁned;

IA-03(03)_ODP[02]

lease duraon to be employed to standardize dynamic address allocaon for devices is deﬁned;

IA-03(03)(a)[01]

dynamic address allocaon lease informaon assigned to devices where addresses are allocated dynamically are standardized in accordance with <IA-03(03)_ODP[01] lease informaon>;

IA-03(03)(a)[02]

dynamic address allocaon lease duraon assigned to devices where addresses are allocated dynamically are standardized in accordance with <IA-03(03)_ODP[02] lease duraon>;

IA-03(03)(b)

lease informaon is audited when assigned to a device.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

IA-03(03)-Examine

[SELECT FROM: Idenﬁcaon and authencaon policy; system security plan; procedures addressing device idenﬁcaon and authencaon; system design documentaon; system conﬁguraon sengs and associated documentaon; evidence of lease informaon and lease duraon assigned to devices; device connecon reports; system audit records; other relevant documents or records].

IA-03(03)-Interview

IA-03(03)-Test

[SELECT FROM: Mechanisms supporng and/or implemenng device idenﬁcaon and authencaon capabilies; mechanisms supporng and/or implemenng dynamic address allocaon; mechanisms supporng and/or implanng auding of lease informaon].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 251

NIST SP 800-53A, REV. 5

IA-03(04)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

DEVICE IDENTIFICATION AND AUTHENTICATION | DEVICE ATTESTATION ASSESSMENT OBJECTIVE: Determine if:

IA-03(04)_ODP

conﬁguraon management process to be employed to handle device idenﬁcaon and authencaon based on aestaon is deﬁned;

IA-03(04)

device idenﬁcaon and authencaon are handled based on aestaon by <IA-03(04)_ODP conﬁguraon management process>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

IA-04

IA-03(04)-Examine

[SELECT FROM: Idenﬁcaon and authencaon policy; system security plan; procedures addressing device idenﬁcaon and authencaon; procedures addressing device conﬁguraon management; system design documentaon; system conﬁguraon sengs and associated documentaon; conﬁguraon management records; change control records; system audit records; other relevant documents or records].

IA-03(04)-Interview

IA-03(04)-Test

[SELECT FROM: Mechanisms supporng and/or implemenng device idenﬁcaon and authencaon capabilies; mechanisms supporng and/or implemenng conﬁguraon management; cryptographic mechanisms supporng device aestaon].

IDENTIFIER MANAGEMENT ASSESSMENT OBJECTIVE: Determine if:

IA-04_ODP[01]

personnel or roles from whom authorizaon must be received to assign an idenﬁer are deﬁned;

IA-04_ODP[02]

a me period for prevenng reuse of idenﬁers is deﬁned;

IA-04a.

system idenﬁers are managed by receiving authorizaon from <IA-04_ODP[01] personnel or roles> to assign to an individual, group, role, or device idenﬁer;

IA-04b.

system idenﬁers are managed by selecng an idenﬁer that idenﬁes an individual, group, role, service, or device;

IA-04c.

system idenﬁers are managed by assigning the idenﬁer to the intended individual, group, role, service, or device;

IA-04d.

system idenﬁers are managed by prevenng reuse of idenﬁers for <IA-04_ODP[02] me period>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: IA-04-Examine

CHAPTER FOUR

[SELECT FROM: Idenﬁcaon and authencaon policy; procedures addressing idenﬁer management; procedures addressing account management; system security plan; system design documentaon; system conﬁguraon sengs and associated documentaon; list of system accounts; list of idenﬁers generated from physical access control devices; other relevant documents or records].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 252

NIST SP 800-53A, REV. 5

IA-04

IA-04(01)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

IDENTIFIER MANAGEMENT IA-04-Interview

[SELECT FROM: Organizaonal personnel with idenﬁer management responsibilies; organizaonal personnel with informaon security responsibilies; system/network administrators; system developers].

IA-04-Test

[SELECT FROM: Mechanisms supporng and/or implemenng idenﬁer management].

IDENTIFIER MANAGEMENT | PROHIBIT ACCOUNT IDENTIFIERS AS PUBLIC IDENTIFIERS

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

ASSESSMENT OBJECTIVE: Determine if: IA-04(01)

the use of system account idenﬁers that are the same as public idenﬁers is prohibited for individual accounts.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

IA-04(02)

IA-04(01)-Examine

[SELECT FROM: Idenﬁcaon and authencaon policy; system security plan; procedures addressing idenﬁer management; procedures addressing account management; system design documentaon; system conﬁguraon sengs and associated documentaon; system audit records; other relevant documents or records].

IA-04(01)-Interview

[SELECT FROM: Organizaonal personnel with idenﬁer management responsibilies; organizaonal personnel with informaon security responsibilies; system/network administrators].

IA-04(01)-Test

[SELECT FROM: Mechanisms supporng and/or implemenng idenﬁer management].

IDENTIFIER MANAGEMENT | SUPERVISOR AUTHORIZATION [WITHDRAWN: Incorporated into IA-12(01).]

IA-04(03)

IDENTIFIER MANAGEMENT | MULTIPLE FORMS OF CERTIFICATION [WITHDRAWN: Incorporated into IA-12(02).]

IA-04(04)

IDENTIFIER MANAGEMENT | IDENTIFY USER STATUS ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

IA-04(04)_ODP

characteriscs used to idenfy individual status is deﬁned;

IA-04(04)

individual idenﬁers are managed by uniquely idenfying each individual as <IA-04(04)_ODP characteriscs>.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 253

NIST SP 800-53A, REV. 5

IA-04(04)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

IDENTIFIER MANAGEMENT | IDENTIFY USER STATUS POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

IA-04(05)

IA-04(04)-Examine

[SELECT FROM: Idenﬁcaon and authencaon policy; system security plan; procedures addressing idenﬁer management; procedures addressing account management; list of characteriscs idenfying individual status; other relevant documents or records].

IA-04(04)-Interview

[SELECT FROM: Organizaonal personnel with idenﬁer management responsibilies; organizaonal personnel with informaon security responsibilies; system/network administrators].

IA-04(04)-Test

[SELECT FROM: Mechanisms supporng and/or implemenng idenﬁer management].

IDENTIFIER MANAGEMENT | DYNAMIC MANAGEMENT ASSESSMENT OBJECTIVE: Determine if:

IA-04(05)_ODP

a dynamic idenﬁer policy for managing individual idenﬁers is deﬁned;

IA-04(05)

individual idenﬁers are dynamically managed in accordance with <IA-04(05)_ODP dynamic idenﬁer policy>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

IA-04(06)

IA-04(05)-Examine

IA-04(05)-Interview

IA-04(05)-Test

[SELECT FROM: Mechanisms supporng and/or implemenng dynamic idenﬁer management].

IDENTIFIER MANAGEMENT | CROSS-ORGANIZATION MANAGEMENT ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

IA-04(06)_ODP

external organizaons with whom to coordinate the cross-organizaon management of idenﬁers are deﬁned;

IA-04(06)

cross-organizaon management of idenﬁers is coordinated with <IA-04(06)_ODP external organizaons>.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 254

NIST SP 800-53A, REV. 5

IA-04(06)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

IDENTIFIER MANAGEMENT | CROSS-ORGANIZATION MANAGEMENT POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

IA-04(07)

IA-04(06)-Examine

[SELECT FROM: Idenﬁcaon and authencaon policy; procedures addressing idenﬁer management; procedures addressing account management; system security plan; other relevant documents or records].

IA-04(06)-Interview

[SELECT FROM: Organizaonal personnel with idenﬁer management responsibilies; organizaonal personnel with informaon security responsibilies].

IA-04(06)-Test

[SELECT FROM: Mechanisms supporng and/or implemenng idenﬁer management].

IDENTIFIER MANAGEMENT | IN-PERSON REGISTRATION [WITHDRAWN: Incorporated into IA-12(04).]

IA-04(08)

IDENTIFIER MANAGEMENT | PAIRWISE PSEUDONYMOUS IDENTIFIERS ASSESSMENT OBJECTIVE: Determine if: IA-04(08)

pairwise pseudonymous idenﬁers are generated.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

IA-04(09)

IA-04(08)-Examine

IA-04(08)-Interview

[SELECT FROM: Organizaonal personnel with idenﬁer management responsibilies; organizaonal personnel with informaon security responsibilies].

IA-04(08)-Test

[SELECT FROM: Mechanisms supporng and/or implemenng idenﬁer management].

IDENTIFIER MANAGEMENT | ATTRIBUTE MAINTENANCE AND PROTECTION ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

IA-04(09)_ODP

protected central storage used to maintain the aributes for each uniquely idenﬁed individual, device, or service is deﬁned;

IA-04(09)

the aributes for each uniquely idenﬁed individual, device, or service are maintained in <IA-04(09)_ODP protected central storage>.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 255

NIST SP 800-53A, REV. 5

IA-04(09)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

IDENTIFIER MANAGEMENT | ATTRIBUTE MAINTENANCE AND PROTECTION POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

IA-05

IA-04(09)-Examine

IA-04(09)-Interview

[SELECT FROM: Organizaonal personnel with idenﬁer management responsibilies; organizaonal personnel with informaon security responsibilies].

IA-04(09)-Test

[SELECT FROM: Mechanisms supporng and/or implemenng idenﬁer management].

AUTHENTICATOR MANAGEMENT ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

IA-05_ODP[01]

a me period for changing or refreshing authencators by authencator type is deﬁned;

IA-05_ODP[02]

events that trigger the change or refreshment of authencators are deﬁned;

IA-05a.

system authencators are managed through the veriﬁcaon of the identy of the individual, group, role, service, or device receiving the authencator as part of the inial authencator distribuon;

IA-05b.

system authencators are managed through the establishment of inial authencator content for any authencators issued by the organizaon;

IA-05c.

system authencators are managed to ensure that authencators have suﬃcient strength of mechanism for their intended use;

IA-05d.

system authencators are managed through the establishment and implementaon of administrave procedures for inial authencator distribuon; lost, compromised, or damaged authencators; and the revocaon of authencators;

IA-05e.

system authencators are managed through the change of default authencators prior to ﬁrst use;

IA-05f.

system authencators are managed through the change or refreshment of authencators <IA-05_ODP[01] me period by authencator type> or when <IA-05_ODP[02] events> occur;

IA-05g.

system authencators are managed through the protecon of authencator content from unauthorized disclosure and modiﬁcaon;

IA-05h.[01]

system authencators are managed through the requirement for individuals to take speciﬁc controls to protect authencators;

IA-05h.[02]

system authencators are managed through the requirement for devices to implement speciﬁc controls to protect authencators;

IA-05i.

system authencators are managed through the change of authencators for group or role accounts when membership to those accounts changes.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 256

NIST SP 800-53A, REV. 5

IA-05

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

AUTHENTICATOR MANAGEMENT POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

IA-05(01)

IA-05-Examine

[SELECT FROM: Idenﬁcaon and authencaon policy; system security plan; addressing authencator management; system design documentaon; system conﬁguraon sengs and associated documentaon; list of system authencator types; change control records associated with managing system authencators; system audit records; other relevant documents or records].

IA-05-Interview

[SELECT FROM: Organizaonal personnel with authencator management responsibilies; organizaonal personnel with informaon security responsibilies; system/network administrators].

IA-05-Test

[SELECT FROM: Mechanisms supporng and/or implemenng authencator management capability].

AUTHENTICATOR MANAGEMENT | PASSWORD-BASED AUTHENTICATION ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

IA-05(01)_ODP[01]

the frequency at which to update the list of commonly used, expected, or compromised passwords is deﬁned;

IA-05(01)_ODP[02]

authencator composion and complexity rules are deﬁned;

IA-05(01)(a)

for password-based authencaon, a list of commonly used, expected, or compromised passwords is maintained and updated <IA-05(01)_ODP[01] frequency> and when organizaonal passwords are suspected to have been compromised directly or indirectly;

IA-05(01)(b)

for password-based authencaon when passwords are created or updated by users, the passwords are veriﬁed not to be found on the list of commonly used, expected, or compromised passwords in IA-05(01)(a);

IA-05(01)(c)

for password-based authencaon, passwords are only transmied over cryptographically protected channels;

IA-05(01)(d)

for password-based authencaon, passwords are stored using an approved salted key derivaon funcon, preferably using a keyed hash;

IA-05(01)(e)

for password-based authencaon, immediate selecon of a new password is required upon account recovery;

IA-05(01)(f)

for password-based authencaon, user selecon of long passwords and passphrases is allowed, including spaces and all printable characters;

IA-05(01)(g)

for password-based authencaon, automated tools are employed to assist the user in selecng strong password authencators;

IA-05(01)(h)

for password-based authencaon, <IA-05(01)_ODP[02] composion and complexity rules> are enforced.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 257

NIST SP 800-53A, REV. 5

IA-05(01)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

AUTHENTICATOR MANAGEMENT | PASSWORD-BASED AUTHENTICATION POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

IA-05(02)

IA-05(01)-Examine

[SELECT FROM: Idenﬁcaon and authencaon policy; password policy; procedures addressing authencator management; system security plan; system design documentaon; system conﬁguraon sengs and associated documentaon; password conﬁguraons and associated documentaon; other relevant documents or records].

IA-05(01)-Interview

[SELECT FROM: Organizaonal personnel with authencator management responsibilies; organizaonal personnel with informaon security responsibilies; system/network administrators; system developers].

IA-05(01)-Test

[SELECT FROM: Mechanisms supporng and/or implemenng password-based authencator management capability].

AUTHENTICATOR MANAGEMENT | PUBLIC KEY-BASED AUTHENTICATION ASSESSMENT OBJECTIVE: Determine if:

IA-05(02)(a)(01)

authorized access to the corresponding private key is enforced for public key-based authencaon;

IA-05(02)(a)(02)

the authencated identy is mapped to the account of the individual or group for public key-based authencaon;

IA-05(02)(b)(01)

when public key infrastructure (PKI) is used, cerﬁcates are validated by construcng and verifying a cerﬁcaon path to an accepted trust anchor, including checking cerﬁcate status informaon;

IA-05(02)(b)(02)

when public key infrastructure (PKI) is used, a local cache of revocaon data is implemented to support path discovery and validaon.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

IA-05(03)

IA-05(02)-Examine

[SELECT FROM: Idenﬁcaon and authencaon policy; procedures addressing authencator management; system security plan; system design documentaon; system conﬁguraon sengs and associated documentaon; PKI cerﬁcaon validaon records; PKI cerﬁcaon revocaon lists; other relevant documents or records].

IA-05(02)-Interview

[SELECT FROM: Organizaonal personnel with PKI-based, authencator management responsibilies; organizaonal personnel with informaon security responsibilies; system/network administrators; system developers].

IA-05(02)-Test

[SELECT FROM: Mechanisms supporng and/or implemenng PKI-based, authencator management capability].

AUTHENTICATOR MANAGEMENT | IN-PERSON OR TRUSTED EXTERNAL PARTY REGISTRATION [WITHDRAWN: Incorporated into IA-12(04).]

CHAPTER FOUR

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 258

NIST SP 800-53A, REV. 5

IA-05(04)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

AUTHENTICATOR MANAGEMENT | AUTOMATED SUPPORT FOR PASSWORD STRENGTH DETERMINATION [WITHDRAWN: Incorporated into IA-05(01).]

IA-05(05)

AUTHENTICATOR MANAGEMENT | CHANGE AUTHENTICATORS PRIOR TO DELIVERY ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

IA-05(05)

developers and installers of system components are required to provide unique authencators or change default authencators prior to delivery and installaon.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

IA-05(06)

IA-05(05)-Examine

[SELECT FROM: Idenﬁcaon and authencaon policy; system security plan; system and services acquision policy; procedures addressing authencator management; procedures addressing the integraon of security requirements into the acquision process; acquision documentaon; acquision contracts for system procurements or services; other relevant documents or records].

IA-05(05)-Interview

[SELECT FROM: Organizaonal personnel with authencator management responsibilies; organizaonal personnel with informaon security, acquision, and contracng responsibilies; system developers].

IA-05(05)-Test

[SELECT FROM: Mechanisms supporng and/or implemenng authencator management capability].

AUTHENTICATOR MANAGEMENT | PROTECTION OF AUTHENTICATORS ASSESSMENT OBJECTIVE: Determine if: IA-05(06)

authencators are protected commensurate with the security category of the informaon to which use of the authencator permits access.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

IA-05(06)-Examine

[SELECT FROM: Idenﬁcaon and authencaon policy; procedures addressing authencator management; security categorizaon documentaon for the system; security assessments of authencator protecons; risk assessment results; system security plan; other relevant documents or records].

IA-05(06)-Interview

[SELECT FROM: Organizaonal personnel with authencator management responsibilies; organizaonal personnel implemenng and/or maintaining authencator protecons; organizaonal personnel with informaon security responsibilies; system/network administrators].

IA-05(06)-Test

[SELECT FROM: Mechanisms supporng and/or implemenng authencator management capability; mechanisms protecng authencators].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 259

NIST SP 800-53A, REV. 5

IA-05(07)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

AUTHENTICATOR MANAGEMENT | NO EMBEDDED UNENCRYPTED STATIC AUTHENTICATORS ASSESSMENT OBJECTIVE: Determine if: IA-05(07)

unencrypted stac authencators are not embedded in applicaons or other forms of stac storage.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

IA-05(08)

IA-05(07)-Examine

[SELECT FROM: Idenﬁcaon and authencaon policy; system security plan; procedures addressing authencator management; system design documentaon; system conﬁguraon sengs and associated documentaon; logical access scripts; applicaon code reviews for detecng unencrypted stac authencators; other relevant documents or records].

IA-05(07)-Interview

IA-05(07)-Test

[SELECT FROM: Mechanisms supporng and/or implemenng authencator management capability; mechanisms implemenng authencaon in applicaons].

AUTHENTICATOR MANAGEMENT | MULTIPLE SYSTEM ACCOUNTS ASSESSMENT OBJECTIVE: Determine if:

IA-05(08)_ODP

security controls implemented to manage the risk of compromise due to individuals having accounts on mulple systems are deﬁned;

IA-05(08)

<IA-05(08)_ODP security controls> are implemented to manage the risk of compromise due to individuals having accounts on mulple systems.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

IA-05(09)

IA-05(08)-Examine

[SELECT FROM: Idenﬁcaon and authencaon policy; procedures addressing authencator management; system security plan; list of individuals having accounts on mulple systems; list of security safeguards intended to manage risk of compromise due to individuals having accounts on mulple systems; other relevant documents or records].

IA-05(08)-Interview

[SELECT FROM: Organizaonal personnel with authencator management responsibilies; organizaonal personnel with informaon security responsibilies; system/network administrators].

IA-05(08)-Test

[SELECT FROM: Mechanisms supporng and/or implemenng safeguards for authencator management].

AUTHENTICATOR MANAGEMENT | FEDERATED CREDENTIAL MANAGEMENT ASSESSMENT OBJECTIVE: Determine if:

IA-05(09)_ODP

CHAPTER FOUR

external organizaons to be used for federang credenals are deﬁned;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 260

NIST SP 800-53A, REV. 5

IA-05(09)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

AUTHENTICATOR MANAGEMENT | FEDERATED CREDENTIAL MANAGEMENT IA-05(09)

<IA-05(09)_ODP external organizaons> are used to federate credenals.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

IA-05(10)

IA-05(09)-Examine

[SELECT FROM: Idenﬁcaon and authencaon policy; procedures addressing authencator management; procedures addressing account management; system security plan; security agreements; other relevant documents or records].

IA-05(09)-Interview

[SELECT FROM: Organizaonal personnel with authencator management responsibilies; organizaonal personnel with informaon security responsibilies; system/network administrators].

IA-05(09)-Test

[SELECT FROM: Mechanisms supporng and/or implemenng safeguards for authencator management].

AUTHENTICATOR MANAGEMENT | DYNAMIC CREDENTIAL BINDING ASSESSMENT OBJECTIVE: Determine if:

IA-05(10)_ODP

rules for dynamically binding idenes and authencators are deﬁned;

IA-05(10)

idenes and authencators are dynamically bound using <IA-05(10)_ODP binding rules>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

IA-05(11)

IA-05(10)-Examine

[SELECT FROM: Idenﬁcaon and authencaon policy; procedures addressing idenﬁer management; system security plan; system design documentaon; automated mechanisms providing dynamic binding of idenﬁers and authencators; system conﬁguraon sengs and associated documentaon; system audit records; other relevant documents or records].

IA-05(10)-Interview

[SELECT FROM: Organizaonal personnel with idenﬁer management responsibilies; organizaonal personnel with informaon security responsibilies; system/network administrators].

IA-05(10)-Test

[SELECT FROM: Automated mechanisms implemenng idenﬁer management capability; automated mechanisms implemenng dynamic binding of idenes and authencators].

AUTHENTICATOR MANAGEMENT | HARDWARE TOKEN-BASED AUTHENTICATION [WITHDRAWN: Incorporated into IA-02(01), IA-02(02).]

IA-05(12)

AUTHENTICATOR MANAGEMENT | BIOMETRIC AUTHENTICATION PERFORMANCE ASSESSMENT OBJECTIVE: Determine if:

IA-05(12)_ODP

CHAPTER FOUR

biometric quality requirements for biometric-based authencaon are deﬁned;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 261

NIST SP 800-53A, REV. 5

IA-05(12)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

AUTHENTICATOR MANAGEMENT | BIOMETRIC AUTHENTICATION PERFORMANCE IA-05(12)

mechanisms that sasfy <IA-05(12)_ODP biometric quality requirements> are employed for biometric-based authencaon.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

IA-05(13)

IA-05(12)-Examine

[SELECT FROM: Idenﬁcaon and authencaon policy; procedures addressing authencator management; system security plan; system design documentaon; mechanisms employing biometric-based authencaon for the system; list of biometric quality requirements; system conﬁguraon sengs and associated documentaon; system audit records; other relevant documents or records].

IA-05(12)-Interview

IA-05(12)-Test

[SELECT FROM: Mechanisms supporng and/or implemenng biometric-based authencator management capability].

AUTHENTICATOR MANAGEMENT | EXPIRATION OF CACHED AUTHENTICATORS ASSESSMENT OBJECTIVE: Determine if:

IA-05(13)_ODP

the me period aer which the use of cached authencators is prohibited is deﬁned;

IA-05(13)

the use of cached authencators is prohibited aer <IA-05(13)_ODP me period>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

IA-05(14)

IA-05(13)-Examine

[SELECT FROM: Idenﬁcaon and authencaon policy; procedures addressing authencator management; system security plan; system design documentaon; system conﬁguraon sengs and associated documentaon; system audit records; other relevant documents or records].

IA-05(13)-Interview

IA-05(13)-Test

[SELECT FROM: Mechanisms supporng and/or implemenng authencator management capability].

AUTHENTICATOR MANAGEMENT | MANAGING CONTENT OF PKI TRUST STORES ASSESSMENT OBJECTIVE: Determine if: IA-05(14)

CHAPTER FOUR

an organizaon-wide methodology for managing the content of PKI trust stores is employed across all plaorms, including networks, operang systems, browsers, and applicaons for PKI-based authencaon.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 262

NIST SP 800-53A, REV. 5

IA-05(14)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

AUTHENTICATOR MANAGEMENT | MANAGING CONTENT OF PKI TRUST STORES POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

IA-05(15)

IA-05(14)-Examine

[SELECT FROM: Idenﬁcaon and authencaon policy; procedures addressing authencator management; system security plan; organizaonal methodology for managing content of PKI trust stores across installed all plaorms; system design documentaon; system conﬁguraon sengs and associated documentaon; enterprise security architecture documentaon; enterprise architecture documentaon; other relevant documents or records].

IA-05(14)-Interview

IA-05(14)-Test

[SELECT FROM: Mechanisms supporng and/or implemenng PKI-based authencator management capability; mechanisms supporng and/or implemenng the PKI trust store capability].

AUTHENTICATOR MANAGEMENT | GSA-APPROVED PRODUCTS AND SERVICES ASSESSMENT OBJECTIVE: Determine if: IA-05(15)

only General Services Administraon-approved products and services are used for identy, credenal, and access management.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

IA-05(16)

IA-05(15)-Examine

[SELECT FROM: Idenﬁcaon and authencaon policy; procedures addressing idenﬁer management; system security plan; system design documentaon; mechanisms providing dynamic binding of idenﬁers and authencators; system conﬁguraon sengs and associated documentaon; system audit records; other relevant documents or records].

IA-05(15)-Interview

[SELECT FROM: Organizaonal personnel with idenﬁcaon and authencaon management responsibilies; organizaonal personnel with informaon security responsibilies; system/network administrators].

IA-05(15)-Test

[SELECT FROM: Mechanisms supporng and/or implemenng account management capability; mechanisms supporng and/or implemenng idenﬁcaon and authencaon management capabilies for the system].

AUTHENTICATOR MANAGEMENT | IN-PERSON OR TRUSTED EXTERNAL PARTY AUTHENTICATOR ISSUANCE ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

IA-05(16)_ODP[01]

types of and/or speciﬁc authencators to be issued are deﬁned;

IA-05(16)_ODP[02]

one of the following PARAMETER VALUES is selected: {in person; by a trusted external party};

IA-05(16)_ODP[03]

the registraon authority that issues authencators is deﬁned;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 263

NIST SP 800-53A, REV. 5

IA-05(16)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

AUTHENTICATOR MANAGEMENT | IN-PERSON OR TRUSTED EXTERNAL PARTY AUTHENTICATOR ISSUANCE IA-05(16)_ODP[04]

the personnel or roles who authorize the issuance of authencators are deﬁned;

IA-05(16)

the issuance of <IA-05(16)_ODP[01] types of and/or speciﬁc authencators> is required to be conducted <IA-05(16)_ODP[02] SELECTED PARAMETER VALUE> before <IA-05(16)_ODP[03] registraon authority> with authorizaon by <IA-05(16)_ODP[04] personnel or roles>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

IA-05(17)

IA-05(16)-Examine

IA-05(16)-Interview

IA-05(16)-Test

AUTHENTICATOR MANAGEMENT | PRESENTATION ATTACK DETECTION FOR BIOMETRIC AUTHENTICATORS ASSESSMENT OBJECTIVE: Determine if: IA-05(17)

presentaon aack detecon mechanisms are employed for biometric-based authencaon.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

IA-05(17)-Examine

IA-05(17)-Interview

IA-05(17)-Test

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 264

NIST SP 800-53A, REV. 5

IA-05(18)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

AUTHENTICATOR MANAGEMENT | PASSWORD MANAGERS ASSESSMENT OBJECTIVE: Determine if:

IA-05(18)_ODP[01]

password managers employed for generang and managing passwords are deﬁned;

IA-05(18)_ODP[02]

controls for protecng passwords are deﬁned;

IA-05(18)(a)

<IA-05(18)_ODP[01] password managers> are employed to generate and manage passwords;

IA-05(18)(b)

the passwords are protected using <IA-05(18)_ODP[02] controls>.

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

IA-06

IA-05(18)-Examine

IA-05(18)-Interview

IA-05(18)-Test

AUTHENTICATION FEEDBACK ASSESSMENT OBJECTIVE: Determine if: IA-06

the feedback of authencaon informaon is obscured during the authencaon process to protect the informaon from possible exploitaon and use by unauthorized individuals.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

IA-06-Examine

[SELECT FROM: Idenﬁcaon and authencaon policy; system security plan; procedures addressing authencator feedback; system design documentaon; system conﬁguraon sengs and associated documentaon; system audit records; other relevant documents or records].

IA-06-Interview

[SELECT FROM: Organizaonal personnel with informaon security responsibilies; system/network administrators; system developers].

IA-06-Test

[SELECT FROM: Mechanisms supporng and/or implemenng the obscuring of feedback of authencaon informaon during authencaon].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 265

NIST SP 800-53A, REV. 5

IA-07

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

CRYPTOGRAPHIC MODULE AUTHENTICATION ASSESSMENT OBJECTIVE: Determine if: IA-07

mechanisms for authencaon to a cryptographic module are implemented that meet the requirements of applicable laws, execuve orders, direcves, policies, regulaons, standards, and guidelines for such authencaon.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

IA-08

IA-07-Examine

[SELECT FROM: Idenﬁcaon and authencaon policy; system security plan; procedures addressing cryptographic module authencaon; system design documentaon; system conﬁguraon sengs and associated documentaon; system audit records; other relevant documents or records].

IA-07-Interview

[SELECT FROM: Organizaonal personnel with responsibility for cryptographic module authencaon; organizaonal personnel with informaon security responsibilies; system/network administrators; system developers].

IA-07-Test

[SELECT FROM: Mechanisms supporng and/or implemenng cryptographic module authencaon].

IDENTIFICATION AND AUTHENTICATION (NON-ORGANIZATIONAL USERS) ASSESSMENT OBJECTIVE: Determine if: IA-08

non-organizaonal users or processes acng on behalf of non-organizaonal users are uniquely idenﬁed and authencated.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

IA-08(01)

IA-08-Examine

[SELECT FROM: Idenﬁcaon and authencaon policy; system security plan; privacy plan; procedures addressing user idenﬁcaon and authencaon; system design documentaon; system conﬁguraon sengs and associated documentaon; system audit records; list of system accounts; other relevant documents or records].

IA-08-Interview

[SELECT FROM: Organizaonal personnel with system operaons responsibilies; organizaonal personnel with informaon security and privacy responsibilies; system/network administrators; organizaonal personnel with account management responsibilies].

IA-08-Test

[SELECT FROM: Mechanisms supporng and/or implemenng idenﬁcaon and authencaon capabilies].

IDENTIFICATION AND AUTHENTICATION (NON-ORGANIZATIONAL USERS) | ACCEPTANCE OF PIV CREDENTIALS FROM OTHER AGENCIES ASSESSMENT OBJECTIVE: Determine if:

IA-08(01)[01]

CHAPTER FOUR

Personal Identy Veriﬁcaon-compliant credenals from other federal agencies are accepted;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 266

NIST SP 800-53A, REV. 5

IA-08(01)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

IDENTIFICATION AND AUTHENTICATION (NON-ORGANIZATIONAL USERS) | ACCEPTANCE OF PIV CREDENTIALS FROM OTHER AGENCIES IA-08(01)[02]

Personal Identy Veriﬁcaon-compliant credenals from other federal agencies are electronically veriﬁed.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

IA-08(02)

IA-08(01)-Examine

IA-08(01)-Interview

[SELECT FROM: Organizaonal personnel with system operaons responsibilies; organizaonal personnel with informaon security responsibilies; system/ network administrators; system developers; organizaonal personnel with account management responsibilies].

IA-08(01)-Test

[SELECT FROM: Mechanisms supporng and/or implemenng idenﬁcaon and authencaon capabilies; mechanisms that accept and verify PIV credenals].

IDENTIFICATION AND AUTHENTICATION (NON-ORGANIZATIONAL USERS) | ACCEPTANCE OF EXTERNAL AUTHENTICATORS ASSESSMENT OBJECTIVE: Determine if: IA-08(02)(a)

only external authencators that are NIST-compliant are accepted;

IA-08(02)(b)[01]

a list of accepted external authencators is documented;

IA-08(02)(b)[02]

a list of accepted external authencators is maintained.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

IA-08(02)-Examine

[SELECT FROM: Idenﬁcaon and authencaon policy; system security plan; procedures addressing user idenﬁcaon and authencaon; system design documentaon; system conﬁguraon sengs and associated documentaon; system audit records; list of third-party credenaling products, components, or services procured and implemented by organizaon; third-party credenal veriﬁcaon records; evidence of third-party credenals; third-party credenal authorizaons; other relevant documents or records].

IA-08(02)-Interview

[SELECT FROM: Organizaonal personnel with system operaons responsibilies; organizaonal personnel with informaon security responsibilies; system/ network administrators; system developers; organizaonal personnel with account management responsibilies].

IA-08(02)-Test

[SELECT FROM: Mechanisms supporng and/or implemenng idenﬁcaon and authencaon capabilies; mechanisms that accept external credenals].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 267

NIST SP 800-53A, REV. 5

IA-08(03)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

IDENTIFICATION AND AUTHENTICATION (NON-ORGANIZATIONAL USERS) | USE OF FICAM-APPROVED PRODUCTS [WITHDRAWN: Incorporated into IA-08(02).]

IA-08(04)

IDENTIFICATION AND AUTHENTICATION (NON-ORGANIZATIONAL USERS) | USE OF DEFINED PROFILES ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

IA-08(04)_ODP

identy management proﬁles are deﬁned;

IA-08(04)

there is conformance with <IA-08(04)_ODP identy management proﬁles> for identy management.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

IA-08(05)

IA-08(04)-Examine

[SELECT FROM: Idenﬁcaon and authencaon policy; system security plan; system design documentaon; system conﬁguraon sengs and associated documentaon; system audit records; other relevant documents or records].

IA-08(04)-Interview

[SELECT FROM: Organizaonal personnel with system operaons responsibilies; organizaonal personnel with informaon security responsibilies; system/ network administrators; system developers; organizaonal personnel with account management responsibilies].

IA-08(04)-Test

[SELECT FROM: Mechanisms supporng and/or implemenng idenﬁcaon and authencaon capabilies; mechanisms supporng and/or implemenng conformance with proﬁles].

IDENTIFICATION AND AUTHENTICATION (NON-ORGANIZATIONAL USERS) | ACCEPTANCE OF PIV-I CREDENTIALS ASSESSMENT OBJECTIVE: Determine if:

IA-08(05)_ODP

a policy for using federated or PKI credenals is deﬁned;

IA-08(05)[01]

federated or PKI credenals that meet <IA-08(05)_ODP policy> are accepted;

IA-08(05)[02]

federated or PKI credenals that meet <IA-08(05)_ODP policy> are veriﬁed.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

IA-08(05)-Examine

[SELECT FROM: Idenﬁcaon and authencaon policy; system security plan; procedures addressing user idenﬁcaon and authencaon; system design documentaon; system conﬁguraon sengs and associated documentaon; system audit records; PIV-I veriﬁcaon records; evidence of PIV-I credenals; PIV-I credenal authorizaons; other relevant documents or records].

IA-08(05)-Interview

[SELECT FROM: Organizaonal personnel with system operaons responsibilies; organizaonal personnel with informaon security responsibilies; system/ network administrators; system developers; organizaonal personnel with account management responsibilies].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 268

NIST SP 800-53A, REV. 5

IA-08(05)

IDENTIFICATION AND AUTHENTICATION (NON-ORGANIZATIONAL USERS) | ACCEPTANCE OF PIV-I CREDENTIALS IA-08(05)-Test

IA-08(06)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

[SELECT FROM: Mechanisms supporng and/or implemenng idenﬁcaon and authencaon capabilies; mechanisms that accept and verify PIV-I credenals].

IDENTIFICATION AND AUTHENTICATION (NON-ORGANIZATIONAL USERS) | DISASSOCIABILITY ASSESSMENT OBJECTIVE:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

Determine if:

IA-08(06)_ODP

disassociability measures are deﬁned;

IA-08(06)

<IA-08(06)_ODP measures> to disassociate user aributes or idenﬁer asseron relaonships among individuals, credenal service providers, and relying pares are implemented.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

IA-09

IA-08(06)-Examine

IA-08(06)-Interview

[SELECT FROM: Organizaonal personnel with system operaons responsibilies; organizaonal personnel with informaon security and privacy responsibilies; system/network administrators; system developers; organizaonal personnel with account management responsibilies].

IA-08(06)-Test

[SELECT FROM: Mechanisms supporng and/or implemenng idenﬁcaon and authencaon capabilies].

SERVICE IDENTIFICATION AND AUTHENTICATION ASSESSMENT OBJECTIVE: Determine if: IA-09_ODP

system services and applicaons to be uniquely idenﬁed and authencated are deﬁned;

IA-09

<IA-09_ODP system services and applicaons> are uniquely idenﬁed and authencated before establishing communicaons with devices, users, or other services or applicaons.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: IA-09-Examine

CHAPTER FOUR

[SELECT FROM: Idenﬁcaon and authencaon policy; procedures addressing service idenﬁcaon and authencaon; system security plan; system design documentaon; security safeguards used to idenfy and authencate system services; system conﬁguraon sengs and associated documentaon; system audit records; other relevant documents or records].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 269

NIST SP 800-53A, REV. 5

IA-09

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

IA-09(01)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

SERVICE IDENTIFICATION AND AUTHENTICATION IA-09-Interview

[SELECT FROM: Organizaonal personnel with system operaons responsibilies; organizaonal personnel with informaon security responsibilies; system/network administrators; system developers; organizaonal personnel with idenﬁcaon and authencaon responsibilies].

IA-09-Test

[SELECT FROM: Security safeguards implemenng service idenﬁcaon and authencaon capabilies].

SERVICE IDENTIFICATION AND AUTHENTICATION | INFORMATION EXCHANGE [WITHDRAWN: Incorporated into IA-09.]

IA-09(02)

SERVICE IDENTIFICATION AND AUTHENTICATION | TRANSMISSION OF DECISIONS [WITHDRAWN: Incorporated into IA-09.]

IA-10

ADAPTIVE AUTHENTICATION ASSESSMENT OBJECTIVE: Determine if:

IA-10_ODP[01]

supplemental authencaon techniques or mechanisms to be employed when accessing the system under speciﬁc circumstances or situaons are deﬁned;

IA-10_ODP[02]

circumstances or situaons that require individuals accessing the system to employ supplemental authencaon techniques or mechanisms are deﬁned;

IA-10

individuals accessing the system are required to employ <IA-10_ODP[01] supplemental authencaon techniques or mechanisms> under speciﬁc <IA-10_ODP[02] circumstances or situaons>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

IA-10-Examine

[SELECT FROM: Idenﬁcaon and authencaon policy; procedures addressing adapve/supplemental idenﬁcaon and authencaon techniques or mechanisms; system security plan; system design documentaon; system conﬁguraon sengs and associated documentaon; supplemental idenﬁcaon and authencaon techniques or mechanisms; system audit records; other relevant documents or records].

IA-10-Interview

[SELECT FROM: Organizaonal personnel with system operaons responsibilies; organizaonal personnel with informaon security responsibilies; system/network administrators; system developers; organizaonal personnel with idenﬁcaon and authencaon responsibilies].

IA-10-Test

[SELECT FROM: Mechanisms supporng and/or implemenng idenﬁcaon and authencaon capabilies].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 270

NIST SP 800-53A, REV. 5

IA-11

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

RE-AUTHENTICATION ASSESSMENT OBJECTIVE: Determine if: IA-11_ODP

circumstances or situaons requiring re-authencaon are deﬁned;

IA-11

users are required to re-authencate when <IA-11_ODP circumstances or situaons>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

IA-12

IA-11-Examine

[SELECT FROM: Idenﬁcaon and authencaon policy; procedures addressing user and device re-authencaon; system security plan; system design documentaon; system conﬁguraon sengs and associated documentaon; list of circumstances or situaons requiring re-authencaon; system audit records; other relevant documents or records].

IA-11-Interview

[SELECT FROM: Organizaonal personnel with system operaons responsibilies; organizaonal personnel with informaon security responsibilies; system/network administrators; system developers; organizaonal personnel with idenﬁcaon and authencaon responsibilies].

IA-11-Test

[SELECT FROM: Mechanisms supporng and/or implemenng idenﬁcaon and authencaon capabilies].

IDENTITY PROOFING ASSESSMENT OBJECTIVE: Determine if: IA-12a.

users who require accounts for logical access to systems based on appropriate identy assurance level requirements as speciﬁed in applicable standards and guidelines are identy proofed;

IA-12b.

user idenes are resolved to a unique individual;

IA-12c.[01]

identy evidence is collected;

IA-12c.[02]

identy evidence is validated;

IA-12c.[03]

identy evidence is veriﬁed.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

IA-12-Examine

[SELECT FROM: Idenﬁcaon and authencaon policy; procedures addressing identy prooﬁng; system security plan; privacy plan; other relevant documents or records].

IA-12-Interview

[SELECT FROM: Organizaonal personnel with system operaons responsibilies; organizaonal personnel with informaon security and privacy responsibilies; legal counsel; system/network administrators; system developers; organizaonal personnel with idenﬁcaon and authencaon responsibilies].

IA-12-Test

[SELECT FROM: Mechanisms supporng and/or implemenng idenﬁcaon and authencaon capabilies].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 271

NIST SP 800-53A, REV. 5

IA-12(01)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

IDENTITY PROOFING | SUPERVISOR AUTHORIZATION ASSESSMENT OBJECTIVE: Determine if: IA-12(01)

the registraon process to receive an account for logical access includes supervisor or sponsor authorizaon.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

IA-12(02)

IA-12(01)-Examine

[SELECT FROM: Idenﬁcaon and authencaon policy; procedures addressing identy prooﬁng; system security plan; other relevant documents or records].

IA-12(01)-Interview

[SELECT FROM: Organizaonal personnel with system operaons responsibilies; organizaonal personnel with informaon security responsibilies; system/network administrators; system developers; organizaonal personnel with idenﬁcaon and authencaon responsibilies].

IA-12(01)-Test

[SELECT FROM: Mechanisms supporng and/or implemenng idenﬁcaon and authencaon capabilies].

IDENTITY PROOFING | IDENTITY EVIDENCE ASSESSMENT OBJECTIVE: Determine if: IA-12(02)

evidence of individual idenﬁcaon is presented to the registraon authority.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

IA-12(03)

IA-12(02)-Examine

[SELECT FROM: Idenﬁcaon and authencaon policy; procedures addressing identy prooﬁng; system security plan; other relevant documents or records].

IA-12(02)-Interview

[SELECT FROM: Organizaonal personnel with system operaons responsibilies; organizaonal personnel with informaon security responsibilies; system/network administrators; system developers; organizaonal personnel with idenﬁcaon and authencaon responsibilies].

IA-12(02)-Test

[SELECT FROM: Mechanisms supporng and/or implemenng idenﬁcaon and authencaon capabilies].

IDENTITY PROOFING | IDENTITY EVIDENCE VALIDATION AND VERIFICATION ASSESSMENT OBJECTIVE: Determine if:

IA-12(03)_ODP

methods of validaon and veriﬁcaon of identy evidence are deﬁned;

IA-12(03)

the presented identy evidence is validated and veriﬁed through <IA-12(03)_ODP methods of validaon and veriﬁcaon>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: IA-12(03)-Examine

CHAPTER FOUR

[SELECT FROM: Idenﬁcaon and authencaon policy; procedures addressing identy prooﬁng; system security plan; other relevant documents or records].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 272

NIST SP 800-53A, REV. 5

IA-12(03)

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

IA-12(04)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

IDENTITY PROOFING | IDENTITY EVIDENCE VALIDATION AND VERIFICATION IA-12(03)-Interview

[SELECT FROM: Organizaonal personnel with system operaons responsibilies; organizaonal personnel with informaon security responsibilies; system/network administrators; system developers; organizaonal personnel with idenﬁcaon and authencaon responsibilies].

IA-12(03)-Test

[SELECT FROM: Mechanisms supporng and/or implemenng idenﬁcaon and authencaon capabilies].

IDENTITY PROOFING | IN-PERSON VALIDATION AND VERIFICATION ASSESSMENT OBJECTIVE: Determine if: IA-12(04)

the validaon and veriﬁcaon of identy evidence is conducted in person before a designated registraon authority.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

IA-12(05)

IA-12(04)-Examine

[SELECT FROM: Idenﬁcaon and authencaon policy; procedures addressing identy prooﬁng; system security plan; other relevant documents or records].

IA-12(04)-Interview

[SELECT FROM: Organizaonal personnel with system operaons responsibilies; organizaonal personnel with informaon security responsibilies; system/network administrators; system developers; organizaonal personnel with idenﬁcaon and authencaon responsibilies].

IA-12(04)-Test

[SELECT FROM: Mechanisms supporng and/or implemenng idenﬁcaon and authencaon capabilies].

IDENTITY PROOFING | ADDRESS CONFIRMATION ASSESSMENT OBJECTIVE: Determine if:

IA-12(05)_ODP

one of the following PARAMETER VALUES is selected: {registraon code; noce of prooﬁng};

IA-12(05)

a <IA-12(05)_ODP SELECTED PARAMETER VALUE> is delivered through an out-ofband channel to verify the user’s address (physical or digital) of record.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

IA-12(05)-Examine

[SELECT FROM: Idenﬁcaon and authencaon policy; procedures addressing identy prooﬁng; system security plan; other relevant documents or records].

IA-12(05)-Interview

[SELECT FROM: Organizaonal personnel with system operaons responsibilies; organizaonal personnel with informaon security responsibilies; system/network administrators; system developers; organizaonal personnel with idenﬁcaon and authencaon responsibilies].

IA-12(05)-Test

[SELECT FROM: Mechanisms supporng and/or implemenng idenﬁcaon and authencaon capabilies].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 273

NIST SP 800-53A, REV. 5

IA-12(06)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

IDENTITY PROOFING | ACCEPT EXTERNALLY-PROOFED IDENTITIES ASSESSMENT OBJECTIVE: Determine if:

IA-12(06)_ODP

an identy assurance level for accepng externally proofed idenes is deﬁned;

IA-12(06)

externally proofed idenes are accepted <IA-12(06)_ODP identy assurance level>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5 CHAPTER FOUR

IA-12(06)-Examine

[SELECT FROM: Idenﬁcaon and authencaon policy; procedures addressing identy prooﬁng; system security plan; other relevant documents or records].

IA-12(06)-Interview

[SELECT FROM: Organizaonal personnel with system operaons responsibilies; organizaonal personnel with informaon security responsibilies; system/network administrators; system developers; organizaonal personnel with idenﬁcaon and authencaon responsibilies].

IA-12(06)-Test

[SELECT FROM: Mechanisms supporng and/or implemenng idenﬁcaon and authencaon capabilies].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 274

NIST SP 800-53A, REV. 5

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

4.8 INCIDENT RESPONSE IR-01

POLICY AND PROCEDURES ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5 CHAPTER FOUR

IR-01_ODP[01]

personnel or roles to whom the incident response policy is to be disseminated is/ are deﬁned;

IR-01_ODP[02]

personnel or roles to whom the incident response procedures are to be disseminated is/are deﬁned;

IR-01_ODP[03]

one or more of the following PARAMETER VALUES is/are selected: {organizaonlevel; mission/business process-level; system-level};

IR-01_ODP[04]

an oﬃcial to manage the incident response policy and procedures is deﬁned;

IR-01_ODP[05]

the frequency at which the current incident response policy is reviewed and updated is deﬁned;

IR-01_ODP[06]

events that would require the current incident response policy to be reviewed and updated are deﬁned;

IR-01_ODP[07]

the frequency at which the current incident response procedures are reviewed and updated is deﬁned;

IR-01_ODP[08]

events that would require the incident response procedures to be reviewed and updated are deﬁned;

IR-01a.[01]

an incident response policy is developed and documented;

IR-01a.[02]

the incident response policy is disseminated to <IR-01_ODP[01] personnel or roles>;

IR-01a.[03]

incident response procedures to facilitate the implementaon of the incident response policy and associated incident response controls are developed and documented;

IR-01a.[04]

the incident response procedures are disseminated to <IR-01_ODP[02] personnel or roles>;

IR-01a.01(a)[01]

the <IR-01_ODP[03] SELECTED PARAMETER VALUE(S)> incident response policy addresses purpose;

IR-01a.01(a)[02]

the <IR-01_ODP[03] SELECTED PARAMETER VALUE(S)> incident response policy addresses scope;

IR-01a.01(a)[03]

the <IR-01_ODP[03] SELECTED PARAMETER VALUE(S)> incident response policy addresses roles;

IR-01a.01(a)[04]

the <IR-01_ODP[03] SELECTED PARAMETER VALUE(S)> incident response policy addresses responsibilies;

IR-01a.01(a)[05]

the <IR-01_ODP[03] SELECTED PARAMETER VALUE(S)> incident response policy addresses management commitment;

IR-01a.01(a)[06]

the <IR-01_ODP[03] SELECTED PARAMETER VALUE(S)> incident response policy addresses coordinaon among organizaonal enes;

IR-01a.01(a)[07]

the <IR-01_ODP[03] SELECTED PARAMETER VALUE(S)> incident response policy addresses compliance;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 275

NIST SP 800-53A, REV. 5

IR-01

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

POLICY AND PROCEDURES

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

IR-01a.01(b)

the <IR-01_ODP[03] SELECTED PARAMETER VALUE(S)> incident response policy is consistent with applicable laws, Execuve Orders, direcves, regulaons, policies, standards, and guidelines;

IR-01b.

the <IR-01_ODP[04] oﬃcial> is designated to manage the development, documentaon, and disseminaon of the incident response policy and procedures;

IR-01c.01[01]

the current incident response policy is reviewed and updated <IR-01_ODP[05] frequency>;

IR-01c.01[02]

the current incident response policy is reviewed and updated following <IR-01_ODP[06] events>;

IR-01c.02[01]

the current incident response procedures are reviewed and updated <IR-01_ODP[07] frequency>;

IR-01c.02[02]

the current incident response procedures are reviewed and updated following <IR-01_ODP[08] events>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

IR-02

IR-01-Examine

[SELECT FROM: Incident response policy and procedures; system security plan; privacy plan; other relevant documents or records].

IR-01-Interview

[SELECT FROM: Organizaonal personnel with incident response responsibilies; organizaonal personnel with informaon security and privacy responsibilies].

INCIDENT RESPONSE TRAINING ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

IR-02_ODP[01]

a me period within which incident response training is to be provided to system users assuming an incident response role or responsibility is deﬁned;

IR-02_ODP[02]

frequency at which to provide incident response training to users is deﬁned;

IR-02_ODP[03]

frequency at which to review and update incident response training content is deﬁned;

IR-02_ODP[04]

events that iniate a review of the incident response training content are deﬁned;

IR-02a.01

incident response training is provided to system users consistent with assigned roles and responsibilies within <IR-02_ODP[01] me period> of assuming an incident response role or responsibility or acquiring system access;

IR-02a.02

incident response training is provided to system users consistent with assigned roles and responsibilies when required by system changes;

IR-02a.03

incident response training is provided to system users consistent with assigned roles and responsibilies <IR-02_ODP[02] frequency> thereaer;

IR-02b.[01]

incident response training content is reviewed and updated <IR-02_ODP[03] frequency>;

IR-02b.[02]

incident response training content is reviewed and updated following <IR-02_ODP[04] events>.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 276

NIST SP 800-53A, REV. 5

IR-02

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

INCIDENT RESPONSE TRAINING POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

IR-02(01)

IR-02-Examine

[SELECT FROM: Incident response policy; procedures addressing incident response training; incident response training curriculum; incident response training materials; privacy plan; incident response plan; incident response training records; system security plan; privacy plan; other relevant documents or records].

IR-02-Interview

[SELECT FROM: Organizaonal personnel with incident response training and operaonal responsibilies; organizaonal personnel with informaon security and privacy responsibilies].

INCIDENT RESPONSE TRAINING | SIMULATED EVENTS ASSESSMENT OBJECTIVE: Determine if: IR-02(01)

simulated events are incorporated into incident response training to facilitate the required response by personnel in crisis situaons.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

IR-02(02)

IR-02(01)-Examine

[SELECT FROM: Incident response policy; procedures addressing incident response training; incident response training curriculum; incident response training materials; incident response plan; system security plan; privacy plan; other relevant documents or records].

IR-02(01)-Interview

[SELECT FROM: Organizaonal personnel with incident response training and operaonal responsibilies; organizaonal personnel with informaon security and privacy responsibilies].

IR-02(01)-Test

[SELECT FROM: Mechanisms that support and/or implement simulated events for incident response training].

INCIDENT RESPONSE TRAINING | AUTOMATED TRAINING ENVIRONMENTS ASSESSMENT OBJECTIVE: Determine if:

IR-02(02)_ODP

automated mechanisms used in an incident response training environment are deﬁned;

IR-02(02)

an incident response training environment is provided using <IR-02(02)_ODP automated mechanisms>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: IR-02(02)-Examine

CHAPTER FOUR

[SELECT FROM: Incident response policy; procedures addressing incident response training; incident response training curriculum; incident response training materials; automated mechanisms supporng incident response training; incident response plan; system security plan; privacy plan; other relevant documents or records].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 277

NIST SP 800-53A, REV. 5

IR-02(02)

IR-02(03)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

INCIDENT RESPONSE TRAINING | AUTOMATED TRAINING ENVIRONMENTS IR-02(02)-Interview

[SELECT FROM: Organizaonal personnel with incident response training and operaonal responsibilies; organizaonal personnel with informaon security and privacy responsibilies].

IR-02(02)-Test

[SELECT FROM: Automated mechanisms that provide a thorough and realisc incident response training environment].

INCIDENT RESPONSE TRAINING | BREACH

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

ASSESSMENT OBJECTIVE: Determine if:

IR-02(03)[01]

incident response training on how to idenfy and respond to a breach is provided;

IR-02(03)[02]

incident response training on the organizaon’s process for reporng a breach is provided.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

IR-03

IR-02(03)-Examine

[SELECT FROM: Incident response policy; conngency planning policy; procedures addressing incident response tesng; procedures addressing conngency plan tesng; incident response tesng material; incident response test results; incident response test plan; incident response plan; conngency plan; system security plan; privacy plan; other relevant documents or records].

IR-02(03)-Interview

[SELECT FROM: Organizaonal personnel with incident response training responsibilies; organizaonal personnel with informaon security and privacy responsibilies].

INCIDENT RESPONSE TESTING ASSESSMENT OBJECTIVE: Determine if:

IR-03_ODP[01]

frequency at which to test the eﬀecveness of the incident response capability for the system is deﬁned;

IR-03_ODP[02]

tests used to test the eﬀecveness of the incident response capability for the system are deﬁned;

IR-03

the eﬀecveness of the incident response capability for the system is tested <IR-03_ODP[01] frequency> using <IR-03_ODP[02] tests>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

IR-03-Examine

IR-03-Interview

[SELECT FROM: Organizaonal personnel with incident response tesng responsibilies; organizaonal personnel with informaon security and privacy responsibilies].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 278

NIST SP 800-53A, REV. 5

IR-03(01)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

INCIDENT RESPONSE TESTING | AUTOMATED TESTING ASSESSMENT OBJECTIVE: Determine if:

IR-03(01)_ODP

automated mechanisms used to test the incident response capability are deﬁned;

IR-03(01)

the incident response capability is tested using <IR-03(01)_ODP automated mechanisms>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

IR-03(02)

IR-03(01)-Examine

[SELECT FROM: Incident response policy; conngency planning policy; procedures addressing incident response tesng; procedures addressing conngency plan tesng; incident response tesng documentaon; incident response test results; incident response test plan; incident response plan; conngency plan; system security plan; automated mechanisms supporng incident response tests; other relevant documents or records].

IR-03(01)-Interview

[SELECT FROM: Organizaonal personnel with incident response tesng responsibilies; organizaonal personnel with informaon security responsibilies].

IR-03(01)-Test

[SELECT FROM: Automated mechanisms that more thoroughly and eﬀecvely test the incident response capability].

INCIDENT RESPONSE TESTING | COORDINATION WITH RELATED PLANS ASSESSMENT OBJECTIVE: Determine if: IR-03(02)

incident response tesng is coordinated with organizaonal elements responsible for related plans.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

IR-03(03)

IR-03(02)-Examine

[SELECT FROM: Incident response policy; conngency planning policy; procedures addressing incident response tesng; incident response tesng documentaon; incident response plan; business connuity plans; conngency plans; disaster recovery plans; connuity of operaons plans; crisis communicaons plans; crical infrastructure plans; occupant emergency plans; system security plan; privacy plan; other relevant documents or records].

IR-03(02)-Interview

[SELECT FROM: Organizaonal personnel with incident response tesng responsibilies; organizaonal personnel with responsibilies for tesng organizaonal plans related to incident response tesng; organizaonal personnel with informaon security and privacy responsibilies].

INCIDENT RESPONSE TESTING | CONTINUOUS IMPROVEMENT ASSESSMENT OBJECTIVE: Determine if:

IR-03(03)(a)[01]

CHAPTER FOUR

qualitave data from tesng are used to determine the eﬀecveness of incident response processes;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 279

NIST SP 800-53A, REV. 5

IR-03(03)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

INCIDENT RESPONSE TESTING | CONTINUOUS IMPROVEMENT

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

IR-03(03)(a)[02]

quantave data from tesng are used to determine the eﬀecveness of incident response processes;

IR-03(03)(b)[01]

qualitave data from tesng are used to connuously improve incident response processes;

IR-03(03)(b)[02]

quantave data from tesng are used to connuously improve incident response processes;

IR-03(03)(c)[01]

qualitave data from tesng are used to provide incident response measures and metrics that are accurate;

IR-03(03)(c)[02]

quantave data from tesng are used to provide incident response measures and metrics that are accurate;

IR-03(03)(c)[03]

qualitave data from tesng are used to provide incident response measures and metrics that are consistent;

IR-03(03)(c)[04]

quantave data from tesng are used to provide incident response measures and metrics that are consistent;

IR-03(03)(c)[05]

qualitave data from tesng are used to provide incident response measures and metrics in a reproducible format;

IR-03(03)(c)[06]

quantave data from tesng are used to provide incident response measures and metrics in a reproducible format.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

IR-04

IR-03(03)-Examine

IR-03(03)-Interview

INCIDENT HANDLING ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

IR-04a.[01]

an incident handling capability for incidents is implemented that is consistent with the incident response plan;

IR-04a.[02]

the incident handling capability for incidents includes preparaon;

IR-04a.[03]

the incident handling capability for incidents includes detecon and analysis;

IR-04a.[04]

the incident handling capability for incidents includes containment;

IR-04a.[05]

the incident handling capability for incidents includes eradicaon;

IR-04a.[06]

the incident handling capability for incidents includes recovery;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 280

NIST SP 800-53A, REV. 5

IR-04

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

INCIDENT HANDLING

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

IR-04b.

incident handling acvies are coordinated with conngency planning acvies;

IR-04c.[01]

lessons learned from ongoing incident handling acvies are incorporated into incident response procedures, training, and tesng;

IR-04c.[02]

the changes resulng from the incorporated lessons learned are implemented accordingly;

IR-04d.[01]

the rigor of incident handling acvies is comparable and predictable across the organizaon;

IR-04d.[02]

the intensity of incident handling acvies is comparable and predictable across the organizaon;

IR-04d.[03]

the scope of incident handling acvies is comparable and predictable across the organizaon;

IR-04d.[04]

the results of incident handling acvies are comparable and predictable across the organizaon.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

IR-04(01)

IR-04-Examine

[SELECT FROM: Incident response policy; conngency planning policy; procedures addressing incident handling; incident response plan; conngency plan; system security plan; privacy plan; other relevant documents or records].

IR-04-Interview

[SELECT FROM: Organizaonal personnel with incident handling responsibilies; organizaonal personnel with conngency planning responsibilies; organizaonal personnel with informaon security and privacy responsibilies].

IR-04-Test

[SELECT FROM: Incident handling capability for the organizaon].

INCIDENT HANDLING | AUTOMATED INCIDENT HANDLING PROCESSES ASSESSMENT OBJECTIVE: Determine if:

IR-04(01)_ODP

automated mechanisms used to support the incident handling process are deﬁned;

IR-04(01)

the incident handling process is supported using <IR-04(01)_ODP automated mechanisms>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

IR-04(01)-Examine

[SELECT FROM: Incident response policy; procedures addressing incident handling; automated mechanisms supporng incident handling; system design documentaon; system conﬁguraon sengs and associated documentaon; system audit records; incident response plan; system security plan; other relevant documents or records].

IR-04(01)-Interview

[SELECT FROM: Organizaonal personnel with incident handling responsibilies; organizaonal personnel with informaon security responsibilies].

IR-04(01)-Test

[SELECT FROM: Automated mechanisms that support and/or implement the incident handling process].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 281

NIST SP 800-53A, REV. 5

IR-04(02)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

INCIDENT HANDLING | DYNAMIC RECONFIGURATION ASSESSMENT OBJECTIVE: Determine if:

IR-04(02)_ODP[01]

types of dynamic reconﬁguraon for system components are deﬁned;

IR-04(02)_ODP[02]

system components that require dynamic reconﬁguraon are deﬁned;

IR-04(02)

<IR-04(02)_ODP[01] types of dynamic reconﬁguraon> for <IR-04(02)_ODP[02] system components> are included as part of the incident response capability.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

IR-04(03)

IR-04(02)-Examine

[SELECT FROM: Incident response policy; procedures addressing incident handling; mechanisms supporng incident handling; list of system components to be dynamically reconﬁgured as part of incident response capability; system design documentaon; system conﬁguraon sengs and associated documentaon; system audit records; incident response plan; system security plan; other relevant documents or records].

IR-04(02)-Interview

[SELECT FROM: Organizaonal personnel with incident handling responsibilies; organizaonal personnel with informaon security responsibilies].

IR-04(02)-Test

[SELECT FROM: Mechanisms that support and/or implement the dynamic reconﬁguraon of components as part of incident response].

INCIDENT HANDLING | CONTINUITY OF OPERATIONS ASSESSMENT OBJECTIVE: Determine if:

IR-04(03)_ODP[01]

classes of incidents requiring an organizaon-deﬁned acon (deﬁned in IR-04(03)_ODP[02]) to be taken are deﬁned;

IR-04(03)_ODP[02]

acons to be taken in response to organizaon-deﬁned classes of incidents are deﬁned;

IR-04(03)[01]

<IR-04(03)_ODP[01] classes of incidents> are idenﬁed;

IR-04(03)[02]

<IR-04(03)_ODP[02] acons> are taken in response to those incidents (deﬁned in IR-04(03)_ODP[01]) to ensure the connuaon of organizaonal mission and business funcons.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

IR-04(03)-Examine

[SELECT FROM: Incident response policy; procedures addressing incident handling; incident response plan; privacy plan; list of classes of incidents; list of appropriate incident response acons; system security plan; other relevant documents or records].

IR-04(03)-Interview

[SELECT FROM: Organizaonal personnel with incident handling responsibilies; organizaonal personnel with informaon security responsibilies].

IR-04(03)-Test

[SELECT FROM: Mechanisms that support and/or implement connuity of operaons].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 282

NIST SP 800-53A, REV. 5

IR-04(04)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

INCIDENT HANDLING | INFORMATION CORRELATION ASSESSMENT OBJECTIVE: Determine if: IR-04(04)

incident informaon and individual incident responses are correlated to achieve an organizaon-wide perspecve on incident awareness and response.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

IR-04(05)

IR-04(04)-Examine

[SELECT FROM: Incident response policy; procedures addressing incident handling; incident response plan; privacy plan; mechanisms supporng incident and event correlaon; system design documentaon; system conﬁguraon sengs and associated documentaon; system security plan; privacy plan; incident management correlaon logs; event management correlaon logs; security informaon and event management logs; incident management correlaon reports; event management correlaon reports; security informaon and event management reports; audit records; other relevant documents or records].

IR-04(04)-Interview

[SELECT FROM: Organizaonal personnel with incident handling responsibilies; organizaonal personnel with informaon security and privacy responsibilies; organizaonal personnel with whom incident informaon and individual incident responses are to be correlated].

IR-04(04)-Test

[SELECT FROM: Organizaonal processes for correlang incident informaon and individual incident responses; mechanisms that support and or implement the correlaon of incident response informaon with individual incident responses].

INCIDENT HANDLING | AUTOMATIC DISABLING OF SYSTEM ASSESSMENT OBJECTIVE: Determine if:

IR-04(05)_ODP

security violaons that automacally disable a system are deﬁned;

IR-04(05)

a conﬁgurable capability is implemented to automacally disable the system if <IR-04(05)_ODP security violaons> are detected.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

IR-04(05)-Examine

[SELECT FROM: Incident response policy; procedures addressing incident handling; automated mechanisms supporng incident handling; system design documentaon; system conﬁguraon sengs and associated documentaon; system security plan; incident response plan; privacy plan; other relevant documents or records].

IR-04(05)-Interview

[SELECT FROM: Organizaonal personnel with incident handling responsibilies; organizaonal personnel with informaon security responsibilies; system developers].

IR-04(05)-Test

[SELECT FROM: Incident handling capability for the organizaon; automated mechanisms supporng and/or implemenng automac disabling of the system].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 283

NIST SP 800-53A, REV. 5

IR-04(06)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

INCIDENT HANDLING | INSIDER THREATS ASSESSMENT OBJECTIVE: Determine if: IR-04(06)

an incident handling capability is implemented for incidents involving insider threats.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

IR-04(07)

IR-04(06)-Examine

[SELECT FROM: Incident response policy; procedures addressing incident handling; mechanisms supporng incident handling; system design documentaon; system conﬁguraon sengs and associated documentaon; incident response plan; system security plan; audit records; other relevant documents or records].

IR-04(06)-Interview

[SELECT FROM: Organizaonal personnel with incident handling responsibilies; organizaonal personnel with informaon security responsibilies].

IR-04(06)-Test

[SELECT FROM: Incident handling capability for the organizaon].

INCIDENT HANDLING | INSIDER THREATS — INTRA-ORGANIZATION COORDINATION ASSESSMENT OBJECTIVE: Determine if:

IR-04(07)_ODP

enes that require coordinaon for an incident handling capability for insider threats are deﬁned;

IR-04(07)[01]

an incident handling capability is coordinated for insider threats;

IR-04(07)[02]

the coordinated incident handling capability includes <IR-04(07)_ODP enes>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

IR-04(08)

IR-04(07)-Examine

[SELECT FROM: Incident response policy; procedures addressing incident handling; incident response plan; insider threat program plan; insider threat CONOPS; system security plan; privacy plan; other relevant documents or records].

IR-04(07)-Interview

[SELECT FROM: Organizaonal personnel with incident handling responsibilies; organizaonal personnel with informaon security and privacy responsibilies; organizaonal personnel/elements with whom the incident handling capability is to be coordinated].

IR-04(07)-Test

[SELECT FROM: Organizaonal processes for coordinang incident handling].

INCIDENT HANDLING | CORRELATION WITH EXTERNAL ORGANIZATIONS ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

IR-04(08)_ODP[01]

external organizaons with whom organizaonal incident informaon is to be coordinated and shared are deﬁned;

IR-04(08)_ODP[02]

incident informaon to be correlated and shared with organizaon-deﬁned external organizaons are deﬁned;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 284

NIST SP 800-53A, REV. 5

IR-04(08)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

INCIDENT HANDLING | CORRELATION WITH EXTERNAL ORGANIZATIONS IR-04(08)

there is coordinaon with <IR-04(08)_ODP[01] external organizaons> to correlate and share <IR-04(08)_ODP[02] incident informaon> to achieve a cross-organizaon perspecve on incident awareness and more eﬀecve incident responses.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

IR-04(09)

IR-04(08)-Examine

[SELECT FROM: Incident response policy; procedures addressing incident handling; list of external organizaons; records of incident handling coordinaon with external organizaons; incident response plan; system security plan; privacy plan; other relevant documents or records].

IR-04(08)-Interview

[SELECT FROM: Organizaonal personnel with incident handling responsibilies; organizaonal personnel with informaon security and privacy responsibilies; personnel from external organizaons with whom incident response informaon is to be coordinated, shared, and correlated].

IR-04(08)-Test

[SELECT FROM: Organizaonal processes for coordinang incident handling informaon with external organizaons].

INCIDENT HANDLING | DYNAMIC RESPONSE CAPABILITY ASSESSMENT OBJECTIVE: Determine if:

IR-04(09)_ODP

dynamic response capabilies to be employed to respond to incidents are deﬁned;

IR-04(09)

<IR-04(09)_ODP dynamic response capabilies> are employed to respond to incidents.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

IR-04(10)

IR-04(09)-Examine

[SELECT FROM: Incident response policy; procedures addressing incident handling; automated mechanisms supporng dynamic response capabilies; system design documentaon; system conﬁguraon sengs and associated documentaon; incident response plan; system security plan; audit records; other relevant documents or records].

IR-04(09)-Interview

[SELECT FROM: Organizaonal personnel with incident handling responsibilies; organizaonal personnel with informaon security responsibilies].

IR-04(09)-Test

[SELECT FROM: Organizaonal processes for dynamic response capability; automated mechanisms supporng and/or implemenng the dynamic response capability for the organizaon].

INCIDENT HANDLING | SUPPLY CHAIN COORDINATION ASSESSMENT OBJECTIVE: Determine if: IR-04(10)

CHAPTER FOUR

incident handling acvies involving supply chain events are coordinated with other organizaons involved in the supply chain.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 285

NIST SP 800-53A, REV. 5

IR-04(10)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

INCIDENT HANDLING | SUPPLY CHAIN COORDINATION POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

IR-04(11)

IR-04(10)-Examine

[SELECT FROM: Incident response policy; procedures addressing supply chain coordinaon and supply chain risk informaon sharing with the Federal Acquision Security Council; acquision contracts; service-level agreements; incident response plan; supply chain risk management plan; system security plan; incident response plans of other organizaon involved in supply chain acvies; other relevant documents or records].

IR-04(10)-Interview

[SELECT FROM: Organizaonal personnel with incident handling responsibilies; organizaonal personnel with mission and business responsibilies; organizaonal personnel with legal responsibilies; organizaonal personnel with informaon security responsibilies; organizaonal personnel with supply chain risk management responsibilies; organizaonal personnel with acquision responsibilies].

INCIDENT HANDLING | INTEGRATED INCIDENT RESPONSE TEAM ASSESSMENT OBJECTIVE: Determine if:

IR-04(11)_ODP

the me period within which an integrated incident response team can be deployed is deﬁned;

IR-04(11)[01]

an integrated incident response team is established and maintained;

IR-04(11)[02]

the integrated incident response team can be deployed to any locaon idenﬁed by the organizaon in <IR-04(11)_ODP me period>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

IR-04(12)

IR-04(11)-Examine

[SELECT FROM: Incident response policy; procedures addressing incident handling; procedures addressing incident response planning; incident response plan; system security plan; privacy plan; other relevant documents or records].

IR-04(11)-Interview

[SELECT FROM: Organizaonal personnel with incident handling responsibilies; organizaonal personnel with informaon security and privacy responsibilies; members of the integrated incident response team].

INCIDENT HANDLING | MALICIOUS CODE AND FORENSIC ANALYSIS ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

IR-04(12)[01]

malicious code remaining in the system is analyzed aer the incident;

IR-04(12)[02]

other residual arfacts remaining in the system (if any) are analyzed aer the incident.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 286

NIST SP 800-53A, REV. 5

IR-04(12)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

INCIDENT HANDLING | MALICIOUS CODE AND FORENSIC ANALYSIS POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

IR-04(13)

IR-04(12)-Examine

[SELECT FROM: Incident response policy; procedures addressing incident handling; procedures addressing code and forensic analysis; procedures addressing incident response; incident response plan; system design documentaon; malicious code protecon mechanisms, tools, and techniques; results from malicious code analyses; system security plan; system audit records; other relevant documents or records].

IR-04(12)-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies; organizaonal personnel installing, conﬁguring, and/or maintaining the system; organizaonal personnel with responsibility for malicious code protecon; organizaonal personnel responsible for incident response/management].

IR-04(12)-Test

[SELECT FROM: Organizaonal process for incident response; organizaonal processes for conducng forensic analysis; tools and techniques for analysis of malicious code characteriscs and behavior].

INCIDENT HANDLING | BEHAVIOR ANALYSIS ASSESSMENT OBJECTIVE: Determine if:

IR-04(13)_ODP

environments or resources which may contain or may be related to anomalous or suspected adversarial behavior are deﬁned;

IR-04(13)

anomalous or suspected adversarial behavior in or related to <IR-04(13)_ODP environments or resources> are analyzed.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

IR-04(14)

IR-04(13)-Examine

[SELECT FROM: Incident response policy; procedures addressing system monitoring tools and techniques; incident response plan; system monitoring logs or records; system monitoring tools and techniques documentaon; system conﬁguraon sengs and associated documentaon; security plan; system component inventory; network diagram; system protocols documentaon; list of acceptable thresholds for false posives and false negaves; system security plan; other relevant documents or records].

IR-04(13)-Interview

[SELECT FROM: Organizaonal personnel with informaon security responsibilies; system/network administrators].

IR-04(13)-Test

[SELECT FROM: Organizaonal processes for detecng anomalous behavior].

INCIDENT HANDLING | SECURITY OPERATIONS CENTER ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

IR-04(14)[01]

a security operaons center is established;

IR-04(14)[02]

a security operaons center is maintained.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 287

NIST SP 800-53A, REV. 5

IR-04(14)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

INCIDENT HANDLING | SECURITY OPERATIONS CENTER POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

IR-04(15)

IR-04(14)-Examine

[SELECT FROM: Incident response policy; conngency planning policy; procedures addressing incident handling; procedures addressing the security operaons center operaons; mechanisms supporng dynamic response capabilies; incident response plan; conngency plan; system security plan; other relevant documents or records].

IR-04(14)-Interview

[SELECT FROM: Organizaonal personnel with incident handling responsibilies; organizaonal personnel with conngency planning responsibilies; security operaons center personnel; organizaonal personnel with informaon security responsibilies].

IR-04(14)-Test

[SELECT FROM: Mechanisms that support and/or implement the security operaons center capability; mechanisms that support and/or implement the incident handling process].

INCIDENT HANDLING | PUBLIC RELATIONS AND REPUTATION REPAIR ASSESSMENT OBJECTIVE: Determine if: IR-04(15)(a)

public relaons associated with an incident are managed;

IR-04(15)(b)

measures are employed to repair the reputaon of the organizaon.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

IR-05

IR-04(15)-Examine

[SELECT FROM: Incident response policy; procedures addressing incident response; procedures addressing incident handling; incident response plan; system security plan; other relevant documents or records].

IR-04(15)-Interview

[SELECT FROM: Organizaonal personnel with incident handling responsibilies; organizaonal personnel with informaon security responsibilies; organizaonal personnel with communicaons or public relaons responsibilies].

INCIDENT MONITORING ASSESSMENT OBJECTIVE: Determine if: IR-05[01]

incidents are tracked;

IR-05[02]

incidents are documented.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

IR-05-Examine

[SELECT FROM: Incident response policy; procedures addressing incident monitoring; incident response records and documentaon; incident response plan; system security plan; privacy plan; other relevant documents or records].

IR-05-Interview

[SELECT FROM: Organizaonal personnel with incident monitoring responsibilies; organizaonal personnel with informaon security and privacy responsibilies].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 288

NIST SP 800-53A, REV. 5

IR-05

INCIDENT MONITORING IR-05-Test

IR-05(01)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

[SELECT FROM: Incident monitoring capability for the organizaon; mechanisms supporng and/or implemenng the tracking and documenng of system security incidents].

INCIDENT MONITORING | AUTOMATED TRACKING, DATA COLLECTION, AND ANALYSIS ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

IR-05(01)_ODP[01]

automated mechanisms used to track incidents are deﬁned;

IR-05(01)_ODP[02]

automated mechanisms used to collect incident informaon are deﬁned;

IR-05(01)_ODP[03]

automated mechanisms used to analyze incident informaon are deﬁned;

IR-05(01)[01]

incidents are tracked using <IR-05(01)_ODP[01] automated mechanisms>;

IR-05(01)[02]

incident informaon is collected using <IR-05(01)_ODP[02] automated mechanisms>;

IR-05(01)[03]

incident informaon is analyzed using <IR-05(01)_ODP[03] automated mechanisms>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

IR-06

IR-05(01)-Examine

[SELECT FROM: Incident response policy; procedures addressing incident monitoring; incident response records and documentaon; system security plan; incident response plan; other relevant documents or records].

IR-05(01)-Interview

[SELECT FROM: Organizaonal personnel with incident monitoring responsibilies; organizaonal personnel with informaon security responsibilies].

IR-05(01)-Test

[SELECT FROM: Incident monitoring capability for the organizaon; automated mechanisms supporng and/or implemenng the tracking and documenng of system security incidents].

INCIDENT REPORTING ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

IR-06_ODP[01]

me period for personnel to report suspected incidents to the organizaonal incident response capability is deﬁned;

IR-06_ODP[02]

authories to whom incident informaon is to be reported are deﬁned;

IR-06a.

personnel is/are required to report suspected incidents to the organizaonal incident response capability within <IR-06_ODP[01] me period>;

IR-06b.

incident informaon is reported to <IR-06_ODP[02] authories>.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 289

NIST SP 800-53A, REV. 5

IR-06

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

INCIDENT REPORTING POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

IR-06(01)

IR-06-Examine

[SELECT FROM: Incident response policy; procedures addressing incident reporng; incident reporng records and documentaon; incident response plan; system security plan; privacy plan; other relevant documents or records].

IR-06-Interview

[SELECT FROM: Organizaonal personnel with incident reporng responsibilies; organizaonal personnel with informaon security and privacy responsibilies; personnel who have/should have reported incidents; personnel (authories) to whom incident informaon is to be reported; system users].

IR-06-Test

[SELECT FROM: Organizaonal processes for incident reporng; mechanisms supporng and/or implemenng incident reporng].

INCIDENT REPORTING | AUTOMATED REPORTING ASSESSMENT OBJECTIVE: Determine if:

IR-06(01)_ODP

automated mechanisms used for reporng incidents are deﬁned;

IR-06(01)

incidents are reported using <IR-06(01)_ODP automated mechanisms>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

IR-06(02)

IR-06(01)-Examine

[SELECT FROM: Incident response policy; procedures addressing incident reporng; automated mechanisms supporng incident reporng; system design documentaon; system conﬁguraon sengs and associated documentaon; incident response plan; system security plan; other relevant documents or records].

IR-06(01)-Interview

[SELECT FROM: Organizaonal personnel with incident reporng responsibilies; organizaonal personnel with informaon security responsibilies].

IR-06(01)-Test

[SELECT FROM: Organizaonal processes for incident reporng; automated mechanisms supporng and/or implemenng the reporng of security incidents].

INCIDENT REPORTING | VULNERABILITIES RELATED TO INCIDENTS ASSESSMENT OBJECTIVE: Determine if:

IR-06(02)_ODP

personnel or roles to whom system vulnerabilies associated with reported incidents are reported to is/are deﬁned;

IR-06(02)

system vulnerabilies associated with reported incidents are reported to <IR-06(02)_ODP personnel or roles>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: IR-06(02)-Examine

CHAPTER FOUR

[SELECT FROM: Incident response policy; procedures addressing incident reporng; incident response plan; system security plan; privacy plan; security incident reports and associated system vulnerabilies; other relevant documents or records].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 290

NIST SP 800-53A, REV. 5

IR-06(02)

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

IR-06(03)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

INCIDENT REPORTING | VULNERABILITIES RELATED TO INCIDENTS IR-06(02)-Interview

[SELECT FROM: Organizaonal personnel with incident reporng responsibilies; organizaonal personnel with informaon security and privacy responsibilies; system/network administrators; personnel to whom vulnerabilies associated with security incidents are to be reported].

IR-06(02)-Test

[SELECT FROM: Organizaonal processes for incident reporng; mechanisms supporng and/or implemenng the reporng of vulnerabilies associated with security incidents].

INCIDENT REPORTING | SUPPLY CHAIN COORDINATION ASSESSMENT OBJECTIVE: Determine if: IR-06(03)

incident informaon is provided to the provider of the product or service and other organizaons involved in the supply chain or supply chain governance for systems or system components related to the incident.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

IR-07

IR-06(03)-Examine

[SELECT FROM: Incident response policy; procedures addressing supply chain coordinaon and supply chain risk informaon sharing with the Federal Acquision Security Council; acquision policy; acquision contracts; service-level agreements; incident response plan; supply chain risk management plan; system security plan; plans of other organizaons involved in supply chain acvies; other relevant documents or records].

IR-06(03)-Interview

[SELECT FROM: Organizaonal personnel with incident reporng responsibilies; organizaonal personnel with informaon security responsibilies; organizaonal personnel with supply chain risk management responsibilies; organizaon personnel with acquision responsibilies].

IR-06(03)-Test

[SELECT FROM: Organizaonal processes for incident reporng; organizaonal processes for supply chain risk informaon sharing; mechanisms supporng and/or implemenng the reporng of incident informaon involved in the supply chain].

INCIDENT RESPONSE ASSISTANCE ASSESSMENT OBJECTIVE: Determine if: IR-07[01]

an incident response support resource, integral to the organizaonal incident response capability, is provided;

IR-07[02]

the incident response support resource oﬀers advice and assistance to users of the system for the response and reporng of incidents.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: IR-07-Examine

CHAPTER FOUR

[SELECT FROM: Incident response policy; procedures addressing incident response assistance; incident response plan; system security plan; privacy plan; other relevant documents or records].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 291

NIST SP 800-53A, REV. 5

IR-07

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

IR-07(01)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

INCIDENT RESPONSE ASSISTANCE IR-07-Interview

[SELECT FROM: Organizaonal personnel with incident response assistance and support responsibilies; organizaonal personnel with access to incident response support and assistance capability; organizaonal personnel with informaon security and privacy responsibilies].

IR-07-Test

[SELECT FROM: Organizaonal processes for incident response assistance; mechanisms supporng and/or implemenng incident response assistance].

INCIDENT RESPONSE ASSISTANCE | AUTOMATION SUPPORT FOR AVAILABILITY OF INFORMATION AND SUPPORT ASSESSMENT OBJECTIVE: Determine if:

IR-07(01)_ODP

automated mechanisms used to increase the availability of incident response informaon and support are deﬁned;

IR-07(01)

the availability of incident response informaon and support is increased using <IR-07(01)_ODP automated mechanisms>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

IR-07(02)

IR-07(01)-Examine

[SELECT FROM: Incident response policy; procedures addressing incident response assistance; automated mechanisms supporng incident response support and assistance; system design documentaon; system conﬁguraon sengs and associated documentaon; incident response plan; system security plan; other relevant documents or records].

IR-07(01)-Interview

[SELECT FROM: Organizaonal personnel with incident response support and assistance responsibilies; organizaonal personnel with access to incident response support and assistance capability; organizaonal personnel with informaon security responsibilies].

IR-07(01)-Test

[SELECT FROM: Organizaonal processes for incident response assistance; automated mechanisms supporng and/or implemenng an increase in the availability of incident response informaon and support].

INCIDENT RESPONSE ASSISTANCE | COORDINATION WITH EXTERNAL PROVIDERS ASSESSMENT OBJECTIVE: Determine if: IR-07(02)(a)

a direct, cooperave relaonship is established between its incident response capability and external providers of the system protecon capability;

IR-07(02)(b)

organizaonal incident response team members are idenﬁed to the external providers.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: IR-07(02)-Examine

CHAPTER FOUR

[SELECT FROM: Incident response policy; procedures addressing incident response assistance; incident response plan; system security plan; privacy plan; other relevant documents or records].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 292

NIST SP 800-53A, REV. 5

IR-07(02)

INCIDENT RESPONSE ASSISTANCE | COORDINATION WITH EXTERNAL PROVIDERS IR-07(02)-Interview

IR-08

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

[SELECT FROM: Organizaonal personnel with incident response support and assistance responsibilies; external providers of system protecon capability; organizaonal personnel with informaon security and privacy responsibilies].

INCIDENT RESPONSE PLAN ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5 CHAPTER FOUR

IR-08_ODP[01]

personnel or roles that review and approve the incident response plan is/are idenﬁed;

IR-08_ODP[02]

the frequency at which to review and approve the incident response plan is deﬁned;

IR-08_ODP[03]

enes, personnel, or roles with designated responsibility for incident response are deﬁned;

IR-08_ODP[04]

incident response personnel (idenﬁed by name and/or by role) to whom copies of the incident response plan are to be distributed is/are deﬁned;

IR-08_ODP[05]

organizaonal elements to which copies of the incident response plan are to be distributed are deﬁned;

IR-08_ODP[06]

incident response personnel (idenﬁed by name and/or by role) to whom changes to the incident response plan is/are communicated are deﬁned;

IR-08_ODP[07]

organizaonal elements to which changes to the incident response plan are communicated are deﬁned;

IR-08a.01

an incident response plan is developed that provides the organizaon with a roadmap for implemenng its incident response capability;

IR-08a.02

an incident response plan is developed that describes the structure and organizaon of the incident response capability;

IR-08a.03

an incident response plan is developed that provides a high-level approach for how the incident response capability ﬁts into the overall organizaon;

IR-08a.04

an incident response plan is developed that meets the unique requirements of the organizaon with regard to mission, size, structure, and funcons;

IR-08a.05

an incident response plan is developed that deﬁnes reportable incidents;

IR-08a.06

an incident response plan is developed that provides metrics for measuring the incident response capability within the organizaon;

IR-08a.07

an incident response plan is developed that deﬁnes the resources and management support needed to eﬀecvely maintain and mature an incident response capability;

IR-08a.08

an incident response plan is developed that addresses the sharing of incident informaon;

IR-08a.09

an incident response plan is developed that is reviewed and approved by <IR-08_ODP[01] personnel or roles> <IR-08_ODP[02] frequency>;

IR-08a.10

an incident response plan is developed that explicitly designates responsibility for incident response to <IR-08_ODP[03] enes, personnel, or roles>.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 293

NIST SP 800-53A, REV. 5

IR-08

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

INCIDENT RESPONSE PLAN

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

IR-08b.[01]

copies of the incident response plan are distributed to <IR-08_ODP[04] incident response personnel>;

IR-08b.[02]

copies of the incident response plan are distributed to <IR-08_ODP[05] organizaonal elements>;

IR-08c.

the incident response plan is updated to address system and organizaonal changes or problems encountered during plan implementaon, execuon, or tesng;

IR-08d.[01]

incident response plan changes are communicated to <IR-08_ODP[06] incident response personnel>;

IR-08d.[02]

incident response plan changes are communicated to <IR-08_ODP[07] organizaonal elements>;

IR-08e.[01]

the incident response plan is protected from unauthorized disclosure;

IR-08e.[02]

the incident response plan is protected from unauthorized modiﬁcaon.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

IR-08(01)

IR-08-Examine

[SELECT FROM: Incident response policy; procedures addressing incident response planning; incident response plan; system security plan; privacy plan; records of incident response plan reviews and approvals; other relevant documents or records].

IR-08-Interview

[SELECT FROM: Organizaonal personnel with incident response planning responsibilies; organizaonal personnel with informaon security and privacy responsibilies].

IR-08-Test

[SELECT FROM: Organizaonal incident response plan and related organizaonal processes].

INCIDENT RESPONSE PLAN | BREACHES ASSESSMENT OBJECTIVE: Determine if: IR-08(01)(a)

the incident response plan for breaches involving personally idenﬁable informaon includes a process to determine if noce to individuals or other organizaons, including oversight organizaons, is needed;

IR-08(01)(b)

the incident response plan for breaches involving personally idenﬁable informaon includes an assessment process to determine the extent of the harm, embarrassment, inconvenience, or unfairness to aﬀected individuals and any mechanisms to migate such harms;

IR-08(01)(c)

the incident response plan for breaches involving personally idenﬁable informaon includes the idenﬁcaon of applicable privacy requirements.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: IR-08(01)-Examine

CHAPTER FOUR

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 294

NIST SP 800-53A, REV. 5

IR-08(01)

IR-09

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

INCIDENT RESPONSE PLAN | BREACHES IR-08(01)-Interview

[SELECT FROM: Organizaonal personnel with incident response planning responsibilies; organizaonal personnel with informaon security and privacy responsibilies].

IR-08(01)-Test

[SELECT FROM: Organizaonal incident response plan and related organizaonal processes].

INFORMATION SPILLAGE RESPONSE

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

ASSESSMENT OBJECTIVE: Determine if:

IR-09_ODP[01]

personnel or roles assigned the responsibility for responding to informaon spills is/are deﬁned;

IR-09_ODP[02]

personnel or roles to be alerted of the informaon spill using a method of communicaon not associated with the spill is/are deﬁned;

IR-09_ODP[03]

acons to be performed are deﬁned;

IR-09a.

<IR-09_ODP[01] personnel or roles> is/are assigned the responsibility to respond to informaon spills;

IR-09b.

the speciﬁc informaon involved in the system contaminaon is idenﬁed in response to informaon spills;

IR-09c.

<IR-09_ODP[02] personnel or roles> is/are alerted of the informaon spill using a method of communicaon not associated with the spill;

IR-09d.

the contaminated system or system component is isolated in response to informaon spills;

IR-09e.

the informaon is eradicated from the contaminated system or component in response to informaon spills;

IR-09f.

other systems or system components that may have been subsequently contaminated are idenﬁed in response to informaon spills;

IR-09g.

<IR-09_ODP[03] acons> are performed in response to informaon spills.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

IR-09-Examine

[SELECT FROM: Incident response policy; procedures addressing informaon spillage; incident response plan; system security plan; records of informaon spillage alerts/noﬁcaons; list of personnel who should receive alerts of informaon spillage; list of acons to be performed regarding informaon spillage; other relevant documents or records].

IR-09-Interview

[SELECT FROM: Organizaonal personnel with incident response responsibilies; organizaonal personnel with informaon security responsibilies].

IR-09-Test

[SELECT FROM: Organizaonal processes for informaon spillage response; mechanisms supporng and/or implemenng informaon spillage response acons and related communicaons].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 295

NIST SP 800-53A, REV. 5

IR-09(01)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

INFORMATION SPILLAGE RESPONSE | RESPONSIBLE PERSONNEL [WITHDRAWN: Incorporated into IR-09.]

IR-09(02)

INFORMATION SPILLAGE RESPONSE | TRAINING ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

IR-09(02)_ODP

frequency at which to provide informaon spillage response training is deﬁned;

IR-09(02)

informaon spillage response training is provided <IR-09(02)_ODP frequency>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

IR-09(03)

IR-09(02)-Examine

[SELECT FROM: Incident response policy; procedures addressing informaon spillage response training; informaon spillage response training curriculum; informaon spillage response training materials; incident response plan; system security plan; informaon spillage response training records; other relevant documents or records].

IR-09(02)-Interview

[SELECT FROM: Organizaonal personnel with incident response training responsibilies; organizaonal personnel with informaon security responsibilies].

INFORMATION SPILLAGE RESPONSE | POST-SPILL OPERATIONS ASSESSMENT OBJECTIVE: Determine if:

IR-09(03)_ODP

procedures to be implemented to ensure that organizaonal personnel impacted by informaon spills can connue to carry out assigned tasks while contaminated systems are undergoing correcve acons are deﬁned;

IR-09(03)

<IR-09(03)_ODP procedures> are implemented to ensure that organizaonal personnel impacted by informaon spills can connue to carry out assigned tasks while contaminated systems are undergoing correcve acons.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

IR-09(03)-Examine

[SELECT FROM: Incident response policy; procedures addressing incident response; procedures addressing informaon spillage; incident response plan; system security plan; other relevant documents or records].

IR-09(03)-Interview

[SELECT FROM: Organizaonal personnel with incident response responsibilies; organizaonal personnel with informaon security responsibilies].

IR-09(03)-Test

[SELECT FROM: Organizaonal processes for post-spill operaons].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 296

NIST SP 800-53A, REV. 5

IR-09(04)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

INFORMATION SPILLAGE RESPONSE | EXPOSURE TO UNAUTHORIZED PERSONNEL ASSESSMENT OBJECTIVE: Determine if:

IR-09(04)_ODP

controls employed for personnel exposed to informaon not within assigned access authorizaons are deﬁned;

IR-09(04)

<IR-09(04)_ODP controls> are employed for personnel exposed to informaon not within assigned access authorizaons.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

IR-10

IR-09(04)-Examine

IR-09(04)-Interview

[SELECT FROM: Organizaonal personnel with incident response responsibilies; organizaonal personnel with informaon security responsibilies].

IR-09(04)-Test

[SELECT FROM: Organizaonal processes for dealing with informaon exposed to unauthorized personnel; mechanisms supporng and/or implemenng safeguards for personnel exposed to informaon not within assigned access authorizaons].

INTEGRATED INFORMATION SECURITY ANALYSIS TEAM [WITHDRAWN: Moved to IR-04(11).]

CHAPTER FOUR

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 297

NIST SP 800-53A, REV. 5

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

4.9 MAINTENANCE MA-01

POLICY AND PROCEDURES ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5 CHAPTER FOUR

MA-01_ODP[01]

personnel or roles to whom the maintenance policy is to be disseminated is/are deﬁned;

MA-01_ODP[02]

personnel or roles to whom the maintenance procedures are to be disseminated is/are deﬁned;

MA-01_ODP[03]

one or more of the following PARAMETER VALUES is/are selected: {organizaonlevel; mission/business process-level; system-level};

MA-01_ODP[04]

an oﬃcial to manage the maintenance policy and procedures is deﬁned;

MA-01_ODP[05]

the frequency with which the current maintenance policy is reviewed and updated is deﬁned;

MA-01_ODP[06]

events that would require the current maintenance policy to be reviewed and updated are deﬁned;

MA-01_ODP[07]

the frequency with which the current maintenance procedures are reviewed and updated is deﬁned;

MA-01_ODP[08]

events that would require the maintenance procedures to be reviewed and updated are deﬁned;

MA-01a.[01]

a maintenance policy is developed and documented;

MA-01a.[02]

the maintenance policy is disseminated to <MA-01_ODP[01] personnel or roles>;

MA-01a.[03]

maintenance procedures to facilitate the implementaon of the maintenance policy and associated maintenance controls are developed and documented;

MA-01a.[04]

the maintenance procedures are disseminated to <MA-01_ODP[02] personnel or roles>;

MA-01a.01(a)[01]

the <MA-01_ODP[03] SELECTED PARAMETER VALUE(S)> maintenance policy addresses purpose;

MA-01a.01(a)[02]

the <MA-01_ODP[03] SELECTED PARAMETER VALUE(S)> maintenance policy addresses scope;

MA-01a.01(a)[03]

the <MA-01_ODP[03] SELECTED PARAMETER VALUE(S)> maintenance policy addresses roles;

MA-01a.01(a)[04]

the <MA-01_ODP[03] SELECTED PARAMETER VALUE(S)> maintenance policy addresses responsibilies;

MA-01a.01(a)[05]

the <MA-01_ODP[03] SELECTED PARAMETER VALUE(S)> maintenance policy addresses management commitment;

MA-01a.01(a)[06]

the <MA-01_ODP[03] SELECTED PARAMETER VALUE(S)> maintenance policy addresses coordinaon among organizaonal enes;

MA-01a.01(a)[07]

the <MA-01_ODP[03] SELECTED PARAMETER VALUE(S)> maintenance policy addresses compliance;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 298

NIST SP 800-53A, REV. 5

MA-01

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

POLICY AND PROCEDURES

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

MA-01a.01(b)

the <MA-01_ODP[03] SELECTED PARAMETER VALUE(S)> maintenance policy is consistent with applicable laws, Execuve Orders, direcves, regulaons, policies, standards, and guidelines;

MA-01b.

the <MA-01_ODP[04] oﬃcial> is designated to manage the development, documentaon, and disseminaon of the maintenance policy and procedures;

MA-01c.01[01]

the current maintenance policy is reviewed and updated <MA-01_ODP[05] frequency>;

MA-01c.01[02]

the current maintenance policy is reviewed and updated following <MA-01_ODP[06] events>;

MA-01c.02[01]

the current maintenance procedures are reviewed and updated <MA-01_ODP[07] frequency>;

MA-01c.02[02]

the current maintenance procedures are reviewed and updated following <MA-01_ODP[08] events>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

MA-02

MA-01-Examine

[SELECT FROM: Maintenance policy and procedures; system security plan; privacy plan; organizaonal risk management strategy; other relevant documents or records].

MA-01-Interview

[SELECT FROM: Organizaonal personnel with maintenance responsibilies; organizaonal personnel with informaon security and privacy responsibilies].

CONTROLLED MAINTENANCE ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

MA-02_ODP[01]

personnel or roles required to explicitly approve the removal of the system or system components from organizaonal facilies for oﬀ-site maintenance or repairs is/are deﬁned;

MA-02_ODP[02]

informaon to be removed from associated media prior to removal from organizaonal facilies for oﬀ-site maintenance, repair, or replacement is deﬁned;

MA-02_ODP[03]

informaon to be included in organizaonal maintenance records is deﬁned;

MA-02a.[01]

maintenance, repair, and replacement of system components are scheduled in accordance with manufacturer or vendor speciﬁcaons and/or organizaonal requirements;

MA-02a.[02]

maintenance, repair, and replacement of system components are documented in accordance with manufacturer or vendor speciﬁcaons and/or organizaonal requirements;

MA-02a.[03]

records of maintenance, repair, and replacement of system components are reviewed in accordance with manufacturer or vendor speciﬁcaons and/or organizaonal requirements;

MA-02b.[01]

all maintenance acvies, whether performed on site or remotely and whether the system or system components are serviced on site or removed to another locaon, are approved;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 299

NIST SP 800-53A, REV. 5

MA-02

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

CONTROLLED MAINTENANCE

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

MA-02b.[02]

all maintenance acvies, whether performed on site or remotely and whether the system or system components are serviced on site or removed to another locaon, are monitored;

MA-02c.

<MA-02_ODP[01] personnel or roles> is/are required to explicitly approve the removal of the system or system components from organizaonal facilies for oﬀsite maintenance, repair, or replacement;

MA-02d.

equipment is sanized to remove <MA-02_ODP[02] informaon> from associated media prior to removal from organizaonal facilies for oﬀ-site maintenance, repair, or replacement;

MA-02e.

all potenally impacted controls are checked to verify that the controls are sll funconing properly following maintenance, repair, or replacement acons;

MA-02f.

<MA-02_ODP[03] informaon> is included in organizaonal maintenance records.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: MA-02-Examine

[SELECT FROM: Maintenance policy; procedures addressing controlled system maintenance; maintenance records; manufacturer/vendor maintenance speciﬁcaons; equipment sanizaon records; media sanizaon records; system security plan; other relevant documents or records].

MA-02-Interview

[SELECT FROM: Organizaonal personnel with system maintenance responsibilies; organizaonal personnel with informaon security responsibilies; organizaonal personnel responsible for media sanizaon; system/network administrators].

MA-02-Test

[SELECT FROM: Organizaonal processes for scheduling, performing, documenng, reviewing, approving, and monitoring maintenance and repairs for the system; organizaonal processes for sanizing system components; mechanisms supporng and/or implemenng controlled maintenance; mechanisms implemenng the sanizaon of system components].

MA-02(01) CONTROLLED MAINTENANCE | RECORD CONTENT [WITHDRAWN: Incorporated into MA-02.]

MA-02(02) CONTROLLED MAINTENANCE | AUTOMATED MAINTENANCE ACTIVITIES ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

MA-02(02)_ODP[01]

automated mechanisms used to schedule maintenance, repair, and replacement acons for the system are deﬁned;

MA-02(02)_ODP[02]

automated mechanisms used to conduct maintenance, repair, and replacement acons for the system are deﬁned;

MA-02(02)_ODP[03]

automated mechanisms used to document maintenance, repair, and replacement acons for the system are deﬁned;

MA-02(02)(a)[01]

<MA-02(02)_ODP[01] automated mechanisms> are used to schedule maintenance, repair, and replacement acons for the system;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 300

NIST SP 800-53A, REV. 5

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

MA-02(02) CONTROLLED MAINTENANCE | AUTOMATED MAINTENANCE ACTIVITIES

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

MA-02(02)(a)[02]

<MA-02(02)_ODP[02] automated mechanisms> are used to conduct maintenance, repair, and replacement acons for the system;

MA-02(02)(a)[03]

<MA-02(02)_ODP[03] automated mechanisms> are used to document maintenance, repair, and replacement acons for the system;

MA-02(02)(b)[01]

up-to date, accurate, and complete records of all maintenance acons requested, scheduled, in process, and completed are produced.

MA-02(02)(b)[02]

up-to date, accurate, and complete records of all repair acons requested, scheduled, in process, and completed are produced.

MA-02(02)(b)[03]

up-to date, accurate, and complete records of all replacement acons requested, scheduled, in process, and completed are produced.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

MA-03

MA-02(02)-Examine

[SELECT FROM: Maintenance policy; procedures addressing controlled system maintenance; automated mechanisms supporng system maintenance acvies; system conﬁguraon sengs and associated documentaon; maintenance records; system security plan; other relevant documents or records].

MA-02(02)-Interview

[SELECT FROM: Organizaonal personnel with system maintenance responsibilies; organizaonal personnel with informaon security responsibilies; system/network administrators].

MA-02(02)-Test

[SELECT FROM: Automated mechanisms supporng and/or implemenng controlled maintenance; automated mechanisms supporng and/or implemenng the producon of records of maintenance and repair acons].

MAINTENANCE TOOLS ASSESSMENT OBJECTIVE: Determine if: MA-03_ODP

frequency at which to review previously approved system maintenance tools is deﬁned;

MA-03a.[01]

the use of system maintenance tools is approved;

MA-03a.[02]

the use of system maintenance tools is controlled;

MA-03a.[03]

the use of system maintenance tools is monitored;

MA-03b.

previously approved system maintenance tools are reviewed <MA-03_ODP frequency>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

MA-03-Examine

[SELECT FROM: Maintenance policy; procedures addressing system maintenance tools; system maintenance tools and associated documentaon; maintenance records; system security plan; other relevant documents or records].

MA-03-Interview

[SELECT FROM: Organizaonal personnel with system maintenance responsibilies; organizaonal personnel with informaon security responsibilies].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 301

NIST SP 800-53A, REV. 5

MA-03

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

MAINTENANCE TOOLS MA-03-Test

[SELECT FROM: Organizaonal processes for approving, controlling, and monitoring maintenance tools; mechanisms supporng and/or implemenng the approval, control, and/or monitoring of maintenance tools].

MA-03(01) MAINTENANCE TOOLS | INSPECT TOOLS ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

MA-03(01)

maintenance tools used by maintenance personnel are inspected for improper or unauthorized modiﬁcaons.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: MA-03(01)-Examine

[SELECT FROM: Maintenance policy; procedures addressing system maintenance tools; system maintenance tools and associated documentaon; maintenance tool inspecon records; maintenance records; system security plan; other relevant documents or records].

MA-03(01)-Interview

[SELECT FROM: Organizaonal personnel with system maintenance responsibilies; organizaonal personnel with informaon security responsibilies].

MA-03(01)-Test

[SELECT FROM: Organizaonal processes for inspecng maintenance tools; mechanisms supporng and/or implemenng the inspecon of maintenance tools].

MA-03(02) MAINTENANCE TOOLS | INSPECT MEDIA ASSESSMENT OBJECTIVE: Determine if: MA-03(02)

media containing diagnosc and test programs are checked for malicious code before the media are used in the system.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

MA-03(02)-Examine

MA-03(02)-Interview

[SELECT FROM: Organizaonal personnel with system maintenance responsibilies; organizaonal personnel with informaon security responsibilies].

MA-03(02)-Test

[SELECT FROM: Organizaonal process for inspecng media for malicious code; mechanisms supporng and/or implemenng the inspecon of media used for maintenance].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 302

NIST SP 800-53A, REV. 5

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

MA-03(03) MAINTENANCE TOOLS | PREVENT UNAUTHORIZED REMOVAL ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

MA-03(03)_ODP

personnel or roles who can authorize removal of equipment from the facility is/ are deﬁned;

MA-03(03)(a)

the removal of maintenance equipment containing organizaonal informaon is prevented by verifying that there is no organizaonal informaon contained on the equipment; or

MA-03(03)(b)

the removal of maintenance equipment containing organizaonal informaon is prevented by sanizing or destroying the equipment; or

MA-03(03)(c)

the removal of maintenance equipment containing organizaonal informaon is prevented by retaining the equipment within the facility; or

MA-03(03)(d)

the removal of maintenance equipment containing organizaonal informaon is prevented by obtaining an exempon from <MA-03(03)_ODP personnel or roles> explicitly authorizing removal of the equipment from the facility.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: MA-03(03)-Examine

[SELECT FROM: Maintenance policy; procedures addressing system maintenance tools; system maintenance tools and associated documentaon; maintenance records; equipment sanizaon records; media sanizaon records; exempons for equipment removal; system security plan; other relevant documents or records].

MA-03(03)-Interview

MA-03(03)-Test

[SELECT FROM: Organizaonal process for prevenng unauthorized removal of informaon; mechanisms supporng media sanizaon or destrucon of equipment; mechanisms supporng veriﬁcaon of media sanizaon].

MA-03(04) MAINTENANCE TOOLS | RESTRICTED TOOL USE ASSESSMENT OBJECTIVE: Determine if: MA-03(04)

the use of maintenance tools is restricted to authorized personnel only.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

MA-03(04)-Examine

[SELECT FROM: Maintenance policy; procedures addressing system maintenance tools; system maintenance tools and associated documentaon; list of personnel authorized to use maintenance tools; maintenance tool usage records; maintenance records; system security plan; other relevant documents or records].

MA-03(04)-Interview

[SELECT FROM: Organizaonal personnel with system maintenance responsibilies; organizaonal personnel with informaon security responsibilies].

MA-03(04)-Test

[SELECT FROM: Organizaonal processes for restricng the use of maintenance tools; mechanisms supporng and/or implemenng the restricted use of maintenance tools].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 303

NIST SP 800-53A, REV. 5

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

MA-03(05) MAINTENANCE TOOLS | EXECUTION WITH PRIVILEGE ASSESSMENT OBJECTIVE: Determine if: MA-03(05)

the use of maintenance tools that execute with increased privilege is monitored.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

MA-03(05)-Examine

MA-03(05)-Interview

[SELECT FROM: Organizaonal personnel with system maintenance responsibilies; organizaonal personnel with informaon security responsibilies].

MA-03(05)-Test

[SELECT FROM: Organizaonal processes for restricng the use of maintenance tools; organizaonal process for monitoring maintenance tools and maintenance tool usage; mechanisms monitoring the use of maintenance tools].

MA-03(06) MAINTENANCE TOOLS | SOFTWARE UPDATES AND PATCHES ASSESSMENT OBJECTIVE: Determine if: MA-03(06)

maintenance tools are inspected to ensure that the latest soware updates and patches are installed.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

MA-04

MA-03(06)-Examine

MA-03(06)-Interview

[SELECT FROM: Organizaonal personnel with system maintenance responsibilies; organizaonal personnel with informaon security responsibilies].

MA-03(06)-Test

[SELECT FROM: Organizaonal processes for inspecng maintenance tools; organizaonal processes for maintenance tools updates; mechanisms supporng and/or implemenng the inspecon of maintenance tools; mechanisms supporng and/or implemenng maintenance tool updates.].

NONLOCAL MAINTENANCE ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

MA-04a.[01]

nonlocal maintenance and diagnosc acvies are approved;

MA-04a.[02]

nonlocal maintenance and diagnosc acvies are monitored;

MA-04b.[01]

the use of nonlocal maintenance and diagnosc tools are allowed only as consistent with organizaonal policy;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 304

NIST SP 800-53A, REV. 5

MA-04

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

NONLOCAL MAINTENANCE MA-04b.[02]

the use of nonlocal maintenance and diagnosc tools are documented in the security plan for the system;

MA-04c.

strong authencaon is employed in the establishment of nonlocal maintenance and diagnosc sessions;

MA-04d.

records for nonlocal maintenance and diagnosc acvies are maintained;

MA-04e.[01]

session connecons are terminated when nonlocal maintenance is completed;

MA-04e.[02]

network connecons are terminated when nonlocal maintenance is completed.

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

POTENTIAL ASSESSMENT METHODS AND OBJECTS: MA-04-Examine

[SELECT FROM: Maintenance policy; procedures addressing nonlocal system maintenance; remote access policy; remote access procedures; system design documentaon; system conﬁguraon sengs and associated documentaon; maintenance records; records of remote access; diagnosc records; system security plan; other relevant documents or records].

MA-04-Interview

[SELECT FROM: Organizaonal personnel with system maintenance responsibilies; organizaonal personnel with informaon security responsibilies; system/network administrators].

MA-04-Test

[SELECT FROM: Organizaonal processes for managing nonlocal maintenance; mechanisms implemenng, supporng, and/or managing nonlocal maintenance; mechanisms for strong authencaon of nonlocal maintenance diagnosc sessions; mechanisms for terminang nonlocal maintenance sessions and network connecons].

MA-04(01) NONLOCAL MAINTENANCE | LOGGING AND REVIEW ASSESSMENT OBJECTIVE: Determine if:

MA-04(01)_ODP[01]

audit events to be logged for nonlocal maintenance are deﬁned;

MA-04(01)_ODP[02]

audit events to be logged for diagnosc sessions are deﬁned;

MA-04(01)(a)[01]

<MA-04(01)_ODP[01] audit events> are logged for nonlocal maintenance sessions;

MA-04(01)(a)[02]

<MA-04(01)_ODP[02] audit events> are logged for nonlocal diagnosc sessions;

MA-04(01)(b)[01]

the audit records of the maintenance sessions are reviewed to detect anomalous behavior;

MA-04(01)(b)[02]

the audit records of the diagnosc sessions are reviewed to detect anomalous behavior.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: MA-04(01)-Examine

CHAPTER FOUR

[SELECT FROM: Maintenance policy; procedures addressing nonlocal system maintenance; list of audit events; system conﬁguraon sengs and associated documentaon; maintenance records; diagnosc records; audit records; reviews of maintenance and diagnosc session records; system security plan; other relevant documents or records].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 305

NIST SP 800-53A, REV. 5

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

MA-04(01) NONLOCAL MAINTENANCE | LOGGING AND REVIEW MA-04(01)-Interview

[SELECT FROM: Organizaonal personnel with system maintenance responsibilies; organizaonal personnel with informaon security responsibilies; organizaonal personnel with audit and review responsibilies; system/network administrators].

MA-04(01)-Test

[SELECT FROM: Organizaonal processes for audit and review of nonlocal maintenance; mechanisms supporng and/or implemenng audit and review of nonlocal maintenance].

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

MA-04(02) NONLOCAL MAINTENANCE | DOCUMENT NONLOCAL MAINTENANCE [WITHDRAWN: Incorporated into MA-01, MA-04.]

MA-04(03) NONLOCAL MAINTENANCE | COMPARABLE SECURITY AND SANITIZATION ASSESSMENT OBJECTIVE: Determine if:

MA-04(03)(a)[01]

nonlocal maintenance services are required to be performed from a system that implements a security capability comparable to the capability implemented on the system being serviced;

MA-04(03)(a)[02]

nonlocal diagnosc services are required to be performed from a system that implements a security capability comparable to the capability implemented on the system being serviced; or

MA-04(03)(b)[01]

the component to be serviced is removed from the system prior to nonlocal maintenance or diagnosc services;

MA-04(03)(b)[02]

the component to be serviced is sanized (for organizaonal informaon);

MA-04(03)(b)[03]

the component is inspected and sanized (for potenally malicious soware) aer the service is performed and before reconnecng the component to the system.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

MA-04(03)-Examine

[SELECT FROM: Maintenance policy; procedures addressing nonlocal system maintenance; service provider contracts and/or service-level agreements; maintenance records; inspecon records; audit records; equipment sanizaon records; media sanizaon records; system security plan; other relevant documents or records].

MA-04(03)-Interview

[SELECT FROM: Organizaonal personnel with system maintenance responsibilies; system maintenance provider; organizaonal personnel with informaon security responsibilies; organizaonal personnel responsible for media sanizaon; system/network administrators].

MA-04(03)-Test

[SELECT FROM: Organizaonal processes for comparable security and sanizaon for nonlocal maintenance; organizaonal processes for the removal, sanizaon, and inspecon of components serviced via nonlocal maintenance; mechanisms supporng and/or implemenng component sanizaon and inspecon].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 306

NIST SP 800-53A, REV. 5

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

MA-04(04) NONLOCAL MAINTENANCE | AUTHENTICATION AND SEPARATION OF MAINTENANCE SESSIONS ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

MA-04(04)_ODP

authencators that are replay resistant are deﬁned;

MA-04(04)(a)

nonlocal maintenance sessions are protected by employing <MA-04(04)_ODP authencators that are replay resistant>;

MA-04(04)(b)(01)

nonlocal maintenance sessions are protected by separang maintenance sessions from other network sessions with the system by physically separated communicaon paths; or

MA-04(04)(b)(02)

nonlocal maintenance sessions are protected by logically separated communicaon paths.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: MA-04(04)-Examine

MA-04(04)-Interview

[SELECT FROM: Organizaonal personnel with system maintenance responsibilies; network engineers; organizaonal personnel with informaon security responsibilies; system/network administrators].

MA-04(04)-Test

[SELECT FROM: Organizaonal processes for protecng nonlocal maintenance sessions; mechanisms implemenng replay-resistant authencators; mechanisms implemenng logically separated/encrypted communicaon paths].

MA-04(05) NONLOCAL MAINTENANCE | APPROVALS AND NOTIFICATIONS ASSESSMENT OBJECTIVE: Determine if:

MA-04(05)_ODP[01]

personnel or roles required to approve each nonlocal maintenance session is/are deﬁned;

MA-04(05)_ODP[02]

personnel and roles to be noﬁed of the date and me of planned nonlocal maintenance is/are deﬁned;

MA-04(05)(a)

the approval of each nonlocal maintenance session is required by <MA-04(05)_ODP[01] personnel or roles>;

MA-04(05)(b)

<MA-04(05)_ODP[02] personnel and roles> is/are noﬁed of the date and me of planned nonlocal maintenance.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: MA-04(05)-Examine

CHAPTER FOUR

[SELECT FROM: Maintenance policy; procedures addressing nonlocal system maintenance; noﬁcaons supporng nonlocal maintenance sessions; maintenance records; audit records; system security plan; other relevant documents or records].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 307

NIST SP 800-53A, REV. 5

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

MA-04(05) NONLOCAL MAINTENANCE | APPROVALS AND NOTIFICATIONS MA-04(05)-Interview

[SELECT FROM: Organizaonal personnel with system maintenance responsibilies; organizaonal personnel with noﬁcaon responsibilies; organizaonal personnel with approval responsibilies; organizaonal personnel with informaon security responsibilies].

MA-04(05)-Test

[SELECT FROM: Organizaonal processes for approving and nofying personnel regarding nonlocal maintenance; mechanisms supporng the noﬁcaon and approval of nonlocal maintenance].

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

MA-04(06) NONLOCAL MAINTENANCE | CRYPTOGRAPHIC PROTECTION ASSESSMENT OBJECTIVE: Determine if:

MA-04(06)_ODP

cryptographic mechanisms to be implemented to protect the integrity and conﬁdenality of nonlocal maintenance and diagnosc communicaons are deﬁned;

MA-04(06)[01]

<MA-04(06)_ODP cryptographic mechanisms> are implemented to protect the integrity of nonlocal maintenance and diagnosc communicaons;

MA-04(06)[02]

<MA-04(06)_ODP cryptographic mechanisms> are implemented to protect the conﬁdenality of nonlocal maintenance and diagnosc communicaons.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: MA-04(06)-Examine

[SELECT FROM: Maintenance policy; procedures addressing nonlocal system maintenance; system design documentaon; system conﬁguraon sengs and associated documentaon; cryptographic mechanisms protecng nonlocal maintenance acvies; maintenance records; diagnosc records; audit records; system security plan; other relevant documents or records].

MA-04(06)-Interview

MA-04(06)-Test

[SELECT FROM: Cryptographic mechanisms protecng nonlocal maintenance and diagnosc communicaons].

MA-04(07) NONLOCAL MAINTENANCE | DISCONNECT VERIFICATION ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

MA-04(07)[01]

session connecon terminaon is veriﬁed aer the compleon of nonlocal maintenance and diagnosc sessions;

MA-04(07)[02]

network connecon terminaon is veriﬁed aer the compleon of nonlocal maintenance and diagnosc sessions.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 308

NIST SP 800-53A, REV. 5

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

MA-04(07) NONLOCAL MAINTENANCE | DISCONNECT VERIFICATION POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

MA-05

MA-04(07)-Examine

[SELECT FROM: Maintenance policy; procedures addressing nonlocal system maintenance; system design documentaon; system conﬁguraon sengs and associated documentaon; session/network terminaon logs; cryptographic mechanisms protecng nonlocal maintenance acvies; maintenance records; diagnosc records; audit records; system security plan; other relevant documents or records].

MA-04(07)-Interview

MA-04(07)-Test

[SELECT FROM: Mechanisms implemenng remote disconnect veriﬁcaons of terminated nonlocal maintenance and diagnosc sessions].

MAINTENANCE PERSONNEL ASSESSMENT OBJECTIVE: Determine if: MA-05a.[01]

a process for maintenance personnel authorizaon is established;

MA-05a.[02]

a list of authorized maintenance organizaons or personnel is maintained;

MA-05b.

non-escorted personnel performing maintenance on the system possess the required access authorizaons;

MA-05c.

organizaonal personnel with required access authorizaons and technical competence is/are designated to supervise the maintenance acvies of personnel who do not possess the required access authorizaons.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: MA-05-Examine

[SELECT FROM: Maintenance policy; procedures addressing maintenance personnel; service provider contracts; service-level agreements; list of authorized personnel; maintenance records; access control records; system security plan; other relevant documents or records].

MA-05-Interview

[SELECT FROM: Organizaonal personnel with system maintenance responsibilies; organizaonal personnel with informaon security responsibilies].

MA-05-Test

[SELECT FROM: Organizaonal processes for authorizing and managing maintenance personnel; mechanisms supporng and/or implemenng authorizaon of maintenance personnel].

MA-05(01) MAINTENANCE PERSONNEL | INDIVIDUALS WITHOUT APPROPRIATE ACCESS ASSESSMENT OBJECTIVE: Determine if:

MA-05(01)_ODP

CHAPTER FOUR

alternate controls to be developed and implemented in the event that a system component cannot be sanized, removed, or disconnected from the system are deﬁned;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 309

NIST SP 800-53A, REV. 5

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

MA-05(01) MAINTENANCE PERSONNEL | INDIVIDUALS WITHOUT APPROPRIATE ACCESS

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

MA-05(01)(a)(01)

procedures for the use of maintenance personnel who lack appropriate security clearances or are not U.S. cizens are implemented and include approved organizaonal personnel who are fully cleared, have appropriate access authorizaons, and are technically qualiﬁed escorng and supervising maintenance personnel without the needed access authorizaon during the performance of maintenance and diagnosc acvies;

MA-05(01)(a)(02)

procedures for the use of maintenance personnel who lack appropriate security clearances or are not U.S. cizens are implemented and include all volale informaon storage components within the system being sanized and all nonvolale storage media being removed or physically disconnected from the system and secured prior to iniang maintenance or diagnosc acvies;

MA-05(01)(b)

<MA-05(01)_ODP alternate controls> are developed and implemented in the event that a system cannot be sanized, removed, or disconnected from the system.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: MA-05(01)-Examine

[SELECT FROM: Maintenance policy; procedures addressing maintenance personnel; system media protecon policy; physical and environmental protecon policy; list of maintenance personnel requiring escort/supervision; maintenance records; access control records; system security plan; other relevant documents or records].

MA-05(01)-Interview

[SELECT FROM: Organizaonal personnel with system maintenance responsibilies; organizaonal personnel with personnel security responsibilies; organizaonal personnel with physical access control responsibilies; organizaonal personnel with informaon security responsibilies; organizaonal personnel responsible for media sanizaon; system/network administrators].

MA-05(01)-Test

[SELECT FROM: Organizaonal processes for managing maintenance personnel without appropriate access; mechanisms supporng and/or implemenng alternave security safeguards; mechanisms supporng and/or implemenng informaon storage component sanizaon].

MA-05(02) MAINTENANCE PERSONNEL | SECURITY CLEARANCES FOR CLASSIFIED SYSTEMS ASSESSMENT OBJECTIVE: Determine if:

MA-05(02)[01]

personnel performing maintenance and diagnosc acvies on a system processing, storing, or transming classiﬁed informaon possess security clearances for at least the highest classiﬁcaon level and for compartments of informaon on the system;

MA-05(02)[02]

personnel performing maintenance and diagnosc acvies on a system processing, storing, or transming classiﬁed informaon possess formal access approvals for at least the highest classiﬁcaon level and for compartments of informaon on the system.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: MA-05(02)-Examine

CHAPTER FOUR

[SELECT FROM: Maintenance policy; procedures addressing maintenance personnel; personnel records; maintenance records; access control records; access credenals; access authorizaons; system security plan; other relevant documents or records].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 310

NIST SP 800-53A, REV. 5

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

MA-05(02) MAINTENANCE PERSONNEL | SECURITY CLEARANCES FOR CLASSIFIED SYSTEMS MA-05(02)-Interview

MA-05(02)-Test

[SELECT FROM: Organizaonal processes for managing security clearances for maintenance personnel].

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

MA-05(03) MAINTENANCE PERSONNEL | CITIZENSHIP REQUIREMENTS FOR CLASSIFIED SYSTEMS ASSESSMENT OBJECTIVE: Determine if: MA-05(03)

personnel performing maintenance and diagnosc acvies on a system processing, storing, or transming classiﬁed informaon are U.S. cizens.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: MA-05(03)-Examine

MA-05(03)-Interview

MA-05(04) MAINTENANCE PERSONNEL | FOREIGN NATIONALS ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

MA-05(04)(a)

foreign naonals with appropriate security clearances are used to conduct maintenance and diagnosc acvies on classiﬁed systems only when the systems are jointly owned and operated by the United States and foreign allied governments or owned and operated solely by foreign allied governments;

MA-05(04)(b)[01]

approvals regarding the use of foreign naonals to conduct maintenance and diagnosc acvies on classiﬁed systems are fully documented within Memoranda of Agreements;

MA-05(04)(b)[02]

consents regarding the use of foreign naonals to conduct maintenance and diagnosc acvies on classiﬁed systems are fully documented within Memoranda of Agreements;

MA-05(04)(b)[03]

detailed operaonal condions regarding the use of foreign naonals to conduct maintenance and diagnosc acvies on classiﬁed systems are fully documented within Memoranda of Agreements.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 311

NIST SP 800-53A, REV. 5

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

MA-05(04) MAINTENANCE PERSONNEL | FOREIGN NATIONALS POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

MA-05(04)-Examine

[SELECT FROM: Maintenance policy; procedures addressing maintenance personnel; system media protecon policy; access control policy and procedures; physical and environmental protecon policy and procedures; memorandum of agreement; maintenance records; access control records; access credenals; access authorizaons; system security plan; other relevant documents or records].

MA-05(04)-Interview

[SELECT FROM: Organizaonal personnel with system maintenance responsibilies, organizaonal personnel with personnel security responsibilies; organizaonal personnel managing memoranda of agreements; organizaonal personnel with informaon security responsibilies].

MA-05(04)-Test

[SELECT FROM: Organizaonal processes for managing foreign naonal maintenance personnel].

MA-05(05) MAINTENANCE PERSONNEL | NON-SYSTEM MAINTENANCE ASSESSMENT OBJECTIVE: Determine if: MA-05(05)

non-escorted personnel performing maintenance acvies not directly associated with the system but in the physical proximity of the system have required access authorizaons.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

MA-06

MA-05(05)-Examine

[SELECT FROM: Maintenance policy; procedures addressing maintenance personnel; system media protecon policy; access control policy and procedures; physical and environmental protecon policy and procedures; maintenance records; access control records; access authorizaons; system security plan; other relevant documents or records].

MA-05(05)-Interview

TIMELY MAINTENANCE ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

MA-06_ODP[01]

system components for which maintenance support and/or spare parts are obtained are deﬁned;

MA-06_ODP[02]

me period within which maintenance support and/or spare parts are to be obtained aer a failure are deﬁned;

MA-06

maintenance support and/or spare parts are obtained for <MA-06_ODP[01] system components> within <MA-06_ODP[02] me period> of failure.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 312

NIST SP 800-53A, REV. 5

MA-06

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

TIMELY MAINTENANCE POTENTIAL ASSESSMENT METHODS AND OBJECTS: MA-06-Examine

[SELECT FROM: Maintenance policy; procedures addressing system maintenance; service provider contracts; service-level agreements; inventory and availability of spare parts; system security plan; other relevant documents or records].

MA-06-Interview

[SELECT FROM: Organizaonal personnel with system maintenance responsibilies; organizaonal personnel with acquision responsibilies; organizaonal personnel with informaon security responsibilies; system/network administrators].

MA-06-Test

[SELECT FROM: Organizaonal processes for ensuring mely maintenance].

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

MA-06(01) TIMELY MAINTENANCE | PREVENTIVE MAINTENANCE ASSESSMENT OBJECTIVE: Determine if:

MA-06(01)_ODP[01]

system components on which prevenve maintenance is to be performed are deﬁned;

MA-06(01)_ODP[02]

me intervals within which prevenve maintenance is to be performed on system components are deﬁned;

MA-06(01)

prevenve maintenance is performed on <MA-06(01)_ODP[01] system components> at <MA-06(01)_ODP[02] me intervals>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: MA-06(01)-Examine

[SELECT FROM: Maintenance policy; procedures addressing system maintenance; service provider contracts; service-level agreements; maintenance records; list of system components requiring prevenve maintenance; system security plan; other relevant documents or records].

MA-06(01)-Interview

[SELECT FROM: Organizaonal personnel with system maintenance responsibilies; organizaonal personnel with informaon security responsibilies; system/network administrators].

MA-06(01)-Test

[SELECT FROM: Organizaonal processes for prevenve maintenance; mechanisms supporng and/or implemenng prevenve maintenance].

MA-06(02) TIMELY MAINTENANCE | PREDICTIVE MAINTENANCE ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

MA-06(02)_ODP[01]

system components on which predicve maintenance is to be performed are deﬁned;

MA-06(02)_ODP[02]

me intervals within which predicve maintenance is to be performed are deﬁned;

MA-06(02)

predicve maintenance is performed on <MA-06(02)_ODP[01] system components> at <MA-06(02)_ODP[02] me intervals>.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 313

NIST SP 800-53A, REV. 5

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

MA-06(02) TIMELY MAINTENANCE | PREDICTIVE MAINTENANCE POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

MA-06(02)-Examine

[SELECT FROM: Maintenance policy; procedures addressing system maintenance; service provider contracts; service-level agreements; maintenance records; list of system components requiring predicve maintenance; system security plan; other relevant documents or records].

MA-06(02)-Interview

[SELECT FROM: Organizaonal personnel with system maintenance responsibilies; organizaonal personnel with informaon security responsibilies; system/network administrators].

MA-06(02)-Test

[SELECT FROM: Organizaonal processes for predicve maintenance; mechanisms supporng and/or implemenng predicve maintenance].

MA-06(03) TIMELY MAINTENANCE | AUTOMATED SUPPORT FOR PREDICTIVE MAINTENANCE ASSESSMENT OBJECTIVE: Determine if:

MA-06(03)_ODP

automated mechanisms used to transfer predicve maintenance data to a maintenance management system are deﬁned;

MA-06(03)

predicve maintenance data is transferred to a maintenance management system using <MA-06(03)_ODP automated mechanisms>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

MA-07

MA-06(03)-Examine

[SELECT FROM: Maintenance policy; procedures addressing system maintenance; service provider contracts; service-level agreements; maintenance records; list of system components requiring predicve maintenance; system security plan; other relevant documents or records].

MA-06(03)-Interview

[SELECT FROM: Organizaonal personnel with system maintenance responsibilies; organizaonal personnel with informaon security responsibilies; system/network administrators].

MA-06(03)-Test

[SELECT FROM: Automated mechanisms implemenng the transfer of predicve maintenance data to a computerized maintenance management system; operaons of the computer maintenance management system].

FIELD MAINTENANCE ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

MA-07_ODP[01]

systems or system components on which ﬁeld maintenance is restricted or prohibited to trusted maintenance facilies are deﬁned;

MA-07_ODP[02]

trusted maintenance facilies that are not restricted or prohibited from conducng ﬁeld maintenance are deﬁned;

MA-07

ﬁeld maintenance on <MA-07_ODP[01] systems or system components> are restricted or prohibited to <MA-07_ODP[02] trusted maintenance facilies>.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 314

NIST SP 800-53A, REV. 5

MA-07

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

FIELD MAINTENANCE POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5 CHAPTER FOUR

MA-07-Examine

[SELECT FROM: Maintenance policy; procedures addressing ﬁeld maintenance; system design documentaon; system conﬁguraon sengs and associated documentaon; maintenance records; diagnosc records; system security plan; other relevant documents or records.].

MA-07-Interview

[SELECT FROM: Organizaonal personnel with system maintenance responsibilies; organizaonal personnel with informaon security responsibilies; system/network administrators].

MA-07-Test

[SELECT FROM: Organizaonal processes for managing ﬁeld maintenance; mechanisms implemenng, supporng, and/or managing ﬁeld maintenance; mechanisms for strong authencaon of ﬁeld maintenance diagnosc sessions; mechanisms for terminang ﬁeld maintenance sessions and network connecons].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 315

NIST SP 800-53A, REV. 5

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

4.10 MEDIA PROTECTION MP-01

POLICY AND PROCEDURES ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5 CHAPTER FOUR

MP-01_ODP[01]

personnel or roles to whom the media protecon policy is to be disseminated is/ are deﬁned;

MP-01_ODP[02]

personnel or roles to whom the media protecon procedures are to be disseminated is/are deﬁned;

MP-01_ODP[03]

one or more of the following PARAMETER VALUES is/are selected: {organizaonlevel; mission/business process-level; system-level};

MP-01_ODP[04]

an oﬃcial to manage the media protecon policy and procedures is deﬁned;

MP-01_ODP[05]

the frequency with which the current media protecon policy is reviewed and updated is deﬁned;

MP-01_ODP[06]

events that would require the current media protecon policy to be reviewed and updated are deﬁned;

MP-01_ODP[07]

the frequency with which the current media protecon procedures are reviewed and updated is deﬁned;

MP-01_ODP[08]

events that would require media protecon procedures to be reviewed and updated are deﬁned;

MP-01a.[01]

a media protecon policy is developed and documented;

MP-01a.[02]

the media protecon policy is disseminated to <MP-01_ODP[01] personnel or roles>;

MP-01a.[03]

media protecon procedures to facilitate the implementaon of the media protecon policy and associated media protecon controls are developed and documented;

MP-01a.[04]

the media protecon procedures are disseminated to <MP-01_ODP[02] personnel or roles>;

MP-01a.01(a)[01]

the <MP-01_ODP[03] SELECTED PARAMETER VALUE(S)> media protecon policy addresses purpose;

MP-01a.01(a)[02]

the <MP-01_ODP[03] SELECTED PARAMETER VALUE(S)> media protecon policy addresses scope;

MP-01a.01(a)[03]

the <MP-01_ODP[03] SELECTED PARAMETER VALUE(S)> media protecon policy addresses roles;

MP-01a.01(a)[04]

the <MP-01_ODP[03] SELECTED PARAMETER VALUE(S)> media protecon policy addresses responsibilies;

MP-01a.01(a)[05]

the <MP-01_ODP[03] SELECTED PARAMETER VALUE(S)> media protecon policy addresses management commitment;

MP-01a.01(a)[06]

the <MP-01_ODP[03] SELECTED PARAMETER VALUE(S)> media protecon policy addresses coordinaon among organizaonal enes;

MP-01a.01(a)[07]

the <MP-01_ODP[03] SELECTED PARAMETER VALUE(S)> media protecon policy compliance;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 316

NIST SP 800-53A, REV. 5

MP-01

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

POLICY AND PROCEDURES

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

MP-01a.01(b)

the media protecon policy is consistent with applicable laws, Execuve Orders, direcves, regulaons, policies, standards, and guidelines;

MP-01b.

the <MP-01_ODP[04] oﬃcial> is designated to manage the development, documentaon, and disseminaon of the media protecon policy and procedures.

MP-01c.01[01]

the current media protecon policy is reviewed and updated <MP-01_ODP[05] frequency>;

MP-01c.01[02]

the current media protecon policy is reviewed and updated following <MP-01_ODP[06] events>;

MP-01c.02[01]

the current media protecon procedures are reviewed and updated <MP-01_ODP[07] frequency>;

MP-01c.02[02]

the current media protecon procedures are reviewed and updated following <MP-01_ODP[08] events>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

MP-02

MP-01-Examine

[SELECT FROM: Media protecon policy and procedures; organizaonal risk management strategy; system security plan; privacy plan; other relevant documents or records].

MP-01-Interview

[SELECT FROM: Organizaonal personnel with media protecon responsibilies; organizaonal personnel with informaon security and privacy responsibilies].

MEDIA ACCESS ASSESSMENT OBJECTIVE: Determine if:

MP-02_ODP[01]

types of digital media to which access is restricted are deﬁned;

MP-02_ODP[02]

personnel or roles authorized to access digital media is/are deﬁned;

MP-02_ODP[03]

types of non-digital media to which access is restricted are deﬁned;

MP-02_ODP[04]

personnel or roles authorized to access non-digital media is/are deﬁned;

MP-02[01]

access to <MP-02_ODP[01] types of digital media> is restricted to <MP-02_ODP[02] personnel or roles>;

MP-02[02]

access to <MP-02_ODP[03] types of non-digital media> is restricted to <MP-02_ODP[04] personnel or roles>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

MP-02-Examine

[SELECT FROM: System media protecon policy; procedures addressing media access restricons; access control policy and procedures; physical and environmental protecon policy and procedures; media storage facilies; access control records; system security plan; other relevant documents or records].

MP-02-Interview

[SELECT FROM: Organizaonal personnel with system media protecon responsibilies; organizaonal personnel with informaon security responsibilies; system/network administrators].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 317

NIST SP 800-53A, REV. 5

MP-02

MEDIA ACCESS MP-02-Test

MP-02(01)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

[SELECT FROM: Organizaonal processes for restricng informaon media; mechanisms supporng and/or implemenng media access restricons].

MEDIA ACCESS | AUTOMATED RESTRICTED ACCESS [WITHDRAWN: Incorporated into MP-04(02).]

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

MP-02(02)

MEDIA ACCESS | CRYPTOGRAPHIC PROTECTION [WITHDRAWN: Incorporated into SC-28(01).]

MP-03

MEDIA MARKING ASSESSMENT OBJECTIVE: Determine if:

MP-03_ODP[01]

types of system media exempt from marking when remaining in controlled areas are deﬁned;

MP-03_ODP[02]

controlled areas where media is exempt from marking are deﬁned;

MP-03a.

system media is marked to indicate distribuon limitaons, handling caveats, and applicable security markings (if any) of the informaon;

MP-03b.

<MP-03_ODP[01] types of media exempted from marking> remain within <MP-03_ODP[02] controlled areas>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

MP-04

MP-03-Examine

[SELECT FROM: System media protecon policy; procedures addressing media marking; physical and environmental protecon policy and procedures; list of system media marking security aributes; designated controlled areas; system security plan; other relevant documents or records].

MP-03-Interview

[SELECT FROM: Organizaonal personnel with system media protecon and marking responsibilies; organizaonal personnel with informaon security responsibilies].

MP-03-Test

[SELECT FROM: Organizaonal processes for marking informaon media; mechanisms supporng and/or implemenng media marking].

MEDIA STORAGE ASSESSMENT OBJECTIVE: Determine if:

MP-04_ODP[01]

CHAPTER FOUR

types of digital media to be physically controlled are deﬁned (if selected);

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 318

NIST SP 800-53A, REV. 5

MP-04

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

MEDIA STORAGE

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

MP-04_ODP[02]

types of non-digital media to be physically controlled are deﬁned (if selected);

MP-04_ODP[03]

types of digital media to be securely stored are deﬁned (if selected);

MP-04_ODP[04]

types of non-digital media to be securely stored are deﬁned (if selected);

MP-04_ODP[05]

controlled areas within which to securely store digital media are deﬁned;

MP-04_ODP[06]

controlled areas within which to securely store non-digital media are deﬁned;

MP-04a.[01]

<MP-04_ODP[01] types of digital media> are physically controlled;

MP-04a.[02]

<MP-04_ODP[02] types of non-digital media> are physically controlled;

MP-04a.[03]

<MP-04_ODP[03] types of digital media> are securely stored within <MP-04_ODP[05] controlled areas>;

MP-04a.[04]

<MP-04_ODP[04] types of non-digital media> are securely stored within <MP-04_ODP[06] controlled areas>;

MP-04b.

system media types (deﬁned in MP-04_ODP[01], MP-04_ODP[02], MP-04_ODP[03], MP-04_ODP[04]) are protected unl the media are destroyed or sanized using approved equipment, techniques, and procedures.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

MP-04(01)

MP-04-Examine

[SELECT FROM: System media protecon policy; procedures addressing media storage; physical and environmental protecon policy and procedures; access control policy and procedures; system media; designated controlled areas; system security plan; other relevant documents or records].

MP-04-Interview

[SELECT FROM: Organizaonal personnel with system media protecon and storage responsibilies; organizaonal personnel with informaon security responsibilies].

MP-04-Test

[SELECT FROM: Organizaonal processes for storing informaon media; mechanisms supporng and/or implemenng secure media storage/media protecon].

MEDIA STORAGE | CRYPTOGRAPHIC PROTECTION [WITHDRAWN: Incorporated into SC-28(01).]

MP-04(02)

MEDIA STORAGE | AUTOMATED RESTRICTED ACCESS ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

MP-04(02)_ODP[01]

automated mechanisms to restrict access to media storage areas are deﬁned;

MP-04(02)_ODP[02]

automated mechanisms to log access aempts to media storage areas are deﬁned;

MP-04(02)_ODP[03]

automated mechanisms to log access granted to media storage areas are deﬁned;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 319

NIST SP 800-53A, REV. 5

MP-04(02)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

MEDIA STORAGE | AUTOMATED RESTRICTED ACCESS MP-04(02)[01]

access to media storage areas is restricted using <MP-04(02)_ODP[01] automated mechanisms>;

MP-04(02)[02]

access aempts to media storage areas are logged using <MP-04(02)_ODP[02] automated mechanisms>;

MP-04(02)[03]

access granted to media storage areas is logged using <MP-04(02)_ODP[03] automated mechanisms>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

MP-05

MP-04(02)-Examine

[SELECT FROM: System media protecon policy; procedures addressing media storage; access control policy and procedures; physical and environmental protecon policy and procedures; system design documentaon; system conﬁguraon sengs and associated documentaon; media storage facilies; access control devices; access control records; audit records; system security plan; other relevant documents or records].

MP-04(02)-Interview

[SELECT FROM: Organizaonal personnel with system media protecon and storage responsibilies; organizaonal personnel with informaon security responsibilies; system/network administrators].

MP-04(02)-Test

[SELECT FROM: Automated mechanisms restricng access to media storage areas; automated mechanisms auding access aempts and access granted to media storage areas].

MEDIA TRANSPORT ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

MP-05_ODP[01]

types of system media to protect and control during transport outside of controlled areas are deﬁned;

MP-05_ODP[02]

controls used to protect system media outside of controlled areas are deﬁned;

MP-05_ODP[03]

controls used to control system media outside of controlled areas are deﬁned;

MP-05a.[01]

<MP-05_ODP[01] types of system media> are protected during transport outside of controlled areas using <MP-05_ODP[02] controls>;

MP-05a.[02]

<MP-05_ODP[01] types of system media> are controlled during transport outside of controlled areas using <MP-05_ODP[03] controls>;

MP-05b.

accountability for system media is maintained during transport outside of controlled areas;

MP-05c.

acvies associated with the transport of system media are documented;

MP-05d.[01]

personnel authorized to conduct media transport acvies is/are idenﬁed;

MP-05d.[02]

acvies associated with the transport of system media are restricted to idenﬁed authorized personnel.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 320

NIST SP 800-53A, REV. 5

MP-05

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

MEDIA TRANSPORT POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

MP-05(01)

MP-05-Examine

[SELECT FROM: System media protecon policy; procedures addressing media storage; physical and environmental protecon policy and procedures; access control policy and procedures; authorized personnel list; system media; designated controlled areas; system security plan; other relevant documents or records].

MP-05-Interview

MP-05-Test

[SELECT FROM: Organizaonal processes for storing informaon media; mechanisms supporng and/or implemenng media storage/media protecon].

MEDIA TRANSPORT | PROTECTION OUTSIDE OF CONTROLLED AREAS [WITHDRAWN: Incorporated into MP-05.]

MP-05(02)

MEDIA TRANSPORT | DOCUMENTATION OF ACTIVITIES [WITHDRAWN: Incorporated into MP-05.]

MP-05(03)

MEDIA TRANSPORT | CUSTODIANS ASSESSMENT OBJECTIVE: Determine if:

MP-05(03)[01]

a custodian to transport system media outside of controlled areas is idenﬁed;

MP-05(03)[02]

the idenﬁed custodian is employed during the transport of system media outside of controlled areas.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

MP-05(03)-Examine

[SELECT FROM: System media protecon policy; procedures addressing media transport; physical and environmental protecon policy and procedures; system media transport records; audit records; system security plan; other relevant documents or records].

MP-05(03)-Interview

[SELECT FROM: Organizaonal personnel with system media transport responsibilies; organizaonal personnel with informaon security responsibilies].

MP-05(03)-Test

[SELECT FROM: Organizaonal processes for idenfying and employing a custodian to transport media outside of controlled areas].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 321

NIST SP 800-53A, REV. 5

MP-05(04)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

MEDIA TRANSPORT | CRYPTOGRAPHIC PROTECTION [WITHDRAWN: Incorporated into SC-28(01).]

MP-06

MEDIA SANITIZATION ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

MP-06_ODP[01]

system media to be sanized prior to disposal is deﬁned;

MP-06_ODP[02]

system media to be sanized prior to release from organizaonal control is deﬁned;

MP-06_ODP[03]

system media to be sanized prior to release for reuse is deﬁned;

MP-06_ODP[04]

sanizaon techniques and procedures to be used for sanizaon prior to disposal are deﬁned;

MP-06_ODP[05]

sanizaon techniques and procedures to be used for sanizaon prior to release from organizaonal control are deﬁned;

MP-06_ODP[06]

sanizaon techniques and procedures to be used for sanizaon prior to release for reuse are deﬁned;

MP-06a.[01]

<MP-06_ODP[01] system media> is sanized using <MP-06_ODP[04] sanizaon techniques and procedures> prior to disposal;

MP-06a.[02]

<MP-06_ODP[02] system media> is sanized using <MP-06_ODP[05] sanizaon techniques and procedures> prior to release from organizaonal control;

MP-06a.[03]

<MP-06_ODP[03] system media> is sanized using <MP-06_ODP[06] sanizaon techniques and procedures> prior to release for reuse;

MP-06b.

sanizaon mechanisms with strength and integrity commensurate with the security category or classiﬁcaon of the informaon are employed.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

MP-06-Examine

[SELECT FROM: System media protecon policy; procedures addressing media sanizaon and disposal; applicable federal standards and policies addressing media sanizaon policy; media sanizaon records; system audit records; system design documentaon; records retenon and disposion policy; records retenon and disposion procedures; system conﬁguraon sengs and associated documentaon; system security plan; privacy plan; other relevant documents or records].

MP-06-Interview

[SELECT FROM: Organizaonal personnel with media sanizaon responsibilies; organizaonal personnel with records retenon and disposion responsibilies; organizaonal personnel with informaon security and privacy responsibilies; system/network administrators].

MP-06-Test

[SELECT FROM: Organizaonal processes for media sanizaon; mechanisms supporng and/or implemenng media sanizaon].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 322

NIST SP 800-53A, REV. 5

MP-06(01)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

MEDIA SANITIZATION | REVIEW, APPROVE, TRACK, DOCUMENT, AND VERIFY ASSESSMENT OBJECTIVE: Determine if:

MP-06(01)[01]

media sanizaon and disposal acons are reviewed;

MP-06(01)[02]

media sanizaon and disposal acons are approved;

MP-06(01)[03]

media sanizaon and disposal acons are tracked;

MP-06(01)[04]

media sanizaon and disposal acons are documented;

MP-06(01)[05]

media sanizaon and disposal acons are veriﬁed.

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

MP-06(02)

MP-06(01)-Examine

[SELECT FROM: System media protecon policy; procedures addressing media sanizaon and disposal; records retenon and disposion policy; records retenon and disposion procedures; media sanizaon and disposal records; review records for media sanizaon and disposal acons; approvals for media sanizaon and disposal acons; tracking records; veriﬁcaon records; system audit records; system security plan; privacy plan; other relevant documents or records].

MP-06(01)-Interview

[SELECT FROM: Organizaonal personnel with system media sanizaon and disposal responsibilies; organizaonal personnel with records retenon and disposion responsibilies; organizaonal personnel with informaon security and privacy responsibilies; system/network administrators].

MP-06(01)-Test

[SELECT FROM: Organizaonal processes for media sanizaon; mechanisms supporng and/or implemenng media sanizaon; mechanisms supporng and/ or implemenng veriﬁcaon of media sanizaon].

MEDIA SANITIZATION | EQUIPMENT TESTING ASSESSMENT OBJECTIVE: Determine if:

MP-06(02)_ODP[01]

frequency with which to test sanizaon equipment is deﬁned;

MP-06(02)_ODP[02]

frequency with which to test sanizaon procedures is deﬁned;

MP-06(02)[01]

sanizaon equipment is tested <MP-06(02)_ODP[01] frequency> to ensure that the intended sanizaon is being achieved;

MP-06(02)[02]

sanizaon procedures are tested <MP-06(02)_ODP[02] frequency> to ensure that the intended sanizaon is being achieved.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: MP-06(02)-Examine

CHAPTER FOUR

[SELECT FROM: System media protecon policy; procedures addressing media sanizaon and disposal; procedures addressing tesng of media sanizaon equipment; results of media sanizaon equipment and procedures tesng; system audit records; records retenon and disposion policy; records retenon and disposion procedures; system security plan; privacy plan; other relevant documents or records].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 323

NIST SP 800-53A, REV. 5

MP-06(02)

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

MP-06(03)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

MEDIA SANITIZATION | EQUIPMENT TESTING MP-06(02)-Interview

[SELECT FROM: Organizaonal personnel with system media sanizaon responsibilies; organizaonal personnel with records retenon and disposion responsibilies; organizaonal personnel with informaon security and privacy responsibilies].

MP-06(02)-Test

[SELECT FROM: Organizaonal processes for media sanizaon; automated mechanisms supporng and/or implemenng media sanizaon; automated mechanisms supporng and/or implemenng media sanizaon procedures; sanizaon equipment].

MEDIA SANITIZATION | NONDESTRUCTIVE TECHNIQUES ASSESSMENT OBJECTIVE: Determine if:

MP-06(03)_ODP

circumstances requiring sanizaon of portable storage devices are deﬁned;

MP-06(03)

non-destrucve sanizaon techniques are applied to portable storage devices prior to connecng such devices to the system under <MP-06(03)_ODP circumstances>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

MP-06(04)

MP-06(03)-Examine

[SELECT FROM: System media protecon policy; procedures addressing media sanizaon and disposal; informaon on portable storage devices for the system; list of circumstances requiring sanizaon of portable storage devices; media sanizaon records; audit records; system security plan; other relevant documents or records].

MP-06(03)-Interview

[SELECT FROM: Organizaonal personnel with system media sanizaon responsibilies; organizaonal personnel with informaon security responsibilies].

MP-06(03)-Test

[SELECT FROM: Organizaonal processes for media sanizaon of portable storage devices; mechanisms supporng and/or implemenng media sanizaon].

MEDIA SANITIZATION | CONTROLLED UNCLASSIFIED INFORMATION [WITHDRAWN: Incorporated into MP-06.]

MP-06(05)

MEDIA SANITIZATION | CLASSIFIED INFORMATION [WITHDRAWN: Incorporated into MP-06.]

MP-06(06)

MEDIA SANITIZATION | MEDIA DESTRUCTION [WITHDRAWN: Incorporated into MP-06.]

CHAPTER FOUR

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 324

NIST SP 800-53A, REV. 5

MP-06(07)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

MEDIA SANITIZATION | DUAL AUTHORIZATION ASSESSMENT OBJECTIVE: Determine if:

MP-06(07)_ODP

system media to be sanized using dual authorizaon is deﬁned;

MP-06(07)

dual authorizaon for sanizaon of <MP-06(07)_ODP system media> is enforced.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

MP-06(08)

MP-06(07)-Examine

[SELECT FROM: System media protecon policy; procedures addressing media sanizaon and disposal; dual authorizaon policy and procedures; list of system media requiring dual authorizaon for sanizaon; authorizaon records; media sanizaon records; audit records; system security plan; other relevant documents or records].

MP-06(07)-Interview

[SELECT FROM: Organizaonal personnel with system media sanizaon responsibilies; organizaonal personnel with informaon security responsibilies; system/network administrators].

MP-06(07)-Test

[SELECT FROM: Organizaonal processes requiring dual authorizaon for media sanizaon; mechanisms supporng and/or implemenng media sanizaon; mechanisms supporng and/or implemenng dual authorizaon].

MEDIA SANITIZATION | REMOTE PURGING OR WIPING OF INFORMATION ASSESSMENT OBJECTIVE: Determine if:

MP-06(08)_ODP[01]

systems or system components to purge or wipe informaon either remotely or under speciﬁc condions are deﬁned;

MP-06(08)_ODP[02]

one of the following PARAMETER VALUES is selected: {remotely; under <MP-06(08)_ODP[03] condions>};

MP-06(08)_ODP[03]

condions under which informaon is to be purged or wiped are deﬁned (if selected);

MP-06(08)

the capability to purge or wipe informaon from <MP-06(08)_ODP[01] systems or system components> <MP-06(08)_ODP[02] SELECTED PARAMETER VALUE> is provided.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

MP-06(08)-Examine

[SELECT FROM: System media protecon policy; procedures addressing media sanizaon and disposal; system design documentaon; system conﬁguraon sengs and associated documentaon; authorizaon records; media sanizaon records; audit records; system security plan; other relevant documents or records].

MP-06(08)-Interview

[SELECT FROM: Organizaonal personnel with system media sanizaon responsibilies; organizaonal personnel with informaon security responsibilies; system/network administrators].

MP-06(08)-Test

[SELECT FROM: Organizaonal processes for purging/wiping media; mechanisms supporng and/or implemenng purge/wipe capabilies].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 325

NIST SP 800-53A, REV. 5

MP-07

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

MEDIA USE ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

MP-07_ODP[01]

types of system media to be restricted or prohibited from use on systems or system components are deﬁned;

MP-07_ODP[02]

one of the following PARAMETER VALUES is selected: {restrict; prohibit};

MP-07_ODP[03]

systems or system components on which the use of speciﬁc types of system media to be restricted or prohibited are deﬁned;

MP-07_ODP[04]

controls to restrict or prohibit the use of speciﬁc types of system media on systems or system components are deﬁned;

MP-07a.

the use of <MP-07_ODP[01] types of system media> is <MP-07_ODP[02] SELECTED PARAMETER VALUE> on <MP-07_ODP[03] systems or system components> using <MP-07_ODP[04] controls>;

MP-07b.

the use of portable storage devices in organizaonal systems is prohibited when such devices have no idenﬁable owner.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

MP-07(01)

MP-07-Examine

[SELECT FROM: System media protecon policy; system use policy; procedures addressing media usage restricons; rules of behavior; system design documentaon; system conﬁguraon sengs and associated documentaon; audit records; system security plan; other relevant documents or records].

MP-07-Interview

[SELECT FROM: Organizaonal personnel with system media use responsibilies; organizaonal personnel with informaon security responsibilies; system/network administrators].

MP-07-Test

[SELECT FROM: Organizaonal processes for media use; mechanisms restricng or prohibing the use of system media on systems or system components].

MEDIA USE | PROHIBIT USE WITHOUT OWNER [WITHDRAWN: Incorporated into MP-07.]

MP-07(02)

MEDIA USE | PROHIBIT USE OF SANITIZATION-RESISTANT MEDIA ASSESSMENT OBJECTIVE: Determine if:

MP-07(02)[01]

sanizaon-resistant media is idenﬁed;

MP-07(02)[02]

the use of sanizaon-resistant media in organizaonal systems is prohibited.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: MP-07(02)-Examine

CHAPTER FOUR

[SELECT FROM: System media protecon policy; system use policy; procedures addressing media usage restricons; rules of behavior; system conﬁguraon sengs and associated documentaon; system security plan; other relevant documents or records].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 326

NIST SP 800-53A, REV. 5

MP-07(02)

MP-08

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

MEDIA USE | PROHIBIT USE OF SANITIZATION-RESISTANT MEDIA MP-07(02)-Interview

[SELECT FROM: Organizaonal personnel with system media use responsibilies; organizaonal personnel with informaon security responsibilies; system/network administrators].

MP-07(02)-Test

[SELECT FROM: Organizaonal processes for media use; mechanisms prohibing use of media on systems or system components].

MEDIA DOWNGRADING

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

ASSESSMENT OBJECTIVE: Determine if:

MP-08_ODP[01]

a system media downgrading process is deﬁned;

MP-08_ODP[02]

system media requiring downgrading is deﬁned;

MP-08a.[01]

a <MP-08_ODP[01] system media downgrading process> is established;

MP-08a.[02]

the <MP-08_ODP[01] system media downgrading process> includes employing downgrading mechanisms with strength and integrity commensurate with the security category or classiﬁcaon of the informaon;

MP-08b.[01]

there is veriﬁcaon that the system media downgrading process is commensurate with the security category and/or classiﬁcaon level of the informaon to be removed;

MP-08b.[02]

there is veriﬁcaon that the system media downgrading process is commensurate with the access authorizaons of the potenal recipients of the downgraded informaon;

MP-08c.

<MP-08_ODP[02] system media requiring downgrading> is idenﬁed;

MP-08d.

the idenﬁed system media is downgraded using the <MP-08_ODP[01] system media downgrading process>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

MP-08(01)

MP-08-Examine

[SELECT FROM: System media protecon policy; procedures addressing media downgrading; system categorizaon documentaon; list of media requiring downgrading; records of media downgrading; audit records; system security plan; other relevant documents or records].

MP-08-Interview

[SELECT FROM: Organizaonal personnel with system media downgrading responsibilies; organizaonal personnel with informaon security responsibilies; system/network administrators].

MP-08-Test

[SELECT FROM: Organizaonal processes for media downgrading; mechanisms supporng and/or implemenng media downgrading].

MEDIA DOWNGRADING | DOCUMENTATION OF PROCESS ASSESSMENT OBJECTIVE: Determine if: MP-08(01)

CHAPTER FOUR

system media downgrading acons are documented.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 327

NIST SP 800-53A, REV. 5

MP-08(01)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

MEDIA DOWNGRADING | DOCUMENTATION OF PROCESS POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

MP-08(02)

MP-08(01)-Examine

MP-08(01)-Interview

[SELECT FROM: Organizaonal personnel with system media downgrading responsibilies; organizaonal personnel with informaon security responsibilies; system/network administrators].

MP-08(01)-Test

[SELECT FROM: Organizaonal processes for media downgrading; mechanisms supporng and/or implemenng media downgrading].

MEDIA DOWNGRADING | EQUIPMENT TESTING ASSESSMENT OBJECTIVE: Determine if:

MP-08(02)_ODP[01]

the frequency with which to test downgrading equipment is deﬁned;

MP-08(02)_ODP[02]

the frequency with which to test downgrading procedures is deﬁned;

MP-08(02)[01]

downgrading equipment is tested <MP-08(02)_ODP[01] frequency> to ensure that downgrading acons are being achieved;

MP-08(02)[02]

downgrading procedures are tested <MP-08(02)_ODP[02] frequency> to ensure that downgrading acons are being achieved.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

MP-08(03)

MP-08(02)-Examine

[SELECT FROM: System media protecon policy; procedures addressing media downgrading; procedures addressing tesng of media downgrading equipment; results of downgrading equipment and procedures tesng; records of media downgrading; audit records; system security plan; other relevant documents or records].

MP-08(02)-Interview

[SELECT FROM: Organizaonal personnel with system media downgrading responsibilies; organizaonal personnel with informaon security responsibilies].

MP-08(02)-Test

[SELECT FROM: Organizaonal processes for media downgrading; mechanisms supporng and/or implemenng media downgrading].

MEDIA DOWNGRADING | CONTROLLED UNCLASSIFIED INFORMATION ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

MP-08(03)[01]

system media containing controlled unclassiﬁed informaon is idenﬁed;

MP-08(03)[02]

system media containing controlled unclassiﬁed informaon is downgraded prior to public release.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 328

NIST SP 800-53A, REV. 5

MP-08(03)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

MEDIA DOWNGRADING | CONTROLLED UNCLASSIFIED INFORMATION POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

MP-08(04)

MP-08(03)-Examine

[SELECT FROM: System media protecon policy; access authorizaon policy; procedures addressing downgrading of media containing CUI; applicable federal and organizaonal standards and policies regarding protecon of CUI; media downgrading records; system security plan; other relevant documents or records].

MP-08(03)-Interview

[SELECT FROM: Organizaonal personnel with system media downgrading responsibilies; organizaonal personnel with informaon security responsibilies].

MP-08(03)-Test

[SELECT FROM: Organizaonal processes for media downgrading; mechanisms supporng and/or implemenng media downgrading].

MEDIA DOWNGRADING | CLASSIFIED INFORMATION ASSESSMENT OBJECTIVE: Determine if:

MP-08(04)[01]

system media containing classiﬁed informaon is idenﬁed;

MP-08(04)[02]

system media containing classiﬁed informaon is downgraded prior to release to individuals without required access authorizaons.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

MP-08(04)-Examine

[SELECT FROM: System media protecon policy; access authorizaon policy; procedures addressing downgrading of media containing classiﬁed informaon; procedures addressing handling of classiﬁed informaon; NSA standards and policies regarding protecon of classiﬁed informaon; media downgrading records; system security plan; other relevant documents or records].

MP-08(04)-Interview

[SELECT FROM: Organizaonal personnel with system media downgrading responsibilies; organizaonal personnel with informaon security responsibilies].

MP-08(04)-Test

[SELECT FROM: Organizaonal processes for media downgrading; mechanisms supporng and/or implemenng media downgrading].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 329

NIST SP 800-53A, REV. 5

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

4.11 PHYSICAL AND ENVIRONMENTAL PROTECTION PE-01

POLICY AND PROCEDURES ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5 CHAPTER FOUR

PE-01_ODP[01]

personnel or roles to whom the physical and environmental protecon policy is to be disseminated is/are deﬁned;

PE-01_ODP[02]

personnel or roles to whom the physical and environmental protecon procedures are to be disseminated is/are deﬁned;

PE-01_ODP[03]

one or more of the following PARAMETER VALUES is/are selected: {organizaonlevel; mission/business process-level; system-level};

PE-01_ODP[04]

an oﬃcial to manage the physical and environmental protecon policy and procedures is deﬁned;

PE-01_ODP[05]

the frequency at which the current physical and environmental protecon policy is reviewed and updated is deﬁned;

PE-01_ODP[06]

events that would require the current physical and environmental protecon policy to be reviewed and updated are deﬁned;

PE-01_ODP[07]

the frequency at which the current physical and environmental protecon procedures are reviewed and updated is deﬁned;

PE-01_ODP[08]

events that would require the physical and environmental protecon procedures to be reviewed and updated are deﬁned;

PE-01a.[01]

a physical and environmental protecon policy is developed and documented;

PE-01a.[02]

the physical and environmental protecon policy is disseminated to <PE-01_ODP[01] personnel or roles>;

PE-01a.[03]

physical and environmental protecon procedures to facilitate the implementaon of the physical and environmental protecon policy and associated physical and environmental protecon controls are developed and documented;

PE-01a.[04]

the physical and environmental protecon procedures are disseminated to <PE-01_ODP[02] personnel or roles>;

PE-01a.01(a)[01]

the <PE-01_ODP[03] SELECTED PARAMETER VALUE(S)> physical and environmental protecon policy addresses purpose;

PE-01a.01(a)[02]

the <PE-01_ODP[03] SELECTED PARAMETER VALUE(S)> physical and environmental protecon policy addresses scope;

PE-01a.01(a)[03]

the <PE-01_ODP[03] SELECTED PARAMETER VALUE(S)> physical and environmental protecon policy addresses roles;

PE-01a.01(a)[04]

the <PE-01_ODP[03] SELECTED PARAMETER VALUE(S)> physical and environmental protecon policy addresses responsibilies;

PE-01a.01(a)[05]

the <PE-01_ODP[03] SELECTED PARAMETER VALUE(S)> physical and environmental protecon policy addresses management commitment;

PE-01a.01(a)[06]

the <PE-01_ODP[03] SELECTED PARAMETER VALUE(S)> physical and environmental protecon policy addresses coordinaon among organizaonal enes;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 330

NIST SP 800-53A, REV. 5

PE-01

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

POLICY AND PROCEDURES

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

PE-01a.01(a)[07]

the <PE-01_ODP[03] SELECTED PARAMETER VALUE(S)> physical and environmental protecon policy addresses compliance;

PE-01a.01(b)

the <PE-01_ODP[03] SELECTED PARAMETER VALUE(S)> physical and environmental protecon policy is consistent with applicable laws, Execuve Orders, direcves, regulaons, policies, standards, and guidelines;

PE-01b.

the <PE-01_ODP[04] oﬃcial> is designated to manage the development, documentaon, and disseminaon of the physical and environmental protecon policy and procedures;

PE-01c.01[01]

the current physical and environmental protecon policy is reviewed and updated <PE-01_ODP[05] frequency>;

PE-01c.01[02]

the current physical and environmental protecon policy is reviewed and updated following <PE-01_ODP[06] events>;

PE-01c.02[01]

the current physical and environmental protecon procedures are reviewed and updated <PE-01_ODP[07] frequency>;

PE-01c.02[02]

the current physical and environmental protecon procedures are reviewed and updated following <PE-01_ODP[08] events>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

PE-02

PE-01-Examine

[SELECT FROM: Physical and environmental protecon policy and procedures; system security plan; privacy plan; organizaonal risk management strategy; other relevant documents or records].

PE-01-Interview

[SELECT FROM: Organizaonal personnel with physical and environmental protecon responsibilies; organizaonal personnel with informaon security and privacy responsibilies].

PHYSICAL ACCESS AUTHORIZATIONS ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

PE-02_ODP

frequency at which to review the access list detailing authorized facility access by individuals is deﬁned;

PE-02a.[01]

a list of individuals with authorized access to the facility where the system resides has been developed;

PE-02a.[02]

the list of individuals with authorized access to the facility where the system resides has been approved;

PE-02a.[03]

the list of individuals with authorized access to the facility where the system resides has been maintained;

PE-02b.

authorizaon credenals are issued for facility access;

PE-02c.

the access list detailing authorized facility access by individuals is reviewed <PE-02_ODP frequency>;

PE-02d.

individuals are removed from the facility access list when access is no longer required.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 331

NIST SP 800-53A, REV. 5

PE-02

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

PHYSICAL ACCESS AUTHORIZATIONS POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

PE-02(01)

PE-02-Examine

[SELECT FROM: Physical and environmental protecon policy; procedures addressing physical access authorizaons; authorized personnel access list; authorizaon credenals; physical access list reviews; physical access terminaon records and associated documentaon; system security plan; other relevant documents or records].

PE-02-Interview

[SELECT FROM: Organizaonal personnel with physical access authorizaon responsibilies; organizaonal personnel with physical access to system facility; organizaonal personnel with informaon security responsibilies].

PE-02-Test

[SELECT FROM: Organizaonal processes for physical access authorizaons; mechanisms supporng and/or implemenng physical access authorizaons].

PHYSICAL ACCESS AUTHORIZATIONS | ACCESS BY POSITION OR ROLE ASSESSMENT OBJECTIVE: Determine if: PE-02(01)

physical access to the facility where the system resides is authorized based on posion or role.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

PE-02(02)

PE-02(01)-Examine

[SELECT FROM: Physical and environmental protecon policy; procedures addressing physical access authorizaons; physical access control logs or records; list of posions/roles and corresponding physical access authorizaons; system entry and exit points; system security plan; other relevant documents or records].

PE-02(01)-Interview

PE-02(01)-Test

[SELECT FROM: Organizaonal processes for physical access authorizaons; mechanisms supporng and/or implemenng physical access authorizaons].

PHYSICAL ACCESS AUTHORIZATIONS | TWO FORMS OF IDENTIFICATION ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

PE-02(02)_ODP

a list of acceptable forms of idenﬁcaon for visitor access to the facility where the system resides is deﬁned;

PE-02(02)

two forms of idenﬁcaon are required from <PE-02(02)_ODP list of acceptable forms of idenﬁcaon> for visitor access to the facility where the system resides.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 332

NIST SP 800-53A, REV. 5

PE-02(02)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

PHYSICAL ACCESS AUTHORIZATIONS | TWO FORMS OF IDENTIFICATION POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

PE-02(03)

PE-02(02)-Examine

[SELECT FROM: Physical and environmental protecon policy; procedures addressing physical access authorizaons; list of acceptable forms of idenﬁcaon for visitor access to the facility where the system resides; access authorizaon forms; access credenals; physical access control logs or records; system security plan; other relevant documents or records].

PE-02(02)-Interview

[SELECT FROM: Organizaonal personnel with physical access authorizaon responsibilies; organizaonal personnel with physical access to the system facility; organizaonal personnel with informaon security responsibilies].

PE-02(02)-Test

[SELECT FROM: Organizaonal processes for physical access authorizaons; mechanisms supporng and/or implemenng physical access authorizaons].

PHYSICAL ACCESS AUTHORIZATIONS | RESTRICT UNESCORTED ACCESS ASSESSMENT OBJECTIVE: Determine if:

PE-02(03)_ODP[01]

one or more of the following PARAMETER VALUES is/are selected: {security clearances for all informaon contained within the system; formal access authorizaons for all informaon contained within the system; need for access to all informaon contained within the system; <PE-02(03)_ODP[02] physical access authorizaons>};

PE-02(03)_ODP[02]

physical access authorizaons for unescorted access to the facility where the system resides are deﬁned (if selected);

PE-02(03)

unescorted access to the facility where the system resides is restricted to personnel with <PE-02(03)_ODP[01] SELECTED PARAMETER VALUE(S)>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

PE-03

PE-02(03)-Examine

[SELECT FROM: Physical and environmental protecon policy; procedures addressing physical access authorizaons; authorized personnel access list; security clearances; access authorizaons; access credenals; physical access control logs or records; system security plan; other relevant documents or records].

PE-02(03)-Interview

PE-02(03)-Test

[SELECT FROM: Organizaonal processes for physical access authorizaons; mechanisms supporng and/or implemenng physical access authorizaons].

PHYSICAL ACCESS CONTROL ASSESSMENT OBJECTIVE: Determine if:

PE-03_ODP[01]

CHAPTER FOUR

entry and exit points to the facility in which the system resides are deﬁned;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 333

NIST SP 800-53A, REV. 5

PE-03

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

PHYSICAL ACCESS CONTROL

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

PE-03_ODP[02]

one or more of the following PARAMETER VALUES is/are selected: {<PE-03_ODP[03] systems or devices>; guards};

PE-03_ODP[03]

physical access control systems or devices used to control ingress and egress to the facility are deﬁned (if selected);

PE-03_ODP[04]

entry or exit points for which physical access logs are maintained are deﬁned;

PE-03_ODP[05]

physical access controls to control access to areas within the facility designated as publicly accessible are deﬁned;

PE-03_ODP[06]

circumstances requiring visitor escorts and control of visitor acvity are deﬁned;

PE-03_ODP[07]

physical access devices to be inventoried are deﬁned;

PE-03_ODP[08]

frequency at which to inventory physical access devices is deﬁned;

PE-03_ODP[09]

frequency at which to change combinaons is deﬁned;

PE-03_ODP[10]

frequency at which to change keys is deﬁned;

PE-03a.01

physical access authorizaons are enforced at <PE-03_ODP[01] entry and exit points> by verifying individual access authorizaons before granng access to the facility;

PE-03a.02

physical access authorizaons are enforced at <PE-03_ODP[01] entry and exit points> by controlling ingress and egress to the facility using <PE-03_ODP[02] SELECTED PARAMETER VALUE(S)>;

PE-03b.

physical access audit logs are maintained for <PE-03_ODP[04] entry or exit points>;

PE-03c.

access to areas within the facility designated as publicly accessible are maintained by implemenng <PE-03_ODP[05] physical access controls>;

PE-03d.[01]

visitors are escorted;

PE-03d.[02]

visitor acvity is controlled <PE-03_ODP[06] circumstances>;

PE-03e.[01]

keys are secured;

PE-03e.[02]

combinaons are secured;

PE-03e.[03]

other physical access devices are secured;

PE-03f.

<PE-03_ODP[07] physical access devices> are inventoried <PE-03_ODP[08] frequency>;

PE-03g.[01]

combinaons are changed <PE-03_ODP[09] frequency> , when combinaons are compromised, or when individuals possessing the combinaons are transferred or terminated;

PE-03g.[02]

keys are changed <PE-03_ODP[10] frequency> , when keys are lost, or when individuals possessing the keys are transferred or terminated.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: PE-03-Examine

CHAPTER FOUR

[SELECT FROM: Physical and environmental protecon policy; procedures addressing physical access control; physical access control logs or records; inventory records of physical access control devices; system entry and exit points; records of key and lock combinaon changes; storage locaons for physical access control devices; physical access control devices; list of security safeguards controlling access to designated publicly accessible areas within facility; system security plan; other relevant documents or records].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 334

NIST SP 800-53A, REV. 5

PE-03

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

PE-03(01)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

PHYSICAL ACCESS CONTROL PE-03-Interview

[SELECT FROM: Organizaonal personnel with physical access control responsibilies; organizaonal personnel with informaon security responsibilies].

PE-03-Test

[SELECT FROM: Organizaonal processes for physical access control; mechanisms supporng and/or implemenng physical access control; physical access control devices].

PHYSICAL ACCESS CONTROL | SYSTEM ACCESS ASSESSMENT OBJECTIVE: Determine if:

PE-03(01)_ODP

physical spaces containing one or more components of the system are deﬁned;

PE-03(01)[01]

physical access authorizaons to the system are enforced;

PE-03(01)02]

physical access controls are enforced for the facility at <PE-03(01)_ODP physical spaces>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

PE-03(02)

PE-03(01)-Examine

[SELECT FROM: Physical and environmental protecon policy; procedures addressing physical access control; physical access control logs or records; physical access control devices; access authorizaons; access credenals; system entry and exit points; list of areas within the facility containing concentraons of system components or system components requiring addional physical protecon; system security plan; other relevant documents or records].

PE-03(01)-Interview

[SELECT FROM: Organizaonal personnel with physical access authorizaon responsibilies; organizaonal personnel with informaon security responsibilies].

PE-03(01)-Test

[SELECT FROM: Organizaonal processes for physical access control to the informaon system/components; mechanisms supporng and/or implemenng physical access control for facility areas containing system components].

PHYSICAL ACCESS CONTROL | FACILITY AND SYSTEMS ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

PE-03(02)_ODP

the frequency at which to perform security checks at the physical perimeter of the facility or system for exﬁltraon of informaon or removal of system components is deﬁned;

PE-03(02)

security checks are performed <PE-03(02)_ODP frequency> at the physical perimeter of the facility or system for exﬁltraon of informaon or removal of system components.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 335

NIST SP 800-53A, REV. 5

PE-03(02)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

PHYSICAL ACCESS CONTROL | FACILITY AND SYSTEMS POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

PE-03(03)

PE-03(02)-Examine

[SELECT FROM: Physical and environmental protecon policy; procedures addressing physical access control; physical access control logs or records; records of security checks; security audit reports; security inspecon reports; facility layout documentaon; system entry and exit points; system security plan; other relevant documents or records].

PE-03(02)-Interview

[SELECT FROM: Organizaonal personnel with physical access control responsibilies; organizaonal personnel with informaon security responsibilies].

PE-03(02)-Test

[SELECT FROM: Organizaonal processes for physical access control to the facility and/or system; mechanisms supporng and/or implemenng physical access control for the facility or system; mechanisms supporng and/or implemenng security checks for the unauthorized exﬁltraon of informaon].

PHYSICAL ACCESS CONTROL | CONTINUOUS GUARDS ASSESSMENT OBJECTIVE: Determine if:

PE-03(03)_ODP

physical access points to the facility where the system resides are deﬁned;

PE-03(03)

guards are employed to control <PE-03(03)_ODP physical access points> to the facility where the system resides 24 hours per day, 7 days per week.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

PE-03(04)

PE-03(03)-Examine

[SELECT FROM: Physical and environmental protecon policy; procedures addressing physical access control; physical access control logs or records; physical access control devices; facility surveillance records; facility layout documentaon; system entry and exit points; system security plan; other relevant documents or records].

PE-03(03)-Interview

[SELECT FROM: Organizaonal personnel with physical access control responsibilies; organizaonal personnel with informaon security responsibilies].

PE-03(03)-Test

[SELECT FROM: Organizaonal processes for physical access control to the facility where the system resides; mechanisms supporng and/or implemenng physical access control for the facility where the system resides].

PHYSICAL ACCESS CONTROL | LOCKABLE CASINGS ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

PE-03(04)_ODP

system components to be protected from unauthorized physical access are deﬁned;

PE-03(04)

lockable physical casings are used to protect <PE-03(04)_ODP system components> from unauthorized access.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 336

NIST SP 800-53A, REV. 5

PE-03(04)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

PHYSICAL ACCESS CONTROL | LOCKABLE CASINGS POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

PE-03(05)

PE-03(04)-Examine

[SELECT FROM: Physical and environmental protecon policy; procedures addressing physical access control; list of system components requiring protecon through lockable physical casings; lockable physical casings; system security plan; other relevant documents or records].

PE-03(04)-Interview

[SELECT FROM: Organizaonal personnel with physical access control responsibilies; organizaonal personnel with informaon security responsibilies].

PE-03(04)-Test

[SELECT FROM: Lockable physical casings].

PHYSICAL ACCESS CONTROL | TAMPER PROTECTION ASSESSMENT OBJECTIVE: Determine if:

PE-03(05)_ODP[01]

an-tamper technologies to be employed are deﬁned;

PE-03(05)_ODP[02]

one or more of the following PARAMETER VALUES is/are selected: {detect; prevent};

PE-03(05)_ODP[03]

hardware components to be protected from physical tampering or alteraon are deﬁned;

PE-03(05)

<PE-03(05)_ODP[01] an-tamper technologies> are employed to <PE-03(05)_ODP[02] SELECTED PARAMETER VALUE(S)> physical tampering or alteraon of <PE-03(05)_ODP[03] hardware components> within the system.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

PE-03(06)

PE-03(05)-Examine

[SELECT FROM: Physical and environmental protecon policy; procedures addressing physical access control; list of security safeguards to detect/prevent physical tampering or alteraon of system hardware components; system security plan; other relevant documents or records].

PE-03(05)-Interview

[SELECT FROM: Organizaonal personnel with physical access control responsibilies; organizaonal personnel with informaon security responsibilies].

PE-03(05)-Test

[SELECT FROM: Organizaonal processes to detect/prevent physical tampering or alteraon of system hardware components; mechanisms/security safeguards supporng and/or implemenng the detecon/prevenon of physical tampering/ alternaon of system hardware components].

PHYSICAL ACCESS CONTROL | FACILITY PENETRATION TESTING [WITHDRAWN: Incorporated into CA-08.]

CHAPTER FOUR

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 337

NIST SP 800-53A, REV. 5

PE-03(07)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

PHYSICAL ACCESS CONTROL | PHYSICAL BARRIERS ASSESSMENT OBJECTIVE: Determine if: PE-03(07)

physical barriers are used to limit access.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

PE-03(08)

PE-03(07)-Examine

[SELECT FROM: Physical and environmental protecon policy; procedures addressing physical access control; list of physical barriers to limit access to the system; system security plan; other relevant documents or records].

PE-03(07)-Interview

[SELECT FROM: Organizaonal personnel with physical access control responsibilies; organizaonal personnel with informaon security responsibilies].

PHYSICAL ACCESS CONTROL | ACCESS CONTROL VESTIBULES ASSESSMENT OBJECTIVE: Determine if:

PE-03(08)_ODP

locaons within the facility where access control vesbules are to be employed are deﬁned;

PE-03(08)

access control vesbules are employed at <PE-03(08)_ODP locaons>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

PE-04

PE-03(08)-Examine

[SELECT FROM: Physical and environmental protecon policy; procedures addressing physical access control; list of access control vesbules and locaons; system security plan; other relevant documents or records].

PE-03(08)-Interview

[SELECT FROM: Organizaonal personnel with physical access control responsibilies; organizaonal personnel with informaon security responsibilies].

PE-03(08)-Test

[SELECT FROM: Organizaonal processes for vesbules to prevent unauthorized access.].

ACCESS CONTROL FOR TRANSMISSION ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

PE-04_ODP[01]

system distribuon and transmission lines requiring physical access controls are deﬁned;

PE-04_ODP[02]

security controls to be implemented to control physical access to system distribuon and transmission lines within the organizaonal facility are deﬁned;

PE-04

physical access to <PE-04_ODP[01] system distribuon and transmission lines> within organizaonal facilies is controlled using <PE-04_ODP[02] security controls>.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 338

NIST SP 800-53A, REV. 5

PE-04

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

ACCESS CONTROL FOR TRANSMISSION POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

PE-05

PE-04-Examine

[SELECT FROM: Physical and environmental protecon policy; procedures addressing access control for transmission mediums; system design documentaon; facility communicaons and wiring diagrams; list of physical security safeguards applied to system distribuon and transmission lines; system security plan; other relevant documents or records].

PE-04-Interview

[SELECT FROM: Organizaonal personnel with physical access control responsibilies; organizaonal personnel with informaon security responsibilies].

PE-04-Test

[SELECT FROM: Organizaonal processes for access control to distribuon and transmission lines; mechanisms/security safeguards supporng and/or implemenng access control to distribuon and transmission lines].

ACCESS CONTROL FOR OUTPUT DEVICES ASSESSMENT OBJECTIVE: Determine if: PE-05_ODP

output devices that require physical access control to output are deﬁned;

PE-05

physical access to output from <PE-05_ODP output devices> is controlled to prevent unauthorized individuals from obtaining the output.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

PE-05(01)

PE-05-Examine

[SELECT FROM: Physical and environmental protecon policy; procedures addressing access control for display medium; facility layout of system components; actual displays from system components; list of output devices and associated outputs requiring physical access controls; physical access control logs or records for areas containing output devices and related outputs; system security plan; other relevant documents or records].

PE-05-Interview

[SELECT FROM: Organizaonal personnel with physical access control responsibilies; organizaonal personnel with informaon security responsibilies].

PE-05-Test

[SELECT FROM: Organizaonal processes for access control to output devices; mechanisms supporng and/or implemenng access control to output devices].

ACCESS CONTROL FOR OUTPUT DEVICES | ACCESS TO OUTPUT BY AUTHORIZED INDIVIDUALS [WITHDRAWN: Incorporated into PE-05.]

CHAPTER FOUR

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 339

NIST SP 800-53A, REV. 5

PE-05(02)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

ACCESS CONTROL FOR OUTPUT DEVICES | LINK TO INDIVIDUAL IDENTITY ASSESSMENT OBJECTIVE: Determine if: PE-05(02)

individual identy is linked to the receipt of output from output devices.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

PE-05(03)

PE-05(02)-Examine

[SELECT FROM: Physical and environmental protecon policy; procedures addressing physical access control; system design documentaon; system conﬁguraon sengs and associated documentaon; list of output devices and associated outputs requiring physical access controls; physical access control logs or records for areas containing output devices and related outputs; system audit records; system security plan; privacy plan; privacy impact assessment; privacy risk assessment documentaon; other relevant documents or records].

PE-05(02)-Interview

[SELECT FROM: Organizaonal personnel with physical access control responsibilies; organizaonal personnel with informaon security and privacy responsibilies; system/network administrators; system developers].

PE-05(02)-Test

[SELECT FROM: Organizaonal processes for access control to output devices; mechanisms supporng and/or implemenng access control to output devices].

ACCESS CONTROL FOR OUTPUT DEVICES | MARKING OUTPUT DEVICES [WITHDRAWN: Incorporated into PE-22.]

PE-06

MONITORING PHYSICAL ACCESS ASSESSMENT OBJECTIVE: Determine if:

PE-06_ODP[01]

the frequency at which to review physical access logs is deﬁned;

PE-06_ODP[02]

events or potenal indicaon of events requiring physical access logs to be reviewed are deﬁned;

PE-06a.

physical access to the facility where the system resides is monitored to detect and respond to physical security incidents;

PE-06b.[01]

physical access logs are reviewed <PE-06_ODP[01] frequency>;

PE-06b.[02]

physical access logs are reviewed upon occurrence of <PE-06_ODP[02] events>;

PE-06c.[01]

results of reviews are coordinated with organizaonal incident response capabilies;

PE-06c.[02]

results of invesgaons are coordinated with organizaonal incident response capabilies.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: PE-06-Examine

CHAPTER FOUR

[SELECT FROM: Physical and environmental protecon policy; procedures addressing physical access monitoring; physical access logs or records; physical access monitoring records; physical access log reviews; system security plan; other relevant documents or records].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 340

NIST SP 800-53A, REV. 5

PE-06

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

PE-06(01)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

MONITORING PHYSICAL ACCESS PE-06-Interview

[SELECT FROM: Organizaonal personnel with physical access monitoring responsibilies; organizaonal personnel with incident response responsibilies; organizaonal personnel with informaon security responsibilies].

PE-06-Test

[SELECT FROM: Organizaonal processes for monitoring physical access; mechanisms supporng and/or implemenng physical access monitoring; mechanisms supporng and/or implemenng the review of physical access logs].

MONITORING PHYSICAL ACCESS | INTRUSION ALARMS AND SURVEILLANCE EQUIPMENT ASSESSMENT OBJECTIVE: Determine if:

PE-06(01)[01]

physical access to the facility where the system resides is monitored using physical intrusion alarms;

PE-06(01)[02]

physical access to the facility where the system resides is monitored using physical surveillance equipment.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

PE-06(02)

PE-06(01)-Examine

PE-06(01)-Interview

PE-06(01)-Test

[SELECT FROM: Organizaonal processes for monitoring physical intrusion alarms and surveillance equipment; mechanisms supporng and/or implemenng physical access monitoring; mechanisms supporng and/or implemenng physical intrusion alarms and surveillance equipment].

MONITORING PHYSICAL ACCESS | AUTOMATED INTRUSION RECOGNITION AND RESPONSES ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

PE-06(02)_ODP[01]

classes or types of intrusions to be recognized by automated mechanisms are deﬁned;

PE-06(02)_ODP[02]

response acons to be iniated by automated mechanisms when organizaondeﬁned classes or types of intrusions are recognized are deﬁned;

PE-06(02)_ODP[03]

automated mechanisms used to recognize classes or types of intrusions and iniate response acons (deﬁned in PE-06(02)_ODP) are deﬁned;

PE-06(02)[01]

<PE-06(02)_ODP[01] classes or types of intrusions> are recognized;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 341

NIST SP 800-53A, REV. 5

PE-06(02)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

MONITORING PHYSICAL ACCESS | AUTOMATED INTRUSION RECOGNITION AND RESPONSES PE-06(02)[02]

<PE-06(02)_ODP[02] response acons> are iniated using <PE-06(02)_ODP[03] automated mechanisms>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

PE-06(03)

PE-06(02)-Examine

[SELECT FROM: Physical and environmental protecon policy; procedures addressing physical access monitoring; system design documentaon; system conﬁguraon sengs and associated documentaon; system audit records; list of response acons to be iniated when speciﬁc classes/types of intrusions are recognized; system security plan; privacy plan; other relevant documents or records].

PE-06(02)-Interview

[SELECT FROM: Organizaonal personnel with physical access monitoring responsibilies; organizaonal personnel with informaon security and privacy responsibilies].

PE-06(02)-Test

[SELECT FROM: Organizaonal processes for monitoring physical access; automated mechanisms supporng and/or implemenng physical access monitoring; automated mechanisms supporng and/or implemenng recognion of classes/ types of intrusions and iniaon of a response].

MONITORING PHYSICAL ACCESS | VIDEO SURVEILLANCE ASSESSMENT OBJECTIVE: Determine if:

PE-06(03)_ODP[01]

operaonal areas where video surveillance is to be employed are deﬁned;

PE-06(03)_ODP[02]

frequency at which to review video recordings is deﬁned;

PE-06(03)_ODP[03]

me period for which to retain video recordings is deﬁned;

PE-06(03)(a)

video surveillance of <PE-06(03)_ODP[01] operaonal areas> is employed;

PE-06(03)(b)

video recordings are reviewed <PE-06(03)_ODP[02] frequency>;

PE-06(03)(c)

video recordings are retained for <PE-06(03)_ODP[03] me period>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

PE-06(03)-Examine

[SELECT FROM: Physical and environmental protecon policy; procedures addressing physical access monitoring; video surveillance equipment used to monitor operaonal areas; video recordings of operaonal areas where video surveillance is employed; video surveillance equipment logs or records; system security plan; privacy plan; privacy impact assessment; privacy risk assessment documentaon; other relevant documents or records].

PE-06(03)-Interview

[SELECT FROM: Organizaonal personnel with physical access monitoring responsibilies; organizaonal personnel with informaon security and privacy responsibilies].

PE-06(03)-Test

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 342

NIST SP 800-53A, REV. 5

PE-06(04)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

MONITORING PHYSICAL ACCESS | MONITORING PHYSICAL ACCESS TO SYSTEMS ASSESSMENT OBJECTIVE: Determine if:

PE-06(04)_ODP

physical spaces containing one or more components of the system are deﬁned;

PE-06(04)

physical access to the system is monitored in addion to the physical access monitoring of the facility at <PE-06(04)_ODP physical spaces>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

PE-07

PE-06(04)-Examine

[SELECT FROM: Physical and environmental protecon policy; procedures addressing physical access monitoring; physical access control logs or records; physical access control devices; access authorizaons; access credenals; list of areas within the facility containing concentraons of system components or system components requiring addional physical access monitoring; system security plan; privacy plan; privacy impact assessment; privacy risk assessment documentaon; other relevant documents or records].

PE-06(04)-Interview

[SELECT FROM: Organizaonal personnel with physical access monitoring responsibilies; organizaonal personnel with informaon security and privacy responsibilies].

PE-06(04)-Test

[SELECT FROM: Organizaonal processes for monitoring physical access to the system; mechanisms supporng and/or implemenng physical access monitoring for facility areas containing system components].

VISITOR CONTROL [WITHDRAWN: Incorporated into PE-02, PE-03.]

PE-08

VISITOR ACCESS RECORDS ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

PE-08_ODP[01]

me period for which to maintain visitor access records for the facility where the system resides is deﬁned;

PE-08_ODP[02]

the frequency at which to review visitor access records is deﬁned;

PE-08_ODP[03]

personnel to whom visitor access records anomalies are reported to is/are deﬁned;

PE-08a.

visitor access records for the facility where the system resides are maintained for <PE-08_ODP[01] me period>;

PE-08b.

visitor access records are reviewed <PE-08_ODP[02] frequency>;

PE-08c.

visitor access records anomalies are reported to <PE-08_ODP[03] personnel>.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 343

NIST SP 800-53A, REV. 5

PE-08

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

VISITOR ACCESS RECORDS POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

PE-08(01)

PE-08-Examine

[SELECT FROM: Physical and environmental protecon policy; procedures addressing visitor access records; visitor access control logs or records; visitor access record or log reviews; system security plan; privacy plan; privacy impact assessment; privacy risk assessment documentaon; other relevant documents or records].

PE-08-Interview

[SELECT FROM: Organizaonal personnel with visitor access record responsibilies; organizaonal personnel with informaon security and privacy responsibilies].

PE-08-Test

[SELECT FROM: Organizaonal processes for maintaining and reviewing visitor access records; mechanisms supporng and/or implemenng the maintenance and review of visitor access records].

VISITOR ACCESS RECORDS | AUTOMATED RECORDS MAINTENANCE AND REVIEW ASSESSMENT OBJECTIVE: Determine if:

PE-08(01)_ODP[01]

automated mechanisms used to maintain visitor access records are deﬁned;

PE-08(01)_ODP[02]

automated mechanisms used to review visitor access records are deﬁned;

PE-08(01)[01]

visitor access records are maintained using <PE-08(01)_ODP[01] automated mechanisms>;

PE-08(01)[02]

visitor access records are reviewed using <PE-08(01)_ODP[02] automated mechanisms>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

PE-08(02)

PE-08(01)-Examine

[SELECT FROM: Physical and environmental protecon policy; procedures addressing visitor access records; automated mechanisms supporng management of visitor access records; visitor access control logs or records; system security plan; privacy plan; other relevant documents or records].

PE-08(01)-Interview

[SELECT FROM: Organizaonal personnel with visitor access record responsibilies; organizaonal personnel with informaon security and privacy responsibilies].

PE-08(01)-Test

[SELECT FROM: Organizaonal processes for maintaining and reviewing visitor access records; automated mechanisms supporng and/or implemenng the maintenance and review of visitor access records].

VISITOR ACCESS RECORDS | PHYSICAL ACCESS RECORDS [WITHDRAWN: Incorporated into PE-02.]

CHAPTER FOUR

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 344

NIST SP 800-53A, REV. 5

PE-08(03)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

VISITOR ACCESS RECORDS | LIMIT PERSONALLY IDENTIFIABLE INFORMATION ELEMENTS ASSESSMENT OBJECTIVE: Determine if:

PE-08(03)_ODP

elements idenﬁed in the privacy risk assessment to limit personally idenﬁable informaon contained in visitor access logs are deﬁned;

PE-08(03)

personally idenﬁable informaon contained in visitor access records is limited to <PE-08(03)_ODP elements> idenﬁed in the privacy risk assessment.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

PE-09

PE-08(03)-Examine

[SELECT FROM: Physical and environmental protecon policy; personally idenﬁable informaon processing policy; privacy risk assessment documentaon; privacy impact assessment; visitor access records; personally idenﬁable informaon inventory; system security plan; privacy plan; other relevant documents or records].

PE-08(03)-Interview

[SELECT FROM: Organizaonal personnel with visitor access records responsibilies; organizaonal personnel with informaon security and privacy responsibilies].

PE-08(03)-Test

[SELECT FROM: Organizaonal processes for maintaining and reviewing visitor access records].

POWER EQUIPMENT AND CABLING ASSESSMENT OBJECTIVE: Determine if: PE-09[01]

power equipment for the system is protected from damage and destrucon;

PE-09[02]

power cabling for the system is protected from damage and destrucon.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

PE-09(01)

PE-09-Examine

[SELECT FROM: Physical and environmental protecon policy; procedures addressing power equipment/cabling protecon; facilies housing power equipment/cabling; system security plan; other relevant documents or records].

PE-09-Interview

[SELECT FROM: Organizaonal personnel with the responsibility to protect power equipment/cabling; organizaonal personnel with informaon security responsibilies].

PE-09-Test

[SELECT FROM: Mechanisms supporng and/or implemenng the protecon of power equipment/cabling].

POWER EQUIPMENT AND CABLING | REDUNDANT CABLING ASSESSMENT OBJECTIVE: Determine if:

PE-09(01)_ODP

CHAPTER FOUR

distance by which redundant power cabling paths are to be physically separated is deﬁned;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 345

NIST SP 800-53A, REV. 5

PE-09(01)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

POWER EQUIPMENT AND CABLING | REDUNDANT CABLING PE-09(01)

redundant power cabling paths that are physically separated by <PE-09(01)_ODP distance> are employed.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

PE-09(02)

PE-09(01)-Examine

PE-09(01)-Interview

[SELECT FROM: Organizaonal personnel with the responsibility to protect power equipment/cabling; organizaonal personnel with informaon security responsibilies].

PE-09(01)-Test

[SELECT FROM: Mechanisms supporng and/or implemenng the protecon of power equipment/cabling].

POWER EQUIPMENT AND CABLING | AUTOMATIC VOLTAGE CONTROLS ASSESSMENT OBJECTIVE: Determine if:

PE-09(02)_ODP

the crical system components that require automac voltage controls are deﬁned;

PE-09(02)

automac voltage controls for <PE-09(02)_ODP crical system components> are employed.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

PE-10

PE-09(02)-Examine

[SELECT FROM: Physical and environmental protecon policy; procedures addressing voltage control; security plan; list of crical system components requiring automac voltage controls; automac voltage control mechanisms and associated conﬁguraons; system security plan; other relevant documents or records].

PE-09(02)-Interview

[SELECT FROM: Organizaonal personnel with responsibilies for environmental protecon of system components; organizaonal personnel with informaon security responsibilies].

PE-09(02)-Test

[SELECT FROM: Mechanisms supporng and/or implemenng automac voltage controls].

EMERGENCY SHUTOFF ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

PE-10_ODP[01]

system or individual system components that require the capability to shut oﬀ power in emergency situaons is/are deﬁned;

PE-10_ODP[02]

locaon of emergency shutoﬀ switches or devices by system or system component is deﬁned;

PE-10a.

the capability to shut oﬀ power to <PE-10_ODP[01] system or individual system components> in emergency situaons is provided;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 346

NIST SP 800-53A, REV. 5

PE-10

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

EMERGENCY SHUTOFF PE-10b.

emergency shutoﬀ switches or devices are placed in <PE-10_ODP[02] locaon> to facilitate access for authorized personnel;

PE-10c.

the emergency power shutoﬀ capability is protected from unauthorized acvaon.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

PE-10(01)

PE-10-Examine

[SELECT FROM: Physical and environmental protecon policy; procedures addressing power source emergency shutoﬀ; emergency shutoﬀ controls or switches; locaons housing emergency shutoﬀ switches and devices; security safeguards protecng the emergency power shutoﬀ capability from unauthorized acvaon; system security plan; other relevant documents or records].

PE-10-Interview

[SELECT FROM: Organizaonal personnel with the responsibility for the emergency power shutoﬀ capability (both implemenng and using the capability); organizaonal personnel with informaon security responsibilies].

PE-10-Test

[SELECT FROM: Mechanisms supporng and/or implemenng emergency power shutoﬀ].

EMERGENCY SHUTOFF | ACCIDENTAL AND UNAUTHORIZED ACTIVATION [WITHDRAWN: Incorporated into PE-10.]

PE-11

EMERGENCY POWER ASSESSMENT OBJECTIVE: Determine if: PE-11_ODP

one of the following PARAMETER VALUES is selected: {an orderly shutdown of the system; transion of the system to long-term alternate power};

PE-11

an uninterrupble power supply is provided to facilitate <PE-11_ODP SELECTED PARAMETER VALUE> in the event of a primary power source loss.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

PE-11-Examine

[SELECT FROM: Physical and environmental protecon policy; procedures addressing emergency power; uninterrupble power supply; uninterrupble power supply documentaon; uninterrupble power supply test records; system security plan; other relevant documents or records].

PE-11-Interview

[SELECT FROM: Organizaonal personnel with the responsibility for emergency power and/or planning; organizaonal personnel with informaon security responsibilies].

PE-11-Test

[SELECT FROM: Mechanisms supporng and/or implemenng an uninterrupble power supply; the uninterruptable power supply].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 347

NIST SP 800-53A, REV. 5

PE-11(01)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

EMERGENCY POWER | ALTERNATE POWER SUPPLY — MINIMAL OPERATIONAL CAPABILITY ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

PE-11(01)_ODP

one of the following PARAMETER VALUES is selected: {manually; automacally};

PE-11(01)[01]

an alternate power supply provided for the system is acvated <PE-11(01)_ODP SELECTED PARAMETER VALUE>;

PE-11(01)[02]

the alternate power supply provided for the system can maintain minimally required operaonal capability in the event of an extended loss of the primary power source.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

PE-11(02)

PE-11(01)-Examine

[SELECT FROM: Physical and environmental protecon policy; procedures addressing emergency power; alternate power supply; alternate power supply documentaon; alternate power supply test records; system security plan; other relevant documents or records].

PE-11(01)-Interview

[SELECT FROM: Organizaonal personnel with the responsibility for emergency power and/or planning; organizaonal personnel with informaon security responsibilies].

PE-11(01)-Test

[SELECT FROM: Mechanisms supporng and/or implemenng an alternate power supply; the alternate power supply].

EMERGENCY POWER | ALTERNATE POWER SUPPLY — SELF-CONTAINED ASSESSMENT OBJECTIVE: Determine if:

PE-11(02)_ODP[01]

one of the following PARAMETER VALUES is selected: {manually; automacally};

PE-11(02)_ODP[02]

one of the following PARAMETER VALUES is selected: {minimally required operaonal capability; full operaonal capability};

PE-11(02)

an alternate power supply provided for the system is acvated <PE-11(02)_ODP[01] SELECTED PARAMETER VALUE>;

PE-11(02)(a)

the alternate power supply provided for the system is self-contained;

PE-11(02)(b)

the alternate power supply provided for the system is not reliant on external power generaon;

PE-11(02)(c)

the alternate power supply provided for the system is capable of maintaining <PE-11(02)_ODP[02] SELECTED PARAMETER VALUE> in the event of an extended loss of the primary power source.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: PE-11(02)-Examine

CHAPTER FOUR

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 348

NIST SP 800-53A, REV. 5

PE-11(02)

PE-12

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

EMERGENCY POWER | ALTERNATE POWER SUPPLY — SELF-CONTAINED PE-11(02)-Interview

[SELECT FROM: Organizaonal personnel with the responsibility for emergency power and/or planning; organizaonal personnel with informaon security responsibilies].

PE-11(02)-Test

[SELECT FROM: Mechanisms supporng and/or implemenng an alternate power supply; the alternate power supply].

EMERGENCY LIGHTING

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

ASSESSMENT OBJECTIVE: Determine if: PE-12[01]

automac emergency lighng that acvates in the event of a power outage or disrupon is employed for the system;

PE-12[02]

automac emergency lighng that acvates in the event of a power outage or disrupon is maintained for the system;

PE-12[03]

automac emergency lighng for the system covers emergency exits within the facility;

PE-12[04]

automac emergency lighng for the system covers evacuaon routes within the facility.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

PE-12(01)

PE-12-Examine

[SELECT FROM: Physical and environmental protecon policy; procedures addressing emergency lighng; emergency lighng documentaon; emergency lighng test records; emergency exits and evacuaon routes; system security plan; other relevant documents or records].

PE-12-Interview

[SELECT FROM: Organizaonal personnel with the responsibility for emergency lighng and/or planning; organizaonal personnel with informaon security responsibilies].

PE-12-Test

[SELECT FROM: Mechanisms supporng and/or implemenng an emergency lighng capability].

EMERGENCY LIGHTING | ESSENTIAL MISSION AND BUSINESS FUNCTIONS ASSESSMENT OBJECTIVE: Determine if: PE-12(01)

emergency lighng is provided for all areas within the facility supporng essenal mission and business funcons.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: PE-12(01)-Examine

CHAPTER FOUR

[SELECT FROM: Physical and environmental protecon policy; procedures addressing emergency lighng; emergency lighng documentaon; emergency lighng test records; emergency exits and evacuaon routes; areas/locaons within facility supporng essenal missions and business funcons; system security plan; other relevant documents or records].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 349

NIST SP 800-53A, REV. 5

PE-12(01)

PE-13

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

EMERGENCY LIGHTING | ESSENTIAL MISSION AND BUSINESS FUNCTIONS PE-12(01)-Interview

[SELECT FROM: Organizaonal personnel with the responsibility for emergency lighng and/or planning; organizaonal personnel with informaon security responsibilies].

PE-12(01)-Test

[SELECT FROM: Mechanisms supporng and/or implemenng the emergency lighng capability].

FIRE PROTECTION

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

ASSESSMENT OBJECTIVE: Determine if: PE-13[01]

ﬁre detecon systems are employed;

PE-13[02]

employed ﬁre detecon systems are supported by an independent energy source;

PE-13[03]

employed ﬁre detecon systems are maintained;

PE-13[04]

ﬁre suppression systems are employed;

PE-13[05]

employed ﬁre suppression systems are supported by an independent energy source;

PE-13[06]

employed ﬁre suppression systems are maintained.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

PE-13(01)

PE-13-Examine

[SELECT FROM: Physical and environmental protecon policy; procedures addressing ﬁre protecon; ﬁre suppression and detecon devices/systems; ﬁre suppression and detecon devices/systems documentaon; test records of ﬁre suppression and detecon devices/systems; system security plan; other relevant documents or records].

PE-13-Interview

[SELECT FROM: Organizaonal personnel with responsibilies for ﬁre detecon and suppression devices/systems; organizaonal personnel with informaon security responsibilies].

PE-13-Test

[SELECT FROM: Mechanisms supporng and/or implemenng ﬁre suppression/ detecon devices/systems].

FIRE PROTECTION | DETECTION SYSTEMS — AUTOMATIC ACTIVATION AND NOTIFICATION ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

PE-13(01)_ODP[01]

personnel or roles to be noﬁed in the event of a ﬁre is/are deﬁned;

PE-13(01)_ODP[02]

emergency responders to be noﬁed in the event of a ﬁre are deﬁned;

PE-13(01)[01]

ﬁre detecon systems that acvate automacally are employed in the event of a ﬁre;

PE-13(01)[02]

ﬁre detecon systems that nofy <PE-13(01)_ODP[01] personnel or roles> automacally are employed in the event of a ﬁre;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 350

NIST SP 800-53A, REV. 5

PE-13(01)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

FIRE PROTECTION | DETECTION SYSTEMS — AUTOMATIC ACTIVATION AND NOTIFICATION PE-13(01)[03]

ﬁre detecon systems that nofy <PE-13(01)_ODP[02] emergency responders> automacally are employed in the event of a ﬁre.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

PE-13(02)

PE-13(01)-Examine

[SELECT FROM: Physical and environmental protecon policy; procedures addressing ﬁre protecon; facility housing the informaon system; alarm servicelevel agreements; test records of ﬁre suppression and detecon devices/systems; ﬁre suppression and detecon devices/systems documentaon; alerts/noﬁcaons of ﬁre events; system security plan; other relevant documents or records].

PE-13(01)-Interview

[SELECT FROM: Organizaonal personnel with responsibilies for ﬁre detecon and suppression devices/systems; organizaonal personnel with responsibilies for nofying appropriate personnel, roles, and emergency responders of ﬁres; organizaonal personnel with informaon security responsibilies].

PE-13(01)-Test

[SELECT FROM: Mechanisms supporng and/or implemenng ﬁre detecon devices/systems; acvaon of ﬁre detecon devices/systems (simulated); automated noﬁcaons].

FIRE PROTECTION | SUPPRESSION SYSTEMS — AUTOMATIC ACTIVATION AND NOTIFICATION ASSESSMENT OBJECTIVE: Determine if:

PE-13(02)_ODP[01]

personnel or roles to be noﬁed in the event of a ﬁre is/are deﬁned;

PE-13(02)_ODP[02]

emergency responders to be noﬁed in the event of a ﬁre are deﬁned;

PE-13(02)(a)[01]

ﬁre suppression systems that acvate automacally are employed;

PE-13(02)(a)[02]

ﬁre suppression systems that nofy <PE-13(02)_ODP[01] personnel or roles> automacally are employed;

PE-13(02)(a)[03]

ﬁre suppression systems that nofy <PE-13(02)_ODP[02] emergency responders> automacally are employed;

PE-13(02)(b)

an automac ﬁre suppression capability is employed when the facility is not staﬀed on a connuous basis.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

PE-13(02)-Examine

[SELECT FROM: Physical and environmental protecon policy; procedures addressing ﬁre protecon; ﬁre suppression and detecon devices/systems documentaon; facility housing the system; alarm service-level agreements; test records of ﬁre suppression and detecon devices/systems; system security plan; other relevant documents or records].

PE-13(02)-Interview

[SELECT FROM: Organizaonal personnel with responsibilies for ﬁre detecon and suppression devices/systems; organizaonal personnel with responsibilies for providing automac noﬁcaons of any acvaon of ﬁre suppression devices/ systems to appropriate personnel, roles, and emergency responders; organizaonal personnel with informaon security responsibilies].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 351

NIST SP 800-53A, REV. 5

PE-13(02)

FIRE PROTECTION | SUPPRESSION SYSTEMS — AUTOMATIC ACTIVATION AND NOTIFICATION PE-13(02)-Test

PE-13(03)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

[SELECT FROM: Automated mechanisms supporng and/or implemenng ﬁre suppression devices/systems; acvaon of ﬁre suppression devices/systems (simulated); automated noﬁcaons].

FIRE PROTECTION | AUTOMATIC FIRE SUPPRESSION [WITHDRAWN: Incorporated into PE-13(02).]

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

PE-13(04)

FIRE PROTECTION | INSPECTIONS ASSESSMENT OBJECTIVE: Determine if:

PE-13(04)_ODP[01]

the frequency for conducng ﬁre protecon inspecons on the facility is deﬁned;

PE-13(04)_ODP[02]

a me period for resolving deﬁciencies idenﬁed by ﬁre protecon inspecons is deﬁned;

PE-13(04)[01]

the facility undergoes ﬁre protecon inspecons <PE-13(04)_ODP[01] frequency> by authorized and qualiﬁed inspectors;

PE-13(04)[02]

the idenﬁed deﬁciencies from ﬁre protecon inspecons are resolved within <PE-13(04)_ODP[02] me period>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

PE-14

PE-13(04)-Examine

[SELECT FROM: Physical and environmental protecon policy; procedures addressing ﬁre protecon; facility housing the system; inspecon plans; inspecon results; inspect reports; test records of ﬁre suppression and detecon devices/ systems; system security plan; other relevant documents or records].

PE-13(04)-Interview

[SELECT FROM: Organizaonal personnel with responsibilies for planning, approving, and execung ﬁre inspecons; organizaonal personnel with informaon security responsibilies].

ENVIRONMENTAL CONTROLS ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

PE-14_ODP[01]

one or more of the following PARAMETER VALUES is/are selected: {temperature; humidity; pressure; radiaon; <PE-14_ODP[02] environmental control>};

PE-14_ODP[02]

environmental control(s) for which to maintain a speciﬁed level in the facility where the system resides are deﬁned (if selected);

PE-14_ODP[03]

acceptable levels for environmental controls are deﬁned;

PE-14_ODP[04]

frequency at which to monitor environmental control levels is deﬁned;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 352

NIST SP 800-53A, REV. 5

PE-14

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

ENVIRONMENTAL CONTROLS PE-14a.

<PE-14_ODP[01] SELECTED PARAMETER VALUE(S)> levels are maintained at <PE-14_ODP[03] acceptable levels> within the facility where the system resides;

PE-14b.

environmental control levels are monitored <PE-14_ODP[04] frequency>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

PE-14(01)

PE-14-Examine

[SELECT FROM: Physical and environmental protecon policy; procedures addressing temperature and humidity control; temperature and humidity controls; facility housing the system; temperature and humidity controls documentaon; temperature and humidity records; system security plan; other relevant documents or records].

PE-14-Interview

[SELECT FROM: Organizaonal personnel with responsibilies for system environmental controls; organizaonal personnel with informaon security responsibilies].

PE-14-Test

[SELECT FROM: Mechanisms supporng and/or implemenng the maintenance and monitoring of temperature and humidity levels].

ENVIRONMENTAL CONTROLS | AUTOMATIC CONTROLS ASSESSMENT OBJECTIVE: Determine if:

PE-14(01)_ODP

automac environmental controls to prevent ﬂuctuaons that are potenally harmful to the system are deﬁned;

PE-14(01)

<PE-14(01)_ODP automac environmental controls> are employed in the facility to prevent ﬂuctuaons that are potenally harmful to the system.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

PE-14(02)

PE-14(01)-Examine

[SELECT FROM: Physical and environmental protecon policy; procedures addressing temperature and humidity controls; facility housing the system; automated mechanisms for temperature and humidity; temperature and humidity controls; temperature and humidity documentaon; system security plan; other relevant documents or records].

PE-14(01)-Interview

[SELECT FROM: Organizaonal personnel with responsibilies for system environmental controls; organizaonal personnel with informaon security responsibilies].

PE-14(01)-Test

[SELECT FROM: Automated mechanisms supporng and/or implemenng temperature and humidity levels].

ENVIRONMENTAL CONTROLS | MONITORING WITH ALARMS AND NOTIFICATIONS ASSESSMENT OBJECTIVE: Determine if:

PE-14(02)_ODP

CHAPTER FOUR

personnel or roles to be noﬁed by environmental control monitoring when environmental changes are potenally harmful to personnel or equipment is/are deﬁned;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 353

NIST SP 800-53A, REV. 5

PE-14(02)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

ENVIRONMENTAL CONTROLS | MONITORING WITH ALARMS AND NOTIFICATIONS PE-14(02)[01]

environmental control monitoring is employed;

PE-14(02)[02]

the environmental control monitoring capability provides an alarm or noﬁcaon to <PE-14(02)_ODP personnel or roles> when changes are potenally harmful to personnel or equipment.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

PE-15

PE-14(02)-Examine

[SELECT FROM: Physical and environmental protecon policy; procedures addressing temperature and humidity monitoring; facility housing the system; logs or records of temperature and humidity monitoring; records of changes to temperature and humidity levels that generate alarms or noﬁcaons; system security plan; other relevant documents or records].

PE-14(02)-Interview

[SELECT FROM: Organizaonal personnel with responsibilies for system environmental controls; organizaonal personnel with informaon security responsibilies].

PE-14(02)-Test

[SELECT FROM: Mechanisms supporng and/or implemenng temperature and humidity monitoring].

WATER DAMAGE PROTECTION ASSESSMENT OBJECTIVE: Determine if: PE-15[01]

the system is protected from damage resulng from water leakage by providing master shutoﬀ or isolaon valves;

PE-15[02]

the master shutoﬀ or isolaon valves are accessible;

PE-15[03]

the master shutoﬀ or isolaon valves are working properly;

PE-15[04]

the master shutoﬀ or isolaon valves are known to key personnel.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

PE-15-Examine

[SELECT FROM: Physical and environmental protecon policy; procedures addressing water damage protecon; facility housing the system; master shutoﬀ valves; list of key personnel with knowledge of locaon and acvaon procedures for master shutoﬀ valves for the plumbing system; master shutoﬀ valve documentaon; system security plan; other relevant documents or records].

PE-15-Interview

[SELECT FROM: Organizaonal personnel with responsibilies for system environmental controls; organizaonal personnel with informaon security responsibilies].

PE-15-Test

[SELECT FROM: Master water-shutoﬀ valves; organizaonal process for acvang master water shutoﬀ].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 354

NIST SP 800-53A, REV. 5

PE-15(01)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

WATER DAMAGE PROTECTION | AUTOMATION SUPPORT ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

PE-15(01)_ODP[01]

personnel or roles to be alerted when the presence of water is detected near the system is/are deﬁned;

PE-15(01)_ODP[02]

automated mechanisms used to detect the presence of water near the system are deﬁned;

PE-15(01)[01]

the presence of water near the system can be detected automacally;

PE-15(01)[02]

<PE-15(01)_ODP[01] personnel or roles> is/are alerted using <PE-15(01)_ODP[02] automated mechanisms>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

PE-16

PE-15(01)-Examine

[SELECT FROM: Physical and environmental protecon policy; procedures addressing water damage protecon; facility housing the system; automated mechanisms for water shutoﬀ valves; automated mechanisms for detecng the presence of water in the vicinity of the system; alerts/noﬁcaons of water detecon in system facility; system security plan; other relevant documents or records].

PE-15(01)-Interview

[SELECT FROM: Organizaonal personnel with responsibilies for system environmental controls; organizaonal personnel with informaon security responsibilies].

PE-15(01)-Test

[SELECT FROM: Automated mechanisms supporng and/or implemenng water detecon capabilies and alerts for the system].

DELIVERY AND REMOVAL ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

PE-16_ODP[01]

types of system components to be authorized and controlled when entering the facility are deﬁned;

PE-16_ODP[02]

types of system components to be authorized and controlled when exing the facility are deﬁned;

PE-16a.[01]

<PE-16_ODP[01] types of system components> are authorized when entering the facility;

PE-16a.[02]

<PE-16_ODP[01] types of system components> are controlled when entering the facility;

PE-16a.[03]

<PE-16_ODP[02] types of system components> are authorized when exing the facility;

PE-16a.[04]

<PE-16_ODP[02] types of system components> are controlled when exing the facility;

PE-16b.

records of the system components are maintained.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 355

NIST SP 800-53A, REV. 5

PE-16

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

DELIVERY AND REMOVAL POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

PE-17

PE-16-Examine

[SELECT FROM: Physical and environmental protecon policy; procedures addressing the delivery and removal of system components from the facility; facility housing the system; records of items entering and exing the facility; system security plan; other relevant documents or records].

PE-16-Interview

[SELECT FROM: Organizaonal personnel with responsibilies for controlling system components entering and exing the facility; organizaonal personnel with informaon security responsibilies].

PE-16-Test

[SELECT FROM: Organizaonal process for authorizing, monitoring, and controlling system-related items entering and exing the facility; mechanisms supporng and/ or implemenng, authorizing, monitoring, and controlling system-related items entering and exing the facility].

ALTERNATE WORK SITE ASSESSMENT OBJECTIVE: Determine if:

PE-17_ODP[01]

alternate work sites allowed for use by employees are deﬁned;

PE-17_ODP[02]

controls to be employed at alternate work sites are deﬁned;

PE-17a.

<PE-17_ODP[01] alternate work sites> are determined and documented;

PE-17b.

<PE-17_ODP[02] controls> are employed at alternate work sites;

PE-17c.

the eﬀecveness of controls at alternate work sites is assessed;

PE-17d.

a means for employees to communicate with informaon security and privacy personnel in case of incidents is provided.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

PE-17-Examine

[SELECT FROM: Physical and environmental protecon policy; procedures addressing alternate work sites for organizaonal personnel; list of security controls required for alternate work sites; assessments of security controls at alternate work sites; system security plan; privacy plan; other relevant documents or records].

PE-17-Interview

[SELECT FROM: Organizaonal personnel approving the use of alternate work sites; organizaonal personnel using alternate work sites; organizaonal personnel assessing controls at alternate work sites; organizaonal personnel with informaon security and privacy responsibilies].

PE-17-Test

[SELECT FROM: Organizaonal processes for security and privacy at alternate work sites; mechanisms supporng alternate work sites; security and privacy controls employed at alternate work sites; means of communicaon between personnel at alternate work sites and security and privacy personnel].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 356

NIST SP 800-53A, REV. 5

PE-18

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

LOCATION OF SYSTEM COMPONENTS ASSESSMENT OBJECTIVE: Determine if: PE-18_ODP

physical and environmental hazards that could result in potenal damage to system components within the facility are deﬁned;

PE-18

system components are posioned within the facility to minimize potenal damage from <PE-18_ODP physical and environmental hazards> and to minimize the opportunity for unauthorized access.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

PE-18(01)

PE-18-Examine

[SELECT FROM: Physical and environmental protecon policy; procedures addressing the posioning of system components; documentaon providing the locaon and posion of system components within the facility; locaons housing system components within the facility; list of physical and environmental hazards with the potenal to damage system components within the facility; system security plan; other relevant documents or records].

PE-18-Interview

[SELECT FROM: Organizaonal personnel with responsibilies for posioning system components; organizaonal personnel with informaon security responsibilies].

PE-18-Test

[SELECT FROM: Organizaonal processes for posioning system components].

LOCATION OF SYSTEM COMPONENTS | FACILITY SITE [WITHDRAWN: Moved to PE-23.]

PE-19

INFORMATION LEAKAGE ASSESSMENT OBJECTIVE: Determine if: PE-19

the system is protected from informaon leakage due to electromagnec signal emanaons.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

PE-19-Examine

[SELECT FROM: Physical and environmental protecon policy; procedures addressing informaon leakage due to electromagnec signal emanaons; mechanisms protecng the system against electronic signal emanaons; facility housing the system; records from electromagnec signal emanaon tests; system security plan; other relevant documents or records].

PE-19-Interview

[SELECT FROM: Organizaonal personnel with responsibilies for system environmental controls; organizaonal personnel with informaon security responsibilies].

PE-19-Test

[SELECT FROM: Mechanisms supporng and/or implemenng protecon from informaon leakage due to electromagnec signal emanaons].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 357

NIST SP 800-53A, REV. 5

PE-19(01)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

INFORMATION LEAKAGE | NATIONAL EMISSIONS POLICIES AND PROCEDURES ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

PE-19(01)[01]

system components are protected in accordance with naonal emissions security policies and procedures based on the security category or classiﬁcaon of the informaon;

PE-19(01)[02]

associated data communicaons are protected in accordance with naonal emissions security policies and procedures based on the security category or classiﬁcaon of the informaon;

PE-19(01)[03]

networks are protected in accordance with naonal emissions security policies and procedures based on the security category or classiﬁcaon of the informaon.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

PE-20

PE-19(01)-Examine

[SELECT FROM: Physical and environmental protecon policy; procedures addressing informaon leakage that comply with naonal emissions and TEMPEST policies and procedures; system component design documentaon; system conﬁguraon sengs and associated documentaon system security plan; other relevant documents or records].

PE-19(01)-Interview

[SELECT FROM: Organizaonal personnel with responsibilies for system environmental controls; organizaonal personnel with informaon security responsibilies].

PE-19(01)-Test

[SELECT FROM: Informaon system components for compliance with naonal emissions and TEMPEST policies and procedures].

ASSET MONITORING AND TRACKING ASSESSMENT OBJECTIVE: Determine if:

PE-20_ODP[01]

asset locaon technologies to be employed to track and monitor the locaon and movement of assets is deﬁned;

PE-20_ODP[02]

assets whose locaon and movement are to be tracked and monitored are deﬁned;

PE-20_ODP[03]

controlled areas within which asset locaon and movement are to be tracked and monitored are deﬁned;

PE-20

<PE-20_ODP[01] asset locaon technologies> are employed to track and monitor the locaon and movement of <PE-20_ODP[02] assets> within <PE-20_ODP[03] controlled areas>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: PE-20-Examine

CHAPTER FOUR

[SELECT FROM: Physical and environmental protecon policy; procedures addressing asset monitoring and tracking; documentaon showing the use of asset locaon technologies; system conﬁguraon documentaon; list of organizaonal assets requiring tracking and monitoring; asset monitoring and tracking records; system security plan; privacy plan; other relevant documents or records].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 358

NIST SP 800-53A, REV. 5

PE-20

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

PE-21

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

ASSET MONITORING AND TRACKING PE-20-Interview

[SELECT FROM: Organizaonal personnel with asset monitoring and tracking responsibilies; legal counsel; organizaonal personnel with informaon security and privacy responsibilies].

PE-20-Test

[SELECT FROM: Organizaonal processes for tracking and monitoring assets; mechanisms supporng and/or implemenng the tracking and monitoring of assets].

ELECTROMAGNETIC PULSE PROTECTION ASSESSMENT OBJECTIVE: Determine if:

PE-21_ODP[01]

protecve measures to be employed against electromagnec pulse damage are deﬁned;

PE-21_ODP[02]

system and system components requiring protecon against electromagnec pulse damage are deﬁned;

PE-21

<PE-21_ODP[01] protecve measures> are employed against electromagnec pulse damage for <PE-21_ODP[02] system and system components>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

PE-22

PE-21-Examine

[SELECT FROM: Physical and environmental protecon policy; procedures addressing protecve measures to migate EMP risk to systems and components; documentaon detailing protecve measures to migate EMP risk; list of locaons where protecve measures to migate EMP risk are implemented; system security plan; other relevant documents or records].

PE-21-Interview

[SELECT FROM: Organizaonal personnel with responsibilies for physical and environmental protecon; system developers/integrators; organizaonal personnel with informaon security responsibilies].

PE-21-Test

[SELECT FROM: Mechanisms for migang EMP risk].

COMPONENT MARKING ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

PE-22_ODP

system hardware components to be marked indicang the impact level or classiﬁcaon level of the informaon permied to be processed, stored, or transmied by the hardware component are deﬁned;

PE-22

<PE-22_ODP system hardware components> are marked indicang the impact level or classiﬁcaon level of the informaon permied to be processed, stored, or transmied by the hardware component.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 359

NIST SP 800-53A, REV. 5

PE-22

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

COMPONENT MARKING POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

PE-23

PE-22-Examine

[SELECT FROM: Physical and environmental protecon policy; procedures addressing component marking; list of component marking security aributes; component inventory; informaon types and their impact/classiﬁcaon level; system security plan; other relevant documents or records].

PE-22-Interview

[SELECT FROM: Organizaonal personnel with component marking responsibilies; organizaonal personnel with component inventory responsibilies; organizaonal personnel with informaon categorizaon/classiﬁcaon responsibilies; organizaonal personnel with informaon security responsibilies].

PE-22-Test

[SELECT FROM: Organizaonal processes for component marking; automated mechanisms supporng and/or implemenng component marking].

FACILITY LOCATION ASSESSMENT OBJECTIVE: Determine if: PE-23a.

the locaon or site of the facility where the system resides is planned considering physical and environmental hazards;

PE-23b.

for exisng facilies, physical and environmental hazards are considered in the organizaonal risk management strategy.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

PE-23-Examine

[SELECT FROM: Physical and environmental protecon policy; physical site planning documents; organizaonal assessment of risk; conngency plan; risk migaon strategy documentaon; system security plan; other relevant documents or records].

PE-23-Interview

[SELECT FROM: Organizaonal personnel with site selecon responsibilies for the facility housing the system; organizaonal personnel with risk migaon responsibilies; organizaonal personnel with informaon security responsibilies].

PE-23-Test

[SELECT FROM: Organizaonal processes for site planning].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 360

NIST SP 800-53A, REV. 5

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

4.12 PLANNING PL-01

POLICY AND PROCEDURES ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5 CHAPTER FOUR

PL-01_ODP[01]

personnel or roles to whom the planning policy is to be disseminated is/are deﬁned;

PL-01_ODP[02]

personnel or roles to whom the planning procedures are to be disseminated is/ are deﬁned;

PL-01_ODP[03]

one or more of the following PARAMETER VALUES is/are selected: {organizaonlevel; mission/business process-level; system-level};

PL-01_ODP[04]

an oﬃcial to manage the planning policy and procedures is deﬁned;

PL-01_ODP[05]

the frequency with which the current planning policy is reviewed and updated is deﬁned;

PL-01_ODP[06]

events that would require the current planning policy to be reviewed and updated are deﬁned;

PL-01_ODP[07]

the frequency with which the current planning procedures are reviewed and updated is deﬁned;

PL-01_ODP[08]

events that would require procedures to be reviewed and updated are deﬁned;

PL-01a.[01]

a planning policy is developed and documented.

PL-01a.[02]

the planning policy is disseminated to <PL-01_ODP[01] personnel or roles>;

PL-01a.[03]

planning procedures to facilitate the implementaon of the planning policy and associated planning controls are developed and documented;

PL-01a.[04]

the planning procedures are disseminated to <PL-01_ODP[02] personnel or roles>;

PL-01a.01(a)[01]

the <PL-01_ODP[03] SELECTED PARAMETER VALUE(S)> planning policy addresses purpose;

PL-01a.01(a)[02]

the <PL-01_ODP[03] SELECTED PARAMETER VALUE(S)> planning policy addresses scope;

PL-01a.01(a)[03]

the <PL-01_ODP[03] SELECTED PARAMETER VALUE(S)> planning policy addresses roles;

PL-01a.01(a)[04]

the <PL-01_ODP[03] SELECTED PARAMETER VALUE(S)> planning policy addresses responsibilies;

PL-01a.01(a)[05]

the <PL-01_ODP[03] SELECTED PARAMETER VALUE(S)> planning policy addresses management commitment;

PL-01a.01(a)[06]

the <PL-01_ODP[03] SELECTED PARAMETER VALUE(S)> planning policy addresses coordinaon among organizaonal enes;

PL-01a.01(a)[07]

the <PL-01_ODP[03] SELECTED PARAMETER VALUE(S)> planning policy addresses compliance;

PL-01a.01(b)

the <PL-01_ODP[03] SELECTED PARAMETER VALUE(S)> planning policy is consistent with applicable laws, Execuve Orders, direcves, regulaons, policies, standards, and guidelines;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 361

NIST SP 800-53A, REV. 5

PL-01

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

POLICY AND PROCEDURES

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

PL-01b.

the <PL-01_ODP[04] oﬃcial> is designated to manage the development, documentaon, and disseminaon of the planning policy and procedures;

PL-01c.01[01]

the current planning policy is reviewed and updated <PL-01_ODP[05] frequency>;

PL-01c.01[02]

the current planning policy is reviewed and updated following <PL-01_ODP[06] events>;

PL-01c.02[01]

the current planning procedures are reviewed and updated <PL-01_ODP[07] frequency>;

PL-01c.02[02]

the current planning procedures are reviewed and updated following <PL-01_ODP[08] events>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

PL-02

PL-01-Examine

[SELECT FROM: Planning policy and procedures; system security plan; privacy plan; other relevant documents or records].

PL-01-Interview

[SELECT FROM: Organizaonal personnel with planning responsibilies; organizaonal personnel with informaon security and privacy responsibilies].

SYSTEM SECURITY AND PRIVACY PLANS ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

PL-02_ODP[01]

individuals or groups with whom security and privacy-related acvies aﬀecng the system that require planning and coordinaon is/are assigned;

PL-02_ODP[02]

personnel or roles to receive distributed copies of the system security and privacy plans is/are assigned;

PL-02_ODP[03]

frequency to review system security and privacy plans is deﬁned;

PL-02a.01[01]

a security plan for the system is developed that is consistent with the organizaon’s enterprise architecture;

PL-02a.01[02]

a privacy plan for the system is developed that is consistent with the organizaon’s enterprise architecture;

PL-02a.02[01]

a security plan for the system is developed that explicitly deﬁnes the constuent system components;

PL-02a.02[02]

a privacy plan for the system is developed that explicitly deﬁnes the constuent system components;

PL-02a.03[01]

a security plan for the system is developed that describes the operaonal context of the system in terms of mission and business processes;

PL-02a.03[02]

a privacy plan for the system is developed that describes the operaonal context of the system in terms of mission and business processes;

PL-02a.04[01]

a security plan for the system is developed that idenﬁes the individuals that fulﬁll system roles and responsibilies;

PL-02a.04[02]

a privacy plan for the system is developed that idenﬁes the individuals that fulﬁll system roles and responsibilies;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 362

NIST SP 800-53A, REV. 5

PL-02

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5 CHAPTER FOUR

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

SYSTEM SECURITY AND PRIVACY PLANS PL-02a.05[01]

a security plan for the system is developed that idenﬁes the informaon types processed, stored, and transmied by the system;

PL-02a.05[02]

a privacy plan for the system is developed that idenﬁes the informaon types processed, stored, and transmied by the system;

PL-02a.06[01]

a security plan for the system is developed that provides the security categorizaon of the system, including supporng raonale;

PL-02a.06[02]

a privacy plan for the system is developed that provides the security categorizaon of the system, including supporng raonale;

PL-02a.07[01]

a security plan for the system is developed that describes any speciﬁc threats to the system that are of concern to the organizaon;

PL-02a.07[02]

a privacy plan for the system is developed that describes any speciﬁc threats to the system that are of concern to the organizaon;

PL-02a.08[01]

a security plan for the system is developed that provides the results of a privacy risk assessment for systems processing personally idenﬁable informaon;

PL-02a.08[02]

a privacy plan for the system is developed that provides the results of a privacy risk assessment for systems processing personally idenﬁable informaon;

PL-02a.09[01]

a security plan for the system is developed that describes the operaonal environment for the system and any dependencies on or connecons to other systems or system components;

PL-02a.09[02]

a privacy plan for the system is developed that describes the operaonal environment for the system and any dependencies on or connecons to other systems or system components;

PL-02a.10[01]

a security plan for the system is developed that provides an overview of the security requirements for the system;

PL-02a.10[02]

a privacy plan for the system is developed that provides an overview of the privacy requirements for the system;

PL-02a.11[01]

a security plan for the system is developed that idenﬁes any relevant control baselines or overlays, if applicable;

PL-02a.11[02]

a privacy plan for the system is developed that idenﬁes any relevant control baselines or overlays, if applicable;

PL-02a.12[01]

a security plan for the system is developed that describes the controls in place or planned for meeng the security requirements, including raonale for any tailoring decisions;

PL-02a.12[02]

a privacy plan for the system is developed that describes the controls in place or planned for meeng the privacy requirements, including raonale for any tailoring decisions;

PL-02a.13[01]

a security plan for the system is developed that includes risk determinaons for security architecture and design decisions;

PL-02a.13[02]

a privacy plan for the system is developed that includes risk determinaons for privacy architecture and design decisions;

PL-02a.14[01]

a security plan for the system is developed that includes security-related acvies aﬀecng the system that require planning and coordinaon with <PL-02_ODP[01] individuals or groups>;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 363

NIST SP 800-53A, REV. 5

PL-02

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

SYSTEM SECURITY AND PRIVACY PLANS

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

PL-02a.14[02]

a privacy plan for the system is developed that includes privacy-related acvies aﬀecng the system that require planning and coordinaon with <PL-02_ODP[01] individuals or groups>;

PL-02a.15[01]

a security plan for the system is developed that is reviewed and approved by the authorizing oﬃcial or designated representave prior to plan implementaon;

PL-02a.15[02]

a privacy plan for the system is developed that is reviewed and approved by the authorizing oﬃcial or designated representave prior to plan implementaon.

PL-02b.[01]

copies of the plans are distributed to <PL-02_ODP[02] personnel or roles>;

PL-02b.[02]

subsequent changes to the plans are communicated to <PL-02_ODP[02] personnel or roles>;

PL-02c.

plans are reviewed <PL-02_ODP[03] frequency>;

PL-02d.[01]

plans are updated to address changes to the system and environment of operaons;

PL-02d.[02]

plans are updated to address problems idenﬁed during the plan implementaon;

PL-02d.[03]

plans are updated to address problems idenﬁed during control assessments;

PL-02e.[01]

plans are protected from unauthorized disclosure;

PL-02e.[02]

plans are protected from unauthorized modiﬁcaon.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

PL-02(01)

PL-02-Examine

[SELECT FROM: Security and privacy planning policy; procedures addressing system security and privacy plan development and implementaon; procedures addressing security and privacy plan reviews and updates; enterprise architecture documentaon; system security plan; privacy plan; records of system security and privacy plan reviews and updates; security and privacy architecture and design documentaon; risk assessments; risk assessment results; control assessment documentaon; other relevant documents or records].

PL-02-Interview

[SELECT FROM: Organizaonal personnel with system security and privacy planning and plan implementaon responsibilies; system developers; organizaonal personnel with informaon security and privacy responsibilies].

PL-02-Test

[SELECT FROM: Organizaonal processes for system security and privacy plan development, review, update, and approval; mechanisms supporng the system security and privacy plan].

SYSTEM SECURITY AND PRIVACY PLANS | CONCEPT OF OPERATIONS [WITHDRAWN: Incorporated into PL-07.]

PL-02(02)

SYSTEM SECURITY AND PRIVACY PLANS | FUNCTIONAL ARCHITECTURE [WITHDRAWN: Incorporated into PL-08.]

CHAPTER FOUR

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 364

NIST SP 800-53A, REV. 5

PL-02(03)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

SYSTEM SECURITY AND PRIVACY PLANS | PLAN AND COORDINATE WITH OTHER ORGANIZATIONAL ENTITIES [WITHDRAWN: Incorporated into PL-02.]

PL-03

SYSTEM SECURITY PLAN UPDATE [WITHDRAWN: Incorporated into PL-02.]

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

PL-04

RULES OF BEHAVIOR ASSESSMENT OBJECTIVE: Determine if:

PL-04_ODP[01]

frequency for reviewing and updang the rules of behavior is deﬁned;

PL-04_ODP[02]

one or more of the following PARAMETER VALUES is/are selected: {<PL-04_ODP[03] frequency>; when the rules are revised or updated};

PL-04_ODP[03]

frequency for individuals to read and re-acknowledge the rules of behavior is deﬁned (if selected);

PL-04a.[01]

rules that describe responsibilies and expected behavior for informaon and system usage, security, and privacy are established for individuals requiring access to the system;

PL-04a.[02]

rules that describe responsibilies and expected behavior for informaon and system usage, security, and privacy are provided to individuals requiring access to the system;

PL-04b.

before authorizing access to informaon and the system, a documented acknowledgement from such individuals indicang that they have read, understand, and agree to abide by the rules of behavior is received;

PL-04c.

rules of behavior are reviewed and updated <PL-04_ODP[01] frequency>;

PL-04d.

individuals who have acknowledged a previous version of the rules of behavior are required to read and reacknowledge <PL-04_ODP[02] SELECTED PARAMETER VALUE(S)>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

PL-04-Examine

[SELECT FROM: Security and privacy planning policy; procedures addressing rules of behavior for system users; rules of behavior; signed acknowledgements; records for rules of behavior reviews and updates; other relevant documents or records].

PL-04-Interview

[SELECT FROM: Organizaonal personnel with responsibility for establishing, reviewing, and updang rules of behavior; organizaonal personnel with responsibility for literacy training and awareness and role-based training; organizaonal personnel who are authorized users of the system and have signed and resigned rules of behavior; organizaonal personnel with informaon security and privacy responsibilies].

PL-04-Test

[SELECT FROM: Organizaonal processes for establishing, reviewing, disseminang, and updang rules of behavior; mechanisms supporng and/or implemenng the establishment, review, disseminaon, and update of rules of behavior].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 365

NIST SP 800-53A, REV. 5

PL-04(01)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

RULES OF BEHAVIOR | SOCIAL MEDIA AND EXTERNAL SITE/APPLICATION USAGE RESTRICTIONS ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

PL-04(01)(a)

the rules of behavior include restricons on the use of social media, social networking sites, and external sites/applicaons;

PL-04(01)(b)

the rules of behavior include restricons on posng organizaonal informaon on public websites;

PL-04(01)(c)

the rules of behavior include restricons on the use of organizaon-provided idenﬁers (e.g., email addresses) and authencaon secrets (e.g., passwords) for creang accounts on external sites/applicaons.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

PL-05

PL-04(01)-Examine

[SELECT FROM: Security and privacy planning policy; procedures addressing rules of behavior for system users; rules of behavior; training policy; other relevant documents or records].

PL-04(01)-Interview

[SELECT FROM: Organizaonal personnel with responsibility for establishing, reviewing, and updang rules of behavior; organizaonal personnel with responsibility for literacy training and awareness and role-based training; organizaonal personnel who are authorized users of the system and have signed rules of behavior; organizaonal personnel with informaon security and privacy responsibilies].

PL-04(01)-Test

[SELECT FROM: Organizaonal processes for establishing rules of behavior; mechanisms supporng and/or implemenng the establishment of rules of behavior].

PRIVACY IMPACT ASSESSMENT [WITHDRAWN: Incorporated into RA-08.]

PL-06

SECURITY-RELATED ACTIVITY PLANNING [WITHDRAWN: Incorporated into PL-02.]

PL-07

CONCEPT OF OPERATIONS ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

PL-07_ODP

frequency for review and update of the Concept of Operaons (CONOPS) is deﬁned;

PL-07a.

a CONOPS for the system describing how the organizaon intends to operate the system from the perspecve of informaon security and privacy is developed;

PL-07b.

the CONOPS is reviewed and updated <PL-07_ODP frequency>.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 366

NIST SP 800-53A, REV. 5

PL-07

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

CONCEPT OF OPERATIONS POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

PL-08

PL-07-Examine

[SELECT FROM: Security and privacy planning policy; procedures addressing security and privacy CONOPS development; procedures addressing security and privacy CONOPS reviews and updates; security and privacy CONOPS for the system; system security plan; privacy plan; records of security and privacy CONOPS reviews and updates; other relevant documents or records].

PL-07-Interview

PL-07-Test

[SELECT FROM: Organizaonal processes for developing, reviewing, and updang the security CONOPS; mechanisms supporng and/or implemenng the development, review, and update of the security CONOPS].

SECURITY AND PRIVACY ARCHITECTURES ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

PL-08_ODP

frequency for review and update to reﬂect changes in the enterprise architecture;

PL-08a.01

a security architecture for the system describes the requirements and approach to be taken for protecng the conﬁdenality, integrity, and availability of organizaonal informaon;

PL-08a.02

a privacy architecture describes the requirements and approach to be taken for processing personally idenﬁable informaon to minimize privacy risk to individuals;

PL-08a.03[01]

a security architecture for the system describes how the architecture is integrated into and supports the enterprise architecture;

PL-08a.03[02]

a privacy architecture for the system describes how the architecture is integrated into and supports the enterprise architecture;

PL-08a.04[01]

a security architecture for the system describes any assumpons about and dependencies on external systems and services;

PL-08a.04[02]

a privacy architecture for the system describes any assumpons about and dependencies on external systems and services;

PL-08b.

changes in the enterprise architecture are reviewed and updated <PL-08_ODP frequency> to reﬂect changes in the enterprise architecture;

PL-08c.[01]

planned architecture changes are reﬂected in the security plan;

PL-08c.[02]

planned architecture changes are reﬂected in the privacy plan;

PL-08c.[03]

planned architecture changes are reﬂected in the Concept of Operaons (CONOPS);

PL-08c.[04]

planned architecture changes are reﬂected in cricality analysis;

PL-08c.[05]

planned architecture changes are reﬂected in organizaonal procedures;

PL-08c.[06]

planned architecture changes are reﬂected in procurements and acquisions.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 367

NIST SP 800-53A, REV. 5

PL-08

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

SECURITY AND PRIVACY ARCHITECTURES POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

PL-08(01)

PL-08-Examine

[SELECT FROM: Security and privacy planning policy; procedures addressing informaon security and privacy architecture development; procedures addressing informaon security and privacy architecture reviews and updates; enterprise architecture documentaon; informaon security and privacy architecture documentaon; system security plan; privacy plan; security and privacy CONOPS for the system; records of informaon security and privacy architecture reviews and updates; other relevant documents or records].

PL-08-Interview

[SELECT FROM: Organizaonal personnel with security and privacy planning and plan implementaon responsibilies; organizaonal personnel with informaon security and privacy architecture development responsibilies; organizaonal personnel with informaon security and privacy responsibilies].

PL-08-Test

[SELECT FROM: Organizaonal processes for developing, reviewing, and updang the informaon security and privacy architecture; mechanisms supporng and/or implemenng the development, review, and update of the informaon security and privacy architecture].

SECURITY AND PRIVACY ARCHITECTURES | DEFENSE IN DEPTH ASSESSMENT OBJECTIVE: Determine if:

PL-08(01)_ODP[01]

controls to be allocated are deﬁned;

PL-08(01)_ODP[02]

locaons and architectural layers are deﬁned;

PL-08(01)(a)[01]

the security architecture for the system is designed using a defense-in-depth approach that allocates <PL-08(01)_ODP[01] controls> to <PL-08(01)_ODP[02] locaons and architectural layers>;

PL-08(01)(a)[02]

the privacy architecture for the system is designed using a defense-in-depth approach that allocates <PL-08(01)_ODP[01] controls> to <PL-08(01)_ODP[02] locaons and architectural layers>;

PL-08(01)(b)[01]

the security architecture for the system is designed using a defense-in-depth approach that ensures the allocated controls operate in a coordinated and mutually reinforcing manner;

PL-08(01)(b)[02]

the privacy architecture for the system is designed using a defense-in-depth approach that ensures the allocated controls operate in a coordinated and mutually reinforcing manner.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

PL-08-Examine

[SELECT FROM: Security and privacy planning policy; procedures addressing informaon security and privacy architecture development; enterprise architecture documentaon; informaon security and privacy architecture documentaon; system security plan; privacy plan; security and privacy CONOPS for the system; other relevant documents or records].

PL-08-Interview

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 368

NIST SP 800-53A, REV. 5

PL-08(01)

SECURITY AND PRIVACY ARCHITECTURES | DEFENSE IN DEPTH PL-08-Test

PL-08(02)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

[SELECT FROM: Organizaonal processes for designing the informaon security and privacy architecture; mechanisms supporng and/or implemenng the design of the informaon security and privacy architecture].

SECURITY AND PRIVACY ARCHITECTURES | SUPPLIER DIVERSITY ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

PL-08(02)_ODP[01]

controls to be allocated are deﬁned;

PL-08(02)_ODP[02]

locaons and architectural layers are deﬁned;

PL-08(02)

<PL-08(02)_ODP[01] controls> that are allocated to <PL-08(02)_ODP[02] locaons and architectural layers> are required to be obtained from diﬀerent suppliers.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

PL-09

PL-08(02)-Examine

PL-08(02)-Interview

[SELECT FROM: Organizaonal personnel with security and privacy planning and plan implementaon responsibilies; organizaonal personnel with informaon security and privacy architecture development responsibilies; organizaonal personnel with acquision responsibilies; organizaonal personnel with informaon security and privacy responsibilies].

PL-08(02)-Test

[SELECT FROM: Organizaonal processes for obtaining informaon security and privacy safeguards from diﬀerent suppliers].

CENTRAL MANAGEMENT ASSESSMENT OBJECTIVE: Determine if: PL-09_ODP

security and privacy controls and related processes to be centrally managed are deﬁned;

PL-09

<PL-09_ODP controls and related processes> are centrally managed.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

PL-09-Examine

[SELECT FROM: Security and privacy planning policy; procedures addressing security and privacy plan development and implementaon; system security plan; privacy plan; other relevant documents or records].

PL-09-Interview

[SELECT FROM: Organizaonal personnel with security and privacy planning and plan implementaon responsibilies; organizaonal personnel with responsibilies for planning/implemenng central management of controls and related processes; organizaonal personnel with informaon security and privacy responsibilies].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 369

NIST SP 800-53A, REV. 5

PL-09

CENTRAL MANAGEMENT PL-09-Test

PL-10

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

[SELECT FROM: Organizaonal processes for the central management of controls and related processes; mechanisms supporng and/or implemenng central management of controls and related processes].

BASELINE SELECTION ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

PL-10

a control baseline for the system is selected.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

PL-11

PL-10-Examine

[SELECT FROM: Security and privacy planning policy; procedures addressing system security and privacy plan development and implementaon; procedures addressing system security and privacy plan reviews and updates; system design documentaon; system architecture and conﬁguraon documentaon; system categorizaon decision; informaon types stored, transmied, and processed by the system; system element/component informaon; stakeholder needs analysis; list of security and privacy requirements allocated to the system, system elements, and environment of operaon; list of contractual requirements allocated to external providers of the system or system element; business impact analysis or cricality analysis; risk assessments; risk management strategy; organizaonal security and privacy policy; federal or organizaon-approved or mandated baselines or overlays; system security plan; privacy plan; other relevant documents or records].

PL-10-Interview

[SELECT FROM: Organizaonal personnel with security and privacy planning and plan implementaon responsibilies; organizaonal personnel with informaon security and privacy responsibilies; organizaonal personnel with responsibility for organizaonal risk management acvies].

BASELINE TAILORING ASSESSMENT OBJECTIVE: Determine if: PL-11

the selected control baseline is tailored by applying speciﬁed tailoring acons.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: PL-11-Examine

CHAPTER FOUR

[SELECT FROM: Security and privacy planning policy; procedures addressing system security and privacy plan development and implementaon; system design documentaon; system categorizaon decision; informaon types stored, transmied, and processed by the system; system element/component informaon; stakeholder needs analysis; list of security and privacy requirements allocated to the system, system elements, and environment of operaon; list of contractual requirements allocated to external providers of the system or system element; business impact analysis or cricality analysis; risk assessments; risk management strategy; organizaonal security and privacy policy; federal or organizaon-approved or mandated baselines or overlays; baseline tailoring raonale; system security plan; privacy plan; records of system security and privacy plan reviews and updates; other relevant documents or records].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 370

NIST SP 800-53A, REV. 5

PL-11

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

BASELINE TAILORING PL-11-Interview

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5 CHAPTER FOUR

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 371

NIST SP 800-53A, REV. 5

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

4.13 PROGRAM MANAGEMENT PM-01

INFORMATION SECURITY PROGRAM PLAN ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5 CHAPTER FOUR

PM-01_ODP[01]

the frequency at which to review and update the organizaon-wide informaon security program plan is deﬁned;

PM-01_ODP[02]

events that trigger the review and update of the organizaon-wide informaon security program plan are deﬁned;

PM-01a.[01]

an organizaon-wide informaon security program plan is developed;

PM-01a.[02]

the informaon security program plan is disseminated;

PM-01a.01[01]

the informaon security program plan provides an overview of the requirements for the security program;

PM-01a.01[02]

the informaon security program plan provides a descripon of the security program management controls in place or planned for meeng those requirements;

PM-01a.01[03]

the informaon security program plan provides a descripon of the common controls in place or planned for meeng those requirements;

PM-01a.02[01]

the informaon security program plan includes the idenﬁcaon and assignment of roles;

PM-01a.02[02]

the informaon security program plan includes the idenﬁcaon and assignment of responsibilies;

PM-01a.02[03]

the informaon security program plan addresses management commitment;

PM-01a.02[04]

the informaon security program plan addresses coordinaon among organizaonal enes;

PM-01a.02[05]

the informaon security program plan addresses compliance;

PM-01a.03

the informaon security program plan reﬂects the coordinaon among the organizaonal enes responsible for informaon security;

PM-01a.04

the informaon security program plan is approved by a senior oﬃcial with responsibility and accountability for the risk being incurred to organizaonal operaons (including mission, funcons, image, and reputaon), organizaonal assets, individuals, other organizaons, and the Naon;

PM-01b.[01]

the informaon security program plan is reviewed and updated <PM-01_ODP[01] frequency>;

PM-01b.[02]

the informaon security program plan is reviewed and updated following <PM-01_ODP[02] events>;

PM-01c.[01]

the informaon security program plan is protected from unauthorized disclosure;

PM-01c.[02]

the informaon security program plan is protected from unauthorized modiﬁcaon.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 372

NIST SP 800-53A, REV. 5

PM-01

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

INFORMATION SECURITY PROGRAM PLAN POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

PM-02

PM-01-Examine

[SELECT FROM: Informaon security program plan; procedures addressing program plan development and implementaon; procedures addressing program plan reviews and updates; procedures addressing coordinaon of the program plan with relevant enes; procedures for program plan approvals; records of program plan reviews and updates; other relevant documents or records].

PM-01-Interview

[SELECT FROM: Organizaonal personnel with informaon security program planning and plan implementaon responsibilies; organizaonal personnel with informaon security responsibilies].

PM-01-Test

[SELECT FROM: Organizaonal processes for informaon security program plan development, review, update, and approval; mechanisms supporng and/or implemenng the informaon security program plan].

INFORMATION SECURITY PROGRAM LEADERSHIP ROLE ASSESSMENT OBJECTIVE: Determine if: PM-02[01]

a senior agency informaon security oﬃcer is appointed;

PM-02[02]

the senior agency informaon security oﬃcer is provided with the mission and resources to coordinate an organizaon-wide informaon security program;

PM-02[03]

the senior agency informaon security oﬃcer is provided with the mission and resources to develop an organizaon-wide informaon security program;

PM-02[04]

the senior agency informaon security oﬃcer is provided with the mission and resources to implement an organizaon-wide informaon security program;

PM-02[05]

the senior agency informaon security oﬃcer is provided with the mission and resources to maintain an organizaon-wide informaon security program.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

PM-03

PM-02-Examine

PM-02-Interview

[SELECT FROM: Organizaonal personnel with informaon security program planning and plan implementaon responsibilies; senior informaon security oﬃcer; organizaonal personnel with informaon security responsibilies].

INFORMATION SECURITY AND PRIVACY RESOURCES ASSESSMENT OBJECTIVE: Determine if: PM-03a.[01]

CHAPTER FOUR

the resources needed to implement the informaon security program are included in capital planning and investment requests, and all excepons are documented;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 373

NIST SP 800-53A, REV. 5

PM-03

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

INFORMATION SECURITY AND PRIVACY RESOURCES

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

PM-03a.[02]

the resources needed to implement the privacy program are included in capital planning and investment requests, and all excepons are documented;

PM-03b.[01]

the documentaon required for addressing the informaon security program in capital planning and investment requests is prepared in accordance with applicable laws, execuve orders, direcves, policies, regulaons, standards;

PM-03b.[02]

the documentaon required for addressing the privacy program in capital planning and investment requests is prepared in accordance with applicable laws, execuve orders, direcves, policies, regulaons, standards;

PM-03c.[01]

informaon security resources are made available for expenditure as planned;

PM-03c.[02]

privacy resources are made available for expenditure as planned.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

PM-04

PM-03-Examine

[SELECT FROM: Informaon security program plan; Exhibit 300; Exhibit 53; business cases for capital planning and investment; procedures for capital planning and investment; documentaon of excepons to capital planning requirements; other relevant documents or records].

PM-03-Interview

[SELECT FROM: Organizaonal personnel with informaon security program planning responsibilies; organizaonal personnel with privacy program planning responsibilies; organizaonal personnel responsible for capital planning and investment; organizaonal personnel with informaon security responsibilies; organizaonal personnel with privacy responsibilies].

PM-03-Test

[SELECT FROM: Organizaonal processes for capital planning and investment; organizaonal processes for business case, Exhibit 300, and Exhibit 53 development; mechanisms supporng the capital planning and investment process].

PLAN OF ACTION AND MILESTONES PROCESS ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

PM-04a.01[01]

a process to ensure that plans of acon and milestones for the informaon security program and associated organizaonal systems are developed;

PM-04a.01[02]

a process to ensure that plans of acon and milestones for the informaon security program and associated organizaonal systems are maintained;

PM-04a.01[03]

a process to ensure that plans of acon and milestones for the privacy program and associated organizaonal systems are developed;

PM-04a.01[04]

a process to ensure that plans of acon and milestones for the privacy program and associated organizaonal systems are maintained;

PM-04a.01[05]

a process to ensure that plans of acon and milestones for the supply chain risk management program and associated organizaonal systems are developed;

PM-04a.01[06]

a process to ensure that plans of acon and milestones for the supply chain risk management program and associated organizaonal systems are maintained;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 374

NIST SP 800-53A, REV. 5

PM-04

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

PLAN OF ACTION AND MILESTONES PROCESS

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

PM-04a.02[01]

a process to ensure that plans of acon and milestones for the informaon security program and associated organizaonal systems document remedial informaon security risk management acons to adequately respond to risks to organizaonal operaons and assets, individuals, other organizaons, and the Naon;

PM-04a.02[02]

a process to ensure that plans of acon and milestones for the privacy program and associated organizaonal systems document remedial privacy risk management acons to adequately respond to risks to organizaonal operaons and assets, individuals, other organizaons, and the Naon;

PM-04a.02[03]

a process to ensure that plans of acon and milestones for the supply chain risk management program and associated organizaonal systems document remedial supply chain risk management acons to adequately respond to risks to organizaonal operaons and assets, individuals, other organizaons, and the Naon;

PM-04a.03[01]

a process to ensure that plans of acon and milestones for the informaon security risk management programs and associated organizaonal systems are reported in accordance with established reporng requirements;

PM-04a.03[02]

a process to ensure that plans of acon and milestones for the privacy risk management programs and associated organizaonal systems are reported in accordance with established reporng requirements;

PM-04a.03[03]

a process to ensure that plans of acon and milestones for the supply chain risk management programs and associated organizaonal systems are reported in accordance with established reporng requirements;

PM-04b.[01]

plans of acon and milestones are reviewed for consistency with the organizaonal risk management strategy;

PM-04b.[02]

plans of acon and milestones are reviewed for consistency with organizaon-wide priories for risk response acons.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

PM-04-Examine

[SELECT FROM: Informaon security program plan; plans of acon and milestones; procedures addressing plans of acon and milestones development and maintenance; procedures addressing plans of acon and milestones reporng; procedures for reviewing plans of acon and milestones for consistency with risk management strategy and risk response priories; results of risk assessments associated with plans of acon and milestones; OMB FISMA reporng requirements; other relevant documents or records].

PM-04-Interview

[SELECT FROM: Organizaonal personnel with responsibilies for developing, maintaining, reviewing, and reporng plans of acon and milestones; organizaonal personnel with informaon security responsibilies].

PM-04-Test

[SELECT FROM: Organizaonal processes for plan of acon and milestones development, review, maintenance, and reporng; mechanisms supporng plans of acon and milestones].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 375

NIST SP 800-53A, REV. 5

PM-05

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

SYSTEM INVENTORY ASSESSMENT OBJECTIVE: Determine if: PM-05_ODP

the frequency at which to update the inventory of organizaonal systems is deﬁned;

PM-05[01]

an inventory of organizaonal systems is developed;

PM-05[02]

the inventory of organizaonal systems is updated <PM-05_ODP frequency>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

PM-05(01)

PM-05-Examine

[SELECT FROM: Informaon security program plan; system inventory; procedures addressing system inventory development and maintenance; OMB FISMA reporng guidance; other relevant documents or records].

PM-05-Interview

[SELECT FROM: Organizaonal personnel with informaon security program planning and plan implementaon responsibilies; organizaonal personnel responsible for developing and maintaining the system inventory; organizaonal personnel with informaon security responsibilies].

PM-05-Test

[SELECT FROM: Organizaonal processes for system inventory development and maintenance; mechanisms supporng the system inventory].

SYSTEM INVENTORY | INVENTORY OF PERSONALLY IDENTIFIABLE INFORMATION ASSESSMENT OBJECTIVE: Determine if:

PM-05(01)_ODP

the frequency at which to update the inventory of systems, applicaons, and projects that process personally idenﬁable informaon is deﬁned;

PM-05(01)[01]

an inventory of all systems, applicaons, and projects that process personally idenﬁable informaon is established;

PM-05(01)[02]

an inventory of all systems, applicaons, and projects that process personally idenﬁable informaon is maintained;

PM-05(01)[03]

an inventory of all systems, applicaons, and projects that process personally idenﬁable informaon is updated <PM-05(01)_ODP frequency>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

PM-05(01)-Examine

[SELECT FROM: Procedures addressing system inventory development, maintenance, and updates; OMB FISMA reporng guidance; privacy program plan; informaon security program plan; personally idenﬁable informaon processing policy; system inventory; personally idenﬁable informaon inventory; data mapping documentaon; other relevant documents or records].

PM-05(01)-Interview

[SELECT FROM: Organizaonal personnel with privacy program planning and plan implementaon responsibilies; organizaonal personnel responsible for developing and maintaining the system inventory; organizaonal personnel with informaon security and privacy responsibilies].

PM-05(01)-Test

[SELECT FROM: Organizaonal processes for system inventory development, maintenance, and updates; mechanisms supporng the system inventory].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 376

NIST SP 800-53A, REV. 5

PM-06

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

MEASURES OF PERFORMANCE ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

PM-06[01]

informaon security measures of performance are developed;

PM-06[02]

informaon security measures of performance are monitored;

PM-06[03]

the results of informaon security measures of performance are reported;

PM-06[04]

privacy measures of performance are developed;

PM-06[05]

privacy measures of performance are monitored;

PM-06[06]

the results of privacy measures of performance are reported.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

PM-07

PM-06-Examine

[SELECT FROM: Informaon security program plan; privacy program plan; informaon security measures of performance; privacy measures of performance; procedures addressing the development, monitoring, and reporng of informaon security and privacy measures of performance; risk management strategy; other relevant documents or records].

PM-06-Interview

[SELECT FROM: Organizaonal personnel with informaon security and privacy program planning and plan implementaon responsibilies; organizaonal personnel responsible for developing, monitoring, and reporng informaon security and privacy measures of performance; organizaonal personnel with informaon security and privacy responsibilies].

PM-06-Test

[SELECT FROM: Organizaonal processes for developing, monitoring, and reporng informaon security and privacy measures of performance; mechanisms supporng the development, monitoring, and reporng of informaon security and privacy measures of performance].

ENTERPRISE ARCHITECTURE ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

PM-07[01]

an enterprise architecture is developed with consideraon for informaon security;

PM-07[02]

an enterprise architecture is maintained with consideraon for informaon security;

PM-07[03]

an enterprise architecture is developed with consideraon for privacy;

PM-07[04]

an enterprise architecture is maintained with consideraon for privacy;

PM-07[05]

an enterprise architecture is developed with consideraon for the resulng risk to organizaonal operaons and assets, individuals, other organizaons, and the Naon;

PM-07[06]

an enterprise architecture is maintained with consideraon for the resulng risk to organizaonal operaons and assets, individuals, other organizaons, and the Naon.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 377

NIST SP 800-53A, REV. 5

PM-07

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

ENTERPRISE ARCHITECTURE POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

PM-07(01)

PM-07-Examine

[SELECT FROM: Informaon security program plan; privacy program plan; enterprise architecture documentaon; procedures addressing enterprise architecture development; results of risk assessments of enterprise architecture; other relevant documents or records].

PM-07-Interview

[SELECT FROM: Organizaonal personnel with informaon security and privacy program planning and plan implementaon responsibilies; organizaonal personnel responsible for developing enterprise architecture; organizaonal personnel responsible for risk assessments of enterprise architecture; organizaonal personnel with informaon security and privacy responsibilies].

PM-07-Test

[SELECT FROM: Organizaonal processes for enterprise architecture development; mechanisms supporng the enterprise architecture and its development].

ENTERPRISE ARCHITECTURE | OFFLOADING ASSESSMENT OBJECTIVE: Determine if:

PM-07(01)_ODP

non-essenal funcons or services to be oﬄoaded are deﬁned;

PM-07(01)

<PM-07(01)_ODP non-essenal funcons or services> are oﬄoaded to other systems, system components, or an external provider.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

PM-08

PM-07(01)-Examine

[SELECT FROM: Informaon security program plan; privacy program plan; enterprise architecture documentaon; procedures addressing enterprise architecture development; procedures for idenfying and oﬄoading funcons or services; results of risk assessments of enterprise architecture; other relevant documents or records].

PM-07(01)-Interview

[SELECT FROM: Organizaonal personnel with informaon security and privacy program planning and plan implementaon responsibilies; organizaonal personnel responsible for developing enterprise architecture; organizaonal personnel responsible for risk assessments of enterprise architecture; organizaonal personnel with informaon security and privacy responsibilies].

PM-07(01)-Test

[SELECT FROM: Organizaonal processes for enterprise architecture development; mechanisms supporng the enterprise architecture and its development; mechanisms for oﬄoading funcons and services].

CRITICAL INFRASTRUCTURE PLAN ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

PM-08[01]

informaon security issues are addressed in the development of a crical infrastructure and key resources protecon plan;

PM-08[02]

informaon security issues are addressed in the documentaon of a crical infrastructure and key resources protecon plan;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 378

NIST SP 800-53A, REV. 5

PM-08

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

CRITICAL INFRASTRUCTURE PLAN PM-08[03]

informaon security issues are addressed in the update of a crical infrastructure and key resources protecon plan;

PM-08[04]

privacy issues are addressed in the development of a crical infrastructure and key resources protecon plan;

PM-08[05]

privacy issues are addressed in the documentaon of a crical infrastructure and key resources protecon plan;

PM-08[06]

privacy issues are addressed in the update of a crical infrastructure and key resources protecon plan.

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

PM-09

PM-08-Examine

[SELECT FROM: Informaon security program plan; privacy program plan; crical infrastructure and key resources protecon plan; procedures addressing the development, documentaon, and updang of the crical infrastructure and key resources protecon plan; HSPD 7; Naonal Infrastructure Protecon Plan; other relevant documents or records].

PM-08-Interview

[SELECT FROM: Organizaonal personnel with informaon security and privacy program planning and plan implementaon responsibilies; organizaonal personnel responsible for developing, documenng, and updang the crical infrastructure and key resources protecon plan; organizaonal personnel with informaon security and privacy responsibilies].

PM-08-Test

[SELECT FROM: Organizaonal processes for developing, documenng, and updang the crical infrastructure and key resources protecon plan; mechanisms supporng the development, documentaon, and updang of the crical infrastructure and key resources protecon plan].

RISK MANAGEMENT STRATEGY ASSESSMENT OBJECTIVE: Determine if: PM-09_ODP

the frequency at which to review and update the risk management strategy is deﬁned;

PM-09a.01

a comprehensive strategy is developed to manage security risk to organizaonal operaons and assets, individuals, other organizaons, and the Naon associated with the operaon and use of organizaonal systems;

PM-09a.02

a comprehensive strategy is developed to manage privacy risk to individuals resulng from the authorized processing of personally idenﬁable informaon;

PM-09b.

the risk management strategy is implemented consistently across the organizaon;

PM-09c.

the risk management strategy is reviewed and updated <PM-09_ODP frequency> or as required to address organizaonal changes.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: PM-09-Examine

CHAPTER FOUR

[SELECT FROM: Informaon security program plan; privacy program plan; risk management strategy; supply chain risk management strategy; procedures addressing the development, implementaon, review, and update of the risk management strategy; risk assessment results relevant to the risk management strategy; other relevant documents or records].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 379

NIST SP 800-53A, REV. 5

PM-09

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

PM-10

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

RISK MANAGEMENT STRATEGY PM-09-Interview

[SELECT FROM: Organizaonal personnel with informaon security and privacy program planning and plan implementaon responsibilies; organizaonal personnel responsible for the development, implementaon, review, and update of the risk management strategy; organizaonal personnel with informaon security and privacy responsibilies].

PM-09-Test

[SELECT FROM: Organizaonal processes for the development, implementaon, review, and update of the risk management strategy; mechanisms supporng the development, implementaon, review, and update of the risk management strategy].

AUTHORIZATION PROCESS ASSESSMENT OBJECTIVE: Determine if: PM-10a.[01]

the security state of organizaonal systems and the environments in which those systems operate are managed through authorizaon processes;

PM-10a.[02]

the privacy state of organizaonal systems and the environments in which those systems operate are managed through authorizaon processes;

PM-10b.

individuals are designated to fulﬁll speciﬁc roles and responsibilies within the organizaonal risk management process;

PM-10c.

the authorizaon processes are integrated into an organizaon-wide risk management program.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

PM-11

PM-10-Examine

[SELECT FROM: Informaon security program plan; privacy program plan; procedures addressing management (i.e., documentaon, tracking, and reporng) of the authorizaon process; assessment, authorizaon, and monitoring policy; assessment, authorizaon, and monitoring procedures; system authorizaon documentaon; lists or other documentaon about authorizaon process roles and responsibilies; risk assessment results relevant to the authorizaon process and the organizaon-wide risk management program; organizaonal risk management strategy; other relevant documents or records].

PM-10-Interview

PM-10-Test

[SELECT FROM: Organizaonal processes for authorizaon; mechanisms supporng the authorizaon process].

MISSION AND BUSINESS PROCESS DEFINITION ASSESSMENT OBJECTIVE: Determine if: PM-11_ODP

CHAPTER FOUR

the frequency at which to review and revise the mission and business processes is deﬁned;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 380

NIST SP 800-53A, REV. 5

PM-11

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

MISSION AND BUSINESS PROCESS DEFINITION

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

PM-11a.[01]

organizaonal mission and business processes are deﬁned with consideraon for informaon security;

PM-11a.[02]

organizaonal mission and business processes are deﬁned with consideraon for privacy;

PM-11a.[03]

organizaonal mission and business processes are deﬁned with consideraon for the resulng risk to organizaonal operaons, organizaonal assets, individuals, other organizaons, and the Naon;

PM-11b.[01]

informaon protecon needs arising from the deﬁned mission and business processes are determined;

PM-11b.[02]

personally idenﬁable informaon processing needs arising from the deﬁned mission and business processes are determined;

PM-11c.

the mission and business processes are reviewed and revised <PM-11_ODP frequency>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

PM-12

PM-11-Examine

[SELECT FROM: Informaon security program plan; privacy program plan; risk management strategy; procedures for determining mission and business protecon needs; informaon security and privacy risk assessment results relevant to the determinaon of mission and business protecon needs; personally idenﬁable informaon processing policy; personally idenﬁable informaon inventory; other relevant documents or records].

PM-11-Interview

[SELECT FROM: Organizaonal personnel with informaon security and privacy program planning and plan implementaon responsibilies; organizaonal personnel responsible for enterprise risk management; organizaonal personnel responsible for determining informaon protecon needs for mission and business processes; organizaonal personnel with informaon security and privacy responsibilies].

PM-11-Test

[SELECT FROM: Organizaonal processes for deﬁning mission and business processes and their informaon protecon needs].

INSIDER THREAT PROGRAM ASSESSMENT OBJECTIVE: Determine if: PM-12

an insider threat program that includes a cross-discipline insider threat incident handling team is implemented.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: PM-12-Interview

CHAPTER FOUR

[SELECT FROM: Organizaonal personnel with informaon security and privacy program planning and plan implementaon responsibilies; organizaonal personnel responsible for the insider threat program; members of the crossdiscipline insider threat incident handling team; legal counsel; organizaonal personnel with informaon security and privacy responsibilies].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 381

NIST SP 800-53A, REV. 5

PM-12

INSIDER THREAT PROGRAM PM-12-Test

PM-13

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

[SELECT FROM: Organizaonal processes for implemenng the insider threat program and the cross-discipline insider threat incident handling team; mechanisms supporng and/or implemenng the insider threat program and the cross-discipline insider threat incident handling team].

SECURITY AND PRIVACY WORKFORCE ASSESSMENT OBJECTIVE:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

Determine if: PM-13[01]

a security workforce development and improvement program is established;

PM-13[02]

a privacy workforce development and improvement program is established.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

PM-14

PM-13-Examine

[SELECT FROM: Informaon security program plan; privacy program plan; informaon security and privacy workforce development and improvement program documentaon; procedures for the informaon security and privacy workforce development and improvement program; informaon security and privacy role-based training program documentaon; other relevant documents or records].

PM-13-Interview

[SELECT FROM: Organizaonal personnel with informaon security and privacy program planning and plan implementaon responsibilies; organizaonal personnel responsible for the informaon security and privacy workforce development and improvement program; organizaonal personnel with informaon security and privacy responsibilies].

PM-13-Test

[SELECT FROM: Organizaonal processes for implemenng the informaon security and privacy workforce development and improvement program; mechanisms supporng and/or implemenng the informaon security and privacy workforce development and improvement program].

TESTING, TRAINING, AND MONITORING ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

PM-14a.01[01]

a process is implemented for ensuring that organizaonal plans for conducng security tesng, training, and monitoring acvies associated with organizaonal systems are developed;

PM-14a.01[02]

a process is implemented for ensuring that organizaonal plans for conducng security tesng, training, and monitoring acvies associated with organizaonal systems are maintained;

PM-14a.01[03]

a process is implemented for ensuring that organizaonal plans for conducng privacy tesng, training, and monitoring acvies associated with organizaonal systems are developed;

PM-14a.01[04]

a process is implemented for ensuring that organizaonal plans for conducng privacy tesng, training, and monitoring acvies associated with organizaonal systems are maintained;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 382

NIST SP 800-53A, REV. 5

PM-14

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

TESTING, TRAINING, AND MONITORING

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

PM-14a.02[01]

a process is implemented for ensuring that organizaonal plans for conducng security tesng, training, and monitoring acvies associated with organizaonal systems connue to be executed;

PM-14a.02[02]

a process is implemented for ensuring that organizaonal plans for conducng privacy tesng, training, and monitoring acvies associated with organizaonal systems connue to be executed;

PM-14b.[01]

tesng plans are reviewed for consistency with the organizaonal risk management strategy;

PM-14b.[02]

training plans are reviewed for consistency with the organizaonal risk management strategy;

PM-14b.[03]

monitoring plans are reviewed for consistency with the organizaonal risk management strategy;

PM-14b.[04]

tesng plans are reviewed for consistency with organizaon-wide priories for risk response acons;

PM-14b.[05]

training plans are reviewed for consistency with organizaon-wide priories for risk response acons;

PM-14b.[06]

monitoring plans are reviewed for consistency with organizaon-wide priories for risk response acons.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

PM-14-Examine

[SELECT FROM: Informaon security program plan; privacy program plan; plans for conducng security and privacy tesng, training, and monitoring acvies; organizaonal procedures addressing the development and maintenance of plans for conducng security and privacy tesng, training, and monitoring acvies; risk management strategy; procedures for the review of plans for conducng security and privacy tesng, training, and monitoring acvies for consistency with risk management strategy and risk response priories; results of risk assessments associated with conducng security and privacy tesng, training, and monitoring acvies; documentaon of the mely execuon of plans for conducng security and privacy tesng, training, and monitoring acvies; other relevant documents or records].

PM-14-Interview

[SELECT FROM: Organizaonal personnel with responsibilies for developing and maintaining plans for conducng security and privacy tesng, training, and monitoring acvies; organizaonal personnel with informaon security and privacy responsibilies].

PM-14-Test

[SELECT FROM: Organizaonal processes for the development and maintenance of plans for conducng security and privacy tesng, training, and monitoring acvies; mechanisms supporng the development and maintenance of plans for conducng security and privacy tesng, training, and monitoring acvies].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 383

NIST SP 800-53A, REV. 5

PM-15

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

SECURITY AND PRIVACY GROUPS AND ASSOCIATIONS ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

PM-15a.[01]

contact is established and instuonalized with selected groups and associaons within the security community to facilitate ongoing security educaon and training for organizaonal personnel;

PM-15a.[02]

contact is established and instuonalized with selected groups and associaons within the privacy community to facilitate ongoing privacy educaon and training for organizaonal personnel;

PM-15b.[01]

contact is established and instuonalized with selected groups and associaons within the security community to maintain currency with recommended security pracces, techniques, and technologies;

PM-15b.[02]

contact is established and instuonalized with selected groups and associaons within the privacy community to maintain currency with recommended privacy pracces, techniques, and technologies;

PM-15c.[01]

contact is established and instuonalized with selected groups and associaons within the security community to share current security informaon, including threats, vulnerabilies, and incidents;

PM-15c.[02]

contact is established and instuonalized with selected groups and associaons within the privacy community to share current privacy informaon, including threats, vulnerabilies, and incidents.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

PM-16

PM-15-Examine

[SELECT FROM: Informaon security program plan; privacy program plan; risk management strategy; procedures for establishing and instuonalizing contacts with security and privacy groups and associaons; lists or other records of contacts with and/or membership in security and privacy groups and associaons; other relevant documents or records].

PM-15-Interview

[SELECT FROM: Organizaonal personnel with informaon security and privacy program planning and plan implementaon responsibilies; organizaonal personnel responsible for establishing and instuonalizing contact with security and privacy groups and associaons; organizaonal personnel with informaon security and privacy responsibilies; personnel from selected groups and associaons with which the organizaon has established and instuonalized contact].

PM-15-Test

[SELECT FROM: Organizaonal processes for establishing and instuonalizing contact with security and privacy groups and associaons; mechanisms supporng contact with security and privacy groups and associaons].

THREAT AWARENESS PROGRAM ASSESSMENT OBJECTIVE: Determine if: PM-16

CHAPTER FOUR

a threat awareness program that includes a cross-organizaon informaon-sharing capability for threat intelligence is implemented.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 384

NIST SP 800-53A, REV. 5

PM-16

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

THREAT AWARENESS PROGRAM POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

PM-16(01)

PM-16-Examine

[SELECT FROM: Informaon security program plan; privacy program plan; threat awareness program policy; threat awareness program procedures; risk assessment results relevant to threat awareness; documentaon about the cross-organizaon informaon-sharing capability; other relevant documents or records].

PM-16-Interview

[SELECT FROM: Organizaonal personnel with informaon security and privacy program planning and plan implementaon responsibilies; organizaonal personnel responsible for the threat awareness program; organizaonal personnel responsible for the cross-organizaon informaon-sharing capability; organizaonal personnel with informaon security and privacy responsibilies; external personnel with whom threat awareness informaon is shared by the organizaon].

PM-16-Test

[SELECT FROM: Organizaonal processes for implemenng the threat awareness program; organizaonal processes for implemenng the cross-organizaon informaon-sharing capability; mechanisms supporng and/or implemenng the threat awareness program; mechanisms supporng and/or implemenng the cross-organizaon informaon-sharing capability].

THREAT AWARENESS PROGRAM | AUTOMATED MEANS FOR SHARING THREAT INTELLIGENCE ASSESSMENT OBJECTIVE: Determine if: PM-16(01)

automated mechanisms are employed to maximize the eﬀecveness of sharing threat intelligence informaon.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

PM-16(01)-Examine

[SELECT FROM: Informaon security program plan; privacy program plan; threat awareness program policy; threat awareness program procedures; risk assessment results related to threat awareness; documentaon about the cross-organizaon informaon-sharing capability; other relevant documents or records].

PM-16(01)-Interview

[SELECT FROM: Organizaonal personnel with informaon security and privacy program planning and plan implementaon responsibilies; organizaonal personnel responsible for the threat awareness program; organizaonal personnel responsible for the cross-organizaon informaon-sharing capability; organizaonal personnel with informaon security and privacy responsibilies; external personnel with whom threat awareness informaon is shared by the organizaon].

PM-16(01)-Test

[SELECT FROM: Organizaonal processes for implemenng the threat awareness program; organizaonal processes for implemenng the cross-organizaon informaon-sharing capability; automated mechanisms supporng and/or implemenng the threat awareness program; automated mechanisms supporng and/or implemenng the cross-organizaon informaon-sharing capability].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 385

NIST SP 800-53A, REV. 5

PM-17

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

PROTECTING CONTROLLED UNCLASSIFIED INFORMATION ON EXTERNAL SYSTEMS ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

PM-17_ODP[01]

the frequency at which to review and update the policy is deﬁned;

PM-17_ODP[02]

the frequency at which to review and update the procedures is deﬁned;

PM-17a.[01]

policy is established to ensure that requirements for the protecon of controlled unclassiﬁed informaon that is processed, stored, or transmied on external systems are implemented in accordance with applicable laws, execuve orders, direcves, policies, regulaons, and standards;

PM-17a.[02]

procedures are established to ensure that requirements for the protecon of controlled unclassiﬁed informaon that is processed, stored, or transmied on external systems are implemented in accordance with applicable laws, execuve orders, direcves, policies, regulaons, and standards;

PM-17b.[01]

policy is reviewed and updated <PM-17_ODP[01] frequency>;

PM-17b.[02]

procedures are reviewed and updated <PM-17_ODP[02] frequency>

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

PM-18

PM-17-Examine

[SELECT FROM: Controlled unclassiﬁed informaon policy; controlled unclassiﬁed informaon procedures; other relevant documents or records.].

PM-17-Interview

[SELECT FROM: Organizaonal personnel with controlled unclassiﬁed informaon responsibilies; organizaonal personnel with informaon security responsibilies.].

PRIVACY PROGRAM PLAN ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

PM-18_ODP

the frequency of updates to the privacy program plan is deﬁned;

PM-18a.[01]

an organizaon-wide privacy program plan that provides an overview of the agency’s privacy program is developed;

PM-18a.01[01]

the privacy program plan includes a descripon of the structure of the privacy program;

PM-18a.01[02]

the privacy program plan includes a descripon of the resources dedicated to the privacy program;

PM-18a.02[01]

the privacy program plan provides an overview of the requirements for the privacy program;

PM-18a.02[02]

the privacy program plan provides a descripon of the privacy program management controls in place or planned for meeng the requirements of the privacy program;

PM-18a.02[03]

the privacy program plan provides a descripon of common controls in place or planned for meeng the requirements of the privacy program;

PM-18a.03[01]

the privacy program plan includes the role of the senior agency oﬃcial for privacy;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 386

NIST SP 800-53A, REV. 5

PM-18

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

PRIVACY PROGRAM PLAN

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

PM-18a.03[02]

the privacy program plan includes the idenﬁcaon and assignment of the roles of other privacy oﬃcials and staﬀ and their responsibilies;

PM-18a.04[01]

the privacy program plan describes management commitment;

PM-18a.04[02]

the privacy program plan describes compliance;

PM-18a.04[03]

the privacy program plan describes the strategic goals and objecves of the privacy program;

PM-18a.05

the privacy program plan reﬂects coordinaon among organizaonal enes responsible for the diﬀerent aspects of privacy;

PM-18a.06

the privacy program plan is approved by a senior oﬃcial with responsibility and accountability for the privacy risk being incurred by organizaonal operaons (including, mission, funcons, image, and reputaon), organizaonal assets, individuals, other organizaons, and the Naon;

PM-18a.[02]

the privacy program plan is disseminated;

PM-18b.[01]

the privacy program plan is updated <PM-18_ODP frequency>;

PM-18b.[02]

the privacy program plan is updated to address changes in federal privacy laws and policies;

PM-18b.[03]

the privacy program plan is updated to address organizaonal changes;

PM-18b.[04]

the privacy program plan is updated to address problems idenﬁed during plan implementaon or privacy control assessments.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

PM-19

PM-18-Examine

[SELECT FROM: Privacy program plan; procedures addressing program plan development and implementaon; procedures addressing program plan reviews, updates, and approvals; procedures addressing coordinaon of the program plan with relevant enes; records of program plan reviews, updates, and approvals; other relevant documents or records].

PM-18-Interview

[SELECT FROM: Organizaonal personnel with privacy program planning and plan implementaon responsibilies; organizaonal personnel with privacy responsibilies].

PRIVACY PROGRAM LEADERSHIP ROLE ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

PM-19[01]

a senior agency oﬃcial for privacy with authority, mission, accountability, and resources is appointed;

PM-19[02]

the senior agency oﬃcial for privacy coordinates applicable privacy requirements;

PM-19[03]

the senior agency oﬃcial for privacy develops applicable privacy requirements;

PM-19[04]

the senior agency oﬃcial for privacy implements applicable privacy requirements;

PM-19[05]

the senior agency oﬃcial for privacy manages privacy risks through the organizaon-wide privacy program.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 387

NIST SP 800-53A, REV. 5

PM-19

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

PRIVACY PROGRAM LEADERSHIP ROLE POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

PM-20

PM-19-Examine

[SELECT FROM: Privacy program documents, including policies, procedures, plans, and reports; public privacy noces, including Federal Register noces; privacy impact assessments; privacy risk assessments; Privacy Act statements; system of records noces; computer matching agreements and noces; contracts, informaon sharing agreements, and memoranda of understanding; governing requirements, including laws, execuve orders, regulaons, standards, and guidance; other relevant documents or records].

PM-19-Interview

[SELECT FROM: Organizaonal personnel with privacy program planning and plan implementaon responsibilies; organizaonal personnel with privacy responsibilies; senior agency oﬃcial for privacy; privacy oﬃcials].

DISSEMINATION OF PRIVACY PROGRAM INFORMATION ASSESSMENT OBJECTIVE: Determine if: PM-20[01]

a central resource webpage is maintained on the organizaon’s principal public website;

PM-20[02]

the webpage serves as a central source of informaon about the organizaon’s privacy program;

PM-20a.[01]

the webpage ensures that the public has access to informaon about organizaonal privacy acvies;

PM-20a.[02]

the webpage ensures that the public can communicate with its senior agency oﬃcial for privacy;

PM-20b.[01]

the webpage ensures that organizaonal privacy pracces are publicly available;

PM-20b.[02]

the webpage ensures that organizaonal privacy reports are publicly available;

PM-20c.

the webpage employs publicly facing email addresses and/or phone numbers to enable the public to provide feedback and/or direct quesons to privacy oﬃces regarding privacy pracces.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

PM-20-Examine

[SELECT FROM: Public website; publicly posted privacy program documents, including policies, procedures, plans, and reports; posion descripon of the senior agency oﬃcial for privacy; public privacy noces, including Federal Register noces; privacy impact assessments; privacy risk assessments; Privacy Act statements and system of records noces; computer matching agreements and noces; other relevant documents or records].

PM-20-Interview

[SELECT FROM: Organizaonal personnel with privacy program informaon disseminaon responsibilies; organizaonal personnel with privacy responsibilies].

PM-20-Test

[SELECT FROM: Locaon, access, availability, and funconality of privacy resource webpage].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 388

NIST SP 800-53A, REV. 5

PM-20(01)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

DISSEMINATION OF PRIVACY PROGRAM INFORMATION | PRIVACY POLICIES ON WEBSITES, APPLICATIONS, AND DIGITAL SERVICES ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

PM-20(01)[01]

privacy policies are developed and posted on all external-facing websites;

PM-20(01)[02]

privacy policies are developed and posted on all mobile applicaons;

PM-20(01)[03]

privacy policies are developed and posted on all other digital services;

PM-20(01)(a)[01]

the privacy policies are wrien in plain language;

PM-20(01)(a)[02]

the privacy policies are organized in a way that is easy to understand and navigate;

PM-20(01)(b)[01]

the privacy policies provide the informaon needed by the public to make an informed decision about whether to interact with the organizaon;

PM-20(01)(b)[02]

the privacy policies provide the informaon needed by the public to make an informed decision about how to interact with the organizaon;

PM-20(01)(c)[01]

the privacy policies are updated whenever the organizaon makes a substanve change to the pracces it describes;

PM-20(01)(c)[02]

the privacy policies include a me/date stamp to inform the public of the date of the most recent changes.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

PM-21

PM-20(01)-Examine

[SELECT FROM: Privacy program plan; privacy policies on the agency website, mobile applicaons, and/or other digital services].

PM-20(01)-Interview

[SELECT FROM: Organizaonal personnel with privacy program informaon disseminaon responsibilies; organizaonal personnel with privacy responsibilies].

PM-20(01)-Test

[SELECT FROM: Organizaonal procedures and pracces for authorizing, conducng, managing, and reviewing personally idenﬁable informaon processing; organizaonal procedures and pracces for disseminang privacy program informaon; mechanisms supporng the disseminaon of privacy program informaon].

ACCOUNTING OF DISCLOSURES ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

PM-21a.

an accurate accounng of disclosures of personally idenﬁable informaon is developed and maintained;

PM-21a.01[01]

the accounng includes the date of each disclosure;

PM-21a.01[02]

the accounng includes the nature of each disclosure;

PM-21a.01[03]

the accounng includes the purpose of each disclosure;

PM-21a.02[01]

the accounng includes the name of the individual or organizaon to whom the disclosure was made;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 389

NIST SP 800-53A, REV. 5

PM-21

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

ACCOUNTING OF DISCLOSURES PM-21a.02[02]

the accounng includes the address or other contact informaon of the individual or organizaon to whom the disclosure was made;

PM-21b.

the accounng of disclosures is retained for the length of me that the personally idenﬁable informaon is maintained or ﬁve years aer the disclosure is made, whichever is longer;

PM-21c.

the accounng of disclosures is made available to the individual to whom the personally idenﬁable informaon relates upon request.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

PM-22

PM-21-Examine

[SELECT FROM: Privacy program plan; disclosure policies and procedures; records of disclosures; audit logs; Privacy Act policies and procedures; system of records noce; Privacy Act exempon rules.].

PM-21-Interview

[SELECT FROM: Organizaonal personnel with privacy program responsibilies; organizaonal personnel with privacy responsibilies.].

PM-21-Test

[SELECT FROM: Organizaonal processes for disclosures; mechanisms supporng the accounng of disclosures, including commercial services that provide noﬁcaons and alerts.].

PERSONALLY IDENTIFIABLE INFORMATION QUALITY MANAGEMENT ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

PM-22[01]

organizaon-wide policies for personally idenﬁable informaon quality management are developed and documented;

PM-22[02]

organizaon-wide procedures for personally idenﬁable informaon quality management are developed and documented;

PM-22a.[01]

the policies address reviewing the accuracy of personally idenﬁable informaon across the informaon life cycle;

PM-22a.[02]

the policies address reviewing the relevance of personally idenﬁable informaon across the informaon life cycle;

PM-22a.[03]

the policies address reviewing the meliness of personally idenﬁable informaon across the informaon life cycle;

PM-22a.[04]

the policies address reviewing the completeness of personally idenﬁable informaon across the informaon life cycle;

PM-22a.[05]

the procedures address reviewing the accuracy of personally idenﬁable informaon across the informaon life cycle;

PM-22a.[06]

the procedures address reviewing the relevance of personally idenﬁable informaon across the informaon life cycle;

PM-22a.[07]

the procedures address reviewing the meliness of personally idenﬁable informaon across the informaon life cycle;

PM-22a.[08]

the procedures address reviewing the completeness of personally idenﬁable informaon across the informaon life cycle;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 390

NIST SP 800-53A, REV. 5

PM-22

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

PERSONALLY IDENTIFIABLE INFORMATION QUALITY MANAGEMENT

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

PM-22b.[01]

the policies address correcng or deleng inaccurate or outdated personally idenﬁable informaon;

PM-22b.[02]

the procedures address correcng or deleng inaccurate or outdated personally idenﬁable informaon;

PM-22c.[01]

the policies address disseminang noce of corrected or deleted personally idenﬁable informaon to individuals or other appropriate enes;

PM-22c.[02]

the procedures address disseminang noce of corrected or deleted personally idenﬁable informaon to individuals or other appropriate enes;

PM-22d.[01]

the policies address appeals of adverse decisions on correcon or deleon requests;

PM-22d.[02]

the procedures address appeals of adverse decisions on correcon or deleon requests.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

PM-23

PM-22-Examine

[SELECT FROM: Privacy program plan; policies and procedures addressing personally idenﬁable informaon quality management, informaon life cycle documentaon, and sample noces of correcon or deleon; records of monitoring PII quality management pracces; documentaon of reviews and updates of policies and procedures].

PM-22-Interview

[SELECT FROM: Organizaonal personnel with privacy program informaon disseminaon responsibilies; organizaonal personnel with privacy responsibilies].

PM-22-Test

[SELECT FROM: [Organizaonal processes for data quality and personally idenﬁable informaon quality management procedures; mechanisms supporng and/or implemenng quality management requirements].

DATA GOVERNANCE BODY ASSESSMENT OBJECTIVE: Determine if:

PM-23_ODP[01]

the roles of a Data Governance Body are deﬁned;

PM-23_ODP[02]

the responsibilies of a Data Governance Body are deﬁned;

PM-23

a Data Governance Body consisng of <PM-23_ODP[01] roles> with <PM-23_ODP[02] responsibilies> is established.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

PM-23-Examine

[SELECT FROM: Privacy program plan; documentaon relang to the Data Governance Body, including documents establishing such a body, its charter of operaons, and any plans and reports; records of board meengs and decisions; records of requests to review data; policies, procedures, and standards that facilitate data governance].

PM-23-Interview

[SELECT FROM: Oﬃcials serving on the Data Governance Body (e.g., chief informaon oﬃcer, senior agency informaon security oﬃcer, and senior agency oﬃcial for privacy)].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 391

NIST SP 800-53A, REV. 5

PM-24

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

DATA INTEGRITY BOARD ASSESSMENT OBJECTIVE: Determine if: PM-24

a Data Integrity Board is established;

PM-24a.

the Data Integrity Board reviews proposals to conduct or parcipate in a matching program;

PM-24b.

the Data Integrity Board conducts an annual review of all matching programs in which the agency has parcipated.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

PM-25

PM-24-Examine

[SELECT FROM: Privacy program plan; privacy program documents relang to the Data Integrity Board, including documents establishing the board, its charter of operaons, and any plans and reports; computer matching agreements and noces; informaon sharing agreements; memoranda of understanding; records documenng annual reviews; governing requirements, including laws, execuve orders, regulaons, standards, and guidance].

PM-24-Interview

[SELECT FROM: members of the Data Integrity Board (e.g., the chief informaon oﬃcer, senior informaon security oﬃcer, senior agency oﬃcial for privacy, and agency Inspector General)].

MINIMIZATION OF PERSONALLY IDENTIFIABLE INFORMATION USED IN TESTING, TRAINING, AND RESEARCH ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

PM-25_ODP[01]

the frequency for reviewing policies that address the use of personally idenﬁable informaon for internal tesng, training, and research is deﬁned;

PM-25_ODP[02]

the frequency for updang policies that address the use of personally idenﬁable informaon for internal tesng, training, and research is deﬁned;

PM-25_ODP[03]

the frequency for reviewing procedures that address the use of personally idenﬁable informaon for internal tesng, training, and research is deﬁned;

PM-25_ODP[04]

the frequency for updang procedures that address the use of personally idenﬁable informaon for internal tesng, training, and research is deﬁned;

PM-25a.[01]

policies that address the use of personally idenﬁable informaon for internal tesng are developed and documented;

PM-25a.[02]

policies that address the use of personally idenﬁable informaon for internal training are developed and documented;

PM-25a.[03]

policies that address the use of personally idenﬁable informaon for internal research are developed and documented;

PM-25a.[04]

procedures that address the use of personally idenﬁable informaon for internal tesng are developed and documented;

PM-25a.[05]

procedures that address the use of personally idenﬁable informaon for internal training are developed and documented;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 392

NIST SP 800-53A, REV. 5

PM-25

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

MINIMIZATION OF PERSONALLY IDENTIFIABLE INFORMATION USED IN TESTING, TRAINING, AND RESEARCH

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

PM-25a.[06]

procedures that address the use of personally idenﬁable informaon for internal research are developed and documented;

PM-25a.[07]

policies that address the use of personally idenﬁable informaon for internal tesng, are implemented;

PM-25a.[08]

policies that address the use of personally idenﬁable informaon for training are implemented;

PM-25a.[09]

policies that address the use of personally idenﬁable informaon for research are implemented;

PM-25a.[10]

procedures that address the use of personally idenﬁable informaon for internal tesng are implemented;

PM-25a.[11]

procedures that address the use of personally idenﬁable informaon for training are implemented;

PM-25a.[12]

procedures that address the use of personally idenﬁable informaon for research are implemented;

PM-25b.[01]

the amount of personally idenﬁable informaon used for internal tesng purposes is limited or minimized;

PM-25b.[02]

the amount of personally idenﬁable informaon used for internal training purposes is limited or minimized;

PM-25b.[03]

the amount of personally idenﬁable informaon used for internal research purposes is limited or minimized;

PM-25c.[01]

the required use of personally idenﬁable informaon for internal tesng is authorized;

PM-25c.[02]

the required use of personally idenﬁable informaon for internal training is authorized;

PM-25c.[03]

the required use of personally idenﬁable informaon for internal research is authorized;

PM-25d.[01]

policies are reviewed <PM-25_ODP[01] frequency>;

PM-25d.[02]

policies are updated <PM-25_ODP[02] frequency>;

PM-25d.[03]

procedures are reviewed <PM-25_ODP[03] frequency>;

PM-25d.[04]

procedures are updated <PM-25_ODP[04] frequency>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

PM-25-Examine

[SELECT FROM: Privacy program plan; policies and procedures for the minimizaon of personally idenﬁable informaon used in tesng, training, and research; documentaon supporng policy implementaon (e.g., templates for tesng, training, and research; privacy threshold analysis; privacy risk assessment); data sets used for tesng, training, and research].

PM-25-Interview

[SELECT FROM: Organizaonal personnel with privacy program responsibilies; organizaonal personnel with privacy responsibilies; system developers; personnel with IRB responsibilies].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 393

NIST SP 800-53A, REV. 5

PM-25

MINIMIZATION OF PERSONALLY IDENTIFIABLE INFORMATION USED IN TESTING, TRAINING, AND RESEARCH PM-25-Test

PM-26

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

[SELECT FROM: Organizaonal processes for data quality and personally idenﬁable informaon management; mechanisms supporng data quality management and personally idenﬁable informaon management to minimize the use of personally idenﬁable informaon].

COMPLAINT MANAGEMENT

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

ASSESSMENT OBJECTIVE: Determine if:

PM-26_ODP[01]

the me period in which complaints (including concerns or quesons) from individuals are to be reviewed is deﬁned;

PM-26_ODP[02]

the me period in which complaints (including concerns or quesons) from individuals are to be addressed is deﬁned;

PM-26_ODP[03]

the me period for acknowledging the receipt of complaints is deﬁned;

PM-26_ODP[04]

the me period for responding to complaints is deﬁned;

PM-26[01]

a process for receiving complaints, concerns, or quesons from individuals about organizaonal security and privacy pracces is implemented;

PM-26[02]

a process for responding to complaints, concerns, or quesons from individuals about organizaonal security and privacy pracces is implemented;

PM-26a.[01]

the complaint management process includes mechanisms that are easy to use by the public;

PM-26a.[02]

the complaint management process includes mechanisms that are readily accessible by the public;

PM-26b.

the complaint management process includes all informaon necessary for successfully ﬁling complaints;

PM-26c.[01]

the complaint management process includes tracking mechanisms to ensure that all complaints are reviewed within <PM-26_ODP[01] me period>;

PM-26c.[02]

the complaint management process includes tracking mechanisms to ensure that all complaints are addressed within <PM-26_ODP[02] me period>;

PM-26d.

the complaint management process includes acknowledging the receipt of complaints, concerns, or quesons from individuals within <PM-26_ODP[03] me period>;

PM-26e.

the complaint management process includes responding to complaints, concerns, or quesons from individuals within <PM-26_ODP[04] me period>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

PM-26-Examine

[SELECT FROM: Privacy program plan; procedures addressing complaint management; complaint documentaon; procedures addressing the reviews of complaints; other relevant documents or records].

PM-26-Interview

[SELECT FROM: Organizaonal personnel with privacy program responsibilies; organizaonal personnel with privacy responsibilies].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 394

NIST SP 800-53A, REV. 5

PM-26

COMPLAINT MANAGEMENT PM-26-Test

PM-27

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

[SELECT FROM: Organizaonal processes for complaint management; mechanisms supporng complaint management; tools used by the public to submit complaints, concerns, and quesons (e.g., telephone, hotline, email, or web-based forms].

PRIVACY REPORTING ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

PM-27_ODP[01]

privacy reports are deﬁned;

PM-27_ODP[02]

privacy oversight bodies are deﬁned;

PM-27_ODP[03]

oﬃcials responsible for monitoring privacy program compliance are deﬁned;

PM-27_ODP[04]

the frequency for reviewing and updang privacy reports is deﬁned;

PM-27a.

<PM-27_ODP[01] privacy reports> are developed;

PM-27a.01

the privacy reports are disseminated to <PM-27_ODP[02] oversight bodies> to demonstrate accountability with statutory, regulatory, and policy privacy mandates;

PM-27a.02[01]

the privacy reports are disseminated to <PM-27_ODP[03] oﬃcials>;

PM-27a.02[02]

the privacy reports are disseminated to other personnel responsible for monitoring privacy program compliance;

PM-27b.

the privacy reports are reviewed and updated <PM-27_ODP[04] frequency>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

PM-28

PM-27-Examine

[SELECT FROM: Privacy program plan; internal and external privacy reports; privacy program plan; annual senior agency oﬃcial for privacy reports to OMB; reports to Congress required by law, regulaon, or policy, including internal policies; records documenng the disseminaon of reports to oversight bodies and oﬃcials responsible for monitoring privacy program compliance; records of review and updates of privacy reports.].

PM-27-Interview

[SELECT FROM: Organizaonal personnel with privacy program responsibilies; organizaonal personnel with privacy responsibilies; legal counsel.].

RISK FRAMING ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

PM-28_ODP[01]

the personnel to receive the results of risk framing acvies is/are deﬁned;

PM-28_ODP[02]

the frequency for reviewing and updang risk framing consideraons is deﬁned;

PM-28a.01[01]

assumpons aﬀecng risk assessments are idenﬁed and documented;

PM-28a.01[02]

assumpons aﬀecng risk responses are idenﬁed and documented;

PM-28a.01[03]

assumpons aﬀecng risk monitoring are idenﬁed and documented;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 395

NIST SP 800-53A, REV. 5

PM-28

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

RISK FRAMING

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

PM-28a.02[01]

constraints aﬀecng risk assessments are idenﬁed and documented;

PM-28a.02[02]

constraints aﬀecng risk responses are idenﬁed and documented;

PM-28a.02[03]

constraints aﬀecng risk monitoring are idenﬁed and documented;

PM-28a.03[01]

priories considered by the organizaon for managing risk are idenﬁed and documented;

PM-28a.03[02]

trade-oﬀs considered by the organizaon for managing risk are idenﬁed and documented;

PM-28a.04

organizaonal risk tolerance is idenﬁed and documented;

PM-28b.

the results of risk framing acvies are distributed to <PM-28_ODP[01] personnel>;

PM-28c.

risk framing consideraons are reviewed and updated <PM-28_ODP[02] frequency>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

PM-29

PM-28-Examine

[SELECT FROM: Informaon security program plan; privacy program plan; supply chain risk management strategy; documentaon of risk framing acvies; policies and procedures for risk framing acvies; risk management strategy].

PM-28-Interview

[SELECT FROM: Organizaonal personnel (including mission, business, and system owners or stewards; authorizing oﬃcials; senior agency informaon security oﬃcer; senior agency oﬃcial for privacy; and senior accountable oﬃcial for risk management)].

PM-28-Test

[SELECT FROM: Organizaonal procedures and pracces for authorizing, conducng, managing, and reviewing personally idenﬁable informaon processing; organizaonal processes for risk framing; mechanisms supporng the development, review, update, and approval of risk framing].

RISK MANAGEMENT PROGRAM LEADERSHIP ROLES ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

PM-29a.[01]

a Senior Accountable Oﬃcial for Risk Management is appointed;

PM-29a.[02]

a Senior Accountable Oﬃcial for Risk Management aligns informaon security and privacy management processes with strategic, operaonal, and budgetary planning processes;

PM-29b.[01]

a Risk Execuve (funcon) is established;

PM-29b.[02]

a Risk Execuve (funcon) views and analyzes risk from an organizaon-wide perspecve;

PM-29b.[03]

a Risk Execuve (funcon) ensures that the management of risk is consistent across the organizaon.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 396

NIST SP 800-53A, REV. 5

PM-29

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

RISK MANAGEMENT PROGRAM LEADERSHIP ROLES POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

PM-30

PM-29-Examine

[SELECT FROM: Informaon security program plan; privacy program plan; risk management strategy; supply chain risk management strategy; documentaon of appointment, roles, and responsibilies of a Senior Accountable Oﬃcial for Risk Management; documentaon of acons taken by the Oﬃcial; documentaon of the establishment, policies, and procedures of a Risk Execuve (funcon)].

PM-29-Interview

[SELECT FROM: Senior Accountable Oﬃcial for Risk Management; chief informaon oﬃcer; senior agency informaon security oﬃcer; senior agency oﬃcial for privacy; organizaonal personnel with informaon security and privacy program responsibilies].

SUPPLY CHAIN RISK MANAGEMENT STRATEGY ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

PM-30_ODP

the frequency for reviewing and updang the supply chain risk management strategy is deﬁned;

PM-30a.[01]

an organizaon-wide strategy for managing supply chain risks is developed;

PM-30a.[02]

the supply chain risk management strategy addresses risks associated with the development of systems;

PM-30a.[03]

the supply chain risk management strategy addresses risks associated with the development of system components;

PM-30a.[04]

the supply chain risk management strategy addresses risks associated with the development of system services;

PM-30a.[05]

the supply chain risk management strategy addresses risks associated with the acquision of systems;

PM-30a.[06]

the supply chain risk management strategy addresses risks associated with the acquision of system components;

PM-30a.[07]

the supply chain risk management strategy addresses risks associated with the acquision of system services;

PM-30a.[08]

the supply chain risk management strategy addresses risks associated with the maintenance of systems;

PM-30a.[09]

the supply chain risk management strategy addresses risks associated with the maintenance of system components;

PM-30a.[10]

the supply chain risk management strategy addresses risks associated with the maintenance of system services;

PM-30a.[11]

the supply chain risk management strategy addresses risks associated with the disposal of systems;

PM-30a.[12]

the supply chain risk management strategy addresses risks associated with the disposal of system components;

PM-30a.[13]

the supply chain risk management strategy addresses risks associated with the disposal of system services;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 397

NIST SP 800-53A, REV. 5

PM-30

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

SUPPLY CHAIN RISK MANAGEMENT STRATEGY PM-30b.

the supply chain risk management strategy is implemented consistently across the organizaon;

PM-30c.

the supply chain risk management strategy is reviewed and updated <PM-30_ODP frequency> or as required to address organizaonal changes.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

PM-30(01)

PM-30-Examine

[SELECT FROM: Supply chain risk management strategy; organizaonal risk management strategy; enterprise risk management documents; other relevant documents or records].

PM-30-Interview

[SELECT FROM: Organizaonal personnel with supply chain risk management responsibilies; organizaonal personnel with informaon security responsibilies; organizaonal personnel with acquision responsibilies; organizaonal personnel with enterprise risk management responsibilies].

SUPPLY CHAIN RISK MANAGEMENT STRATEGY | SUPPLIERS OF CRITICAL OR MISSIONESSENTIAL ITEMS ASSESSMENT OBJECTIVE: Determine if:

PM-30(01)[01]

suppliers of crical or mission-essenal technologies, products, and services are idenﬁed;

PM-30(01)[02]

suppliers of crical or mission-essenal technologies, products, and services are priorized;

PM-30(01)[03]

suppliers of crical or mission-essenal technologies, products, and services are assessed.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

PM-30(01)-Examine

[SELECT FROM: Supply chain risk management strategy; organizaon-wide risk management strategy; enterprise risk management documents; inventory records or suppliers; assessment and priorizaon documentaon; crical or missionessenal technologies, products, and service documents or records; other relevant documents or records].

PM-30(01)-Interview

PM-30(01)-Test

[SELECT FROM: Organizaonal processes for idenfying, priorizing, and assessing crical or mission-essenal technologies, products, and services; organizaonal processes for maintaining an inventory of suppliers; organizaonal process for associang suppliers with crical or mission-essenal technologies, products, and services].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 398

NIST SP 800-53A, REV. 5

PM-31

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

CONTINUOUS MONITORING STRATEGY ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5 CHAPTER FOUR

PM-31_ODP[01]

the metrics for organizaon-wide connuous monitoring are deﬁned;

PM-31_ODP[02]

the frequency for monitoring is deﬁned;

PM-31_ODP[03]

the frequency for assessing control eﬀecveness is deﬁned;

PM-31_ODP[04]

the personnel or roles for reporng the security status of organizaonal systems to is/are deﬁned;

PM-31_ODP[05]

the personnel or roles for reporng the privacy status of organizaonal systems to is/are deﬁned;

PM-31_ODP[06]

the frequency at which to report the security status of organizaonal systems is deﬁned;

PM-31_ODP[07]

the frequency at which to report the privacy status of organizaonal systems is deﬁned;

PM-31

an organizaon-wide connuous monitoring strategy is developed;

PM-31a.

connuous monitoring programs are implemented that include establishing <PM-31_ODP[01] metrics> to be monitored;

PM-31b.[01]

connuous monitoring programs are implemented that establish <PM-31_ODP[02] frequency> for monitoring;

PM-31b.[02]

connuous monitoring programs are implemented that establish <PM-31_ODP[03] frequency> for assessment of control eﬀecveness;

PM-31c.

connuous monitoring programs are implemented that include monitoring <PM-31_ODP[01] metrics> on an ongoing basis in accordance with the connuous monitoring strategy;

PM-31d.[01]

connuous monitoring programs are implemented that include correlang informaon generated by control assessments and monitoring;

PM-31d.[02]

connuous monitoring programs are implemented that include analyzing informaon generated by control assessments and monitoring;

PM-31e.[01]

connuous monitoring programs are implemented that include response acons to address the analysis of control assessment informaon;

PM-31e.[02]

connuous monitoring programs are implemented that include response acons to address the analysis of monitoring informaon;

PM-31f.[01]

connuous monitoring programs are implemented that include reporng the security status of organizaonal systems to <PM-31_ODP[04] personnel or roles> <PM-31_ODP[06] frequency>;

PM-31f.[02]

connuous monitoring programs are implemented that include reporng the privacy status of organizaonal systems to <PM-31_ODP[05] personnel or roles> <PM-31_ODP[07] frequency>.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 399

NIST SP 800-53A, REV. 5

PM-31

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

CONTINUOUS MONITORING STRATEGY POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

PM-32

PM-31-Examine

[SELECT FROM: Informaon security program plan; privacy program plan; supply chain risk management plan; connuous monitoring strategy; risk management strategy; informaon security connuous monitoring program documentaon, reporng, metrics, and arfacts; informaon security connuous monitoring program assessment documentaon, reporng, metrics, and arfacts; assessment and authorizaon policy; procedures addressing the connuous monitoring of controls; privacy program connuous monitoring documentaon, reporng, metrics, and arfacts; connuous monitoring program records, security, and privacy impact analyses; status reports; risk response documentaon; other relevant documents or records.].

PM-31-Interview

PM-31-Test

[SELECT FROM: Organizaonal procedures and mechanisms used for informaon security, privacy, and supply chain connuous monitoring].

PURPOSING ASSESSMENT OBJECTIVE: Determine if: PM-32_ODP

the systems or system components supporng mission-essenal services or funcons are deﬁned;

PM-32

<PM-32_ODP systems or system components> supporng mission-essenal services or funcons are analyzed to ensure that the informaon resources are being used in a manner that is consistent with their intended purpose.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

PM-32-Examine

[SELECT FROM: Informaon security program plan; privacy program plan; list of essenal services and funcons; organizaonal analysis of informaon resources; risk management strategy; other relevant documents or records.].

PM-32-Interview

[SELECT FROM: Organizaonal personnel with informaon security, privacy, and supply chain risk management program responsibilies].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 400

NIST SP 800-53A, REV. 5

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

4.14 PERSONNEL SECURITY PS-01

POLICY AND PROCEDURES ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5 CHAPTER FOUR

PS-01_ODP[01]

personnel or roles to whom the personnel security policy is to be disseminated is/ are deﬁned;

PS-01_ODP[02]

personnel or roles to whom the personnel security procedures are to be disseminated is/are deﬁned;

PS-01_ODP[03]

one or more of the following PARAMETER VALUES is/are selected: {organizaonlevel; mission/business process-level; system-level};

PS-01_ODP[04]

an oﬃcial to manage the personnel security policy and procedures is deﬁned;

PS-01_ODP[05]

the frequency at which the current personnel security policy is reviewed and updated is deﬁned;

PS-01_ODP[06]

events that would require the current personnel security policy to be reviewed and updated are deﬁned;

PS-01_ODP[07]

the frequency at which the current personnel security procedures are reviewed and updated is deﬁned;

PS-01_ODP[08]

events that would require the personnel security procedures to be reviewed and updated are deﬁned;

PS-01a.[01]

a personnel security policy is developed and documented;

PS-01a.[02]

the personnel security policy is disseminated to <PS-01_ODP[01] personnel or roles>;

PS-01a.[03]

personnel security procedures to facilitate the implementaon of the personnel security policy and associated personnel security controls are developed and documented;

PS-01a.[04]

the personnel security procedures are disseminated to <PS-01_ODP[02] personnel or roles>;

PS-01a.01(a)[01]

the <PS-01_ODP[03] SELECTED PARAMETER VALUE(S)> personnel security policy addresses purpose;

PS-01a.01(a)[02]

the <PS-01_ODP[03] SELECTED PARAMETER VALUE(S)> personnel security policy addresses scope;

PS-01a.01(a)[03]

the <PS-01_ODP[03] SELECTED PARAMETER VALUE(S)> personnel security policy addresses roles;

PS-01a.01(a)[04]

the <PS-01_ODP[03] SELECTED PARAMETER VALUE(S)> personnel security policy addresses responsibilies;

PS-01a.01(a)[05]

the <PS-01_ODP[03] SELECTED PARAMETER VALUE(S)> personnel security policy addresses management commitment;

PS-01a.01(a)[06]

the <PS-01_ODP[03] SELECTED PARAMETER VALUE(S)> personnel security policy addresses coordinaon among organizaonal enes;

PS-01a.01(a)[07]

the <PS-01_ODP[03] SELECTED PARAMETER VALUE(S)> personnel security policy addresses compliance;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 401

NIST SP 800-53A, REV. 5

PS-01

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

POLICY AND PROCEDURES

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

PS-01a.01(b)

the <PS-01_ODP[03] SELECTED PARAMETER VALUE(S)> personnel security policy is consistent with applicable laws, Execuve Orders, direcves, regulaons, policies, standards, and guidelines;

PS-01b.

the <PS-01_ODP[04] oﬃcial> is designated to manage the development, documentaon, and disseminaon of the personnel security policy and procedures;

PS-01c.01[01]

the current personnel security policy is reviewed and updated <PS-01_ODP[05] frequency>;

PS-01c.01[02]

the current personnel security policy is reviewed and updated following <PS-01_ODP[06] events>;

PS-01c.02[01]

the current personnel security procedures are reviewed and updated <PS-01_ODP[07] frequency>;

PS-01c.02[02]

the current personnel security procedures are reviewed and updated following <PS-01_ODP[08] events>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

PS-02

PS-01-Examine

[SELECT FROM: Personnel security policy; personnel security procedures; system security plan; privacy plan; risk management strategy documentaon; audit ﬁndings; other relevant documents or records].

PS-01-Interview

[SELECT FROM: Organizaonal personnel with personnel security responsibilies; organizaonal personnel with informaon security responsibilies].

POSITION RISK DESIGNATION ASSESSMENT OBJECTIVE: Determine if: PS-02_ODP

the frequency at which to review and update posion risk designaons is deﬁned;

PS-02a.

a risk designaon is assigned to all organizaonal posions;

PS-02b.

screening criteria are established for individuals ﬁlling organizaonal posions;

PS-02c.

posion risk designaons are reviewed and updated <PS-02_ODP frequency>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

PS-02-Examine

[SELECT FROM: Personnel security policy; procedures addressing posion categorizaon; appropriate codes of federal regulaons; list of risk designaons for organizaonal posions; records of posion risk designaon reviews and updates; system security plan; other relevant documents or records].

PS-02-Interview

[SELECT FROM: Organizaonal personnel with personnel security responsibilies; organizaonal personnel with informaon security responsibilies].

PS-02-Test

[SELECT FROM: Organizaonal processes for assigning, reviewing, and updang posion risk designaons; organizaonal processes for establishing screening criteria].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 402

NIST SP 800-53A, REV. 5

PS-03

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

PERSONNEL SCREENING ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

PS-03_ODP[01]

condions requiring rescreening of individuals are deﬁned;

PS-03_ODP[02]

the frequency of rescreening individuals where it is so indicated is deﬁned;

PS-03a.

individuals are screened prior to authorizing access to the system;

PS-03b.[01]

individuals are rescreened in accordance with <PS-03_ODP[01] condions requiring rescreening>;

PS-03b.[02]

where rescreening is so indicated, individuals are rescreened <PS-03_ODP[02] frequency>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

PS-03(01)

PS-03-Examine

[SELECT FROM: Personnel security policy; procedures addressing personnel screening; records of screened personnel; system security plan; other relevant documents or records].

PS-03-Interview

[SELECT FROM: Organizaonal personnel with personnel security responsibilies; organizaonal personnel with informaon security responsibilies].

PS-03-Test

[SELECT FROM: Organizaonal processes for personnel screening].

PERSONNEL SCREENING | CLASSIFIED INFORMATION ASSESSMENT OBJECTIVE: Determine if:

PS-03(01)[01]

individuals accessing a system processing, storing, or transming classiﬁed informaon are cleared;

PS-03(01)[02]

individuals accessing a system processing, storing, or transming classiﬁed informaon are indoctrinated to the highest classiﬁcaon level of the informaon to which they have access on the system.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

PS-03(01)-Examine

[SELECT FROM: Personnel security policy; procedures addressing personnel screening; records of screened personnel; system security plan; other relevant documents or records].

PS-03(01)-Interview

[SELECT FROM: Organizaonal personnel with personnel security responsibilies; organizaonal personnel with informaon security responsibilies].

PS-03(01)-Test

[SELECT FROM: Organizaonal processes for clearing and indoctrinang personnel for access to classiﬁed informaon].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 403

NIST SP 800-53A, REV. 5

PS-03(02)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

PERSONNEL SCREENING | FORMAL INDOCTRINATION ASSESSMENT OBJECTIVE: Determine if: PS-03(02)

individuals accessing a system processing, storing, or transming types of classiﬁed informaon that require formal indoctrinaon are formally indoctrinated for all of the relevant types of informaon to which they have access on the system.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

PS-03(03)

PS-03(02)-Examine

[SELECT FROM: Personnel security policy; procedures addressing personnel screening; indoctrinaon documents; records of screened personnel; system security plan; other relevant documents or records].

PS-03(02)-Interview

[SELECT FROM: Organizaonal personnel with personnel security responsibilies; organizaonal personnel with informaon security responsibilies].

PS-03(02)-Test

[SELECT FROM: Organizaonal processes for formal indoctrinaon for all relevant types of informaon to which personnel have access].

PERSONNEL SCREENING | INFORMATION REQUIRING SPECIAL PROTECTIVE MEASURES ASSESSMENT OBJECTIVE: Determine if:

PS-03(03)_ODP

addional personnel screening criteria to be sasﬁed for individuals accessing a system processing, storing, or transming informaon requiring special protecon are deﬁned;

PS-03(03)(a)

individuals accessing a system processing, storing, or transming informaon requiring special protecon have valid access authorizaons that are demonstrated by assigned oﬃcial government dues;

PS-03(03)(b)

individuals accessing a system processing, storing, or transming informaon requiring special protecon sasfy <PS-03(03)_ODP addional personnel screening criteria>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

PS-03(03)-Examine

[SELECT FROM: Personnel security policy; access control policy, procedures addressing personnel screening; records of screened personnel; screening criteria; records of access authorizaons; system security plan; other relevant documents or records].

PS-03(03)-Interview

[SELECT FROM: Organizaonal personnel with personnel security responsibilies; organizaonal personnel with informaon security responsibilies].

PS-03(03)-Test

[SELECT FROM: Organizaonal processes for ensuring valid access authorizaons for informaon requiring special protecon; organizaonal process for addional personnel screening for informaon requiring special protecon].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 404

NIST SP 800-53A, REV. 5

PS-03(04)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

PERSONNEL SCREENING | CITIZENSHIP REQUIREMENTS ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

PS-03(04)_ODP[01]

informaon types that are processed, stored, or transmied by a system that require individuals accessing the system to meet <PS-03(04)_ODP[02] cizenship requirements> are deﬁned;

PS-03(04)_ODP[02]

cizenship requirements to be met by individuals to access a system processing, storing, or transming informaon are deﬁned;

PS-03(04)

individuals accessing a system processing, storing, or transming <PS-03(04)_ODP[01] informaon types> meet <PS-03(04)_ODP[02] cizenship requirements>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

PS-04

PS-03(04)-Examine

PS-03(04)-Interview

[SELECT FROM: Organizaonal personnel with personnel security responsibilies; organizaonal personnel with informaon security responsibilies].

PS-03(04)-Test

[SELECT FROM: Organizaonal processes for ensuring valid access authorizaons for informaon requiring cizenship; organizaonal process for addional personnel screening for informaon requiring cizenship].

PERSONNEL TERMINATION ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

PS-04_ODP[01]

a me period within which to disable system access is deﬁned;

PS-04_ODP[02]

informaon security topics to be discussed when conducng exit interviews are deﬁned;

PS-04a.

upon terminaon of individual employment, system access is disabled within <PS-04_ODP[01] me period>;

PS-04b.

upon terminaon of individual employment, any authencators and credenals are terminated or revoked;

PS-04c.

upon terminaon of individual employment, exit interviews that include a discussion of <PS-04_ODP[02] informaon security topics> are conducted;

PS-04d.

upon terminaon of individual employment, all security-related organizaonal system-related property is retrieved;

PS-04e.

upon terminaon of individual employment, access to organizaonal informaon and systems formerly controlled by the terminated individual are retained.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 405

NIST SP 800-53A, REV. 5

PS-04

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

PERSONNEL TERMINATION POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

PS-04(01)

PS-04-Examine

[SELECT FROM: Personnel security policy; procedures addressing personnel terminaon; records of personnel terminaon acons; list of system accounts; records of terminated or revoked authencators/credenals; records of exit interviews; system security plan; other relevant documents or records].

PS-04-Interview

[SELECT FROM: Organizaonal personnel with personnel security responsibilies; organizaonal personnel with account management responsibilies; system/ network administrators; organizaonal personnel with informaon security responsibilies].

PS-04-Test

[SELECT FROM: Organizaonal processes for personnel terminaon; mechanisms supporng and/or implemenng personnel terminaon noﬁcaons; mechanisms for disabling system access/revoking authencators].

PERSONNEL TERMINATION | POST-EMPLOYMENT REQUIREMENTS ASSESSMENT OBJECTIVE: Determine if: PS-04(01)(a)

terminated individuals are noﬁed of applicable, legally binding post-employment requirements for the protecon of organizaonal informaon;

PS-04(01)(b)

terminated individuals are required to sign an acknowledgement of postemployment requirements as part of the organizaonal terminaon process.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

PS-04(02)

PS-04(01)-Examine

[SELECT FROM: Personnel security policy; procedures addressing personnel terminaon; signed post-employment acknowledgement forms; list of applicable, legally binding post-employment requirements; system security plan; other relevant documents or records].

PS-04(01)-Interview

[SELECT FROM: Organizaonal personnel with personnel security responsibilies; organizaonal personnel with informaon security responsibilies].

PS-04(01)-Test

[SELECT FROM: Organizaonal processes for post-employment requirements].

PERSONNEL TERMINATION | AUTOMATED ACTIONS ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

PS-04(02)_ODP[01]

automated mechanisms to nofy personnel or roles of individual terminaon acons and/or to disable access to system resources are deﬁned;

PS-04(02)_ODP[02]

one or more of the following PARAMETER VALUES is/are selected: {nofy <PS-04(02)_ODP[03] personnel or roles> of individual terminaon acons; disable access to system resources};

PS-04(02)_ODP[03]

personnel or roles to be noﬁed upon terminaon of an individual is/are deﬁned (if selected);

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 406

NIST SP 800-53A, REV. 5

PS-04(02)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

PERSONNEL TERMINATION | AUTOMATED ACTIONS PS-04(02)

<PS-04(02)_ODP[01] automated mechanisms> are used to <PS-04(02)_ODP[02] SELECTED PARAMETER VALUE(S)>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

PS-05

PS-04(02)-Examine

[SELECT FROM: Personnel security policy; procedures addressing personnel terminaon; system design documentaon; system conﬁguraon sengs and associated documentaon; records of personnel terminaon acons; automated noﬁcaons of employee terminaons; system security plan; other relevant documents or records].

PS-04(02)-Interview

[SELECT FROM: Organizaonal personnel with personnel security responsibilies; organizaonal personnel with informaon security responsibilies].

PS-04(02)-Test

[SELECT FROM: Organizaonal processes for personnel terminaon; automated mechanisms supporng and/or implemenng personnel terminaon noﬁcaons].

PERSONNEL TRANSFER ASSESSMENT OBJECTIVE: Determine if:

PS-05_ODP[01]

transfer or reassignment acons to be iniated following transfer or reassignment are deﬁned;

PS-05_ODP[02]

the me period within which transfer or reassignment acons must occur following transfer or reassignment is deﬁned;

PS-05_ODP[03]

personnel or roles to be noﬁed when individuals are reassigned or transferred to other posions within the organizaon is/are deﬁned;

PS-05_ODP[04]

me period within which to nofy organizaon-deﬁned personnel or roles when individuals are reassigned or transferred to other posions within the organizaon is deﬁned;

PS-05a.

the ongoing operaonal need for current logical and physical access authorizaons to systems and facilies are reviewed and conﬁrmed when individuals are reassigned or transferred to other posions within the organizaon;

PS-05b.

<PS-05_ODP[01] transfer or reassignment acons> are iniated within <PS-05_ODP[02] me period following the formal transfer acon>;

PS-05c.

access authorizaon is modiﬁed as needed to correspond with any changes in operaonal need due to reassignment or transfer;

PS-05d.

<PS-05_ODP[03] personnel or roles> are noﬁed within <PS-05_ODP[04] me period>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

PS-05-Examine

[SELECT FROM: Personnel security policy; procedures addressing personnel transfer; records of personnel transfer acons; list of system and facility access authorizaons; system security plan; other relevant documents or records].

PS-05-Interview

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 407

NIST SP 800-53A, REV. 5

PS-05

PERSONNEL TRANSFER PS-05-Test

PS-06

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

[SELECT FROM: Organizaonal processes for personnel transfer; mechanisms supporng and/or implemenng personnel transfer noﬁcaons; mechanisms for disabling system access/revoking authencators].

ACCESS AGREEMENTS ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

PS-06_ODP[01]

the frequency at which to review and update access agreements is deﬁned;

PS-06_ODP[02]

the frequency at which to re-sign access agreements to maintain access to organizaonal informaon is deﬁned;

PS-06a.

access agreements are developed and documented for organizaonal systems;

PS-06b.

the access agreements are reviewed and updated <PS-06_ODP[01] frequency>;

PS-06c.01

individuals requiring access to organizaonal informaon and systems sign appropriate access agreements prior to being granted access;

PS-06c.02

individuals requiring access to organizaonal informaon and systems re-sign access agreements to maintain access to organizaonal systems when access agreements have been updated or <PS-06_ODP[02] frequency>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

PS-06(01)

PS-06-Examine

[SELECT FROM: Personnel security policy; personnel security procedures; procedures addressing access agreements for organizaonal informaon and systems; access control policy; access control procedures; access agreements (including non-disclosure agreements, acceptable use agreements, rules of behavior, and conﬂict-of-interest agreements); documentaon of access agreement reviews, updates, and re-signing; system security plan; privacy plan; other relevant documents or records].

PS-06-Interview

[SELECT FROM: Organizaonal personnel with personnel security responsibilies; organizaonal personnel who have signed/resigned access agreements; organizaonal personnel with informaon security and privacy responsibilies].

PS-06-Test

[SELECT FROM: Organizaonal processes for reviewing, updang, and re-signing access agreements; mechanisms supporng the reviewing, updang, and re-signing of access agreements].

ACCESS AGREEMENTS | INFORMATION REQUIRING SPECIAL PROTECTION [WITHDRAWN: Incorporated into PS-03.]

CHAPTER FOUR

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 408

NIST SP 800-53A, REV. 5

PS-06(02)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

ACCESS AGREEMENTS | CLASSIFIED INFORMATION REQUIRING SPECIAL PROTECTION ASSESSMENT OBJECTIVE: Determine if: PS-06(02)(a)

access to classiﬁed informaon requiring special protecon is granted only to individuals who have a valid access authorizaon that is demonstrated by assigned oﬃcial government dues;

PS-06(02)(b)

access to classiﬁed informaon requiring special protecon is granted only to individuals who sasfy associated personnel security criteria;

PS-06(02)(c)

access to classiﬁed informaon requiring special protecon is granted only to individuals who have read, understood, and signed a non-disclosure agreement.

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

PS-06(03)

PS-06(02)-Examine

[SELECT FROM: Personnel security policy; procedures addressing access agreements for organizaonal informaon and systems; access agreements; access authorizaons; personnel security criteria; signed non-disclosure agreements; system security plan; other relevant documents or records].

PS-06(02)-Interview

[SELECT FROM: Organizaonal personnel with personnel security responsibilies; organizaonal personnel who have signed non-disclosure agreements; organizaonal personnel with informaon security responsibilies].

PS-06(02)-Test

[SELECT FROM: Organizaonal processes for access to classiﬁed informaon requiring special protecon].

ACCESS AGREEMENTS | POST-EMPLOYMENT REQUIREMENTS ASSESSMENT OBJECTIVE: Determine if: PS-06(03)(a)

individuals are noﬁed of applicable, legally binding post-employment requirements for the protecon of organizaonal informaon;

PS-06(03)(b)

individuals are required to sign an acknowledgement of applicable, legally binding post-employment requirements as part of being granted inial access to covered informaon.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

PS-06(03)-Examine

[SELECT FROM: Personnel security policy; procedures addressing access agreements for organizaonal informaon and systems; signed post-employment acknowledgement forms; access agreements; list of applicable, legally binding postemployment requirements; system security plan; other relevant documents or records].

PS-06(03)-Interview

[SELECT FROM: Organizaonal personnel with personnel security responsibilies; organizaonal personnel who have signed access agreements that include postemployment requirements; organizaonal personnel with informaon security responsibilies].

PS-06(03)-Test

[SELECT FROM: Organizaonal processes for post-employment requirements; mechanisms supporng noﬁcaons and individual acknowledgements of postemployment requirements].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 409

NIST SP 800-53A, REV. 5

PS-07

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

EXTERNAL PERSONNEL SECURITY ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

PS-07_ODP[01]

personnel or roles to be noﬁed of any personnel transfers or terminaons of external personnel who possess organizaonal credenals and/or badges or who have system privileges is/are deﬁned;

PS-07_ODP[02]

me period within which third-party providers are required to nofy organizaon-deﬁned personnel or roles of any personnel transfers or terminaons of external personnel who possess organizaonal credenals and/or badges or who have system privileges is deﬁned;

PS-07a.

personnel security requirements are established, including security roles and responsibilies for external providers;

PS-07b.

external providers are required to comply with personnel security policies and procedures established by the organizaon;

PS-07c.

personnel security requirements are documented;

PS-07d.

external providers are required to nofy <PS-07_ODP[01] personnel or roles> of any personnel transfers or terminaons of external personnel who possess organizaonal credenals and/or badges or who have system privileges within <PS-07_ODP[02] me period>;

PS-07e.

provider compliance with personnel security requirements is monitored.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

PS-08

PS-07-Examine

[SELECT FROM: Personnel security policy; procedures addressing external personnel security; list of personnel security requirements; acquision documents; service-level agreements; compliance monitoring process; system security plan; other relevant documents or records].

PS-07-Interview

[SELECT FROM: Organizaonal personnel with personnel security responsibilies; external providers; system/network administrators; organizaonal personnel with account management responsibilies; organizaonal personnel with informaon security responsibilies].

PS-07-Test

[SELECT FROM: Organizaonal processes for managing and monitoring external personnel security; mechanisms supporng and/or implemenng the monitoring of provider compliance].

PERSONNEL SANCTIONS ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

PS-08_ODP[01]

personnel or roles to be noﬁed when a formal employee sancons process is iniated is/are deﬁned;

PS-08_ODP[02]

the me period within which organizaon-deﬁned personnel or roles must be noﬁed when a formal employee sancons process is iniated is deﬁned;

PS-08a.

a formal sancons process is employed for individuals failing to comply with established informaon security and privacy policies and procedures;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 410

NIST SP 800-53A, REV. 5

PS-08

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

PERSONNEL SANCTIONS PS-08b.

<PS-08_ODP[01] personnel or roles> is/are noﬁed within <PS-08_ODP[02] me period> when a formal employee sancons process is iniated, idenfying the individual sanconed and the reason for the sancon.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

PS-09

PS-08-Examine

[SELECT FROM: Personnel security policy; personnel security procedures; procedures addressing personnel sancons; access agreements (including nondisclosure agreements, acceptable use agreements, rules of behavior, and conﬂictof-interest agreements); list of personnel or roles to be noﬁed of formal employee sancons; records or noﬁcaons of formal employee sancons; system security plan; privacy plan; personally idenﬁable informaon processing policy; other relevant documents or records].

PS-08-Interview

[SELECT FROM: Organizaonal personnel with personnel security responsibilies; legal counsel; organizaonal personnel with informaon security and privacy responsibilies].

PS-08-Test

[SELECT FROM: Organizaonal processes for managing formal employee sancons; mechanisms supporng and/or implemenng formal employee sancons noﬁcaons].

POSITION DESCRIPTIONS ASSESSMENT OBJECTIVE: Determine if: PS-09[01]

security roles and responsibilies are incorporated into organizaonal posion descripons;

PS-09[02]

privacy roles and responsibilies are incorporated into organizaonal posion descripons.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

PS-09-Examine

[SELECT FROM: Personnel security policy; personnel security procedures; procedures addressing posion descripons; security and privacy posion descripons; system security plan; privacy plan; privacy program plan; other relevant documents or records].

PS-09-Interview

[SELECT FROM: Organizaonal personnel with personnel security responsibilies; organizaonal personnel with informaon security and privacy responsibilies; organizaonal personnel with human capital management responsibilies].

PS-09-Test

[SELECT FROM: Organizaonal processes for managing posion descripons].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 411

NIST SP 800-53A, REV. 5

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

4.15 PERSONALLY IDENTIFIABLE INFORMATION PROCESSING AND TRANSPARENCY PT-01

POLICY AND PROCEDURES ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5 CHAPTER FOUR

PT-01_ODP[01]

personnel or roles to whom the personally idenﬁable informaon processing and transparency policy is to be disseminated is/are deﬁned;

PT-01_ODP[02]

personnel or roles to whom the personally idenﬁable informaon processing and transparency procedures are to be disseminated is/are deﬁned;

PT-01_ODP[03]

one or more of the following PARAMETER VALUES is/are selected: {organizaonlevel; mission/business process-level; system-level};

PT-01_ODP[04]

an oﬃcial to manage the personally idenﬁable informaon processing and transparency policy and procedures is deﬁned;

PT-01_ODP[05]

the frequency at which the current personally idenﬁable informaon processing and transparency policy is reviewed and updated is deﬁned;

PT-01_ODP[06]

events that would require the current personally idenﬁable informaon processing and transparency policy to be reviewed and updated are deﬁned;

PT-01_ODP[07]

the frequency at which the current personally idenﬁable informaon processing and transparency procedures are reviewed and updated is deﬁned;

PT-01_ODP[08]

events that would require the personally idenﬁable informaon processing and transparency procedures to be reviewed and updated are deﬁned;

PT-01a.[01]

a personally idenﬁable informaon processing and transparency policy is developed and documented;

PT-01a.[02]

the personally idenﬁable informaon processing and transparency policy is disseminated to <PT-01_ODP[01] personnel or roles>;

PT-01a.[03]

personally idenﬁable informaon processing and transparency procedures to facilitate the implementaon of the personally idenﬁable informaon processing and transparency policy and associated personally idenﬁable informaon processing and transparency controls are developed and documented;

PT-01a.[04]

the personally idenﬁable informaon processing and transparency procedures are disseminated to <PT-01_ODP[02] personnel or roles>;

PT-01a.01(a)[01]

the <PT-01_ODP[03] SELECTED PARAMETER VALUE(S)> personally idenﬁable informaon processing and transparency policy addresses purpose;

PT-01a.01(a)[02]

the <PT-01_ODP[03] SELECTED PARAMETER VALUE(S)> personally idenﬁable informaon processing and transparency policy addresses scope;

PT-01a.01(a)[03]

the <PT-01_ODP[03] SELECTED PARAMETER VALUE(S)> personally idenﬁable informaon processing and transparency policy addresses roles;

PT-01a.01(a)[04]

the <PT-01_ODP[03] SELECTED PARAMETER VALUE(S)> personally idenﬁable informaon processing and transparency policy addresses responsibilies;

PT-01a.01(a)[05]

the <PT-01_ODP[03] SELECTED PARAMETER VALUE(S)> personally idenﬁable informaon processing and transparency policy addresses management commitment;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 412

NIST SP 800-53A, REV. 5

PT-01

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

POLICY AND PROCEDURES

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

PT-01a.01(a)[06]

the <PT-01_ODP[03] SELECTED PARAMETER VALUE(S)> personally idenﬁable informaon processing and transparency policy addresses coordinaon among organizaonal enes;

PT-01a.01(a)[07]

the <PT-01_ODP[03] SELECTED PARAMETER VALUE(S)> personally idenﬁable informaon processing and transparency policy addresses compliance;

PT-01a.01(b)

the <PT-01_ODP[03] SELECTED PARAMETER VALUE(S)> personally idenﬁable informaon processing and transparency policy is consistent with applicable laws, Execuve Orders, direcves, regulaons, policies, standards, and guidelines;

PT-01b.

the <PT-01_ODP[04] oﬃcial> is designated to manage the development, documentaon, and disseminaon of the personally idenﬁable informaon processing and transparency policy and procedures;

PT-01c.01[01]

the current personally idenﬁable informaon processing and transparency policy is reviewed and updated <PT-01_ODP[05] frequency>;

PT-01c.01[02]

the current personally idenﬁable informaon processing and transparency policy is reviewed and updated following <PT-01_ODP[06] events>;

PT-01c.02[01]

the current personally idenﬁable informaon processing and transparency procedures are reviewed and updated <PT-01_ODP[07] frequency>;

PT-01c.02[02]

the current personally idenﬁable informaon processing and transparency procedures are reviewed and updated following <PT-01_ODP[08] events>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

PT-02

PT-01-Examine

[SELECT FROM: Personally idenﬁable informaon processing and transparency policy and procedures; privacy plan; privacy program plan; other relevant documents or records].

PT-01-Interview

[SELECT FROM: Organizaonal personnel with personally idenﬁable informaon processing and transparency responsibilies; organizaonal personnel with informaon security and privacy responsibilies].

AUTHORITY TO PROCESS PERSONALLY IDENTIFIABLE INFORMATION ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

PT-02_ODP[01]

the authority to permit the processing (deﬁned in PT-02_ODP[02]) of personally idenﬁable informaon is deﬁned;

PT-02_ODP[02]

the type of processing of personally idenﬁable informaon is deﬁned;

PT-02_ODP[03]

the type of processing of personally idenﬁable informaon to be restricted is deﬁned;

PT-02a.

the <PT-02_ODP[01] authority> that permits the <PT-02_ODP[02] processing> of personally idenﬁable informaon is determined and documented;

PT-02b.

the <PT-02_ODP[03] processing> of personally idenﬁable informaon is restricted to only that which is authorized.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 413

NIST SP 800-53A, REV. 5

PT-02

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

AUTHORITY TO PROCESS PERSONALLY IDENTIFIABLE INFORMATION POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

PT-02(01)

PT-02-Examine

[SELECT FROM: Personally idenﬁable informaon processing and transparency policy and procedures; privacy plan; other relevant documents or records].

PT-02-Interview

PT-02-Test

[SELECT FROM: Organizaonal processes for authorizing the processing of personally idenﬁable informaon; mechanisms supporng and/or implemenng the restricon of personally idenﬁable informaon processing].

AUTHORITY TO PROCESS PERSONALLY IDENTIFIABLE INFORMATION | DATA TAGGING ASSESSMENT OBJECTIVE: Determine if:

PT-02(01)_ODP[01]

the authorized processing of personally idenﬁable informaon is deﬁned;

PT-02(01)_ODP[02]

elements of personally idenﬁable informaon to be tagged are deﬁned;

PT-02(01)

data tags containing <PT-02(01)_ODP[01] authorized processing> are aached to <PT-02(01)_ODP[02] elements of personally idenﬁable informaon>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

PT-02(02)

PT-02(01)-Examine

[SELECT FROM: Personally idenﬁable informaon processing and transparency policy and procedures including procedures addressing data tagging; data tag deﬁnions; documented requirements for use and monitoring of data tagging; data extracts with corresponding data tags; privacy plan; other relevant documents or records].

PT-02(01)-Interview

PT-02(01)-Test

[SELECT FROM: Organizaonal processes for authorizing the processing of personally idenﬁable informaon; organizaonal processes for data tagging; mechanisms for applying and monitoring data tagging; mechanisms supporng and/or implemenng the restricon of personally idenﬁable informaon processing].

AUTHORITY TO PROCESS PERSONALLY IDENTIFIABLE INFORMATION | AUTOMATION ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

PT-02(02)_ODP

automated mechanisms used to manage enforcement of the authorized processing of personally idenﬁable informaon are deﬁned;

PT-02(02)

enforcement of the authorized processing of personally idenﬁable informaon is managed using <PT-02(02)_ODP automated mechanisms>.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 414

NIST SP 800-53A, REV. 5

PT-02(02)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

AUTHORITY TO PROCESS PERSONALLY IDENTIFIABLE INFORMATION | AUTOMATION POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

PT-03

PT-02(02)-Examine

[SELECT FROM: Personally idenﬁable informaon processing and transparency policy and procedures; privacy plan; other relevant documents or records].

PT-02(02)-Interview

PT-02(02)-Test

[SELECT FROM: Organizaonal processes for authorizing the processing of personally idenﬁable informaon; automated mechanisms supporng and/or implemenng the management of authorized personally idenﬁable informaon processing].

PERSONALLY IDENTIFIABLE INFORMATION PROCESSING PURPOSES ASSESSMENT OBJECTIVE: Determine if:

PT-03_ODP[01]

the purpose(s) for processing personally idenﬁable informaon is/are deﬁned;

PT-03_ODP[02]

the processing of personally idenﬁable informaon to be restricted is deﬁned;

PT-03_ODP[03]

mechanisms to be implemented for ensuring any changes in the processing of personally idenﬁable informaon are made in accordance with requirements are deﬁned;

PT-03_ODP[04]

requirements for changing the processing of personally idenﬁable informaon are deﬁned;

PT-03a.

the <PT-03_ODP[01] purpose(s)> for processing personally idenﬁable informaon is/are idenﬁed and documented;

PT-03b.[01]

the purpose(s) is/are described in the public privacy noces of the organizaon;

PT-03b.[02]

the purpose(s) is/are described in the policies of the organizaon;

PT-03c.

the <PT-03_ODP[02] processing> of personally idenﬁable informaon are restricted to only that which is compable with the idenﬁed purpose(s);

PT-03d.[01]

changes in the processing of personally idenﬁable informaon are monitored;

PT-03d.[02]

<PT-03_ODP[03] mechanisms> are implemented to ensure that any changes are made in accordance with <PT-03_ODP[04] requirements>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

PT-03-Examine

[SELECT FROM: Personally idenﬁable informaon processing and transparency policy and procedures; conﬁguraon management plan; organizaonal privacy noces; organizaonal policies; Privacy Act statements; computer matching noces; applicable Federal Register noces; documented requirements for enforcing and monitoring the processing of personally idenﬁable informaon; privacy plan; other relevant documents or records].

PT-03-Interview

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 415

NIST SP 800-53A, REV. 5

PT-03

PERSONALLY IDENTIFIABLE INFORMATION PROCESSING PURPOSES PT-03-Test

PT-03(01)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

[SELECT FROM: Organizaonal processes for authorizing the processing of personally idenﬁable informaon; mechanisms supporng and/or implemenng the management of authorized personally idenﬁable informaon processing; organizaonal processes for monitoring changes in processing personally idenﬁable informaon].

PERSONALLY IDENTIFIABLE INFORMATION PROCESSING PURPOSES | DATA TAGGING

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

ASSESSMENT OBJECTIVE: Determine if:

PT-03(01)_ODP[01]

processing purposes to be contained in data tags are deﬁned;

PT-03(01)_ODP[02]

elements of personally idenﬁable informaon to be tagged are deﬁned;

PT-03(01)

data tags containing <PT-03(01)_ODP[01] processing purposes> are aached to <PT-03(01)_ODP[02] elements of personally idenﬁable informaon>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

PT-03(02)

PT-03(01)-Examine

[SELECT FROM: Personally idenﬁable informaon processing and transparency policy and procedures; documented descripon of how data tags are used to idenfy personally idenﬁable informaon data elements and their authorized uses; data tag schema; data extracts with corresponding data tags; privacy plan; other relevant documents or records].

PT-03(01)-Interview

[SELECT FROM: Organizaonal personnel with personally idenﬁable informaon processing and transparency responsibilies; organizaonal personnel with data tagging responsibilies; organizaonal personnel with informaon security and privacy responsibilies].

PT-03(01)-Test

[SELECT FROM: Organizaonal processes for authorizing the processing of personally idenﬁable informaon; mechanisms supporng and/or implemenng data tagging].

PERSONALLY IDENTIFIABLE INFORMATION PROCESSING PURPOSES | AUTOMATION ASSESSMENT OBJECTIVE: Determine if:

PT-03(02)_ODP

automated mechanisms for tracking the processing purposes of personally idenﬁable informaon are deﬁned;

PT-03(02)

the processing purposes of personally idenﬁable informaon are tracked using <PT-03(02)_ODP automated mechanisms>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: PT-03(02)-Examine

CHAPTER FOUR

[SELECT FROM: Personally idenﬁable informaon processing and transparency policy and procedures; data extracts with corresponding data tags; privacy plan; other relevant documents or records].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 416

NIST SP 800-53A, REV. 5

PT-03(02)

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

PT-04

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

PERSONALLY IDENTIFIABLE INFORMATION PROCESSING PURPOSES | AUTOMATION PT-03(02)-Interview

PT-03(02)-Test

[SELECT FROM: Organizaonal processes for managing the enforcement of authorized processing of personally idenﬁable informaon; automated tracking mechanisms].

CONSENT ASSESSMENT OBJECTIVE: Determine if: PT-04_ODP

the tools or mechanisms to be implemented for individuals to consent to the processing of their personally idenﬁable informaon are deﬁned;

PT-04

the <PT-04_ODP tools or mechanisms> are implemented for individuals to consent to the processing of their personally idenﬁable informaon prior to its collecon that facilitate individuals’ informed decision-making.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

PT-04(01)

PT-04-Examine

[SELECT FROM: Personally idenﬁable informaon processing and transparency policy and procedures; consent policies and procedures; consent tools and mechanisms; consent presentaon or display (user interface); evidence of individuals’ consent; privacy plan; other relevant documents or records].

PT-04-Interview

PT-04-Test

[SELECT FROM: Organizaonal processes for the collecon of personally idenﬁable informaon; consent tools or mechanisms for users to authorize the processing of their personally idenﬁable informaon; mechanisms implemenng consent].

CONSENT | TAILORED CONSENT ASSESSMENT OBJECTIVE: Determine if:

PT-04(01)_ODP

tailoring mechanisms for processing selected elements of personally idenﬁable informaon permissions are deﬁned;

PT-04(01)

<PT-04(01)_ODP mechanisms> are provided to allow individuals to tailor processing permissions to selected elements of personally idenﬁable informaon.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: PT-04(01)-Examine

CHAPTER FOUR

[SELECT FROM: Personally idenﬁable informaon processing and transparency policy and procedures; consent policies and procedures; consent tools and mechanisms; consent presentaon or display (user interface); privacy plan; other relevant documents or records].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 417

NIST SP 800-53A, REV. 5

PT-04(01)

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

PT-04(02)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

CONSENT | TAILORED CONSENT PT-04(01)-Interview

[SELECT FROM: Organizaonal personnel with personally idenﬁable informaon processing and transparency responsibilies; organizaonal personnel with user interface or user experience responsibilies; organizaonal personnel with informaon security and privacy responsibilies].

PT-04(01)-Test

[SELECT FROM: Organizaonal processes for consenng to the processing of personally idenﬁable informaon; consent tools or mechanisms; mechanisms implemenng consent].

CONSENT | JUST-IN-TIME CONSENT ASSESSMENT OBJECTIVE: Determine if:

PT-04(02)_ODP[01]

consent mechanisms to be presented to individuals are deﬁned;

PT-04(02)_ODP[02]

the frequency at which to present consent mechanisms to individuals is deﬁned;

PT-04(02)_ODP[03]

personally idenﬁable informaon processing to be presented in conjuncon with organizaon-deﬁned consent mechanisms is deﬁned;

PT-04(02)

<PT-04(02)_ODP[01] consent mechanisms> are presented to individuals <PT-04(02)_ODP[02] frequency> and in conjuncon with <PT-04(02)_ODP[03] personally idenﬁable informaon processing>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

PT-04(03)

PT-04(02)-Examine

[SELECT FROM: Personally idenﬁable informaon processing and transparency policy and procedures; consent policies and procedures; privacy plan; other relevant documents or records].

PT-04(02)-Interview

PT-04(02)-Test

[SELECT FROM: Organizaonal processes for the collecon of personally idenﬁable informaon; mechanisms for obtaining just-in-me consent from users for the processing of their personally idenﬁable informaon; mechanisms implemenng just-in-me consent].

CONSENT | REVOCATION ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

PT-04(03)_ODP

the tools or mechanisms to be implemented for revoking consent to the processing of personally idenﬁable informaon are deﬁned;

PT-04(03)

the <PT-04(03)_ODP tools or mechanisms> are implemented for individuals to revoke consent to the processing of their personally idenﬁable informaon.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 418

NIST SP 800-53A, REV. 5

PT-04(03)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

CONSENT | REVOCATION POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

PT-05

PT-04(03)-Examine

[SELECT FROM: Personally idenﬁable informaon processing and transparency policy and procedures; consent revocaon policies and procedures; consent revocaon user interface or user experience; privacy plan; other relevant documents or records].

PT-04(03)-Interview

PT-04(03)-Test

[SELECT FROM: Organizaonal processes for consenng to the processing of personally idenﬁable informaon; tools or mechanisms for implemenng consent revocaon].

PRIVACY NOTICE ASSESSMENT OBJECTIVE: Determine if:

PT-05_ODP[01]

the frequency at which a noce is provided to individuals aer inial interacon with an organizaon is deﬁned;

PT-05_ODP[02]

informaon to be included with the noce about the processing of personally idenﬁable informaon is deﬁned;

PT-05a.[01]

a noce to individuals about the processing of personally idenﬁable informaon is provided such that the noce is available to individuals upon ﬁrst interacng with an organizaon;

PT-05a.[02]

a noce to individuals about the processing of personally idenﬁable informaon is provided such that the noce is subsequently available to individuals <PT-05_ODP[01] frequency>;

PT-05b.

a noce to individuals about the processing of personally idenﬁable informaon is provided that is clear, easy-to-understand, and expresses informaon about personally idenﬁable informaon processing in plain language;

PT-05c.

a noce to individuals about the processing of personally idenﬁable informaon that idenﬁes the authority that authorizes the processing of personally idenﬁable informaon is provided;

PT-05d.

a noce to individuals about the processing of personally idenﬁable informaon that idenﬁes the purpose for which personally idenﬁable informaon is to be processed is provided;

PT-05e.

a noce to individuals about the processing of personally idenﬁable informaon which includes <PT-05_ODP[02] informaon> is provided.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: PT-05-Examine

CHAPTER FOUR

[SELECT FROM: Personally idenﬁable informaon processing and transparency policy and procedures; privacy noce; Privacy Act statements; privacy plan; other relevant documents or records].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 419

NIST SP 800-53A, REV. 5

PT-05

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

PT-05(01)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

PRIVACY NOTICE PT-05-Interview

PT-05-Test

[SELECT FROM: Organizaonal processes and implementaon support or mechanisms for providing noce to individuals regarding the processing of their personally idenﬁable informaon].

PRIVACY NOTICE | JUST-IN-TIME NOTICE ASSESSMENT OBJECTIVE: Determine if:

PT-05(01)_ODP

the frequency at which to present a noce of personally idenﬁable informaon processing is deﬁned;

PT-05(01)

a noce of personally idenﬁable informaon processing is presented to individuals at a me and locaon where the individual provides personally idenﬁable informaon, in conjuncon with a data acon, or <PT-05(01)_ODP frequency>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

PT-05(02)

PT-05(01)-Examine

[SELECT FROM: Personally idenﬁable informaon processing and transparency policy and procedures; privacy noce; privacy plan; other relevant documents or records].

PT-05(01)-Interview

PT-05(01)-Test

[SELECT FROM: Organizaonal processes and implementaon support or mechanisms for providing noce to individuals regarding the processing of their personally idenﬁable informaon].

PRIVACY NOTICE | PRIVACY ACT STATEMENTS ASSESSMENT OBJECTIVE: Determine if: PT-05(02)

Privacy Act statements are included on forms that collect informaon that will be maintained in a Privacy Act system of records, or Privacy Act statements are provided on separate forms that can be retained by individuals.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: PT-05(02)-Examine

CHAPTER FOUR

[SELECT FROM: Personally idenﬁable informaon processing and transparency policy and procedures; privacy noce; Privacy Act system of records; forms that include Privacy Act statements; privacy plan; other relevant documents or records].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 420

NIST SP 800-53A, REV. 5

PT-05(02)

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

PT-06

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

PRIVACY NOTICE | PRIVACY ACT STATEMENTS PT-05(02)-Interview

PT-05(02)-Test

[SELECT FROM: Organizaonal processes for including Privacy Act statements on forms that collect informaon or on separate forms that can be retained by individuals].

SYSTEM OF RECORDS NOTICE ASSESSMENT OBJECTIVE: Determine if: PT-06a.[01]

system of records noces are draed in accordance with OMB guidance for systems that process informaon that will be maintained in a Privacy Act system of records;

PT-06a.[02]

new and signiﬁcantly modiﬁed system of records noces are submied to the OMB and appropriate congressional commiees for advance review for systems that process informaon that will be maintained in a Privacy Act system of records;

PT-06b.

system of records noces are published in the Federal Register for systems that process informaon that will be maintained in a Privacy Act system of records;

PT-06c.

system of records noces are kept accurate, up-to-date, and scoped in accordance with policy for systems that process informaon that will be maintained in a Privacy Act system of records.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

PT-06(01)

PT-06-Examine

[SELECT FROM: Personally idenﬁable informaon processing and transparency policy and procedures; privacy noce; Privacy Act system of records; Federal Register noces; privacy plan; other relevant documents or records].

PT-06-Interview

PT-06-Test

[SELECT FROM: Organizaonal processes for Privacy Act system of records maintenance].

SYSTEM OF RECORDS NOTICE | ROUTINE USES ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

PT-06(01)_ODP

the frequency at which to review all roune uses published in the system of records noce is deﬁned;

PT-06(01)

all roune uses published in the system of records noce are reviewed <PT-06(01)_ODP frequency> to ensure connued accuracy, and to ensure that roune uses connue to be compable with the purpose for which the informaon was collected.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 421

NIST SP 800-53A, REV. 5

PT-06(01)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

SYSTEM OF RECORDS NOTICE | ROUTINE USES POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

PT-06(02)

PT-06(01)-Examine

[SELECT FROM: Personally idenﬁable informaon processing and transparency policy and procedures; privacy noce; Privacy Act system of records; privacy plan; other relevant documents or records].

PT-06(01)-Interview

PT-06(01)-Test

[SELECT FROM: Organizaonal processes for reviewing system of records noces].

SYSTEM OF RECORDS NOTICE | EXEMPTION RULES ASSESSMENT OBJECTIVE: Determine if:

PT-06(02)_ODP

the frequency at which to review all Privacy Act exempons claimed for the system of records is deﬁned;

PT-06(02)[01]

all Privacy Act exempons claimed for the system of records are reviewed <PT-06(02)_ODP frequency> to ensure that they remain appropriate and necessary in accordance with law;

PT-06(02)[02]

all Privacy Act exempons claimed for the system of records are reviewed <PT-06(02)_ODP frequency> to ensure that they have been promulgated as regulaons;

PT-06(02)[03]

all Privacy Act exempons claimed for the system of records are reviewed <PT-06(02)_ODP frequency> to ensure that they are accurately described in the system of records noce.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

PT-07

PT-06(02)-Examine

[SELECT FROM: Personally idenﬁable informaon processing and transparency policy and procedures; privacy noce; Privacy Act system of records; Privacy Act exempons; privacy plan; other relevant documents or records].

PT-06(02)-Interview

PT-06(02)-Test

[SELECT FROM: Organizaonal processes for Privacy Act system of records maintenance].

SPECIFIC CATEGORIES OF PERSONALLY IDENTIFIABLE INFORMATION ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

PT-07_ODP

processing condions to be applied for speciﬁc categories of personally idenﬁable informaon are deﬁned;

PT-07

<PT-07_ODP processing condions> are applied for speciﬁc categories of personally idenﬁable informaon.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 422

NIST SP 800-53A, REV. 5

PT-07

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

SPECIFIC CATEGORIES OF PERSONALLY IDENTIFIABLE INFORMATION POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

PT-07(01)

PT-07-Examine

[SELECT FROM: Personally idenﬁable informaon processing and transparency policy and procedures; privacy noce; Privacy Act system of records; computer matching agreements and noces; contracts; privacy informaon sharing agreements; memoranda of understanding; governing requirements; privacy plan; other relevant documents or records].

PT-07-Interview

PT-07-Test

[SELECT FROM: Organizaonal processes for supporng and/or implemenng personally idenﬁable informaon processing].

SPECIFIC CATEGORIES OF PERSONALLY IDENTIFIABLE INFORMATION | SOCIAL SECURITY NUMBERS ASSESSMENT OBJECTIVE: Determine if:

PT-07(01)(a)[01]

when a system processes Social Security numbers, the unnecessary collecon, maintenance, and use of Social Security numbers are eliminated;

PT-07(01)(a)[02]

when a system processes Social Security numbers, alternaves to the use of Social Security Numbers as a personal idenﬁer are explored;

PT-07(01)(b)

when a system processes Social Security numbers, individual rights, beneﬁts, or privileges provided by law are not denied because of an individual’s refusal to disclose their Social Security number;

PT-07(01)(c)[01]

when a system processes Social Security numbers, any individual who is asked to disclose their Social Security number is informed whether that disclosure is mandatory or voluntary, by what statutory or other authority such number is solicited, and what uses will be made of it;

PT-07(01)(c)[02]

when a system processes Social Security numbers, any individual who is asked to disclose their Social Security number is informed by what statutory or other authority the number is solicited;

PT-07(01)(c)[03]

when a system processes Social Security numbers, any individual who is asked to disclose their Social Security number is informed what uses will be made of it.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

PT-07(01)-Examine

[SELECT FROM: Personally idenﬁable informaon processing and transparency policy and procedures; privacy noce; Privacy Act system of records; privacy noce; separate noce regarding the use of Social Security numbers; privacy plan; other relevant documents or records].

PT-07(01)-Interview

PT-07(01)-Test

[SELECT FROM: Organizaonal processes for idenfying, reviewing, and taking acon to control the unnecessary use of Social Security numbers; implementaon of an alternave to Social Security numbers as idenﬁers].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 423

NIST SP 800-53A, REV. 5

PT-07(02)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

SPECIFIC CATEGORIES OF PERSONALLY IDENTIFIABLE INFORMATION | FIRST AMENDMENT INFORMATION ASSESSMENT OBJECTIVE: Determine if: PT-07(02)

the processing of informaon describing how any individual exercises rights guaranteed by the First Amendment is prohibited unless expressly authorized by statute or by the individual or unless pernent to and within the scope of an authorized law enforcement acvity.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

PT-08

PT-07(02)-Examine

PT-07(02)-Interview

PT-07(02)-Test

[SELECT FROM: Organizaonal processes for supporng and/or implemenng personally idenﬁable informaon processing].

COMPUTER MATCHING REQUIREMENTS ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

PT-08a.

approval to conduct the matching program is obtained from the Data Integrity Board when a system or organizaon processes informaon for the purpose of conducng a matching program;

PT-08b.[01]

a computer matching agreement is developed when a system or organizaon processes informaon for the purpose of conducng a matching program;

PT-08b.[02]

a computer matching agreement is entered into when a system or organizaon processes informaon for the purpose of conducng a matching program;

PT-08c.

a matching noce is published in the Federal Register when a system or organizaon processes informaon for the purpose of conducng a matching program;

PT-08d.

the informaon produced by the matching program is independently veriﬁed before taking adverse acon against an individual, if required, when a system or organizaon processes informaon for the purpose of conducng a matching program;

PT-08e.[01]

individuals are provided with noce when a system or organizaon processes informaon for the purpose of conducng a matching program;

PT-08e.[02]

individuals are provided with an opportunity to contest the ﬁndings before adverse acon is taken against them when a system or organizaon processes informaon for the purpose of conducng a matching program.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 424

NIST SP 800-53A, REV. 5

PT-08

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

COMPUTER MATCHING REQUIREMENTS POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5 CHAPTER FOUR

PT-08-Examine

[SELECT FROM: Personally idenﬁable informaon processing and transparency policy and procedures; privacy noce; Privacy Act system of records; Federal Register noces; Data Integrity Board determinaons; contracts; informaon sharing agreements; memoranda of understanding; governing requirements; privacy plan; other relevant documents or records].

PT-08-Interview

PT-08-Test

[SELECT FROM: Organizaonal processes for supporng and/or implemenng personally idenﬁable informaon processing; matching program].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 425

NIST SP 800-53A, REV. 5

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

4.16 RISK ASSESSMENT RA-01

POLICY AND PROCEDURES ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5 CHAPTER FOUR

RA-01_ODP[01]

personnel or roles to whom the risk assessment policy is to be disseminated is/are deﬁned;

RA-01_ODP[02]

personnel or roles to whom the risk assessment procedures are to be disseminated is/are deﬁned;

RA-01_ODP[03]

one or more of the following PARAMETER VALUES is/are selected: {organizaonlevel; mission/business process-level; system-level};

RA-01_ODP[04]

an oﬃcial to manage the risk assessment policy and procedures is deﬁned;

RA-01_ODP[05]

the frequency at which the current risk assessment policy is reviewed and updated is deﬁned;

RA-01_ODP[06]

events that would require the current risk assessment policy to be reviewed and updated are deﬁned;

RA-01_ODP[07]

the frequency at which the current risk assessment procedures are reviewed and updated is deﬁned;

RA-01_ODP[08]

events that would require risk assessment procedures to be reviewed and updated are deﬁned;

RA-01a.[01]

a risk assessment policy is developed and documented;

RA-01a.[02]

the risk assessment policy is disseminated to <RA-01_ODP[01] personnel or roles>;

RA-01a.[03]

risk assessment procedures to facilitate the implementaon of the risk assessment policy and associated risk assessment controls are developed and documented;

RA-01a.[04]

the risk assessment procedures are disseminated to <RA-01_ODP[02] personnel or roles>;

RA-01a.01(a)[01]

the <RA-01_ODP[03] SELECTED PARAMETER VALUE(S)> risk assessment policy addresses purpose;

RA-01a.01(a)[02]

the <RA-01_ODP[03] SELECTED PARAMETER VALUE(S)> risk assessment policy addresses scope;

RA-01a.01(a)[03]

the <RA-01_ODP[03] SELECTED PARAMETER VALUE(S)> risk assessment policy addresses roles;

RA-01a.01(a)[04]

the <RA-01_ODP[03] SELECTED PARAMETER VALUE(S)> risk assessment policy addresses responsibilies;

RA-01a.01(a)[05]

the <RA-01_ODP[03] SELECTED PARAMETER VALUE(S)> risk assessment policy addresses management commitment;

RA-01a.01(a)[06]

the <RA-01_ODP[03] SELECTED PARAMETER VALUE(S)> risk assessment policy addresses coordinaon among organizaonal enes;

RA-01a.01(a)[07]

the <RA-01_ODP[03] SELECTED PARAMETER VALUE(S)> risk assessment policy addresses compliance;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 426

NIST SP 800-53A, REV. 5

RA-01

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

POLICY AND PROCEDURES

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

RA-01a.01(b)

the <RA-01_ODP[03] SELECTED PARAMETER VALUE(S)> risk assessment policy is consistent with applicable laws, execuve orders, direcves, regulaons, policies, standards, and guidelines;

RA-01b.

the <RA-01_ODP[04] oﬃcial> is designated to manage the development, documentaon, and disseminaon of the risk assessment policy and procedures;

RA-01c.01[01]

the current risk assessment policy is reviewed and updated <RA-01_ODP[05] frequency>;

RA-01c.01[02]

the current risk assessment policy is reviewed and updated following <RA-01_ODP[06] events>;

RA-01c.02[01]

the current risk assessment procedures are reviewed and updated <RA-01_ODP[07] frequency>;

RA-01c.02[02]

the current risk assessment procedures are reviewed and updated following <RA-01_ODP[08] events>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

RA-02

RA-01-Examine

[SELECT FROM: Risk assessment policy and procedures; system security plan; privacy plan; other relevant documents or records].

RA-01-Interview

[SELECT FROM: Organizaonal personnel with risk assessment responsibilies; organizaonal personnel with security and privacy responsibilies].

SECURITY CATEGORIZATION ASSESSMENT OBJECTIVE: Determine if: RA-02a.

the system and the informaon it processes, stores, and transmits are categorized;

RA-02b.

the security categorizaon results, including supporng raonale, are documented in the security plan for the system;

RA-02c.

the authorizing oﬃcial or authorizing oﬃcial designated representave reviews and approves the security categorizaon decision.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

RA-02-Examine

[SELECT FROM: Risk assessment policy; security planning policy and procedures; procedures addressing security categorizaon of organizaonal informaon and systems; security categorizaon documentaon; system security plan; privacy plan; other relevant documents or records].

RA-02-Interview

[SELECT FROM: Organizaonal personnel with security categorizaon and risk assessment responsibilies; organizaonal personnel with security and privacy responsibilies].

RA-02-Test

[SELECT FROM: Organizaonal processes for security categorizaon].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 427

NIST SP 800-53A, REV. 5

RA-02(01)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

SECURITY CATEGORIZATION | IMPACT-LEVEL PRIORITIZATION ASSESSMENT OBJECTIVE: Determine if: RA-02(01)

an impact-level priorizaon of organizaonal systems is conducted to obtain addional granularity on system impact levels.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

RA-03

RA-02(01)-Examine

[SELECT FROM: Risk assessment policy; security and privacy planning policy and procedures; procedures addressing security categorizaon of organizaonal informaon and systems; security categorizaon documentaon; system security plan; privacy plan; other relevant documents or records].

RA-02(01)-Interview

[SELECT FROM: Organizaonal personnel with security categorizaon and risk assessment responsibilies; organizaonal personnel with security and privacy responsibilies].

RA-02(01)-Test

[SELECT FROM: Organizaonal processes for security categorizaon].

RISK ASSESSMENT ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

RA-03_ODP[01]

one of the following PARAMETER VALUES is selected: {security and privacy plans; risk assessment report; <RA-03_ODP[02] document>};

RA-03_ODP[02]

a document in which risk assessment results are to be documented (if not documented in the security and privacy plans or risk assessment report) is deﬁned (if selected);

RA-03_ODP[03]

the frequency to review risk assessment results is deﬁned;

RA-03_ODP[04]

personnel or roles to whom risk assessment results are to be disseminated is/are deﬁned;

RA-03_ODP[05]

the frequency to update the risk assessment is deﬁned;

RA-03a.01

a risk assessment is conducted to idenfy threats to and vulnerabilies in the system;

RA-03a.02

a risk assessment is conducted to determine the likelihood and magnitude of harm from unauthorized access, use, disclosure, disrupon, modiﬁcaon, or destrucon of the system; the informaon it processes, stores, or transmits; and any related informaon;

RA-03a.03

a risk assessment is conducted to determine the likelihood and impact of adverse eﬀects on individuals arising from the processing of personally idenﬁable informaon;

RA-03b.

risk assessment results and risk management decisions from the organizaon and mission or business process perspecves are integrated with system-level risk assessments;

RA-03c.

risk assessment results are documented in <RA-03_ODP[01] SELECTED PARAMETER VALUE>;

RA-03d.

risk assessment results are reviewed <RA-03_ODP[03] frequency>;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 428

NIST SP 800-53A, REV. 5

RA-03

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

RISK ASSESSMENT RA-03e.

risk assessment results are disseminated to <RA-03_ODP[04] personnel or roles>;

RA-03f.

the risk assessment is updated <RA-03_ODP[05] frequency> or when there are signiﬁcant changes to the system, its environment of operaon, or other condions that may impact the security or privacy state of the system.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

RA-03(01)

RA-03-Examine

[SELECT FROM: Risk assessment policy; risk assessment procedures; security and privacy planning policy and procedures; procedures addressing organizaonal assessments of risk; risk assessment; risk assessment results; risk assessment reviews; risk assessment updates; system security plan; privacy plan; other relevant documents or records].

RA-03-Interview

[SELECT FROM: Organizaonal personnel with risk assessment responsibilies; organizaonal personnel with security and privacy responsibilies].

RA-03-Test

[SELECT FROM: Organizaonal processes for risk assessment; mechanisms supporng and/or conducng, documenng, reviewing, disseminang, and updang the risk assessment].

RISK ASSESSMENT | SUPPLY CHAIN RISK ASSESSMENT ASSESSMENT OBJECTIVE: Determine if:

RA-03(01)_ODP[01]

systems, system components, and system services to assess supply chain risks are deﬁned;

RA-03(01)_ODP[02]

the frequency at which to update the supply chain risk assessment is deﬁned;

RA-03(01)(a)

supply chain risks associated with <RA-03(01)_ODP[01] systems, system components, and system services> are assessed;

RA-03(01)(b)

the supply chain risk assessment is updated <RA-03(01)_ODP[02] frequency> , when there are signiﬁcant changes to the relevant supply chain, or when changes to the system, environments of operaon, or other condions may necessitate a change in the supply chain.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

RA-03(01)-Examine

[SELECT FROM: Supply chain risk management policy; inventory of crical systems, system components, and system services; risk assessment policy; security planning policy and procedures; procedures addressing organizaonal assessments of supply chain risk; risk assessment; risk assessment results; risk assessment reviews; risk assessment updates; acquision policy; system security plan; supply chain risk management plan; other relevant documents or records].

RA-03(01)-Interview

[SELECT FROM: Organizaonal personnel with risk assessment responsibilies; organizaonal personnel with security responsibilies; organizaonal personnel with supply chain risk management responsibilies].

RA-03(01)-Test

[SELECT FROM: Organizaonal processes for risk assessment; mechanisms supporng and/or conducng, documenng, reviewing, disseminang, and updang the supply chain risk assessment].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 429

NIST SP 800-53A, REV. 5

RA-03(02)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

RISK ASSESSMENT | USE OF ALL-SOURCE INTELLIGENCE ASSESSMENT OBJECTIVE: Determine if: RA-03(02)

all-source intelligence is used to assist in the analysis of risk.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

RA-03(03)

RA-03(02)-Examine

[SELECT FROM: Risk assessment policy; security planning policy and procedures; procedures addressing organizaonal assessments of risk; risk assessment; risk assessment results; risk assessment reviews; risk assessment updates; risk intelligence reports; system security plan; other relevant documents or records].

RA-03(02)-Interview

[SELECT FROM: Organizaonal personnel with risk assessment responsibilies; organizaonal personnel with security responsibilies].

RA-03(02)-Test

[SELECT FROM: Organizaonal processes for risk assessment; mechanisms supporng and/or conducng, documenng, reviewing, disseminang, and updang the risk assessment].

RISK ASSESSMENT | DYNAMIC THREAT AWARENESS ASSESSMENT OBJECTIVE: Determine if:

RA-03(03)_ODP

means to determine the current cyber threat environment on an ongoing basis;

RA-03(03)

the current cyber threat environment is determined on an ongoing basis using <RA-03(03)_ODP means>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

RA-03(04)

RA-03(03)-Examine

[SELECT FROM: Risk assessment policy; security planning policy and procedures; procedures addressing organizaonal assessments of risk; risk assessment; risk assessment results; risk assessment reviews; risk assessment updates; risk reports; system security plan; other relevant documents or records].

RA-03(03)-Interview

[SELECT FROM: Organizaonal personnel with risk assessment responsibilies; organizaonal personnel with security responsibilies].

RA-03(03)-Test

[SELECT FROM: Organizaonal processes for risk assessment; mechanisms supporng and/or conducng, documenng, reviewing, disseminang, and updang the risk assessment].

RISK ASSESSMENT | PREDICTIVE CYBER ANALYTICS ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

RA-03(04)_ODP[01]

advanced automaon capabilies to predict and idenfy risks are deﬁned;

RA-03(04)_ODP[02]

systems or system components where advanced automaon and analycs capabilies are to be employed are deﬁned;

RA-03(04)_ODP[03]

advanced analycs capabilies to predict and idenfy risks are deﬁned;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 430

NIST SP 800-53A, REV. 5

RA-03(04)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

RISK ASSESSMENT | PREDICTIVE CYBER ANALYTICS RA-03(04)[01]

<RA-03(04)_ODP[01] advanced automaon capabilies> are employed to predict and idenfy risks to <RA-03(04)_ODP[02] systems or system components>;

RA-03(04)[02]

<RA-03(04)_ODP[03] advanced analycs capabilies> are employed to predict and idenfy risks to <RA-03(04)_ODP[02] systems or system components>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

RA-04

RA-03(04)-Examine

[SELECT FROM: Risk assessment policy; security planning policy and procedures; procedures addressing organizaonal assessments of risk; risk assessment; risk assessment results; risk assessment reviews; risk assessment updates; risk reports; system security plan; other relevant documents or records].

RA-03(04)-Interview

[SELECT FROM: Organizaonal personnel with risk assessment responsibilies; organizaonal personnel with security responsibilies].

RA-03(04)-Test

[SELECT FROM: Organizaonal processes for risk assessment; mechanisms supporng and/or conducng, documenng, reviewing, disseminang, and updang the risk assessment].

RISK ASSESSMENT UPDATE [WITHDRAWN: Incorporated into RA-03.]

RA-05

VULNERABILITY MONITORING AND SCANNING ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

RA-05_ODP[01]

frequency for monitoring systems and hosted applicaons for vulnerabilies is deﬁned;

RA-05_ODP[02]

frequency for scanning systems and hosted applicaons for vulnerabilies is deﬁned;

RA-05_ODP[03]

response mes to remediate legimate vulnerabilies in accordance with an organizaonal assessment of risk are deﬁned;

RA-05_ODP[04]

personnel or roles with whom informaon obtained from the vulnerability scanning process and control assessments is to be shared;

RA-05a.[01]

systems and hosted applicaons are monitored for vulnerabilies <RA-05_ODP[01] frequency and/or randomly in accordance with organizaon-deﬁned process> and when new vulnerabilies potenally aﬀecng the system are idenﬁed and reported;

RA-05a.[02]

systems and hosted applicaons are scanned for vulnerabilies <RA-05_ODP[02] frequency and/or randomly in accordance with organizaon-deﬁned process> and when new vulnerabilies potenally aﬀecng the system are idenﬁed and reported;

RA-05b.

vulnerability monitoring tools and techniques are employed to facilitate interoperability among tools;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 431

NIST SP 800-53A, REV. 5

RA-05

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

VULNERABILITY MONITORING AND SCANNING

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

RA-05b.01

vulnerability monitoring tools and techniques are employed to automate parts of the vulnerability management process by using standards for enumerang plaorms, soware ﬂaws, and improper conﬁguraons;

RA-05b.02

vulnerability monitoring tools and techniques are employed to facilitate interoperability among tools and to automate parts of the vulnerability management process by using standards for formang checklists and test procedures;

RA-05b.03

RA-05c.

vulnerability scan reports and results from vulnerability monitoring are analyzed;

RA-05d.

legimate vulnerabilies are remediated <RA-05_ODP[03] response mes> in accordance with an organizaonal assessment of risk;

RA-05e.

informaon obtained from the vulnerability monitoring process and control assessments is shared with <RA-05_ODP[04] personnel or roles> to help eliminate similar vulnerabilies in other systems;

RA-05f.

vulnerability monitoring tools that include the capability to readily update the vulnerabilies to be scanned are employed.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

RA-05(01)

RA-05-Examine

[SELECT FROM: Risk assessment policy; procedures addressing vulnerability scanning; risk assessment; assessment report; vulnerability scanning tools and associated conﬁguraon documentaon; vulnerability scanning results; patch and vulnerability management records; system security plan; other relevant documents or records].

RA-05-Interview

[SELECT FROM: Organizaonal personnel with risk assessment, control assessment, and vulnerability scanning responsibilies; organizaonal personnel with vulnerability scan analysis responsibilies; organizaonal personnel with vulnerability remediaon responsibilies; organizaonal personnel with security responsibilies; system/network administrators].

RA-05-Test

[SELECT FROM: Organizaonal processes for vulnerability scanning, analysis, remediaon, and informaon sharing; mechanisms supporng and/or implemenng vulnerability scanning, analysis, remediaon, and informaon sharing].

VULNERABILITY MONITORING AND SCANNING | UPDATE TOOL CAPABILITY [WITHDRAWN: Incorporated into RA-05.]

CHAPTER FOUR

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 432

NIST SP 800-53A, REV. 5

RA-05(02)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

VULNERABILITY MONITORING AND SCANNING | UPDATE VULNERABILITIES TO BE SCANNED ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

RA-05(02)_ODP[01]

one or more of the following PARAMETER VALUES is/are selected: {<RA-05(02)_ODP[02] frequency>; prior to a new scan; when new vulnerabilies are idenﬁed and reported};

RA-05(02)_ODP[02]

the frequency for updang the system vulnerabilies to be scanned is deﬁned (if selected);

RA-05(02)

the system vulnerabilies to be scanned are updated <RA-05(02)_ODP[01] SELECTED PARAMETER VALUE(S)>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

RA-05(03)

RA-05(02)-Examine

[SELECT FROM: Procedures addressing vulnerability scanning; assessment report; vulnerability scanning tools and associated conﬁguraon documentaon; vulnerability scanning results; patch and vulnerability management records; system security plan; other relevant documents or records].

RA-05(02)-Interview

[SELECT FROM: Organizaonal personnel with vulnerability scanning responsibilies; organizaonal personnel with vulnerability scan analysis responsibilies; organizaonal personnel with security responsibilies; system/ network administrators].

RA-05(02)-Test

[SELECT FROM: Organizaonal processes for vulnerability scanning; mechanisms/ tools supporng and/or implemenng vulnerability scanning].

VULNERABILITY MONITORING AND SCANNING | BREADTH AND DEPTH OF COVERAGE ASSESSMENT OBJECTIVE: Determine if: RA-05(03)

the breadth and depth of vulnerability scanning coverage are deﬁned.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

RA-05(03)-Examine

RA-05(03)-Interview

RA-05(03)-Test

[SELECT FROM: Organizaonal processes for vulnerability scanning; mechanisms/ tools supporng and/or implemenng vulnerability scanning].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 433

NIST SP 800-53A, REV. 5

RA-05(04)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

VULNERABILITY MONITORING AND SCANNING | DISCOVERABLE INFORMATION ASSESSMENT OBJECTIVE: Determine if:

RA-05(04)_ODP

correcve acons to be taken if informaon about the system is discoverable are deﬁned;

RA-05(04)[01]

informaon about the system is discoverable;

RA-05(04)[02]

<RA-05(04)_ODP correcve acons> are taken when informaon about the system is conﬁrmed as discoverable.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

RA-05(05)

RA-05(04)-Examine

[SELECT FROM: Procedures addressing vulnerability scanning; assessment report; penetraon test results; vulnerability scanning results; risk assessment report; records of correcve acons taken; incident response records; audit records; system security plan; other relevant documents or records].

RA-05(04)-Interview

[SELECT FROM: Organizaonal personnel with vulnerability scanning and/or penetraon tesng responsibilies; organizaonal personnel with vulnerability scan analysis responsibilies; organizaonal personnel responsible for risk response; organizaonal personnel responsible for incident management and response; organizaonal personnel with security responsibilies].

RA-05(04)-Test

[SELECT FROM: Organizaonal processes for vulnerability scanning; organizaonal processes for risk response; organizaonal processes for incident management and response; mechanisms/tools supporng and/or implemenng vulnerability scanning; mechanisms supporng and/or implemenng risk response; mechanisms supporng and/or implemenng incident management and response].

VULNERABILITY MONITORING AND SCANNING | PRIVILEGED ACCESS ASSESSMENT OBJECTIVE: Determine if:

RA-05(05)_ODP[01]

system components to which privileged access is authorized for selected vulnerability scanning acvies are deﬁned;

RA-05(05)_ODP[02]

vulnerability scanning acvies selected for privileged access authorizaon to system components are deﬁned;

RA-05(05)

privileged access authorizaon is implemented to <RA-05(05)_ODP[01] system components> for <RA-05(05)_ODP[02] vulnerability scanning acvies>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

RA-05(05)-Examine

[SELECT FROM: Risk assessment policy; procedures addressing vulnerability scanning; system design documentaon; system conﬁguraon sengs and associated documentaon; list of system components for vulnerability scanning; personnel access authorizaon list; authorizaon credenals; access authorizaon records; system security plan; other relevant documents or records].

RA-05(05)-Interview

[SELECT FROM: Organizaonal personnel with vulnerability scanning responsibilies; system/network administrators; organizaonal personnel responsible for access control to the system; organizaonal personnel responsible for conﬁguraon management of the system; system developers; organizaonal personnel with security responsibilies].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 434

NIST SP 800-53A, REV. 5

RA-05(05)

VULNERABILITY MONITORING AND SCANNING | PRIVILEGED ACCESS RA-05(05)-Test

RA-05(06)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

[SELECT FROM: Organizaonal processes for vulnerability scanning; organizaonal processes for access control; mechanisms supporng and/or implemenng access control; mechanisms/tools supporng and/or implemenng vulnerability scanning].

VULNERABILITY MONITORING AND SCANNING | AUTOMATED TREND ANALYSES ASSESSMENT OBJECTIVE:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

Determine if:

RA-05(06)_ODP

automated mechanisms to compare the results of mulple vulnerability scans are deﬁned;

RA-05(06)

the results of mulple vulnerability scans are compared using <RA-05(06)_ODP automated mechanisms>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

RA-05(07)

RA-05(06)-Examine

[SELECT FROM: Risk assessment policy; procedures addressing vulnerability scanning; system design documentaon; vulnerability scanning tools and techniques documentaon; vulnerability scanning results; system security plan; other relevant documents or records].

RA-05(06)-Interview

RA-05(06)-Test

[SELECT FROM: Organizaonal processes for vulnerability scanning; automated mechanisms/tools supporng and/or implemenng vulnerability scanning; automated mechanisms supporng and/or implemenng trend analysis of vulnerability scan results].

VULNERABILITY MONITORING AND SCANNING | AUTOMATED DETECTION AND NOTIFICATION OF UNAUTHORIZED COMPONENTS [WITHDRAWN: Incorporated into CM-08.]

RA-05(08)

VULNERABILITY MONITORING AND SCANNING | REVIEW HISTORIC AUDIT LOGS ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

RA-05(08)_ODP[01]

a system whose historic audit logs are to be reviewed is deﬁned;

RA-05(08)_ODP[02]

a me period for a potenal previous exploit of a system is deﬁned;

RA-05(08)

historic audit logs are reviewed to determine if a vulnerability idenﬁed in a <RA-05(08)_ODP[01] system> has been previously exploited within <RA-05(08)_ODP[02] me period>.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 435

NIST SP 800-53A, REV. 5

RA-05(08)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

VULNERABILITY MONITORING AND SCANNING | REVIEW HISTORIC AUDIT LOGS POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

RA-05(09)

RA-05(08)-Examine

[SELECT FROM: Risk assessment policy; procedures addressing vulnerability scanning; audit logs; records of audit log reviews; vulnerability scanning results; patch and vulnerability management records; system security plan; other relevant documents or records].

RA-05(08)-Interview

[SELECT FROM: Organizaonal personnel with vulnerability scanning responsibilies; organizaonal personnel with vulnerability scan analysis responsibilies; organizaonal personnel with audit record review responsibilies; system/network administrators; organizaonal personnel with security responsibilies].

RA-05(08)-Test

[SELECT FROM: Organizaonal processes for vulnerability scanning; organizaonal process for audit record review and response; mechanisms/tools supporng and/or implemenng vulnerability scanning; mechanisms supporng and/or implemenng audit record review].

VULNERABILITY MONITORING AND SCANNING | PENETRATION TESTING AND ANALYSES [WITHDRAWN: Incorporated into CA-08.]

RA-05(10)

VULNERABILITY MONITORING AND SCANNING | CORRELATE SCANNING INFORMATION ASSESSMENT OBJECTIVE: Determine if: RA-05(10)

the output from vulnerability scanning tools is correlated to determine the presence of mul-vulnerability and mul-hop aack vectors.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

RA-05(10)-Examine

[SELECT FROM: Risk assessment policy; procedures addressing vulnerability scanning; risk assessment; vulnerability scanning tools and techniques documentaon; vulnerability scanning results; vulnerability management records; audit records; event/vulnerability correlaon logs; system security plan; other relevant documents or records].

RA-05(10)-Interview

RA-05(10)-Test

[SELECT FROM: Organizaonal processes for vulnerability scanning; mechanisms/ tools supporng and/or implemenng vulnerability scanning; mechanisms implemenng the correlaon of vulnerability scan results].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 436

NIST SP 800-53A, REV. 5

RA-05(11)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

VULNERABILITY MONITORING AND SCANNING | PUBLIC DISCLOSURE PROGRAM ASSESSMENT OBJECTIVE: Determine if: RA-05(11)

a public reporng channel is established for receiving reports of vulnerabilies in organizaonal systems and system components.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

RA-06

RA-05(11)-Examine

[SELECT FROM: Risk assessment policy; procedures addressing vulnerability scanning; risk assessment; vulnerability scanning tools and techniques documentaon; vulnerability scanning results; vulnerability management records; audit records; public reporng channel; system security plan; other relevant documents or records].

RA-05(11)-Interview

RA-05(11)-Test

[SELECT FROM: Organizaonal processes for vulnerability scanning; mechanisms/ tools supporng and/or implemenng vulnerability scanning; mechanisms implemenng the public reporng of vulnerabilies].

TECHNICAL SURVEILLANCE COUNTERMEASURES SURVEY ASSESSMENT OBJECTIVE: Determine if:

RA-06_ODP[01]

locaons to employ technical surveillance countermeasure surveys are deﬁned;

RA-06_ODP[02]

one or more of the following PARAMETER VALUES is/are selected: {<RA-06_ODP[03] frequency>; when <RA-06_ODP[04] events or indicators>};

RA-06_ODP[03]

the frequency at which to employ technical surveillance countermeasure surveys is deﬁned (if selected);

RA-06_ODP[04]

events or indicators which, if they occur, trigger a technical surveillance countermeasures survey are deﬁned (if selected);

RA-06

a technical surveillance countermeasures survey is employed at <RA-06_ODP[01] locaons> <RA-06_ODP[02] SELECTED PARAMETER VALUE(S)>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

RA-06-Examine

[SELECT FROM: Risk assessment policy; procedures addressing technical surveillance countermeasures surveys; audit records/event logs; system security plan; other relevant documents or records].

RA-06-Interview

[SELECT FROM: Organizaonal personnel with technical surveillance countermeasures surveys responsibilies; system/network administrators; organizaonal personnel with security responsibilies].

RA-06-Test

[SELECT FROM: Organizaonal processes for technical surveillance countermeasures surveys; mechanisms/tools supporng and/or implemenng technical surveillance countermeasure surveys].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 437

NIST SP 800-53A, REV. 5

RA-07

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

RISK RESPONSE ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

RA-07[01]

ﬁndings from security assessments are responded to in accordance with organizaonal risk tolerance;

RA-07[02]

ﬁndings from privacy assessments are responded to in accordance with organizaonal risk tolerance;

RA-07[03]

ﬁndings from monitoring are responded to in accordance with organizaonal risk tolerance;

RA-07[04]

ﬁndings from audits are responded to in accordance with organizaonal risk tolerance.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

RA-08

RA-07-Examine

[SELECT FROM: Risk assessment policy; assessment reports; audit records/event logs; system security plan; privacy plan; other relevant documents or records].

RA-07-Interview

[SELECT FROM: Organizaonal personnel with assessment and auding responsibilies; system/network administrators; organizaonal personnel with security and privacy responsibilies].

RA-07-Test

[SELECT FROM: Organizaonal processes for assessments and audits; mechanisms/ tools supporng and/or implemenng assessments and auding].

PRIVACY IMPACT ASSESSMENTS ASSESSMENT OBJECTIVE: Determine if: RA-08a.

privacy impact assessments are conducted for systems, programs, or other acvies before developing or procuring informaon technology that processes personally idenﬁable informaon;

RA-08b.[01]

privacy impact assessments are conducted for systems, programs, or other acvies before iniang a collecon of personally idenﬁable informaon that will be processed using informaon technology;

RA-08b.[02]

privacy impact assessments are conducted for systems, programs, or other acvies before iniang a collecon of personally idenﬁable informaon that includes personally idenﬁable informaon perming the physical or virtual (online) contacng of a speciﬁc individual, if idencal quesons have been posed to, or idencal reporng requirements imposed on, ten or more individuals, other than agencies, instrumentalies, or employees of the federal government.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

RA-08-Examine

[SELECT FROM: Risk assessment policy; security and privacy risk assessment reports; acquisions documents; system security plan; privacy plan; other relevant documents or records].

RA-08-Interview

[SELECT FROM: Organizaonal personnel with assessment and auding responsibilies; system/network administrators; system developers; program managers; legal counsel; organizaonal personnel with security and privacy responsibilies].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 438

NIST SP 800-53A, REV. 5

RA-08

PRIVACY IMPACT ASSESSMENTS RA-08-Test

RA-09

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

[SELECT FROM: Organizaonal processes for assessments and audits; mechanisms/ tools supporng and/or implemenng assessments and auding].

CRITICALITY ANALYSIS ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

RA-09_ODP[01]

systems, system components, or system services to be analyzed for cricality are deﬁned;

RA-09_ODP[02]

decision points in the system development life cycle when a cricality analysis is to be performed are deﬁned;

RA-09

crical system components and funcons are idenﬁed by performing a cricality analysis for <RA-09_ODP[01] systems, system components, or system services> at <RA-09_ODP[02] decision points in the system development life cycle>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

RA-10

RA-09-Examine

[SELECT FROM: Risk assessment policy; assessment reports; cricality analysis/ ﬁnalized cricality for each component/subcomponent; audit records/event logs; analysis reports; system security plan; other relevant documents or records].

RA-09-Interview

[SELECT FROM: Organizaonal personnel with assessment and auding responsibilies; organizaonal personnel with cricality analysis responsibilies; system/network administrators; organizaonal personnel with security responsibilies].

RA-09-Test

[SELECT FROM: Organizaonal processes for assessments and audits; mechanisms/ tools supporng and/or implemenng assessments and auding].

THREAT HUNTING ASSESSMENT OBJECTIVE: Determine if: RA-10_ODP

the frequency at which to employ the threat hunng capability is deﬁned;

RA-10a.01

a cyber threat capability is established and maintained to search for indicators of compromise in organizaonal systems;

RA-10a.02

a cyber threat capability is established and maintained to detect, track, and disrupt threats that evade exisng controls;

RA-10b.

the threat hunng capability is employed <RA-10_ODP frequency>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: RA-10-Examine

CHAPTER FOUR

[SELECT FROM: Risk assessment policy; assessment reports; audit records/event logs; threat hunng capability; system security plan; other relevant documents or records].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 439

NIST SP 800-53A, REV. 5

RA-10

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

THREAT HUNTING RA-10-Interview

[SELECT FROM: Organizaonal personnel with threat hunng responsibilies; system/network administrators; organizaonal personnel with security responsibilies].

RA-10-Test

[SELECT FROM: Organizaonal processes for assessments and audits; mechanisms/ tools supporng and/or implemenng threat hunng capabilies].

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5 CHAPTER FOUR

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 440

NIST SP 800-53A, REV. 5

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

4.17 SYSTEM AND SERVICES ACQUISITION SA-01

POLICY AND PROCEDURES ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5 CHAPTER FOUR

SA-01_ODP[01]

personnel or roles to whom the system and services acquision policy is to be disseminated is/are deﬁned;

SA-01_ODP[02]

personnel or roles to whom the system and services acquision procedures are to be disseminated is/are deﬁned;

SA-01_ODP[03]

one or more of the following PARAMETER VALUES is/are selected: {organizaonlevel; mission/business process-level; system-level};

SA-01_ODP[04]

an oﬃcial to manage the system and services acquision policy and procedures is deﬁned;

SA-01_ODP[05]

the frequency at which the current system and services acquision policy is reviewed and updated is deﬁned;

SA-01_ODP[06]

events that would require the current system and services acquision policy to be reviewed and updated are deﬁned;

SA-01_ODP[07]

the frequency at which the current system and services acquision procedures are reviewed and updated is deﬁned;

SA-01_ODP[08]

events that would require the system and services acquision procedures to be reviewed and updated are deﬁned;

SA-01a.[01]

a system and services acquision policy is developed and documented;

SA-01a.[02]

the system and services acquision policy is disseminated to <SA-01_ODP[01] personnel or roles>;

SA-01a.[03]

system and services acquision procedures to facilitate the implementaon of the system and services acquision policy and associated system and services acquision controls are developed and documented;

SA-01a.[04]

the system and services acquision procedures are disseminated to <SA-01_ODP[02] personnel or roles>;

SA-01a.01(a)[01]

the <SA-01_ODP[03] SELECTED PARAMETER VALUE(S)> system and services acquision policy addresses purpose;

SA-01a.01(a)[02]

the <SA-01_ODP[03] SELECTED PARAMETER VALUE(S)> system and services acquision policy addresses scope;

SA-01a.01(a)[03]

the <SA-01_ODP[03] SELECTED PARAMETER VALUE(S)> system and services acquision policy addresses roles;

SA-01a.01(a)[04]

the <SA-01_ODP[03] SELECTED PARAMETER VALUE(S)> system and services acquision policy addresses responsibilies;

SA-01a.01(a)[05]

the <SA-01_ODP[03] SELECTED PARAMETER VALUE(S)> system and services acquision policy addresses management commitment;

SA-01a.01(a)[06]

the <SA-01_ODP[03] SELECTED PARAMETER VALUE(S)> system and services acquision policy addresses coordinaon among organizaonal enes;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 441

NIST SP 800-53A, REV. 5

SA-01

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

POLICY AND PROCEDURES

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SA-01a.01(a)[07]

the <SA-01_ODP[03] SELECTED PARAMETER VALUE(S)> system and services acquision policy addresses compliance;

SA-01a.01(b)

the <SA-01_ODP[03] SELECTED PARAMETER VALUE(S)> system and services acquision policy is consistent with applicable laws, Execuve Orders, direcves, regulaons, policies, standards, and guidelines;

SA-01b.

the <SA-01_ODP[04] oﬃcial> is designated to manage the development, documentaon, and disseminaon of the system and services acquision policy and procedures;

SA-01c.01[01]

the system and services acquision policy is reviewed and updated <SA-01_ODP[05] frequency>;

SA-01c.01[02]

the current system and services acquision policy is reviewed and updated following <SA-01_ODP[06] events>;

SA-01c.02[01]

the current system and services acquision procedures are reviewed and updated <SA-01_ODP[07] frequency>;

SA-01c.02[02]

the current system and services acquision procedures are reviewed and updated following <SA-01_ODP[08] events>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SA-02

SA-01-Examine

[SELECT FROM: System and services acquision policy; system and services acquision procedures; supply chain risk management policy; supply chain risk management procedures; supply chain risk management plan; system security plan; privacy plan; other relevant documents or records].

SA-01-Interview

[SELECT FROM: Organizaonal personnel with system and services acquision responsibilies; organizaonal personnel with informaon security and privacy responsibilies; organizaonal personnel with supply chain risk management responsibilies].

ALLOCATION OF RESOURCES ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

SA-02a.[01]

the high-level informaon security requirements for the system or system service are determined in mission and business process planning;

SA-02a.[02]

the high-level privacy requirements for the system or system service are determined in mission and business process planning;

SA-02b.[01]

the resources required to protect the system or system service are determined and documented as part of the organizaonal capital planning and investment control process;

SA-02b.[02]

the resources required to protect the system or system service are allocated as part of the organizaonal capital planning and investment control process;

SA-02c.[01]

a discrete line item for informaon security is established in organizaonal programming and budgeng documentaon;

SA-02c.[02]

a discrete line item for privacy is established in organizaonal programming and budgeng documentaon.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 442

NIST SP 800-53A, REV. 5

SA-02

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

ALLOCATION OF RESOURCES POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SA-03

SA-02-Examine

[SELECT FROM: System and services acquision policy; system and services acquision procedures; system and services acquision strategy and plans; procedures addressing the allocaon of resources to informaon security and privacy requirements; procedures addressing capital planning and investment control; organizaonal programming and budgeng documentaon; system security plan; privacy plan; supply chain risk management policy; other relevant documents or records].

SA-02-Interview

[SELECT FROM: Organizaonal personnel with capital planning, investment control, organizaonal programming, and budgeng responsibilies; organizaonal personnel with informaon security and privacy responsibilies; organizaonal personnel with supply chain risk management responsibilies].

SA-02-Test

[SELECT FROM: Organizaonal processes for determining informaon security and privacy requirements; organizaonal processes for capital planning, programming, and budgeng; mechanisms supporng and/or implemenng organizaonal capital planning, programming, and budgeng].

SYSTEM DEVELOPMENT LIFE CYCLE ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

SA-03_ODP

system development life cycle is deﬁned;

SA-03a.[01]

the system is acquired, developed, and managed using <SA-03_ODP systemdevelopment life cycle> that incorporates informaon security consideraons;

SA-03a.[02]

the system is acquired, developed, and managed using <SA-03_ODP systemdevelopment life cycle> that incorporates privacy consideraons;

SA-03b.[01]

informaon security roles and responsibilies are deﬁned and documented throughout the system development life cycle;

SA-03b.[02]

privacy roles and responsibilies are deﬁned and documented throughout the system development life cycle;

SA-03c.[01]

individuals with informaon security roles and responsibilies are idenﬁed;

SA-03c.[02]

individuals with privacy roles and responsibilies are idenﬁed;

SA-03d.[01]

organizaonal informaon security risk management processes are integrated into system development life cycle acvies;

SA-03d.[02]

organizaonal privacy risk management processes are integrated into system development life cycle acvies.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 443

NIST SP 800-53A, REV. 5

SA-03

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

SYSTEM DEVELOPMENT LIFE CYCLE POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SA-03(01)

SA-03-Examine

[SELECT FROM: System and services acquision policy; system and services acquision procedures; procedures addressing the integraon of informaon security and privacy and supply chain risk management into the system development life cycle process; system development life cycle documentaon; organizaonal risk management strategy; informaon security and privacy risk management strategy documentaon; system security plan; privacy plan; privacy program plan; enterprise architecture documentaon; role-based security and privacy training program documentaon; data mapping documentaon; other relevant documents or records].

SA-03-Interview

[SELECT FROM: Organizaonal personnel with informaon security and privacy responsibilies; organizaonal personnel with system life cycle development responsibilies; organizaonal personnel with supply chain risk management responsibilies].

SA-03-Test

[SELECT FROM: Organizaonal processes for deﬁning and documenng the system development life cycle; organizaonal processes for idenfying system development life cycle roles and responsibilies; organizaonal processes for integrang informaon security and privacy and supply chain risk management into the system development life cycle; mechanisms supporng and/or implemenng the system development life cycle].

SYSTEM DEVELOPMENT LIFE CYCLE | MANAGE PREPRODUCTION ENVIRONMENT ASSESSMENT OBJECTIVE: Determine if: SA-03(01)

system pre-producon environments are protected commensurate with risk throughout the system development life cycle for the system, system component, or system service.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

SA-03(01)-Examine

[SELECT FROM: System and services acquision policy; procedures addressing the integraon of security and supply chain risk management into the system development life cycle process; system development life cycle documentaon; procedures addressing program protecon planning; cricality analysis results; security and supply chain risk management strategy/program documentaon; system security plan; supply chain risk management plan; other relevant documents or records].

SA-03(01)-Interview

[SELECT FROM: Organizaonal personnel with security and system life cycle development responsibilies; organizaonal personnel with informaon security responsibilies].

SA-03(01)-Test

[SELECT FROM: Organizaonal processes for deﬁning and documenng the system development life cycle; organizaonal processes for idenfying system development life cycle roles and responsibilies; organizaonal process for integrang security risk management into the system development life cycle; mechanisms supporng and/or implemenng the system development life cycle].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 444

NIST SP 800-53A, REV. 5

SA-03(02)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

SYSTEM DEVELOPMENT LIFE CYCLE | USE OF LIVE OR OPERATIONAL DATA ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SA-03(02)a.[01]

the use of live data in pre-producon environments is approved for the system, system component, or system service;

SA-03(02)a.[02]

the use of live data in pre-producon environments is documented for the system, system component, or system service;

SA-03(02)a.[03]

the use of live data in pre-producon environments is controlled for the system, system component, or system service;

SA-03(02)b.

pre-producon environments for the system, system component, or system service are protected at the same impact or classiﬁcaon level as any live data in use within the pre-producon environments.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SA-03(03)

SA-03(02)-Examine

[SELECT FROM: System and services acquision policy; system and services acquision procedures; procedures addressing the integraon of security and privacy into the system development life cycle process; system development life cycle documentaon; security risk assessment documentaon; privacy impact assessment; privacy risk assessment documentaon; system security plan; privacy plan; data mapping documentaon; personally idenﬁable informaon processing policy; procedures addressing the authority to test with personally idenﬁable informaon; procedures addressing the minimizaon of personally idenﬁable informaon used in tesng, training, and research; other relevant documents or records].

SA-03(02)-Interview

[SELECT FROM: Organizaonal personnel with informaon security and privacy responsibility; organizaonal personnel with system life cycle development responsibilies].

SA-03(02)-Test

[SELECT FROM: Organizaonal processes the use of live data in pre-producon environments; mechanisms for protecng live data in pre-producon environments].

SYSTEM DEVELOPMENT LIFE CYCLE | TECHNOLOGY REFRESH ASSESSMENT OBJECTIVE: Determine if:

SA-03(03)[01]

a technology refresh schedule is planned for the system throughout the system development life cycle;

SA-03(03)[02]

a technology refresh schedule is implemented for the system throughout the system development life cycle.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: SA-03(03)-Examine

CHAPTER FOUR

[SELECT FROM: System and services acquision policy; system and services acquision procedures; procedures addressing technology refresh planning and implementaon; system development life cycle documentaon; technology refresh schedule; security risk assessment documentaon; privacy impact assessment; privacy risk assessment documentaon; system security plan; privacy plan; other relevant documents or records].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 445

NIST SP 800-53A, REV. 5

SA-03(03)

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SA-04

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

SYSTEM DEVELOPMENT LIFE CYCLE | TECHNOLOGY REFRESH SA-03(03)-Interview

[SELECT FROM: Organizaonal personnel with informaon security and privacy responsibilies; organizaonal personnel with system life cycle development responsibilies].

SA-03(03)-Test

[SELECT FROM: Organizaonal processes for deﬁning and documenng the system development life cycle; organizaonal processes for idenfying system development life cycle roles and responsibilies; organizaonal processes for integrang security and privacy risk management into the system development life cycle; mechanisms supporng and/or implemenng the system development life cycle].

ACQUISITION PROCESS ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

SA-04_ODP[01]

one or more of the following PARAMETER VALUES is/are selected: {standardized contract language; <SA-04_ODP[02] contract language>};

SA-04_ODP[02]

contract language is deﬁned (if selected);

SA-04a.[01]

security funconal requirements, descripons, and criteria are included explicitly or by reference using <SA-04_ODP[01] SELECTED PARAMETER VALUE(S)> in the acquision contract for the system, system component, or system service;

SA-04a.[02]

privacy funconal requirements, descripons, and criteria are included explicitly or by reference using <SA-04_ODP[01] SELECTED PARAMETER VALUE(S)> in the acquision contract for the system, system component, or system service;

SA-04b.

strength of mechanism requirements, descripons, and criteria are included explicitly or by reference using <SA-04_ODP[01] SELECTED PARAMETER VALUE(S)> in the acquision contract for the system, system component, or system service;

SA-04c.[01]

security assurance requirements, descripons, and criteria are included explicitly or by reference using <SA-04_ODP[01] SELECTED PARAMETER VALUE(S)> in the acquision contract for the system, system component, or system service;

SA-04c.[02]

privacy assurance requirements, descripons, and criteria are included explicitly or by reference using <SA-04_ODP[01] SELECTED PARAMETER VALUE(S)> in the acquision contract for the system, system component, or system service;

SA-04d.[01]

controls needed to sasfy the security requirements, descripons, and criteria are included explicitly or by reference using <SA-04_ODP[01] SELECTED PARAMETER VALUE(S)> in the acquision contract for the system, system component, or system service;

SA-04d.[02]

controls needed to sasfy the privacy requirements, descripons, and criteria are included explicitly or by reference using <SA-04_ODP[01] SELECTED PARAMETER VALUE(S)> in the acquision contract for the system, system component, or system service;

SA-04e.[01]

security documentaon requirements, descripons, and criteria are included explicitly or by reference using <SA-04_ODP[01] SELECTED PARAMETER VALUE(S)> in the acquision contract for the system, system component, or system service;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 446

NIST SP 800-53A, REV. 5

SA-04

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

ACQUISITION PROCESS

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SA-04e.[02]

privacy documentaon requirements, descripons, and criteria are included explicitly or by reference using <SA-04_ODP[01] SELECTED PARAMETER VALUE(S)> in the acquision contract for the system, system component, or system service;

SA-04f.[01]

requirements for protecng security documentaon, descripons, and criteria are included explicitly or by reference using <SA-04_ODP[01] SELECTED PARAMETER VALUE(S)> in the acquision contract for the system, system component, or system service;

SA-04f.[02]

requirements for protecng privacy documentaon, descripons, and criteria are included explicitly or by reference using <SA-04_ODP[01] SELECTED PARAMETER VALUE(S)> in the acquision contract for the system, system component, or system service;

SA-04g.

the descripon of the system development environment and environment in which the system is intended to operate, requirements, and criteria are included explicitly or by reference using <SA-04_ODP[01] SELECTED PARAMETER VALUE(S)> in the acquision contract for the system, system component, or system service;

SA-04h.[01]

the allocaon of responsibility or idenﬁcaon of pares responsible for informaon security requirements, descripons, and criteria are included explicitly or by reference using <SA-04_ODP[01] SELECTED PARAMETER VALUE(S)> in the acquision contract for the system, system component, or system service;

SA-04h.[02]

the allocaon of responsibility or idenﬁcaon of pares responsible for privacy requirements, descripons, and criteria are included explicitly or by reference using <SA-04_ODP[01] SELECTED PARAMETER VALUE(S)>;

SA-04h.[03]

the allocaon of responsibility or idenﬁcaon of pares responsible for supply chain risk management requirements, descripons, and criteria are included explicitly or by reference using <SA-04_ODP[01] SELECTED PARAMETER VALUE(S)>;

SA-04i.

acceptance criteria requirements and descripons are included explicitly or by reference using <SA-04_ODP[01] SELECTED PARAMETER VALUE(S)> in the acquision contract for the system, system component, or system service.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

SA-04-Examine

[SELECT FROM: System and services acquision policy; system and services acquision procedures; procedures addressing the integraon of informaon security and privacy and supply chain risk management into the acquision process; conﬁguraon management plan; acquision contracts for the system, system component, or system service; system design documentaon; system security plan; supply chain risk management plan; privacy plan; other relevant documents or records].

SA-04-Interview

[SELECT FROM: Organizaonal personnel with acquision/contracng responsibilies; organizaonal personnel with informaon security and privacy responsibilies; system/network administrators; organizaonal personnel with supply chain risk management responsibilies].

SA-04-Test

[SELECT FROM: Organizaonal processes for determining system security and privacy funconal, strength, and assurance requirements; organizaonal processes for developing acquision contracts; mechanisms supporng and/or implemenng acquisions and the inclusion of security and privacy requirements in contracts].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 447

NIST SP 800-53A, REV. 5

SA-04(01)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

ACQUISITION PROCESS | FUNCTIONAL PROPERTIES OF CONTROLS ASSESSMENT OBJECTIVE: Determine if: SA-04(01)

the developer of the system, system component, or system service is required to provide a descripon of the funconal properes of the controls to be implemented.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SA-04(02)

SA-04(01)-Examine

SA-04(01)-Interview

[SELECT FROM: Organizaonal personnel with acquision/contracng responsibilies; organizaonal personnel with informaon security and privacy responsibilies; system developers].

SA-04(01)-Test

[SELECT FROM: Organizaonal processes for determining system security funconal requirements; organizaonal processes for developing acquision contracts; mechanisms supporng and/or implemenng acquisions and the inclusion of security and privacy requirements in contracts].

ACQUISITION PROCESS | DESIGN AND IMPLEMENTATION INFORMATION FOR CONTROLS ASSESSMENT OBJECTIVE: Determine if:

SA-04(02)_ODP[01]

one or more of the following PARAMETER VALUES is/are selected: {securityrelevant external system interfaces; high-level design; low-level design; source code or hardware schemacs; <SA-04(02)_ODP[02] design and implementaon informaon>};

SA-04(02)_ODP[02]

design and implementaon informaon is deﬁned (if selected);

SA-04(02)_ODP[03]

level of detail is deﬁned;

SA-04(02)

the developer of the system, system component, or system service is required to provide design and implementaon informaon for the controls that includes using <SA-04(02)_ODP[01] SELECTED PARAMETER VALUE(S)> at <SA-04(02)_ODP[03] level of detail>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: SA-04(02)-Examine

CHAPTER FOUR

[SELECT FROM: System and services acquision policy; system and services acquision procedures; procedures addressing the integraon of security requirements, descripons, and criteria into the acquision process; solicitaon documents; acquision documentaon; acquision contracts for the system, system components, or system services; design and implementaon informaon for controls employed in the system, system component, or system service; system security plan; other relevant documents or records].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 448

NIST SP 800-53A, REV. 5

SA-04(02)

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SA-04(03)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

ACQUISITION PROCESS | DESIGN AND IMPLEMENTATION INFORMATION FOR CONTROLS SA-04(02)-Interview

SA-04(02)-Test

[SELECT FROM: Organizaonal processes for determining the level of detail for system design and controls; organizaonal processes for developing acquision contracts; mechanisms supporng and/or implemenng the development of system design details].

ACQUISITION PROCESS | DEVELOPMENT METHODS, TECHNIQUES, AND PRACTICES ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

SA-04(03)_ODP[01]

systems engineering methods are deﬁned;

SA-04(03)_ODP[02]

one or more of the following PARAMETER VALUES is/are selected: {<SA-04(03)_ODP[03] system security engineering methods>; <SA-04(03)_ODP[04] privacy engineering methods>};

SA-04(03)_ODP[03]

system security engineering methods are deﬁned (if selected);

SA-04(03)_ODP[04]

privacy engineering methods are deﬁned (if selected);

SA-04(03)_ODP[05]

one or more of the following PARAMETER VALUES is/are selected: {<SA-04(03)_ODP[06] soware development methods>; <SA-04(03)_ODP[07] tesng, evaluaon, assessment, veriﬁcaon, and validaon methods>; <SA-04(03)_ODP[08] quality control processes>};

SA-04(03)_ODP[06]

soware development methods are deﬁned (if selected);

SA-04(03)_ODP[07]

tesng, evaluaon, assessment, veriﬁcaon, and validaon methods are deﬁned (if selected);

SA-04(03)_ODP[08]

quality control processes are deﬁned (if selected);

SA-04(03)(a)

the developer of the system, system component, or system service is required to demonstrate the use of a system development life cycle process that includes <SA-04(03)_ODP[01] systems engineering methods>;

SA-04(03)(b)

the developer of the system, system component, or system service is required to demonstrate the use of a system development life cycle process that includes <SA-04(03)_ODP[02] SELECTED PARAMETER VALUE(S)>;

SA-04(03)(c)

the developer of the system, system component, or system service is required to demonstrate the use of a system development life cycle process that includes <SA-04(03)_ODP[05] SELECTED PARAMETER VALUE(S)>.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 449

NIST SP 800-53A, REV. 5

SA-04(03)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

ACQUISITION PROCESS | DEVELOPMENT METHODS, TECHNIQUES, AND PRACTICES POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SA-04(04)

SA-04(03)-Examine

[SELECT FROM: System and services acquision policy; system and services acquision procedures; procedures addressing the integraon of security and privacy requirements, descripons, and criteria into the acquision process; solicitaon documents; acquision documentaon; acquision contracts for the system, system component, or system service; list of systems security and privacy engineering methods to be included in the developer’s system development life cycle process; list of soware development methods to be included in the developer’s system development life cycle process; list of tesng, evaluaon, or validaon techniques to be included in the developer’s system development life cycle process; list of quality control processes to be included in the developer’s system development life cycle process; system security plan; privacy plan; other relevant documents or records].

SA-04(03)-Interview

[SELECT FROM: Organizaonal personnel with acquision/contracng responsibilies; organizaonal personnel with informaon security and privacy responsibilies; organizaonal personnel with system life cycle responsibilies; system developers or service provider].

SA-04(03)-Test

[SELECT FROM: Organizaonal processes for development methods, techniques, and processes].

ACQUISITION PROCESS | ASSIGNMENT OF COMPONENTS TO SYSTEMS [WITHDRAWN: Incorporated into CM-08(09).]

SA-04(05)

ACQUISITION PROCESS | SYSTEM, COMPONENT, AND SERVICE CONFIGURATIONS ASSESSMENT OBJECTIVE: Determine if:

SA-04(05)_ODP

security conﬁguraons for the system, component, or service are deﬁned;

SA-04(05)(a)

the developer of the system, system component, or system service is required to deliver the system, component, or service with <SA-04(05)_ODP security conﬁguraons> implemented;

SA-04(05)(b)

the conﬁguraons are used as the default for any subsequent system, component, or service reinstallaon or upgrade.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: SA-04(05)-Examine

CHAPTER FOUR

[SELECT FROM: System and services acquision policy; procedures addressing the integraon of security requirements, descripons, and criteria into the acquision process; solicitaon documents; acquision documentaon; acquision contracts for the system, system component, or system service; security conﬁguraons to be implemented by the developer of the system, system component, or system service; service level agreements; system security plan; other relevant documents or records].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 450

NIST SP 800-53A, REV. 5

SA-04(05)

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SA-04(06)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

ACQUISITION PROCESS | SYSTEM, COMPONENT, AND SERVICE CONFIGURATIONS SA-04(05)-Interview

SA-04(05)-Test

[SELECT FROM: Mechanisms used to verify that the conﬁguraon of the system, component, or service is delivered as speciﬁed].

ACQUISITION PROCESS | USE OF INFORMATION ASSURANCE PRODUCTS ASSESSMENT OBJECTIVE: Determine if: SA-04(06)(a)

only government oﬀ-the-shelf or commercial oﬀ-the-shelf informaon assurance and informaon assurance-enabled informaon technology products that compose an NSA-approved soluon to protect classiﬁed informaon when the networks used to transmit the informaon are at a lower classiﬁcaon level than the informaon being transmied are employed;

SA-04(06)(b)

these products have been evaluated and/or validated by NSA or in accordance with NSA-approved procedures.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

SA-04(06)-Examine

[SELECT FROM: Supply chain risk management plan; system and services acquision policy; procedures addressing the integraon of security requirements, descripons, and criteria into the acquision process; solicitaon documents; acquision documentaon; acquision contracts for the system, system component, or system service; security conﬁguraons to be implemented by the developer of the system, system component, or system service; service level agreements; list of deployed IT products/soluons; NSA-approved list; system security plan; other relevant documents or records].

SA-04(06)-Interview

[SELECT FROM: Organizaonal personnel with acquision/contracng responsibilies; organizaonal personnel with the responsibility to determine system security requirements; organizaonal personnel responsible for ensuring informaon assurance products are NSA-approved and are evaluated and/or validated products in accordance with NSA-approved procedures; organizaonal personnel with informaon security responsibilies].

SA-04(06)-Test

[SELECT FROM: Organizaonal processes for selecng and employing evaluated and/or validated informaon assurance products and services that compose an NSA-approved soluon to protect classiﬁed informaon].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 451

NIST SP 800-53A, REV. 5

SA-04(07)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

ACQUISITION PROCESS | NIAP-APPROVED PROTECTION PROFILES ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SA-04(07)(a)

the use of commercially provided informaon assurance and informaon assurance-enabled informaon technology products is limited to those products that have been successfully evaluated against a Naonal Informaon Assurance partnership (NIAP)-approved Protecon Proﬁle for a speciﬁc technology type, if such a proﬁle exists;

SA-04(07)(b)

if no NIAP-approved Protecon Proﬁle exists for a speciﬁc technology type but a commercially provided informaon technology product relies on cryptographic funconality to enforce its security policy, that cryptographic module is required to be FIPS-validated or NSA-approved.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SA-04(08)

SA-04(07)-Examine

[SELECT FROM: Supply chain risk management plan; system and services acquision policy; procedures addressing the integraon of security requirements, descripons, and criteria into the acquision process; solicitaon documents; acquision documentaon; acquision contracts for the system, system component, or system service; list of deployed IT products/soluons; NAIPapproved protecon proﬁles; FIPS-validaon informaon for cryptographic funconality; system security plan; other relevant documents or records].

SA-04(07)-Interview

[SELECT FROM: Organizaonal personnel with acquision/contracng responsibilies; organizaonal personnel with the responsibility for determining system security requirements; organizaonal personnel responsible for ensuring that informaon assurance products have been evaluated against a NIAPapproved protecon proﬁle or for ensuring products relying on cryptographic funconality are FIPS-validated; organizaonal personnel with informaon security responsibilies].

SA-04(07)-Test

[SELECT FROM: Organizaonal processes for selecng and employing products/ services evaluated against a NIAP-approved protecon proﬁle or FIPS-validated products].

ACQUISITION PROCESS | CONTINUOUS MONITORING PLAN FOR CONTROLS ASSESSMENT OBJECTIVE: Determine if: SA-04(08)

the developer of the system, system component, or system service is required to produce a plan for the connuous monitoring of control eﬀecveness that is consistent with the connuous monitoring program of the organizaon.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: SA-04(08)-Examine

CHAPTER FOUR

[SELECT FROM: System and services acquision policy; procedures addressing developer connuous monitoring plans; procedures addressing the integraon of security requirements, descripons, and criteria into the acquision process; developer connuous monitoring plans; security assessment plans; acquision contracts for the system, system component, or system service; acquision documentaon; solicitaon documentaon; service level agreements; system security plan; other relevant documents or records].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 452

NIST SP 800-53A, REV. 5

SA-04(08)

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SA-04(09)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

ACQUISITION PROCESS | CONTINUOUS MONITORING PLAN FOR CONTROLS SA-04(08)-Interview

SA-04(08)-Test

[SELECT FROM: Vendor processes for connuous monitoring; mechanisms supporng and/or implemenng developer connuous monitoring].

ACQUISITION PROCESS | FUNCTIONS, PORTS, PROTOCOLS, AND SERVICES IN USE ASSESSMENT OBJECTIVE: Determine if:

SA-04(09)[01]

the developer of the system, system component, or system service is required to idenfy the funcons intended for organizaonal use;

SA-04(09)[02]

the developer of the system, system component, or system service is required to idenfy the ports intended for organizaonal use;

SA-04(09)[03]

the developer of the system, system component, or system service is required to idenfy the protocols intended for organizaonal use;

SA-04(09)[04]

the developer of the system, system component, or system service is required to idenfy the services intended for organizaonal use.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SA-04(10)

SA-04(09)-Examine

[SELECT FROM: System and services acquision policy; procedures addressing the integraon of security requirements, descripons, and criteria into the acquision process; system design documentaon; system documentaon, including funcons, ports, protocols, and services intended for organizaonal use; acquision contracts for systems or services; acquision documentaon; solicitaon documentaon; service level agreements; organizaonal security requirements, descripons, and criteria for developers of systems, system components, and system services; system security plan; other relevant documents or records].

SA-04(09)-Interview

[SELECT FROM: Organizaonal personnel with acquision/contracng responsibilies; organizaonal personnel with the responsibility for determining system security requirements; system/network administrators; organizaonal personnel operang, using, and/or maintaining the system; system developers; organizaonal personnel with informaon security responsibilies].

ACQUISITION PROCESS | USE OF APPROVED PIV PRODUCTS ASSESSMENT OBJECTIVE: Determine if: SA-04(10)

CHAPTER FOUR

only informaon technology products on the FIPS 201-approved products list for the Personal Identy Veriﬁcaon (PIV) capability implemented within organizaonal systems are employed.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 453

NIST SP 800-53A, REV. 5

SA-04(10)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

ACQUISITION PROCESS | USE OF APPROVED PIV PRODUCTS POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SA-04(11)

SA-04(10)-Examine

[SELECT FROM: Supply chain risk management plan; system and services acquision policy; procedures addressing the integraon of security requirements, descripons, and criteria into the acquision process; solicitaon documentaon; acquision documentaon; acquision contracts for the system, system component, or system service; service level agreements; FIPS 201 approved products list; system security plan; other relevant documents or records].

SA-04(10)-Interview

[SELECT FROM: Organizaonal personnel with acquision/contracng responsibilies; organizaonal personnel with the responsibility for determining system security requirements; organizaonal personnel with the responsibility for ensuring that only FIPS 201- approved products are implemented; organizaonal personnel with informaon security responsibilies].

SA-04(10)-Test

[SELECT FROM: Organizaonal processes for selecng and employing FIPS 201approved products].

ACQUISITION PROCESS | SYSTEM OF RECORDS ASSESSMENT OBJECTIVE: Determine if:

SA-04(11)_ODP

Privacy Act requirements for the operaon of a system of records are deﬁned;

SA-04(11)

<SA-04(11)_ODP Privacy Act requirements> are deﬁned in the acquision contract for the operaon of a system of records on behalf of an organizaon to accomplish an organizaonal mission or funcon.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

SA-04(11)-Examine

[SELECT FROM: System and services acquision policy; system and services acquision procedures; procedures addressing the integraon of Privacy Act requirements into systems of records operated by external organizaons; solicitaon documentaon; acquision documentaon; acquision contracts for the system, system component, or system service; service level agreements; system security plan; privacy plan; personally idenﬁable informaon processing policy; privacy program plan; privacy impact assessment; privacy risk assessment documentaon; other relevant documents or records].

SA-04(11)-Interview

[SELECT FROM: Organizaonal personnel with acquision responsibilies; organizaonal personnel with informaon security and privacy responsibilies].

SA-04(11)-Test

[SELECT FROM: Contract management processes to verify Privacy Act requirements are deﬁned for the operaon of a system of records; vendor processes for demonstrang incorporaon of Privacy Act requirements in its operaon of a system of records].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 454

NIST SP 800-53A, REV. 5

SA-04(12)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

ACQUISITION PROCESS | DATA OWNERSHIP ASSESSMENT OBJECTIVE: Determine if:

SA-04(12)_ODP

me frame to remove data from a contractor system and return it to the organizaon is deﬁned;

SA-04(12)(a)

organizaonal data ownership requirements are included in the acquision contract;

SA-04(12)(b)

all data to be removed from the contractor’s system and returned to the organizaon is required within <SA-04(12)_ODP me frame>.

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SA-05

SA-04(12)-Examine

[SELECT FROM: System and services acquision policy; system and services acquision procedures; procedures addressing the integraon of informaon security and privacy requirements, descripons, and criteria into the acquision process; procedures addressing the disposion of personally idenﬁable informaon; solicitaon documentaon; acquision documentaon; acquision contracts for the system or system service; personally idenﬁable informaon processing policy; service level agreements; informaon sharing agreements; memoranda of understanding; system security plan; privacy plan; privacy impact assessment; privacy risk assessment documentaon; other relevant documents or records].

SA-04(12)-Interview

[SELECT FROM: Organizaonal personnel with acquision/contracng responsibilies; organizaonal personnel with the responsibility for data management and processing requirements; organizaonal personnel with informaon security and privacy responsibilies].

SA-04(12)-Test

[SELECT FROM: Contract management processes to verify that data is removed as required; vendor processes for removing data in required meframe; mechanisms verifying the removal and return of data].

SYSTEM DOCUMENTATION ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

SA-05_ODP[01]

acons to take when system, system component, or system service documentaon is either unavailable or nonexistent are deﬁned;

SA-05_ODP[02]

personnel or roles to distribute system documentaon to is/are deﬁned;

SA-05a.01[01]

administrator documentaon for the system, system component, or system service that describes the secure conﬁguraon of the system, component, or service is obtained or developed;

SA-05a.01[02]

administrator documentaon for the system, system component, or system service that describes the secure installaon of the system, component, or service is obtained or developed;

SA-05a.01[03]

administrator documentaon for the system, system component, or system service that describes the secure operaon of the system, component, or service is obtained or developed;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 455

NIST SP 800-53A, REV. 5

SA-05

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5 CHAPTER FOUR

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

SYSTEM DOCUMENTATION SA-05a.02[01]

administrator documentaon for the system, system component, or system service that describes the eﬀecve use of security funcons and mechanisms is obtained or developed;

SA-05a.02[02]

administrator documentaon for the system, system component, or system service that describes the eﬀecve maintenance of security funcons and mechanisms is obtained or developed;

SA-05a.02[03]

administrator documentaon for the system, system component, or system service that describes the eﬀecve use of privacy funcons and mechanisms is obtained or developed;

SA-05a.02[04]

administrator documentaon for the system, system component, or system service that describes the eﬀecve maintenance of privacy funcons and mechanisms is obtained or developed;

SA-05a.03[01]

administrator documentaon for the system, system component, or system service that describes known vulnerabilies regarding the conﬁguraon of administrave or privileged funcons is obtained or developed;

SA-05a.03[02]

administrator documentaon for the system, system component, or system service that describes known vulnerabilies regarding the use of administrave or privileged funcons is obtained or developed;

SA-05b.01[01]

user documentaon for the system, system component, or system service that describes user-accessible security funcons and mechanisms is obtained or developed;

SA-05b.01[02]

user documentaon for the system, system component, or system service that describes how to eﬀecvely use those (user-accessible security) funcons and mechanisms is obtained or developed;

SA-05b.01[03]

user documentaon for the system, system component, or system service that describes user-accessible privacy funcons and mechanisms is obtained or developed;

SA-05b.01[04]

user documentaon for the system, system component, or system service that describes how to eﬀecvely use those (user-accessible privacy) funcons and mechanisms is obtained or developed;

SA-05b.02[01]

user documentaon for the system, system component, or system service that describes methods for user interacon, which enable individuals to use the system, component, or service in a more secure manner is obtained or developed;

SA-05b.02[02]

SA-05b.03[01]

user documentaon for the system, system component, or system service that describes user responsibilies for maintaining the security of the system, component, or service is obtained or developed;

SA-05b.03[02]

user documentaon for the system, system component, or system service that describes user responsibilies for maintaining the privacy of individuals is obtained or developed;

SA-05c.[01]

aempts to obtain system, system component, or system service documentaon when such documentaon is either unavailable or nonexistent is documented;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 456

NIST SP 800-53A, REV. 5

SA-05

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

SYSTEM DOCUMENTATION SA-05c.[02]

aer aempts to obtain system, system component, or system service documentaon when such documentaon is either unavailable or nonexistent, <SA-05_ODP[01] acons> are taken in response;

SA-05d.

documentaon is distributed to <SA-05_ODP[02] personnel or roles>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SA-05(01)

SA-05-Examine

[SELECT FROM: System and services acquision policy; system and services acquision procedures; procedures addressing system documentaon; system documentaon, including administrator and user guides; system design documentaon; records documenng aempts to obtain unavailable or nonexistent system documentaon; list of acons to be taken in response to documented aempts to obtain system, system component, or system service documentaon; risk management strategy documentaon; system security plan; privacy plan; privacy impact assessment; privacy risk assessment documentaon; other relevant documents or records].

SA-05-Interview

[SELECT FROM: Organizaonal personnel with acquision/contracng responsibilies; organizaonal personnel with informaon security and privacy responsibilies; system administrators; organizaonal personnel responsible for operang, using, and/or maintaining the system; system developers].

SA-05-Test

[SELECT FROM: Organizaonal processes for obtaining, protecng, and distribung system administrator and user documentaon].

SYSTEM DOCUMENTATION | FUNCTIONAL PROPERTIES OF SECURITY CONTROLS [WITHDRAWN: Incorporated into SA-04(01).]

SA-05(02)

SYSTEM DOCUMENTATION | SECURITY-RELEVANT EXTERNAL SYSTEM INTERFACES [WITHDRAWN: Incorporated into SA-04(02).]

SA-05(03)

SYSTEM DOCUMENTATION | HIGH-LEVEL DESIGN [WITHDRAWN: Incorporated into SA-04(02).]

SA-05(04)

SYSTEM DOCUMENTATION | LOW-LEVEL DESIGN [WITHDRAWN: Incorporated into SA-04(02).]

CHAPTER FOUR

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 457

NIST SP 800-53A, REV. 5

SA-05(05)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

SYSTEM DOCUMENTATION | SOURCE CODE [WITHDRAWN: Incorporated into SA-04(02).]

SA-06

SOFTWARE USAGE RESTRICTIONS [WITHDRAWN: Incorporated into CM-10, SI-07.]

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SA-07

USER-INSTALLED SOFTWARE [WITHDRAWN: Incorporated into CM-11, SI-07.]

SA-08

SECURITY AND PRIVACY ENGINEERING PRINCIPLES ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

SA-08_ODP[01]

systems security engineering principles are deﬁned;

SA-08_ODP[02]

privacy engineering principles are deﬁned;

SA-08[01]

<SA-08_ODP[01] systems security engineering principles> are applied in the speciﬁcaon of the system and system components;

SA-08[02]

<SA-08_ODP[01] systems security engineering principles> are applied in the design of the system and system components;

SA-08[03]

<SA-08_ODP[01] systems security engineering principles> are applied in the development of the system and system components;

SA-08[04]

<SA-08_ODP[01] systems security engineering principles> are applied in the implementaon of the system and system components;

SA-08[05]

<SA-08_ODP[01] systems security engineering principles> are applied in the modiﬁcaon of the system and system components;

SA-08[06]

<SA-08_ODP[02] privacy engineering principles> are applied in the speciﬁcaon of the system and system components;

SA-08[07]

<SA-08_ODP[02] privacy engineering principles> are applied in the design of the system and system components;

SA-08[08]

<SA-08_ODP[02] privacy engineering principles> are applied in the development of the system and system components;

SA-08[09]

<SA-08_ODP[02] privacy engineering principles> are applied in the implementaon of the system and system components;

SA-08[10]

<SA-08_ODP[02] privacy engineering principles> are applied in the modiﬁcaon of the system and system components.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 458

NIST SP 800-53A, REV. 5

SA-08

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

SECURITY AND PRIVACY ENGINEERING PRINCIPLES POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SA-08(01)

SA-08-Examine

[SELECT FROM: System and services acquision policy; system and services acquision procedures; assessment and authorizaon procedures; procedures addressing security and privacy engineering principles used in the speciﬁcaon, design, development, implementaon, and modiﬁcaon of the system; system design documentaon; security and privacy requirements and speciﬁcaons for the system; system security plan; privacy plan; privacy impact assessment; privacy risk assessment documentaon; other relevant documents or records].

SA-08-Interview

[SELECT FROM: Organizaonal personnel with acquision/contracng responsibilies; organizaonal personnel with informaon security and privacy responsibilies; organizaonal personnel with system speciﬁcaon, design, development, implementaon, and modiﬁcaon responsibilies; system developers].

SA-08-Test

[SELECT FROM: Organizaonal processes for applying security and privacy engineering principles in system speciﬁcaon, design, development, implementaon, and modiﬁcaon; mechanisms supporng the applicaon of security and privacy engineering principles in system speciﬁcaon, design, development, implementaon, and modiﬁcaon].

SECURITY AND PRIVACY ENGINEERING PRINCIPLES | CLEAR ABSTRACTIONS ASSESSMENT OBJECTIVE: Determine if: SA-08(01)

the security design principle of clear abstracons is implemented.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

SA-08(01)-Examine

[SELECT FROM: System and services acquision policy; procedures addressing the security design principle of clear abstracons used in the speciﬁcaon, design, development, implementaon, and modiﬁcaon of the system; system design documentaon; security and privacy requirements and speciﬁcaons for the system; system security and privacy architecture; system security plan; other relevant documents or records].

SA-08(01)-Interview

SA-08(01)-Test

[SELECT FROM: Organizaonal processes for applying the security design principle of clear abstracons to system speciﬁcaon, design, development, implementaon, and modiﬁcaon; mechanisms supporng the applicaon of the security design principle of clear abstracons to system speciﬁcaon, design, development, implementaon, and modiﬁcaon].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 459

NIST SP 800-53A, REV. 5

SA-08(02)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

SECURITY AND PRIVACY ENGINEERING PRINCIPLES | LEAST COMMON MECHANISM ASSESSMENT OBJECTIVE: Determine if:

SA-08(02)_ODP

systems or system components that implement the security design principle of least common mechanism are deﬁned;

SA-08(02)

<SA-08(02)_ODP systems or system components> implement the security design principle of least common mechanism.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SA-08(03)

SA-08(02)-Examine

[SELECT FROM: System and services acquision policy; procedures addressing the security design principle of least common mechanism used in the speciﬁcaon, design, development, implementaon, and modiﬁcaon of the system; system design documentaon; security and privacy requirements and speciﬁcaons for the system; system security and privacy architecture; system security plan; other relevant documents or records].

SA-08(02)-Interview

SA-08(02)-Test

[SELECT FROM: Organizaonal processes for applying the security design principle of least common mechanism in system speciﬁcaon, design, development, implementaon, and modiﬁcaon; mechanisms supporng the applicaon of the security design principle of least common mechanism in system speciﬁcaon, design, development, implementaon, and modiﬁcaon].

SECURITY AND PRIVACY ENGINEERING PRINCIPLES | MODULARITY AND LAYERING ASSESSMENT OBJECTIVE: Determine if:

SA-08(03)_ODP[01]

systems or system components that implement the security design principle of modularity are deﬁned;

SA-08(03)_ODP[02]

systems or system components that implement the security design principle of layering are deﬁned;

SA-08(03)[01]

<SA-08(03)_ODP[01] systems or system components> implement the security design principle of modularity;

SA-08(03)[02]

<SA-08(03)_ODP[02] systems or system components> implement the security design principle of layering.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: SA-08(03)-Examine

CHAPTER FOUR

[SELECT FROM: System and services acquision policy; procedures addressing the security design principles of modularity and layering used in the speciﬁcaon, design, development, implementaon, and modiﬁcaon of the system; system design documentaon; security and privacy requirements and speciﬁcaons for the system; system security and privacy architecture; system security plan; other relevant documents or records].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 460

NIST SP 800-53A, REV. 5

SA-08(03)

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SA-08(04)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

SECURITY AND PRIVACY ENGINEERING PRINCIPLES | MODULARITY AND LAYERING SA-08(03)-Interview

SA-08(03)-Test

[SELECT FROM: Organizaonal processes for applying the security design principles of modularity and layering in system speciﬁcaon, design, development, implementaon, and modiﬁcaon; mechanisms supporng the applicaon of the security design principles of modularity and layering in system speciﬁcaon, design, development, implementaon, and modiﬁcaon; mechanisms supporng and/or implemenng an isolaon boundary].

SECURITY AND PRIVACY ENGINEERING PRINCIPLES | PARTIALLY ORDERED DEPENDENCIES ASSESSMENT OBJECTIVE: Determine if:

SA-08(04)_ODP

systems or system components that implement the security design principle of parally ordered dependencies are deﬁned;

SA-08(04)

<SA-08(04)_ODP systems or system components> implement the security design principle of parally ordered dependencies.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SA-08(05)

SA-08(04)-Examine

[SELECT FROM: System and services acquision policy; procedures addressing the security design principle of parally ordered dependencies used in the speciﬁcaon, design, development, implementaon, and modiﬁcaon of the system; system design documentaon; security and privacy requirements and speciﬁcaons for the system; system security and privacy architecture; system security plan; other relevant documents or records].

SA-08(04)-Interview

SA-08(04)-Test

[SELECT FROM: Organizaonal processes for applying the security design principle of parally ordered dependencies in system speciﬁcaon, design, development, implementaon, and modiﬁcaon; mechanisms supporng the applicaon of the security design principle of parally ordered dependencies in system speciﬁcaon, design, development, implementaon, and modiﬁcaon].

SECURITY AND PRIVACY ENGINEERING PRINCIPLES | EFFICIENTLY MEDIATED ACCESS ASSESSMENT OBJECTIVE: Determine if:

SA-08(05)_ODP

CHAPTER FOUR

systems or system components that implement the security design principle of eﬃciently mediated access are deﬁned;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 461

NIST SP 800-53A, REV. 5

SA-08(05)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

SECURITY AND PRIVACY ENGINEERING PRINCIPLES | EFFICIENTLY MEDIATED ACCESS SA-08(05)

<SA-08(05)_ODP systems or system components> implement the security design principle of eﬃciently mediated access.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SA-08(06)

SA-08(05)-Examine

[SELECT FROM: System and services acquision policy; procedures addressing the security design principle of eﬃciently mediated access used in the speciﬁcaon, design, development, implementaon, and modiﬁcaon of the system; system design documentaon; security and privacy requirements and speciﬁcaons for the system; system security and privacy architecture; system security plan; other relevant documents or records].

SA-08(05)-Interview

[SELECT FROM: Organizaonal personnel with acquision/contracng responsibilies; organizaonal personnel with the responsibility for determining system security and privacy requirements; organizaonal personnel with system speciﬁcaon, design, development, implementaon, and modiﬁcaon responsibilies; system developers; organizaonal personnel with informaon security responsibilies].

SA-08(05)-Test

[SELECT FROM: Organizaonal processes for applying the security design principle of eﬃciently mediated access in system speciﬁcaon, design, development, implementaon, and modiﬁcaon; mechanisms supporng the applicaon of the security design principle of eﬃciently mediated access in system speciﬁcaon, design, development, implementaon, and modiﬁcaon].

SECURITY AND PRIVACY ENGINEERING PRINCIPLES | MINIMIZED SHARING ASSESSMENT OBJECTIVE: Determine if:

SA-08(06)_ODP

systems or system components that implement the security design principle of minimized sharing are deﬁned;

SA-08(06)

<SA-08(06)_ODP systems or system components> implement the security design principle of minimized sharing.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

SA-08(06)-Examine

[SELECT FROM: System and services acquision policy; procedures addressing the security design principle of minimized sharing used in the speciﬁcaon, design, development, implementaon, and modiﬁcaon of the system; system design documentaon; security and privacy requirements and speciﬁcaons for the system; system security and privacy architecture; system security plan; other relevant documents or records].

SA-08(06)-Interview

SA-08(06)-Test

[SELECT FROM: Organizaonal processes for applying the security design principle of minimized sharing in system speciﬁcaon, design, development, implementaon, and modiﬁcaon; mechanisms supporng the applicaon of the security design principle of minimized sharing in system speciﬁcaon, design, development, implementaon, and modiﬁcaon].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 462

NIST SP 800-53A, REV. 5

SA-08(07)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

SECURITY AND PRIVACY ENGINEERING PRINCIPLES | REDUCED COMPLEXITY ASSESSMENT OBJECTIVE: Determine if:

SA-08(07)_ODP

systems or system components that implement the security design principle of reduced complexity are deﬁned;

SA-08(07)

<SA-08(07)_ODP systems or system components> implement the security design principle of reduced complexity.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SA-08(08)

SA-08(07)-Examine

[SELECT FROM: System and services acquision policy; procedures addressing the security design principle of reduced complexity used in the speciﬁcaon, design, development, implementaon, and modiﬁcaon of the system; system design documentaon; security and privacy requirements and speciﬁcaons for the system; system security and privacy architecture; system security plan; other relevant documents or records].

SA-08(07)-Interview

SA-08(07)-Test

[SELECT FROM: Organizaonal processes for applying the security design principle of reduced complexity in system speciﬁcaon, design, development, implementaon, and modiﬁcaon; mechanisms supporng the applicaon of the security design principle of reduced complexity in system speciﬁcaon, design, development, implementaon, and modiﬁcaon].

SECURITY AND PRIVACY ENGINEERING PRINCIPLES | SECURE EVOLVABILITY ASSESSMENT OBJECTIVE: Determine if:

SA-08(08)_ODP

systems or system components that implement the security design principle of secure evolvability are deﬁned;

SA-08(08)

<SA-08(08)_ODP systems or system components> implement the security design principle of secure evolvability.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

SA-08(08)-Examine

[SELECT FROM: System and services acquision policy; procedures addressing the security design principle of secure evolvability used in the speciﬁcaon, design, development, implementaon, and modiﬁcaon of the system; system design documentaon; security and privacy requirements and speciﬁcaons for the system; system security and privacy architecture; system security plan; other relevant documents or records].

SA-08(08)-Interview

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 463

NIST SP 800-53A, REV. 5

SA-08(08)

SECURITY AND PRIVACY ENGINEERING PRINCIPLES | SECURE EVOLVABILITY SA-08(08)-Test

SA-08(09)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

[SELECT FROM: Organizaonal processes for applying the security design principle of secure evolvability in system speciﬁcaon, design, development, implementaon, and modiﬁcaon; mechanisms supporng the applicaon of the security design principle of secure evolvability in system speciﬁcaon, design, development, implementaon, and modiﬁcaon].

SECURITY AND PRIVACY ENGINEERING PRINCIPLES | TRUSTED COMPONENTS

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

ASSESSMENT OBJECTIVE: Determine if:

SA-08(09)_ODP

systems or system components that implement the security design principle of trusted components are deﬁned;

SA-08(09)

<SA-08(09)_ODP systems or system components> implement the security design principle of trusted components.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SA-08(10)

SA-08(09)-Examine

[SELECT FROM: Supply chain risk management plan; system and services acquision policy; procedures addressing the security design principle of trusted components used in the speciﬁcaon, design, development, implementaon, and modiﬁcaon of the system; system design documentaon; security, supply chain risk management, and privacy requirements and speciﬁcaons for the system; system security and privacy architecture; procedures for determining component assurance; system security plan; other relevant documents or records].

SA-08(09)-Interview

[SELECT FROM: Organizaonal personnel with the responsibility for determining system security and privacy requirements; organizaonal personnel with system speciﬁcaon, design, development, implementaon, and modiﬁcaon responsibilies; system developers; organizaonal personnel with informaon security responsibilies; organizaonal personnel with supply chain risk management responsibilies].

SA-08(09)-Test

[SELECT FROM: Organizaonal processes for applying the security design principle of trusted components in system speciﬁcaon, design, development, implementaon, and modiﬁcaon; mechanisms supporng the applicaon of the security design principle of trusted components in system speciﬁcaon, design, development, implementaon, and modiﬁcaon].

SECURITY AND PRIVACY ENGINEERING PRINCIPLES | HIERARCHICAL TRUST ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

SA-08(10)_ODP

systems or system components that implement the security design principle of hierarchical trust are deﬁned;

SA-08(10)

<SA-08(10)_ODP systems or system components> implement the security design principle of hierarchical trust.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 464

NIST SP 800-53A, REV. 5

SA-08(10)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

SECURITY AND PRIVACY ENGINEERING PRINCIPLES | HIERARCHICAL TRUST POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SA-08(11)

SA-08(10)-Examine

[SELECT FROM: System and services acquision policy; procedures addressing the security design principle of hierarchical trust used in the speciﬁcaon, design, development, implementaon, and modiﬁcaon of the system; system design documentaon; security and privacy requirements and speciﬁcaons for the system; system security and privacy architecture; system security plan; other relevant documents or records].

SA-08(10)-Interview

SA-08(10)-Test

[SELECT FROM: Organizaonal processes for applying the security design principle of hierarchical trust in system speciﬁcaon, design, development, implementaon, and modiﬁcaon; mechanisms supporng the applicaon of the security design principle of hierarchical trust in system speciﬁcaon, design, development, implementaon, and modiﬁcaon].

SECURITY AND PRIVACY ENGINEERING PRINCIPLES | INVERSE MODIFICATION THRESHOLD ASSESSMENT OBJECTIVE: Determine if:

SA-08(11)_ODP

systems or system components that implement the security design principle of inverse modiﬁcaon threshold are deﬁned;

SA-08(11)

<SA-08(11)_ODP systems or system components> implement the security design principle of inverse modiﬁcaon threshold.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

SA-08(11)-Examine

[SELECT FROM: System and services acquision policy; procedures addressing the security design principle of inverse modiﬁcaon threshold used in the speciﬁcaon, design, development, implementaon, and modiﬁcaon of the system; system design documentaon; security and privacy requirements and speciﬁcaons for the system; system security and privacy architecture; system security plan; other relevant documents or records].

SA-08(11)-Interview

SA-08(11)-Test

[SELECT FROM: Organizaonal processes for applying the security design principle of inverse modiﬁcaon threshold in system speciﬁcaon, design, development, implementaon, and modiﬁcaon; mechanisms supporng the applicaon of the security design principle of inverse modiﬁcaon threshold in system speciﬁcaon, design, development, implementaon, and modiﬁcaon].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 465

NIST SP 800-53A, REV. 5

SA-08(12)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

SECURITY AND PRIVACY ENGINEERING PRINCIPLES | HIERARCHICAL PROTECTION ASSESSMENT OBJECTIVE: Determine if:

SA-08(12)_ODP

systems or system components that implement the security design principle of hierarchical protecon are deﬁned;

SA-08(12)

<SA-08(12)_ODP systems or system components> implement the security design principle of hierarchical protecon.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SA-08(13)

SA-08(12)-Examine

[SELECT FROM: System and services acquision policy; procedures addressing the security design principle of hierarchical protecon used in the speciﬁcaon, design, development, implementaon, and modiﬁcaon of the system; system design documentaon; security and privacy requirements and speciﬁcaons for the system; system security and privacy architecture; system security plan; other relevant documents or records].

SA-08(12)-Interview

SA-08(12)-Test

[SELECT FROM: Organizaonal processes for applying the security design principle of hierarchical protecon in system speciﬁcaon, design, development, implementaon, and modiﬁcaon; mechanisms supporng the applicaon of the security design principle of hierarchical protecon in system speciﬁcaon, design, development, implementaon, and modiﬁcaon].

SECURITY AND PRIVACY ENGINEERING PRINCIPLES | MINIMIZED SECURITY ELEMENTS ASSESSMENT OBJECTIVE: Determine if:

SA-08(13)_ODP

systems or system components that implement the security design principle of minimized security elements are deﬁned;

SA-08(13)

<SA-08(13)_ODP systems or system components> implement the security design principle of minimized security elements.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

SA-08(13)-Examine

[SELECT FROM: System and services acquision policy; procedures addressing the security design principle of minimized security elements used in the speciﬁcaon, design, development, implementaon, and modiﬁcaon of the system; system design documentaon; security and privacy requirements and speciﬁcaons for the system; system security and privacy architecture; system security plan; other relevant documents or records].

SA-08(13)-Interview

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 466

NIST SP 800-53A, REV. 5

SA-08(13)

SECURITY AND PRIVACY ENGINEERING PRINCIPLES | MINIMIZED SECURITY ELEMENTS SA-08(13)-Test

SA-08(14)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

[SELECT FROM: Organizaonal processes for applying the security design principle of minimized security elements in system speciﬁcaon, design, development, implementaon, and modiﬁcaon; mechanisms supporng the applicaon of the security design principle of minimized security elements in system speciﬁcaon, design, development, implementaon, and modiﬁcaon].

SECURITY AND PRIVACY ENGINEERING PRINCIPLES | LEAST PRIVILEGE

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

ASSESSMENT OBJECTIVE: Determine if:

SA-08(14)_ODP

systems or system components that implement the security design principle of least privilege are deﬁned;

SA-08(14)

<SA-08(14)_ODP systems or system components> implement the security design principle of least privilege.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SA-08(15)

SA-08(14)-Examine

[SELECT FROM: System and services acquision policy; procedures addressing the security design principle of least privilege used in the speciﬁcaon, design, development, implementaon, and modiﬁcaon of the system; system design documentaon; security and privacy requirements and speciﬁcaons for the system; system security and privacy architecture; system security plan; other relevant documents or records].

SA-08(14)-Interview

SA-08(14)-Test

[SELECT FROM: Organizaonal processes for applying the security design principle of least privilege in system speciﬁcaon, design, development, implementaon, and modiﬁcaon; mechanisms supporng the applicaon of the security design principle of least privilege in system speciﬁcaon, design, development, implementaon, and modiﬁcaon].

SECURITY AND PRIVACY ENGINEERING PRINCIPLES | PREDICATE PERMISSION ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

SA-08(15)_ODP

systems or system components that implement the security design principle of predicate permission are deﬁned;

SA-08(15)

<SA-08(15)_ODP systems or system components> implement the security design principle of predicate permission.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 467

NIST SP 800-53A, REV. 5

SA-08(15)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

SECURITY AND PRIVACY ENGINEERING PRINCIPLES | PREDICATE PERMISSION POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SA-08(16)

SA-08(15)-Examine

[SELECT FROM: System and services acquision policy; procedures addressing the security design principle of predicate permission used in the speciﬁcaon, design, development, implementaon, and modiﬁcaon of the system; system design documentaon; security and privacy requirements and speciﬁcaons for the system; system security and privacy architecture; system security plan; other relevant documents or records].

SA-08(15)-Interview

SA-08(15)-Test

[SELECT FROM: Organizaonal processes for applying the security design principle of predicate permission in system speciﬁcaon, design, development, implementaon, and modiﬁcaon; mechanisms supporng the applicaon of the security design principle of predicate permission in system speciﬁcaon, design, development, implementaon, and modiﬁcaon].

SECURITY AND PRIVACY ENGINEERING PRINCIPLES | SELF-RELIANT TRUSTWORTHINESS ASSESSMENT OBJECTIVE: Determine if:

SA-08(16)_ODP

systems or system components that implement the security design principle of self-reliant trustworthiness are deﬁned;

SA-08(16)

<SA-08(16)_ODP systems or system components> implement the security design principle of self-reliant trustworthiness.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

SA-08(16)-Examine

[SELECT FROM: System and services acquision policy; procedures addressing the security design principle of self-reliant trustworthiness used in the speciﬁcaon, design, development, implementaon, and modiﬁcaon of the system; system design documentaon; security and privacy requirements and speciﬁcaons for the system; system security and privacy architecture; system security plan; other relevant documents or records].

SA-08(16)-Interview

SA-08(16)-Test

[SELECT FROM: Organizaonal processes for applying the security design principle of self-reliant trustworthiness in system speciﬁcaon, design, development, implementaon, and modiﬁcaon; mechanisms supporng the applicaon of the security design principle of self-reliant trustworthiness in system speciﬁcaon, design, development, implementaon, and modiﬁcaon].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 468

NIST SP 800-53A, REV. 5

SA-08(17)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

SECURITY AND PRIVACY ENGINEERING PRINCIPLES | SECURE DISTRIBUTED COMPOSITION ASSESSMENT OBJECTIVE: Determine if:

SA-08(17)_ODP

systems or system components that implement the security design principle of secure distributed composion are deﬁned;

SA-08(17)

<SA-08(17)_ODP systems or system components> implement the security design principle of secure distributed composion.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SA-08(18)

SA-08(17)-Examine

[SELECT FROM: System and services acquision policy; procedures addressing the security design principle of secure distributed composion used in the speciﬁcaon, design, development, implementaon, and modiﬁcaon of the system; system design documentaon; security and privacy requirements and speciﬁcaons for the system; system security and privacy architecture; system security plan; other relevant documents or records].

SA-08(17)-Interview

SA-08(17)-Test

[SELECT FROM: Organizaonal processes for applying the security design principle of secure distributed composion in system speciﬁcaon, design, development, implementaon, and modiﬁcaon; mechanisms supporng the applicaon of the security design principle of secure distributed composion in system speciﬁcaon, design, development, implementaon, and modiﬁcaon].

SECURITY AND PRIVACY ENGINEERING PRINCIPLES | TRUSTED COMMUNICATIONS CHANNELS ASSESSMENT OBJECTIVE: Determine if:

SA-08(18)_ODP

systems or system components that implement the security design principle of trusted communicaons channels are deﬁned;

SA-08(18)

<SA-08(18)_ODP systems or system components> implement the security design principle of trusted communicaons channels.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

SA-08(18)-Examine

[SELECT FROM: System and services acquision policy; procedures addressing the security design principle of trusted communicaons channels used in the speciﬁcaon, design, development, implementaon, and modiﬁcaon of the system; system design documentaon; security and privacy requirements and speciﬁcaons for the system; system security and privacy architecture; system security plan; other relevant documents or records].

SA-08(18)-Interview

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 469

NIST SP 800-53A, REV. 5

SA-08(18)

SECURITY AND PRIVACY ENGINEERING PRINCIPLES | TRUSTED COMMUNICATIONS CHANNELS SA-08(18)-Test

SA-08(19)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

[SELECT FROM: Organizaonal processes for applying the security design principle of trusted communicaons channels in system speciﬁcaon, design, development, implementaon, and modiﬁcaon; mechanisms supporng the applicaon of the security design principle of trusted communicaons channels in system speciﬁcaon, design, development, implementaon, and modiﬁcaon].

SECURITY AND PRIVACY ENGINEERING PRINCIPLES | CONTINUOUS PROTECTION

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

ASSESSMENT OBJECTIVE: Determine if:

SA-08(19)_ODP

systems or system components that implement the security design principle of connuous protecon are deﬁned;

SA-08(19)

<SA-08(19)_ODP systems or system components> implement the security design principle of connuous protecon.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SA-08(20)

SA-08(19)-Examine

[SELECT FROM: System and services acquision policy; access control policy; system and communicaons protecon policy; procedures addressing boundary protecon; procedures addressing the security design principle of connuous protecon used in the speciﬁcaon, design, development, implementaon, and modiﬁcaon of the system; system conﬁguraon sengs and associated documentaon; system design documentaon; security and privacy requirements and speciﬁcaons for the system; system security and privacy architecture; system security plan; other relevant documents or records].

SA-08(19)-Interview

[SELECT FROM: Organizaonal personnel with the responsibility for determining system security and privacy requirements; organizaonal personnel with system speciﬁcaon, design, development, implementaon, and modiﬁcaon responsibilies; organizaonal personnel with access enforcement responsibilies; system/network administrators; system developers; organizaonal personnel with informaon security responsibilies; organizaonal personnel with boundary protecon responsibilies].

SA-08(19)-Test

[SELECT FROM: Organizaonal processes for applying the security design principle of connuous protecon in system speciﬁcaon, design, development, implementaon, and modiﬁcaon; mechanisms implemenng access enforcement funcons; mechanisms supporng the applicaon of the security design principle of connuous protecon in system speciﬁcaon, design, development, implementaon, and modiﬁcaon; mechanisms supporng and/or implemenng secure failure].

SECURITY AND PRIVACY ENGINEERING PRINCIPLES | SECURE METADATA MANAGEMENT ASSESSMENT OBJECTIVE: Determine if:

SA-08(20)_ODP

CHAPTER FOUR

systems or system components that implement the security design principle of secure metadata management are deﬁned;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 470

NIST SP 800-53A, REV. 5

SA-08(20)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

SECURITY AND PRIVACY ENGINEERING PRINCIPLES | SECURE METADATA MANAGEMENT SA-08(20)

<SA-08(20)_ODP systems or system components> implement the security design principle of secure metadata management.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SA-08(21)

SA-08(20)-Examine

[SELECT FROM: System and services acquision policy; procedures addressing the security design principle of metadata management used in the speciﬁcaon, design, development, implementaon, and modiﬁcaon of the system; system design documentaon; security and privacy requirements and speciﬁcaons for the system; system security and privacy architecture; system security plan; other relevant documents or records].

SA-08(20)-Interview

SA-08(20)-Test

[SELECT FROM: Organizaonal processes for applying the security design principle of metadata management in system speciﬁcaon, design, development, implementaon, and modiﬁcaon; mechanisms supporng the applicaon of the security design principle of metadata management in system speciﬁcaon, design, development, implementaon, and modiﬁcaon].

SECURITY AND PRIVACY ENGINEERING PRINCIPLES | SELF-ANALYSIS ASSESSMENT OBJECTIVE: Determine if:

SA-08(21)_ODP

systems or system components that implement the security design principle of self-analysis are deﬁned;

SA-08(21)

<SA-08(21)_ODP systems or system components> implement the security design principle of self-analysis.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

SA-08(21)-Examine

[SELECT FROM: System and services acquision policy; procedures addressing the security design principle of self-analysis used in the speciﬁcaon, design, development, implementaon, and modiﬁcaon of the system; system design documentaon; security and privacy requirements and speciﬁcaons for the system; system security and privacy architecture; system security plan; other relevant documents or records].

SA-08(21)-Interview

SA-08(21)-Test

[SELECT FROM: Organizaonal processes for applying the security design principle of self-analysis in system speciﬁcaon, design, development, implementaon, and modiﬁcaon; mechanisms supporng the applicaon of the security design principle of self-analysis in system speciﬁcaon, design, development, implementaon, and modiﬁcaon].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 471

NIST SP 800-53A, REV. 5

SA-08(22)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

SECURITY AND PRIVACY ENGINEERING PRINCIPLES | ACCOUNTABILITY AND TRACEABILITY ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SA-08(22)_ODP[01]

systems or system components that implement the security design principle of accountability are deﬁned;

SA-08(22)_ODP[02]

systems or system components that implement the security design principle of traceability are deﬁned;

SA-08(22)[01]

<SA-08(22)_ODP[01] systems or system components> implement the security design principle of accountability;

SA-08(22)[02]

<SA-08(22)_ODP[02] systems or system components> implement the security design principle of traceability.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SA-08(23)

SA-08(22)-Examine

[SELECT FROM: System and services acquision policy; audit and accountability policy; access control policy; procedures addressing least privilege; procedures addressing auditable events; idenﬁcaon and authencaon policy; procedures addressing user idenﬁcaon and authencaon; procedures addressing the security design principle of accountability and traceability used in the speciﬁcaon, design, development, implementaon, and modiﬁcaon of the system; system design documentaon; system audit records; system auditable events; system conﬁguraon sengs and associated documentaon; security and privacy requirements and speciﬁcaons for the system; system security and privacy architecture; system security plan; other relevant documents or records].

SA-08(22)-Interview

[SELECT FROM: Organizaonal personnel with the responsibility for determining system security and privacy requirements; organizaonal personnel with audit and accountability responsibilies; organizaonal personnel with system speciﬁcaon, design, development, implementaon, and modiﬁcaon responsibilies; system developers; organizaonal personnel with informaon security responsibilies].

SA-08(22)-Test

[SELECT FROM: Organizaonal processes for applying the security design principle of accountability and traceability in system speciﬁcaon, design, development, implementaon, and modiﬁcaon; mechanisms supporng the applicaon of the security design principle of accountability and traceability in system speciﬁcaon, design, development, implementaon, and modiﬁcaon; mechanisms implemenng informaon system auding; mechanisms implemenng least privilege funcons].

SECURITY AND PRIVACY ENGINEERING PRINCIPLES | SECURE DEFAULTS ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

SA-08(23)_ODP

systems or system components that implement the security design principle of secure defaults are deﬁned;

SA-08(23)

<SA-08(23)_ODP systems or system components> implement the security design principle of secure defaults.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 472

NIST SP 800-53A, REV. 5

SA-08(23)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

SECURITY AND PRIVACY ENGINEERING PRINCIPLES | SECURE DEFAULTS POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SA-08(24)

SA-08(23)-Examine

[SELECT FROM: System and services acquision policy; conﬁguraon management policy; procedures addressing the security design principle of secure defaults used in the speciﬁcaon, design, development, implementaon, and modiﬁcaon of the system; system design documentaon; procedures addressing the baseline conﬁguraon of the system; conﬁguraon management plan; system architecture and conﬁguraon documentaon; system conﬁguraon sengs and associated documentaon; security and privacy requirements and speciﬁcaons for the system; system security and privacy architecture; procedures addressing system documentaon; system documentaon; system security plan; other relevant documents or records].

SA-08(23)-Interview

SA-08(23)-Test

[SELECT FROM: Organizaonal processes for applying the security design principle of secure defaults in system speciﬁcaon, design, development, implementaon, and modiﬁcaon; mechanisms supporng the applicaon of the security design principle of secure defaults in system speciﬁcaon, design, development, implementaon, and modiﬁcaon; organizaonal processes for managing baseline conﬁguraons; mechanisms supporng conﬁguraon control of the baseline conﬁguraon].

SECURITY AND PRIVACY ENGINEERING PRINCIPLES | SECURE FAILURE AND RECOVERY ASSESSMENT OBJECTIVE: Determine if:

SA-08(24)_ODP[01]

systems or system components that implement the security design principle of secure failure are deﬁned;

SA-08(24)_ODP[02]

systems or system components that implement the security design principle of secure recovery are deﬁned;

SA-08(24)[01]

<SA-08(24)_ODP[01] systems or system components> implement the security design principle of secure failure;

SA-08(24)[02]

<SA-08(24)_ODP[02] systems or system components> implement the security design principle of secure recovery.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: SA-08(24)-Examine

CHAPTER FOUR

[SELECT FROM: System and services acquision policy; system and communicaons protecon policy; conngency planning policy; procedures addressing informaon system recovery and reconstuon; procedures addressing the security design principle of secure failure and recovery used in the speciﬁcaon, design, development, implementaon, and modiﬁcaon of the system; conngency plan; procedures addressing system backup; conngency plan test documentaon; conngency plan test results; system design documentaon; security and privacy requirements and speciﬁcaons for the system; system security and privacy architecture; system security plan; other relevant documents or records].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 473

NIST SP 800-53A, REV. 5

SA-08(24)

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SA-08(25)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

SECURITY AND PRIVACY ENGINEERING PRINCIPLES | SECURE FAILURE AND RECOVERY SA-08(24)-Interview

[SELECT FROM: Organizaonal personnel with the responsibility for determining system security and privacy requirements; organizaonal personnel with system speciﬁcaon, design, development, implementaon, and modiﬁcaon responsibilies; organizaonal personnel with conngency plan tesng responsibilies; organizaonal personnel with system recovery and reconstuon responsibilies; system developers; organizaonal personnel with informaon security responsibilies; organizaonal personnel with informaon system backup responsibilies].

SA-08(24)-Test

[SELECT FROM: Organizaonal processes for applying the security design principle of secure failure and recovery in system speciﬁcaon, design, development, implementaon, and modiﬁcaon; mechanisms supporng the applicaon of the security design principle of secure failure and recovery in system speciﬁcaon, design, development, implementaon, and modiﬁcaon; mechanisms supporng and/or implemenng secure failure; organizaonal processes for conngency plan tesng; mechanisms supporng conngency plan tesng; mechanisms supporng recovery and reconstuon of the system; organizaonal processes for conducng system backups; mechanisms supporng and/or implemenng system backups].

SECURITY AND PRIVACY ENGINEERING PRINCIPLES | ECONOMIC SECURITY ASSESSMENT OBJECTIVE: Determine if:

SA-08(25)_ODP

systems or system components that implement the security design principle of economic security are deﬁned;

SA-08(25)

<SA-08(25)_ODP systems or system components> implement the security design principle of economic security.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

SA-08(25)-Examine

[SELECT FROM: System and services acquision policy; procedures addressing the security design principle of economic security used in the speciﬁcaon, design, development, implementaon, and modiﬁcaon of the system; system design documentaon; security and privacy requirements and speciﬁcaons for the system; system security and privacy architecture; cost-beneﬁt analysis; system security plan; other relevant documents or records].

SA-08(25)-Interview

SA-08(25)-Test

[SELECT FROM: Organizaonal processes for applying the security design principle of economic security in system speciﬁcaon, design, development, implementaon, and modiﬁcaon; mechanisms supporng the applicaon of the security design principle of economic security in system speciﬁcaon, design, development, implementaon, and modiﬁcaon].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 474

NIST SP 800-53A, REV. 5

SA-08(26)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

SECURITY AND PRIVACY ENGINEERING PRINCIPLES | PERFORMANCE SECURITY ASSESSMENT OBJECTIVE: Determine if:

SA-08(26)_ODP

systems or system components that implement the security design principle of performance security are deﬁned;

SA-08(26)

<SA-08(26)_ODP systems or system components> implement the security design principle of performance security.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SA-08(27)

SA-08(26)-Examine

[SELECT FROM: System and services acquision policy; procedures addressing the security design principle of performance security used in the speciﬁcaon, design, development, implementaon, and modiﬁcaon of the system; system design documentaon; security and privacy requirements and speciﬁcaons for the system; system security and privacy architecture; trade-oﬀ analysis between performance and security; system security plan; other relevant documents or records].

SA-08(26)-Interview

SA-08(26)-Test

[SELECT FROM: Organizaonal processes for applying the security design principle of performance security in system speciﬁcaon, design, development, implementaon, and modiﬁcaon; mechanisms supporng the applicaon of the security design principle of performance security in system speciﬁcaon, design, development, implementaon, and modiﬁcaon].

SECURITY AND PRIVACY ENGINEERING PRINCIPLES | HUMAN FACTORED SECURITY ASSESSMENT OBJECTIVE: Determine if:

SA-08(27)_ODP

systems or system components that implement the security design principle of human factored security are deﬁned;

SA-08(27)

<SA-08(27)_ODP systems or system components> implement the security design principle of human factored security.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

SA-08(27)-Examine

[SELECT FROM: System and services acquision policy; procedures addressing the security design principle of human factored security used in the speciﬁcaon, design, development, implementaon, and modiﬁcaon of the system; system design documentaon; security and privacy requirements and speciﬁcaons for the system; system security and privacy architecture; usability analysis; system security plan; other relevant documents or records].

SA-08(27)-Interview

[SELECT FROM: Organizaonal personnel with the responsibility for determining system security and privacy requirements; organizaonal personnel with human factored security responsibilies; organizaonal personnel with system speciﬁcaon, design, development, implementaon, and modiﬁcaon responsibilies; system developers; organizaonal personnel with informaon security responsibilies].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 475

NIST SP 800-53A, REV. 5

SA-08(27)

SECURITY AND PRIVACY ENGINEERING PRINCIPLES | HUMAN FACTORED SECURITY SA-08(27)-Test

SA-08(28)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

[SELECT FROM: Organizaonal processes for applying the security design principle of human factored security in system speciﬁcaon, design, development, implementaon, and modiﬁcaon; mechanisms supporng the applicaon of the security design principle of human factored security in system speciﬁcaon, design, development, implementaon, and modiﬁcaon; mechanisms that enforce security policies].

SECURITY AND PRIVACY ENGINEERING PRINCIPLES | ACCEPTABLE SECURITY

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

ASSESSMENT OBJECTIVE: Determine if:

SA-08(28)_ODP

systems or system components that implement the security design principle of acceptable security are deﬁned;

SA-08(28)

<SA-08(28)_ODP systems or system components> implement the security design principle of acceptable security.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SA-08(29)

SA-08(28)-Examine

[SELECT FROM: System and services acquision policy; system and services acquision procedures; procedures addressing the security design principle of acceptable security used in the speciﬁcaon, design, development, implementaon, and modiﬁcaon of the system; system design documentaon; security and privacy requirements and speciﬁcaons for the system; system security and privacy architecture; personally idenﬁable informaon processing policy; privacy noﬁcaons provided to users; system security plan; privacy plan; privacy impact assessment; privacy risk assessment documentaon; other relevant documents or records].

SA-08(28)-Interview

[SELECT FROM: Organizaonal personnel with informaon security and privacy responsibilies; organizaonal personnel with system speciﬁcaon, design, development, implementaon, and modiﬁcaon responsibilies; system developers].

SA-08(28)-Test

[SELECT FROM: Organizaonal processes for applying the security design principle of acceptable security in system speciﬁcaon, design, development, implementaon, and modiﬁcaon; mechanisms supporng the applicaon of the security design principle of acceptable security in system speciﬁcaon, design, development, implementaon, and modiﬁcaon; mechanisms that enforce security policies].

SECURITY AND PRIVACY ENGINEERING PRINCIPLES | REPEATABLE AND DOCUMENTED PROCEDURES ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

SA-08(29)_ODP

systems or system components that implement the security design principle of repeatable and documented procedures are deﬁned;

SA-08(29)

<SA-08(29)_ODP systems or system components> implement the security design principle of repeatable and documented procedures.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 476

NIST SP 800-53A, REV. 5

SA-08(29)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

SECURITY AND PRIVACY ENGINEERING PRINCIPLES | REPEATABLE AND DOCUMENTED PROCEDURES POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SA-08(30)

SA-08(29)-Examine

[SELECT FROM: System and services acquision policy; procedures addressing the security design principle of repeatable and documented procedures used in the speciﬁcaon, design, development, implementaon, and modiﬁcaon of the system; system design documentaon; security and privacy requirements and speciﬁcaons for the system; system security and privacy architecture; system security plan; other relevant documents or records].

SA-08(29)-Interview

SA-08(29)-Test

[SELECT FROM: Organizaonal processes for applying the security design principle of repeatable and documented procedures in system speciﬁcaon, design, development, implementaon, and modiﬁcaon; mechanisms supporng the applicaon of the security design principle of repeatable and documented procedures in system speciﬁcaon, design, development, implementaon, and modiﬁcaon; mechanisms that enforce security policies].

SECURITY AND PRIVACY ENGINEERING PRINCIPLES | PROCEDURAL RIGOR ASSESSMENT OBJECTIVE: Determine if:

SA-08(30)_ODP

systems or system components that implement the security design principle of procedural rigor are deﬁned;

SA-08(30)

<SA-08(30)_ODP systems or system components> implement the security design principle of procedural rigor.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

SA-08(30)-Examine

[SELECT FROM: System and services acquision policy; procedures addressing the security design principle of procedural rigor used in the speciﬁcaon, design, development, implementaon, and modiﬁcaon of the system; system design documentaon; security and privacy requirements and speciﬁcaons for the system; system security and privacy architecture; system security plan; other relevant documents or records].

SA-08(30)-Interview

SA-08(30)-Test

[SELECT FROM: Organizaonal processes for applying the security design principle of procedural rigor in system speciﬁcaon, design, development, implementaon, and modiﬁcaon; mechanisms supporng the applicaon of the security design principle of procedural rigor in system speciﬁcaon, design, development, implementaon, and modiﬁcaon; mechanisms that enforce security policies].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 477

NIST SP 800-53A, REV. 5

SA-08(31)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

SECURITY AND PRIVACY ENGINEERING PRINCIPLES | SECURE SYSTEM MODIFICATION ASSESSMENT OBJECTIVE: Determine if:

SA-08(31)_ODP

systems or system components that implement the security design principle of secure system modiﬁcaon are deﬁned;

SA-08(31)

<SA-08(31)_ODP systems or system components> implement the security design principle of secure system modiﬁcaon.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SA-08(32)

SA-08(31)-Examine

[SELECT FROM: System and services acquision policy; conﬁguraon management policy and procedures; procedures addressing the security design principle of secure system modiﬁcaon used in the speciﬁcaon, design, development, implementaon, and modiﬁcaon of the system; system design documentaon; system conﬁguraon sengs and associated documentaon; change control records; security and privacy requirements and speciﬁcaons for the system; system security and privacy architecture; system security plan; other relevant documents or records].

SA-08(31)-Interview

SA-08(31)-Test

[SELECT FROM: Organizaonal processes for applying the security design principle of secure system modiﬁcaon in system speciﬁcaon, design, development, implementaon, and modiﬁcaon; mechanisms supporng the applicaon of the security design principle of secure system modiﬁcaon in system speciﬁcaon, design, development, implementaon, and modiﬁcaon; mechanisms that enforce security policies; organizaonal processes for managing change conﬁguraon; mechanisms supporng conﬁguraon control].

SECURITY AND PRIVACY ENGINEERING PRINCIPLES | SUFFICIENT DOCUMENTATION ASSESSMENT OBJECTIVE: Determine if:

SA-08(32)_ODP

systems or system components that implement the security design principle of suﬃcient documentaon are deﬁned;

SA-08(32)

<SA-08(32)_ODP systems or system components> implement the security design principle of suﬃcient documentaon.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: SA-08(32)-Examine

CHAPTER FOUR

[SELECT FROM: System and services acquision policy; procedures addressing the security design principle of suﬃcient documentaon used in the speciﬁcaon, design, development, implementaon, and modiﬁcaon of the system; system design documentaon; system conﬁguraon sengs and associated documentaon; change control records; security and privacy requirements and speciﬁcaons for the system; system security and privacy documentaon; system security and privacy architecture; system security plan; other relevant documents or records].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 478

NIST SP 800-53A, REV. 5

SA-08(32)

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SA-08(33)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

SECURITY AND PRIVACY ENGINEERING PRINCIPLES | SUFFICIENT DOCUMENTATION SA-08(32)-Interview

SA-08(32)-Test

[SELECT FROM: Organizaonal processes for applying the security design principle of suﬃcient documentaon in system speciﬁcaon, design, development, implementaon, and modiﬁcaon; mechanisms supporng the applicaon of the security design principle of suﬃcient documentaon in system speciﬁcaon, design, development, implementaon, and modiﬁcaon; mechanisms that enforce security policies; organizaonal processes for managing change conﬁguraon; mechanisms supporng conﬁguraon control].

SECURITY AND PRIVACY ENGINEERING PRINCIPLES | MINIMIZATION ASSESSMENT OBJECTIVE: Determine if:

SA-08(33)_ODP

processes that implement the privacy principle of minimizaon are deﬁned;

SA-08(33)

the privacy principle of minimizaon is implemented using <SA-08(33)_ODP processes>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

SA-08(33)-Examine

[SELECT FROM: System and services acquision policy; system and services acquision procedures; personally idenﬁable informaon processing policy; procedures addressing the minimizaon of personally idenﬁable informaon in system design; system design documentaon; system conﬁguraon sengs and associated documentaon; change control records; informaon security and privacy requirements and speciﬁcaons for the system; system security and privacy architecture; system security plan; privacy plan; privacy impact assessment; privacy risk assessment documentaon; other relevant documents or records].

SA-08(33)-Interview

SA-08(33)-Test

[SELECT FROM: Organizaonal processes for applying the privacy design principle of minimizaon in system speciﬁcaon, design, development, implementaon, and modiﬁcaon; mechanisms supporng the applicaon of the security design principle of suﬃcient documentaon in system speciﬁcaon, design, development, implementaon, and modiﬁcaon; mechanisms that enforce security and privacy policy; organizaonal processes for managing change conﬁguraon; mechanisms supporng conﬁguraon control].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 479

NIST SP 800-53A, REV. 5

SA-09

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

EXTERNAL SYSTEM SERVICES ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SA-09_ODP[01]

controls to be employed by external system service providers are deﬁned;

SA-09_ODP[02]

processes, methods, and techniques employed to monitor control compliance by external service providers are deﬁned;

SA-09a.[01]

providers of external system services comply with organizaonal security requirements;

SA-09a.[02]

providers of external system services comply with organizaonal privacy requirements;

SA-09a.[03]

providers of external system services employ <SA-09_ODP[01] controls>;

SA-09b.[01]

organizaonal oversight with regard to external system services are deﬁned and documented;

SA-09b.[02]

user roles and responsibilies with regard to external system services are deﬁned and documented;

SA-09c.

<SA-09_ODP[02] processes, methods, and techniques> are employed to monitor control compliance by external service providers on an ongoing basis.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SA-09(01)

SA-09-Examine

[SELECT FROM: System and services acquision policy; system and services acquision procedures; procedures addressing methods and techniques for monitoring control compliance by external service providers of system services; acquision documentaon; contracts; service level agreements; interagency agreements; licensing agreements; list of organizaonal security and privacy requirements for external provider services; control assessment results or reports from external providers of system services; system security plan; privacy plan; supply chain risk management plan; other relevant documents or records].

SA-09-Interview

[SELECT FROM: Organizaonal personnel with acquision responsibilies; external providers of system services; organizaonal personnel with informaon security and privacy responsibilies; organizaonal personnel with supply chain risk management responsibilies].

SA-09-Test

[SELECT FROM: Organizaonal processes for monitoring security and privacy control compliance by external service providers on an ongoing basis; mechanisms for monitoring security and privacy control compliance by external service providers on an ongoing basis].

EXTERNAL SYSTEM SERVICES | RISK ASSESSMENTS AND ORGANIZATIONAL APPROVALS ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

SA-09(01)_ODP

personnel or roles that approve the acquision or outsourcing of dedicated informaon security services is/are deﬁned;

SA-09(01)(a)

an organizaonal assessment of risk is conducted prior to the acquision or outsourcing of informaon security services;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 480

NIST SP 800-53A, REV. 5

SA-09(01)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

EXTERNAL SYSTEM SERVICES | RISK ASSESSMENTS AND ORGANIZATIONAL APPROVALS SA-09(01)(b)

<SA-09(01)_ODP personnel or roles> approve the acquision or outsourcing of dedicated informaon security services.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SA-09(02)

SA-09(01)-Examine

[SELECT FROM: System and services acquision policy; supply chain risk management policy and procedures; procedures addressing external system services; acquision documentaon; acquision contracts for the system, system component, or system service; risk assessment reports; approval records for the acquision or outsourcing of dedicated security services; system security plan; supply chain risk management plan; other relevant documents or records].

SA-09(01)-Interview

[SELECT FROM: Organizaonal personnel with system and service acquision responsibilies; organizaonal personnel with system security responsibilies; external providers of system services; organizaonal personnel with informaon security responsibilies; organizaonal personnel with supply chain risk management responsibilies].

SA-09(01)-Test

[SELECT FROM: Organizaonal processes for conducng a risk assessment prior to acquiring or outsourcing dedicated security services; organizaonal processes for approving the outsourcing of dedicated security services; mechanisms supporng and/or implemenng risk assessment; mechanisms supporng and/or implemenng approval processes].

EXTERNAL SYSTEM SERVICES | IDENTIFICATION OF FUNCTIONS, PORTS, PROTOCOLS, AND SERVICES ASSESSMENT OBJECTIVE: Determine if:

SA-09(02)_ODP

external system services that require the idenﬁcaon of funcons, ports, protocols, and other services are deﬁned;

SA-09(02)

providers of <SA-09(02)_ODP external system services> are required to idenfy the funcons, ports, protocols, and other services required for the use of such services.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

SA-09(02)-Examine

[SELECT FROM: System and services acquision policy; supply chain risk management policy and procedures; procedures addressing external system services; acquision contracts for the system, system component, or system service; acquision documentaon; solicitaon documentaon; service level agreements; organizaonal security requirements and security speciﬁcaons for external service providers; list of required funcons, ports, protocols, and other services; system security plan; other relevant documents or records].

SA-09(02)-Interview

[SELECT FROM: Organizaonal personnel with system and service acquision responsibilies; organizaonal personnel with informaon security responsibilies; system/network administrators; external providers of system services].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 481

NIST SP 800-53A, REV. 5

SA-09(03)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

EXTERNAL SYSTEM SERVICES | ESTABLISH AND MAINTAIN TRUST RELATIONSHIP WITH PROVIDERS ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SA-09(03)_ODP[01]

security requirements, properes, factors, or condions deﬁning acceptable trust relaonships on which a trust relaonship is maintained are deﬁned;

SA-09(03)_ODP[02]

privacy requirements, properes, factors, or condions deﬁning acceptable trust relaonships on which a trust relaonship is maintained are deﬁned;

SA-09(03)[01]

trust relaonships with external service provides based on <SA-09(03)_ODP[01] security requirements, properes, factors, or condions> are established and documented;

SA-09(03)[02]

trust relaonships with external service provides based on <SA-09(03)_ODP[01] security requirements, properes, factors, or condions> are maintained;

SA-09(03)[03]

trust relaonships with external service provides based on <SA-09(03)_ODP[02] privacy requirements, properes, factors, or condions> are established and documented;

SA-09(03)[04]

trust relaonships with external service provides based on <SA-09(03)_ODP[02] privacy requirements, properes, factors, or condions> are maintained.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SA-09(04)

SA-09(03)-Examine

[SELECT FROM: System and services acquision policy; system and services acquision procedures; acquision contracts for the system, system component, or system service; acquision documentaon; solicitaon documentaon; service level agreements; memorandum of understanding; memorandum of agreements; list of organizaonal security and privacy requirements, properes, factors, or condions for external provider services; documentaon of trust relaonships with external service providers; system security plan; privacy plan; supply chain risk management plan; other relevant documents or records].

SA-09(03)-Interview

[SELECT FROM: Organizaonal personnel with acquision responsibilies; organizaonal personnel with informaon security and privacy responsibilies; external providers of system services; organizaonal personnel with supply chain risk management responsibilies].

EXTERNAL SYSTEM SERVICES | CONSISTENT INTERESTS OF CONSUMERS AND PROVIDERS ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

SA-09(04)_ODP[01]

external service providers are deﬁned;

SA-09(04)_ODP[02]

acons to be taken to verify that the interests of external service providers are consistent with and reﬂect organizaonal interests are deﬁned;

SA-09(04)

<SA-09(04)_ODP[02] acons> are taken to verify that the interests of <SA-09(04)_ODP[01] external service providers> are consistent with and reﬂect organizaonal interests.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 482

NIST SP 800-53A, REV. 5

SA-09(04)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

EXTERNAL SYSTEM SERVICES | CONSISTENT INTERESTS OF CONSUMERS AND PROVIDERS POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SA-09(05)

SA-09(04)-Examine

[SELECT FROM: System and services acquision policy; procedures addressing external system services; acquision contracts for the system, system component, or system service; solicitaon documentaon; acquision documentaon; service level agreements; organizaonal security requirements/safeguards for external service providers; personnel security policies for external service providers; assessments performed on external service providers; system security plan; supply chain risk management plan; other relevant documents or records].

SA-09(04)-Interview

[SELECT FROM: Organizaonal personnel with system and service acquision responsibilies; organizaonal personnel with informaon security responsibilies; external providers of system services; organizaonal personnel with supply chain risk management responsibilies].

SA-09(04)-Test

[SELECT FROM: Organizaonal processes for deﬁning and employing safeguards to ensure consistent interests with external service providers; mechanisms supporng and/or implemenng safeguards to ensure consistent interests with external service providers].

EXTERNAL SYSTEM SERVICES | PROCESSING, STORAGE, AND SERVICE LOCATION ASSESSMENT OBJECTIVE: Determine if:

SA-09(05)_ODP[01]

one or more of the following PARAMETER VALUES is/are selected: {informaon processing; informaon or data; system services};

SA-09(05)_ODP[02]

locaons where <SA-09(05)_ODP[01] SELECTED PARAMETER VALUE(S)> is/are to be restricted are deﬁned;

SA-09(05)_ODP[03]

requirements or condions for restricng the locaon of <SA-09(05)_ODP[01] SELECTED PARAMETER VALUE(S)> are deﬁned;

SA-09(05)

based on <SA-09(05)_ODP[03] requirements>, <SA-09(05)_ODP[01] SELECTED PARAMETER VALUE(S)> is/are restricted to <SA-09(05)_ODP[02] locaons>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

SA-09(05)-Examine

[SELECT FROM: System and services acquision policy; procedures addressing external system services; acquision contracts for the system, system component, or system service; solicitaon documentaon; acquision documentaon; service level agreements; restricted locaons for informaon processing; informaon/ data and/or system services; informaon processing, informaon/data, and/or system services to be maintained in restricted locaons; organizaonal security requirements or condions for external providers; system security plan; supply chain risk management plan; other relevant documents or records].

SA-09(05)-Interview

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 483

NIST SP 800-53A, REV. 5

SA-09(05)

EXTERNAL SYSTEM SERVICES | PROCESSING, STORAGE, AND SERVICE LOCATION SA-09(05)-Test

SA-09(06)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

[SELECT FROM: Organizaonal processes for deﬁning the requirements to restrict locaons of informaon processing, informaon/data, or informaon services; organizaonal processes for ensuring the locaon is restricted in accordance with requirements or condions].

EXTERNAL SYSTEM SERVICES | ORGANIZATION-CONTROLLED CRYPTOGRAPHIC KEYS ASSESSMENT OBJECTIVE:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

Determine if: SA-09(06)

exclusive control of cryptographic keys is maintained for encrypted material stored or transmied through an external system.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SA-09(07)

SA-09(06)-Examine

[SELECT FROM: System and services acquision policy; procedures addressing external system services; acquision contracts for the system, system component, or system service; solicitaon documentaon; acquision documentaon; service level agreements; procedures addressing organizaon-controlled cryptographic key management; organizaonal security requirements or condions for external providers; system security plan; supply chain risk management plan; other relevant documents or records].

SA-09(06)-Interview

[SELECT FROM: Organizaonal personnel with system and service acquision responsibilies; organizaonal personnel with informaon security responsibilies; organizaon personnel with cryptographic key management responsibilies; external providers of system services; organizaonal personnel with supply chain risk management responsibilies].

SA-09(06)-Test

[SELECT FROM: Organizaonal processes for cryptographic key management; mechanisms for supporng and implemenng the management of organizaoncontrolled cryptographic keys].

EXTERNAL SYSTEM SERVICES | ORGANIZATION-CONTROLLED INTEGRITY CHECKING ASSESSMENT OBJECTIVE: Determine if: SA-09(07)

the capability is provided to check the integrity of informaon while it resides in the external system.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: SA-09(07)-Examine

CHAPTER FOUR

[SELECT FROM: System and services acquision policy; procedures addressing external system services; acquision contracts for the system, system component, or system service; solicitaon documentaon; acquision documentaon; service level agreements; procedures addressing organizaon-controlled integrity checking; informaon/data and/or system services; organizaonal security requirements or condions for external providers; system security plan; supply chain risk management plan; other relevant documents or records].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 484

NIST SP 800-53A, REV. 5

SA-09(07)

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SA-09(08)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

EXTERNAL SYSTEM SERVICES | ORGANIZATION-CONTROLLED INTEGRITY CHECKING SA-09(07)-Interview

[SELECT FROM: Organizaonal personnel with system and service acquision responsibilies; organizaonal personnel with informaon security responsibilies; organizaon personnel with integrity checking responsibilies; external providers of system services; organizaonal personnel with supply chain risk management responsibilies].

SA-09(07)-Test

[SELECT FROM: Organizaonal processes for integrity checking; mechanisms for supporng and implemenng integrity checking of informaon in external systems].

EXTERNAL SYSTEM SERVICES | PROCESSING AND STORAGE LOCATION — U.S. JURISDICTION ASSESSMENT OBJECTIVE: Determine if: SA-09(08)

the geographic locaon of informaon processing and data storage is restricted to facilies located within the legal jurisdiconal boundary of the United States.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SA-10

SA-09(08)-Examine

[SELECT FROM: System and services acquision policy; system and services acquision procedures; procedures addressing external system services; acquision contracts for the system, system component, or system service; solicitaon documentaon; acquision documentaon; service level agreements; procedures addressing determining jurisdicon restricons for processing and storage locaon; informaon/data and/or system services; organizaonal security requirements or condions for external providers; system security plan; supply chain risk management plan; other relevant documents or records].

SA-09(08)-Interview

[SELECT FROM: Organizaonal personnel with system and service acquision responsibilies; organizaonal personnel with informaon security responsibilies; organizaon personnel with supply chain risk management responsibilies; external providers of system services].

SA-09(08)-Test

[SELECT FROM: Organizaonal processes restricng external system service providers to process and store informaon within the legal jurisdiconal boundary of the United States].

DEVELOPER CONFIGURATION MANAGEMENT ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

SA-10_ODP[01]

one or more of the following PARAMETER VALUES is/are selected: {design; development; implementaon; operaon; disposal};

SA-10_ODP[02]

conﬁguraon items under conﬁguraon management are deﬁned;

SA-10_ODP[03]

personnel to whom security ﬂaws and ﬂaw resoluons within the system, component, or service are reported is/are deﬁned;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 485

NIST SP 800-53A, REV. 5

SA-10

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

DEVELOPER CONFIGURATION MANAGEMENT

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SA-10a.

the developer of the system, system component, or system service is required to perform conﬁguraon management during system, component, or service <SA-10_ODP[01] SELECTED PARAMETER VALUE(S)>;

SA-10b.[01]

the developer of the system, system component, or system service is required to document the integrity of changes to <SA-10_ODP[02] conﬁguraon items>;

SA-10b.[02]

the developer of the system, system component, or system service is required to manage the integrity of changes to <SA-10_ODP[02] conﬁguraon items>;

SA-10b.[03]

the developer of the system, system component, or system service is required to control the integrity of changes to <SA-10_ODP[02] conﬁguraon items>;

SA-10c.

the developer of the system, system component, or system service is required to implement only organizaon-approved changes to the system, component, or service;

SA-10d.[01]

the developer of the system, system component, or system service is required to document approved changes to the system, component, or service;

SA-10d.[02]

the developer of the system, system component, or system service is required to document the potenal security impacts of approved changes;

SA-10d.[03]

the developer of the system, system component, or system service is required to document the potenal privacy impacts of approved changes;

SA-10e.[01]

the developer of the system, system component, or system service is required to track security ﬂaws within the system, component, or service;

SA-10e.[02]

the developer of the system, system component, or system service is required to track security ﬂaw resoluons within the system, component, or service;

SA-10e.[03]

the developer of the system, system component, or system service is required to report ﬁndings to <SA-10_ODP[03] personnel>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

SA-10-Examine

[SELECT FROM: System and services acquision policy; procedures addressing system developer conﬁguraon management; solicitaon documentaon; acquision documentaon; service level agreements; acquision contracts for the system, system component, or system service; system developer conﬁguraon management plan; security ﬂaw and ﬂaw resoluon tracking records; system change authorizaon records; change control records; conﬁguraon management records; system security plan; other relevant documents or records].

SA-10-Interview

[SELECT FROM: Organizaonal personnel with system and service acquision responsibilies; organizaonal personnel with informaon security responsibilies; organizaonal personnel with conﬁguraon management responsibilies; system developers].

SA-10-Test

[SELECT FROM: Organizaonal processes for monitoring developer conﬁguraon management; mechanisms supporng and/or implemenng the monitoring of developer conﬁguraon management].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 486

NIST SP 800-53A, REV. 5

SA-10(01)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

DEVELOPER CONFIGURATION MANAGEMENT | SOFTWARE AND FIRMWARE INTEGRITY VERIFICATION ASSESSMENT OBJECTIVE: Determine if: SA-10(01)

the developer of the system, system component, or system service is required to enable integrity veriﬁcaon of soware and ﬁrmware components.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SA-10(02)

SA-10(01)-Examine

[SELECT FROM: System and services acquision policy; procedures addressing system developer conﬁguraon management; solicitaon documentaon; acquision documentaon; service level agreements; acquision contracts for the system, system component, or system service; system developer conﬁguraon management plan; soware and ﬁrmware integrity veriﬁcaon records; system change authorizaon records; change control records; conﬁguraon management records; system security plan; supply chain risk management plan; other relevant documents or records].

SA-10(01)-Interview

[SELECT FROM: Organizaonal personnel with system and service acquision responsibilies; organizaonal personnel with informaon security responsibilies; organizaonal personnel with conﬁguraon management responsibilies; system developers; organizaonal personnel with supply chain risk management responsibilies].

SA-10(01)-Test

[SELECT FROM: Organizaonal processes for monitoring developer conﬁguraon management; mechanisms supporng and/or implemenng the monitoring of developer conﬁguraon management].

DEVELOPER CONFIGURATION MANAGEMENT | ALTERNATIVE CONFIGURATION MANAGEMENT PROCESSES ASSESSMENT OBJECTIVE: Determine if: SA-10(02)

an alternate conﬁguraon management process has been provided using organizaonal personnel in the absence of a dedicated developer conﬁguraon management team.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

SA-10(02)-Examine

[SELECT FROM: System and services acquision policy; system and services acquision procedures; conﬁguraon management policy; conﬁguraon management plan; solicitaon documentaon; acquision documentaon; service level agreements; acquision contracts for the system, system component, or system service; system developer conﬁguraon management plan; security impact analyses; privacy impact analyses; privacy impact assessment; privacy risk assessment documentaon; system security plan; privacy plan; other relevant documents or records].

SA-10(02)-Interview

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 487

NIST SP 800-53A, REV. 5

SA-10(02)

DEVELOPER CONFIGURATION MANAGEMENT | ALTERNATIVE CONFIGURATION MANAGEMENT PROCESSES SA-10(02)-Test

SA-10(03)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

[SELECT FROM: Organizaonal processes for monitoring developer conﬁguraon management; mechanisms supporng and/or implemenng the monitoring of developer conﬁguraon management].

DEVELOPER CONFIGURATION MANAGEMENT | HARDWARE INTEGRITY VERIFICATION ASSESSMENT OBJECTIVE:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

Determine if: SA-10(03)

the developer of the system, system component, or system service is required to enable integrity veriﬁcaon of hardware components.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SA-10(04)

SA-10(03)-Examine

[SELECT FROM: System and services acquision policy; procedures addressing system developer conﬁguraon management; solicitaon documentaon; acquision documentaon; service level agreements; acquision contracts for the system, system component, or system service; system developer conﬁguraon management plan; hardware integrity veriﬁcaon records; system security plan; supply chain risk management plan; other relevant documents or records].

SA-10(03)-Interview

[SELECT FROM: Organizaonal personnel with system and service acquision responsibilies; organizaonal personnel with informaon security responsibilies; organizaonal personnel with conﬁguraon management responsibilies; system developers; organizaonal personnel with supply chain risk management responsibilies].

SA-10(03)-Test

[SELECT FROM: Organizaonal processes for monitoring developer conﬁguraon management; mechanisms supporng and/or implemenng the monitoring of developer conﬁguraon management].

DEVELOPER CONFIGURATION MANAGEMENT | TRUSTED GENERATION ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

SA-10(04)[01]

the developer of the system, system component, or system service is required to employ tools for comparing newly generated versions of security-relevant hardware descripons with previous versions;

SA-10(04)[02]

the developer of the system, system component, or system service is required to employ tools for comparing newly generated versions of source code with previous versions;

SA-10(04)[03]

the developer of the system, system component, or system service is required to employ tools for comparing newly generated versions of object code with previous versions.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 488

NIST SP 800-53A, REV. 5

SA-10(04)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

DEVELOPER CONFIGURATION MANAGEMENT | TRUSTED GENERATION POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SA-10(05)

SA-10(04)-Examine

[SELECT FROM: System and services acquision policy; procedures addressing system developer conﬁguraon management; solicitaon documentaon; acquision documentaon; service level agreements; acquision contracts for the system, system component, or system service; system developer conﬁguraon management plan; change control records; conﬁguraon management records; conﬁguraon control audit records; system security plan; other relevant documents or records].

SA-10(04)-Test

[SELECT FROM: Organizaonal processes for monitoring developer conﬁguraon management; mechanisms supporng and/or implemenng the monitoring of developer conﬁguraon management].

DEVELOPER CONFIGURATION MANAGEMENT | MAPPING INTEGRITY FOR VERSION CONTROL ASSESSMENT OBJECTIVE: Determine if: SA-10(05)

the developer of the system, system component, or system service is required to maintain the integrity of the mapping between the master build data describing the current version of security-relevant hardware, soware, and ﬁrmware and the on-site master copy of the data for the current version.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

SA-10(05)-Examine

[SELECT FROM: System and services acquision policy; procedures addressing system developer conﬁguraon management; solicitaon documentaon; acquision documentaon; service level agreements; acquision contracts for the system, system component, or system service; system developer conﬁguraon management plan; change control records; conﬁguraon management records; version control change/update records; integrity veriﬁcaon records between master copies of security-relevant hardware, soware, and ﬁrmware (including designs and source code); system security plan; other relevant documents or records].

SA-10(05)-Interview

[SELECT FROM: Organizaonal personnel with system and service acquision responsibilies; organizaonal personnel with informaon security responsibilies; organizaonal personnel with conﬁguraon management responsibilies; system developers].

SA-10(05)-Test

[SELECT FROM: Organizaonal processes for monitoring developer conﬁguraon management; mechanisms supporng and/or implemenng the monitoring of developer conﬁguraon management].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 489

NIST SP 800-53A, REV. 5

SA-10(06)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

DEVELOPER CONFIGURATION MANAGEMENT | TRUSTED DISTRIBUTION ASSESSMENT OBJECTIVE: Determine if: SA-10(06)

the developer of the system, system component, or system service is required to execute procedures for ensuring that security-relevant hardware, soware, and ﬁrmware updates distributed to the organizaon are exactly as speciﬁed by the master copies.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SA-10(07)

SA-10(06)-Examine

[SELECT FROM: System and services acquision policy; procedures addressing system developer conﬁguraon management; solicitaon documentaon; acquision documentaon; service level agreements; acquision contracts for the system, system component, or system service; system developer conﬁguraon management plan; change control records; conﬁguraon management records; system security plan; other relevant documents or records].

SA-10(06)-Interview

[SELECT FROM: Organizaonal personnel with system and service acquision responsibilies; organizaonal personnel with informaon security responsibilies; organizaonal personnel with conﬁguraon management responsibilies; system developers].

SA-10(06)-Test

[SELECT FROM: Organizaonal processes for monitoring developer conﬁguraon management; mechanisms supporng and/or implemenng the monitoring of developer conﬁguraon management].

DEVELOPER CONFIGURATION MANAGEMENT | SECURITY AND PRIVACY REPRESENTATIVES ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

SA-10(07)_ODP[01]

security representaves to be included in the conﬁguraon change management and control process are deﬁned;

SA-10(07)_ODP[02]

privacy representaves to be included in the conﬁguraon change management and control process are deﬁned;

SA-10(07)_ODP[03]

conﬁguraon change management and control processes in which security representaves are required to be included are deﬁned;

SA-10(07)_ODP[04]

conﬁguraon change management and control processes in which privacy representaves are required to be included are deﬁned;

SA-10(07)[01]

<SA-10(07)_ODP[01] security representaves> are required to be included in the <SA-10(07)_ODP[03] conﬁguraon change management and control processes>;

SA-10(07)[02]

<SA-10(07)_ODP[02] privacy representaves> are required to be included in the <SA-10(07)_ODP[04] conﬁguraon change management and control processes>.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 490

NIST SP 800-53A, REV. 5

SA-10(07)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

DEVELOPER CONFIGURATION MANAGEMENT | SECURITY AND PRIVACY REPRESENTATIVES POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SA-11

SA-10(07)-Examine

[SELECT FROM: System and services acquision policy; system and services acquision procedures; conﬁguraon management policy; conﬁguraon management plan; solicitaon documentaon requiring representaves for security and privacy; acquision documentaon; service level agreements; acquision contracts for the system, system component, or system service; system developer conﬁguraon management plan; change control records; conﬁguraon management records; system security plan; other relevant documents or records].

SA-10(07)-Interview

[SELECT FROM: Organizaonal personnel with system and service acquision responsibilies; organizaonal personnel with informaon security and privacy responsibilies; organizaonal personnel with conﬁguraon management responsibilies; system developers].

DEVELOPER TESTING AND EVALUATION ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

SA-11_ODP[01]

one or more of the following PARAMETER VALUES is/are selected: {unit; integraon; system; regression};

SA-11_ODP[02]

frequency at which to conduct <SA-11_ODP[01] SELECTED PARAMETER VALUE(S)> tesng/evaluaon is deﬁned;

SA-11_ODP[03]

depth and coverage of <SA-11_ODP[01] SELECTED PARAMETER VALUE(S)> tesng/evaluaon is deﬁned;

SA-11a.[01]

the developer of the system, system component, or system service is required at all post-design stages of the system development life cycle to develop a plan for ongoing security assessments;

SA-11a.[02]

the developer of the system, system component, or system service is required at all post-design stages of the system development life cycle to implement a plan for ongoing security assessments;

SA-11a.[03]

the developer of the system, system component, or system service is required at all post-design stages of the system development life cycle to develop a plan for privacy assessments;

SA-11a.[04]

the developer of the system, system component, or system service is required at all post-design stages of the system development life cycle to implement a plan for ongoing privacy assessments;

SA-11b.

the developer of the system, system component, or system service is required at all post-design stages of the system development life cycle to perform <SA-11_ODP[01] SELECTED PARAMETER VALUE(S)> tesng/evaluaon <SA-11_ODP[02] frequency to conduct> at <SA-11_ODP[03] depth and coverage>;

SA-11c.[01]

the developer of the system, system component, or system service is required at all post-design stages of the system development life cycle to produce evidence of the execuon of the assessment plan;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 491

NIST SP 800-53A, REV. 5

SA-11

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

DEVELOPER TESTING AND EVALUATION SA-11c.[02]

the developer of the system, system component, or system service is required at all post-design stages of the system development life cycle to produce the results of the tesng and evaluaon;

SA-11d.

the developer of the system, system component, or system service is required at all post-design stages of the system development life cycle to implement a veriﬁable ﬂaw remediaon process;

SA-11e.

the developer of the system, system component, or system service is required at all post-design stages of the system development life cycle to correct ﬂaws idenﬁed during tesng and evaluaon.

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SA-11(01)

SA-11-Examine

[SELECT FROM: System and services acquision policy; system and services acquision procedures; procedures addressing system developer security and privacy tesng; procedures addressing ﬂaw remediaon; solicitaon documentaon; acquision documentaon; service level agreements; acquision contracts for the system, system component, or system service; security and privacy architecture; system design documentaon; system developer security and privacy assessment plans; results of developer security and privacy assessments for the system, system component, or system service; security and privacy ﬂaw and remediaon tracking records; system security plan; privacy plan; privacy impact assessment; privacy risk assessment documentaon; other relevant documents or records].

SA-11-Interview

[SELECT FROM: Organizaonal personnel with system and service acquision responsibilies; organizaonal personnel with informaon security and privacy responsibilies; organizaonal personnel with developer security and privacy tesng responsibilies; system developers].

SA-11-Test

[SELECT FROM: Organizaonal processes for monitoring developer security tesng and evaluaon; mechanisms supporng and/or implemenng the monitoring of developer security and privacy tesng and evaluaon].

DEVELOPER TESTING AND EVALUATION | STATIC CODE ANALYSIS ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

SA-11(01)[01]

the developer of the system, system component, or system service is required to employ stac code analysis tools to idenfy common ﬂaws;

SA-11(01)[02]

the developer of the system, system component, or system service is required to employ stac code analysis tools to document the results of the analysis.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 492

NIST SP 800-53A, REV. 5

SA-11(01)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

DEVELOPER TESTING AND EVALUATION | STATIC CODE ANALYSIS POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SA-11(02)

SA-11(01)-Examine

[SELECT FROM: System and services acquision policy; system and services acquision procedures; procedures addressing system developer security tesng; procedures addressing ﬂaw remediaon; solicitaon documentaon; acquision documentaon; service level agreements; acquision contracts for the system, system component, or system service; security and privacy architecture; system design documentaon; system developer security and privacy assessment plans; results of system developer security and privacy assessments; security ﬂaw and remediaon tracking records; system security plan; privacy plan; privacy impact assessment; privacy risk assessment documentaon; other relevant documents or records].

SA-11(01)-Interview

[SELECT FROM: Organizaonal personnel with system and service acquision responsibilies; organizaonal personnel with informaon security responsibilies; organizaonal personnel with developer security and privacy tesng responsibilies; organizaonal personnel with conﬁguraon management responsibilies; system developers].

SA-11(01)-Test

DEVELOPER TESTING AND EVALUATION | THREAT MODELING AND VULNERABILITY ANALYSES ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

SA-11(02)_ODP[01]

informaon concerning impact, environment of operaons, known or assumed threats, and acceptable risk levels to be used as contextual informaon for threat modeling and vulnerability analyses is deﬁned;

SA-11(02)_ODP[02]

the tools and methods to be employed for threat modeling and vulnerability analyses are deﬁned;

SA-11(02)_ODP[03]

the breadth and depth of threat modeling to be conducted is deﬁned;

SA-11(02)_ODP[04]

the breadth and depth of vulnerability analyses to be conducted is deﬁned;

SA-11(02)_ODP[05]

acceptance criteria to be met by produced evidence for threat modeling are deﬁned;

SA-11(02)_ODP[06]

acceptance criteria to be met by produced evidence for vulnerability analyses are deﬁned;

SA-11(02)(a)[01]

the developer of the system, system component, or system service is required to perform threat modeling during development of the system, component, or service that uses <SA-11(02)_ODP[01] informaon>;

SA-11(02)(a)[02]

the developer of the system, system component, or system service is required to perform vulnerability analyses during development of the system, component, or service that uses <SA-11(02)_ODP[01] informaon>;

SA-11(02)(a)[03]

the developer of the system, system component, or system service is required to perform threat modeling during the subsequent tesng and evaluaon of the system, component, or service that uses <SA-11(02)_ODP[01] informaon>;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 493

NIST SP 800-53A, REV. 5

SA-11(02)

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5 CHAPTER FOUR

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

DEVELOPER TESTING AND EVALUATION | THREAT MODELING AND VULNERABILITY ANALYSES SA-11(02)(a)[04]

the developer of the system, system component, or system service is required to perform vulnerability analyses during the subsequent tesng and evaluaon of the system, component, or service that uses <SA-11(02)_ODP[01] informaon>;

SA-11(02)(b)[01]

the developer of the system, system component, or system service is required to perform threat modeling during development of the system, component, or service that employs <SA-11(02)_ODP[02] tools and methods>;

SA-11(02)(b)[02]

SA-11(02)(b)[03]

the developer of the system, system component, or system service is required to perform vulnerability analyses during development of the system, component, or service that employs <SA-11(02)_ODP[02] tools and methods>;

SA-11(02)(b)[04]

SA-11(02)(c)[01]

the developer of the system, system component, or system service is required to perform threat modeling at <SA-11(02)_ODP[03] breadth and depth> during development of the system, component, or service;

SA-11(02)(c)[02]

SA-11(02)(d)[01]

the developer of the system, system component, or system service is required to perform threat modeling during development of the system, component, or service that produces evidence that meets <SA-11(02)_ODP[05] acceptance criteria>;

SA-11(02)(d)[02]

SA-11(02)(d)[03]

the developer of the system, system component, or system service is required to perform vulnerability analyses during development of the system, component, or service that produces evidence that meets <SA-11(02)_ODP[06] acceptance criteria>;

SA-11(02)(d)[04]

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 494

NIST SP 800-53A, REV. 5

SA-11(02)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

DEVELOPER TESTING AND EVALUATION | THREAT MODELING AND VULNERABILITY ANALYSES POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SA-11(03)

SA-11(02)-Examine

[SELECT FROM: System and services acquision policy; procedures addressing system developer security tesng; solicitaon documentaon; acquision documentaon; service level agreements; acquision contracts for the system, system component, or system service; system developer security test plans; records of developer security tesng results for the system, system component, or system service; vulnerability scanning results; system risk assessment reports; threat and vulnerability analysis reports; system security plan; supply chain risk management plan; other relevant documents or records].

SA-11(02)-Interview

[SELECT FROM: Organizaonal personnel with system and service acquision responsibilies; organizaonal personnel with informaon security responsibilies; organizaonal personnel with developer security tesng responsibilies; system developers; organizaonal personnel with supply chain risk management responsibilies].

SA-11(02)-Test

DEVELOPER TESTING AND EVALUATION | INDEPENDENT VERIFICATION OF ASSESSMENT PLANS AND EVIDENCE ASSESSMENT OBJECTIVE: Determine if:

SA-11(03)_ODP

independence criteria to be sasﬁed by an independent agent are deﬁned;

SA-11(03)(a)[01]

an independent agent is required to sasfy <SA-11(03)_ODP independence criteria> to verify the correct implementaon of the developer security assessment plan and the evidence produced during tesng and evaluaon;

SA-11(03)(a)[02]

an independent agent is required to sasfy <SA-11(03)_ODP independence criteria> to verify the correct implementaon of the developer privacy assessment plan and the evidence produced during tesng and evaluaon;

SA-11(03)(b)

the independent agent is provided with suﬃcient informaon to complete the veriﬁcaon process or granted the authority to obtain such informaon.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

SA-11(03)-Examine

[SELECT FROM: System and services acquision policy; system and services acquision procedures; procedures addressing system developer security tesng; solicitaon documentaon; acquision documentaon; service level agreements; acquision contracts for the system, system component, or system service; independent veriﬁcaon and validaon reports; security and privacy assessment plans; results of security and privacy assessments for the system, system component, or system service; system security plan; privacy plan; privacy program plan; other relevant documents or records].

SA-11(03)-Interview

[SELECT FROM: Organizaonal personnel with system and service acquision responsibilies; organizaonal personnel with informaon security and privacy responsibilies; organizaonal personnel with developer security tesng responsibilies; system developers; independent veriﬁcaon agent].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 495

NIST SP 800-53A, REV. 5

SA-11(03)

DEVELOPER TESTING AND EVALUATION | INDEPENDENT VERIFICATION OF ASSESSMENT PLANS AND EVIDENCE SA-11(03)-Test

SA-11(04)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

DEVELOPER TESTING AND EVALUATION | MANUAL CODE REVIEWS ASSESSMENT OBJECTIVE:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

Determine if:

SA-11(04)_ODP[01]

speciﬁc code requiring manual code review is deﬁned;

SA-11(04)_ODP[02]

processes, procedures, and/or techniques used for manual code reviews are deﬁned;

SA-11(04)

the developer of the system, system component, or system service is required to perform a manual code review of <SA-11(04)_ODP[01] speciﬁc code> using <SA-11(04)_ODP[02] processes, procedures, and/or techniques>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SA-11(05)

SA-11(04)-Examine

[SELECT FROM: System and services acquision policy; procedures addressing system developer security tesng; processes, procedures, and/or techniques for performing manual code reviews; solicitaon documentaon; acquision documentaon; service level agreements; acquision contracts for the system, system component, or system service; system developer security tesng and evaluaon plans; system developer security tesng and evaluaon results; list of code requiring manual reviews; records of manual code reviews; system security plan; other relevant documents or records].

SA-11(04)-Interview

[SELECT FROM: Organizaonal personnel with system and service acquision responsibilies; organizaonal personnel with informaon security responsibilies; organizaonal personnel with developer security tesng responsibilies; system developers; independent veriﬁcaon agent].

SA-11(04)-Test

[SELECT FROM: Organizaonal processes for monitoring developer security tesng and evaluaon; mechanisms supporng and/or implemenng the monitoring of developer tesng and evaluaon].

DEVELOPER TESTING AND EVALUATION | PENETRATION TESTING ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

SA-11(05)_ODP[01]

the breadth of penetraon tesng is deﬁned;

SA-11(05)_ODP[02]

the depth of penetraon tesng is deﬁned;

SA-11(05)_ODP[03]

constraints of penetraon tesng are deﬁned;

SA-11(05)(a)[01]

the developer of the system, system component, or system service is required to perform penetraon tesng at the following level of rigor: <SA-11(05)_ODP[01] breadth>;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 496

NIST SP 800-53A, REV. 5

SA-11(05)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

DEVELOPER TESTING AND EVALUATION | PENETRATION TESTING SA-11(05)(a)[02]

the developer of the system, system component, or system service is required to perform penetraon tesng at the following level of rigor: <SA-11(05)_ODP[02] depth>;

SA-11(05)(b)

the developer of the system, system component, or system service is required to perform penetraon tesng under <SA-11(05)_ODP[03] constraints>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SA-11(06)

SA-11(05)-Examine

[SELECT FROM: System and services acquision policy; system and services acquision procedures; procedures addressing system developer security tesng; solicitaon documentaon; acquision documentaon; service level agreements; acquision contracts for the system, system component, or system service; system developer penetraon tesng and evaluaon plans; system developer penetraon tesng and evaluaon results; system security plan; privacy plan; personally idenﬁable informaon processing policy; other relevant documents or records].

SA-11(05)-Interview

[SELECT FROM: Organizaonal personnel with system and service acquision responsibilies; organizaonal personnel with informaon security and privacy responsibilies; organizaonal personnel with developer security tesng responsibilies; system developers; independent veriﬁcaon agent].

SA-11(05)-Test

[SELECT FROM: Organizaonal processes for monitoring developer security and privacy assessments; mechanisms supporng and/or implemenng the monitoring of developer security and privacy assessments].

DEVELOPER TESTING AND EVALUATION | ATTACK SURFACE REVIEWS ASSESSMENT OBJECTIVE: Determine if: SA-11(06)

the developer of the system, system component, or system service is required to perform aack surface reviews.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

SA-11(06)-Examine

[SELECT FROM: System and services acquision policy; procedures addressing system developer security tesng; solicitaon documentaon; acquision documentaon; service level agreements; acquision contracts for the system, system component, or system service; system developer security tesng and evaluaon plans; system developer security tesng and evaluaon results; records of aack surface reviews; system security plan; other relevant documents or records].

SA-11(06)-Interview

[SELECT FROM: Organizaonal personnel with system and service acquision responsibilies; organizaonal personnel with informaon security responsibilies; organizaonal personnel with developer security tesng responsibilies; organizaonal personnel with conﬁguraon management responsibilies; system developers].

SA-11(06)-Test

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 497

NIST SP 800-53A, REV. 5

SA-11(07)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

DEVELOPER TESTING AND EVALUATION | VERIFY SCOPE OF TESTING AND EVALUATION ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SA-11(07)_ODP[01]

the breadth of tesng and evaluaon of required controls is deﬁned;

SA-11(07)_ODP[02]

the depth of tesng and evaluaon of required controls is deﬁned;

SA-11(07)[01]

the developer of the system, system component, or system service is required to verify that the scope of tesng and evaluaon provides complete coverage of the required controls at <SA-11(07)_ODP[01] breadth>;

SA-11(07)[02]

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SA-11(08)

SA-11(07)-Examine

[SELECT FROM: System and services acquision policy; procedures addressing system developer security tesng; solicitaon documentaon; acquision documentaon; service level agreements; acquision contracts for the system, system component, or system service; system developer security tesng and evaluaon plans; system developer security tesng and evaluaon results; system security plan; other relevant documents or records].

SA-11(07)-Interview

[SELECT FROM: Organizaonal personnel with system and service acquision responsibilies; organizaonal personnel with informaon security responsibilies; organizaonal personnel with developer security tesng responsibilies; system developers; independent veriﬁcaon agent].

SA-11(07)-Test

DEVELOPER TESTING AND EVALUATION | DYNAMIC CODE ANALYSIS ASSESSMENT OBJECTIVE: Determine if:

SA-11(08)[01]

the developer of the system, system component, or system service is required to employ dynamic code analysis tools to idenfy common ﬂaws;

SA-11(08)[02]

the developer of the system, system component, or system service is required to document the results of the analysis.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: SA-11(08)-Examine

CHAPTER FOUR

[SELECT FROM: System and services acquision policy; procedures addressing system developer security tesng; procedures addressing ﬂaw remediaon; solicitaon documentaon; acquision documentaon; service level agreements; acquision contracts for the system, system component, or system service; system developer security test and evaluaon plans; security test and evaluaon results; security ﬂaw and remediaon tracking reports; system security plan; other relevant documents or records].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 498

NIST SP 800-53A, REV. 5

SA-11(08)

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SA-11(09)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

DEVELOPER TESTING AND EVALUATION | DYNAMIC CODE ANALYSIS SA-11(08)-Interview

[SELECT FROM: Organizaonal personnel with system and service acquision responsibilies; organizaonal personnel with informaon security responsibilies; organizaonal personnel with developer security tesng responsibilies; organizaonal personnel with conﬁguraon management responsibilies; system developers].

SA-11(08)-Test

DEVELOPER TESTING AND EVALUATION | INTERACTIVE APPLICATION SECURITY TESTING ASSESSMENT OBJECTIVE: Determine if:

SA-11(09)[01]

the developer of the system, system component, or system service is required to employ interacve applicaon security tesng tools to idenfy ﬂaws;

SA-11(09)[02]

the developer of the system, system component, or system service is required to document the results of ﬂaw idenﬁcaon.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SA-12

SA-11(09)-Examine

[SELECT FROM: System and services acquision policy; procedures addressing system developer security tesng; procedures addressing interacve applicaon security tesng; solicitaon documentaon; acquision documentaon; service level agreements; acquision contracts for the system, system component, or system service; system developer security test and evaluaon plans; security test and evaluaon results; security ﬂaw and remediaon tracking reports; system security plan; other relevant documents or records].

SA-11(09)-Interview

[SELECT FROM: Organizaonal personnel with system and service acquision responsibilies; organizaonal personnel with informaon security responsibilies; organizaonal personnel with developer security tesng responsibilies; organizaonal personnel with conﬁguraon management responsibilies; system developers].

SA-11(09)-Test

[SELECT FROM: Organizaonal processes for interacve applicaon security tesng; mechanisms supporng and/or implemenng interacve applicaon security tesng].

SUPPLY CHAIN PROTECTION [WITHDRAWN: Incorporated into SR Family.]

SA-12(01)

SUPPLY CHAIN PROTECTION | ACQUISITION STRATEGIES  TOOLS  METHODS [WITHDRAWN: Moved to SR-05.]

CHAPTER FOUR

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 499

NIST SP 800-53A, REV. 5

SA-12(02)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

SUPPLY CHAIN PROTECTION | SUPPLIER REVIEWS [WITHDRAWN: Moved to SR-06.]

SA-12(03)

SUPPLY CHAIN PROTECTION | TRUSTED SHIPPING AND WAREHOUSING [WITHDRAWN: Incorporated into SR-03.]

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SA-12(04)

SUPPLY CHAIN PROTECTION | DIVERSITY OF SUPPLIERS [WITHDRAWN: Moved to SR-03(01).]

SA-12(05)

SUPPLY CHAIN PROTECTION | LIMITATION OF HARM [WITHDRAWN: Moved to SR-03(02).]

SA-12(06)

SUPPLY CHAIN PROTECTION | MINIMIZING PROCUREMENT TIME [WITHDRAWN: Incorporated into SR-05(01).]

SA-12(07)

SUPPLY CHAIN PROTECTION | ASSESSMENTS PRIOR TO SELECTION  ACCEPTANCE  UPDATE [WITHDRAWN: Moved to SR-05(02).]

SA-12(08)

SUPPLY CHAIN PROTECTION | USE OF ALL-SOURCE INTELLIGENCE [WITHDRAWN: Incorporated into RA-03(02).]

SA-12(09)

SUPPLY CHAIN PROTECTION | OPERATIONS SECURITY [WITHDRAWN: Moved to SR-07.]

SA-12(10)

SUPPLY CHAIN PROTECTION | VALIDATE AS GENUINE AND NOT ALTERED [WITHDRAWN: Moved to SR-04(03).]

CHAPTER FOUR

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 500

NIST SP 800-53A, REV. 5

SA-12(11)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

SUPPLY CHAIN PROTECTION | PENETRATION TESTING  ANALYSIS OF ELEMENTS, PROCESSES, AND ACTORS [WITHDRAWN: Moved to SR-06(01).]

SA-12(12)

SUPPLY CHAIN PROTECTION | INTER-ORGANIZATIONAL AGREEMENTS [WITHDRAWN: Moved to SR-08.]

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SA-12(13)

SUPPLY CHAIN PROTECTION | CRITICAL INFORMATION SYSTEM COMPONENTS [WITHDRAWN: Incorporated into MA-06, RA-09.]

SA-12(14)

SUPPLY CHAIN PROTECTION | IDENTITY AND TRACEABILITY [WITHDRAWN: Incorporated into SR-04(01), SR-04(02).]

SA-12(15)

SUPPLY CHAIN PROTECTION | PROCESSES TO ADDRESS WEAKNESSES OR DEFICIENCIES [WITHDRAWN: Incorporated into SR-03.]

SA-13

TRUSTWORTHINESS [WITHDRAWN: Incorporated into SA-08.]

SA-14

CRITICALITY ANALYSIS [WITHDRAWN: Incorporated into RA-09.]

SA-14(01)

CRITICALITY ANALYSIS | CRITICAL COMPONENTS WITH NO VIABLE ALTERNATIVE SOURCING [WITHDRAWN: Incorporated into SA-20.]

CHAPTER FOUR

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 501

NIST SP 800-53A, REV. 5

SA-15

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

DEVELOPMENT PROCESS, STANDARDS, AND TOOLS ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5 CHAPTER FOUR

SA-15_ODP[01]

frequency at which to review the development process, standards, tools, tool opons, and tool conﬁguraons is deﬁned;

SA-15_ODP[02]

security requirements to be sasﬁed by the process, standards, tools, tool opons, and tool conﬁguraons are deﬁned;

SA-15_ODP[03]

privacy requirements to be sasﬁed by the process, standards, tools, tool opons, and tool conﬁguraons are deﬁned;

SA-15a.01[01]

the developer of the system, system component, or system service is required to follow a documented development process that explicitly addresses security requirements;

SA-15a.01[02]

the developer of the system, system component, or system service is required to follow a documented development process that explicitly addresses privacy requirements;

SA-15a.02[01]

the developer of the system, system component, or system service is required to follow a documented development process that idenﬁes the standards used in the development process;

SA-15a.02[02]

the developer of the system, system component, or system service is required to follow a documented development process that idenﬁes the tools used in the development process;

SA-15a.03[01]

the developer of the system, system component, or system service is required to follow a documented development process that documents the speciﬁc tool used in the development process;

SA-15a.03[02]

the developer of the system, system component, or system service is required to follow a documented development process that documents the speciﬁc tool conﬁguraons used in the development process;

SA-15a.04

the developer of the system, system component, or system service is required to follow a documented development process that documents, manages, and ensures the integrity of changes to the process and/or tools used in development;

SA-15b.[01]

the developer of the system, system component, or system service is required to follow a documented development process in which the development process, standards, tools, tool opons, and tool conﬁguraons are reviewed <SA-15_ODP[01] frequency> to determine that the process, standards, tools, tool opons, and tool conﬁguraons selected and employed sasfy <SA-15_ODP[02] security requirements>;

SA-15b.[02]

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 502

NIST SP 800-53A, REV. 5

SA-15

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

DEVELOPMENT PROCESS, STANDARDS, AND TOOLS POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SA-15(01)

SA-15-Examine

[SELECT FROM: System and services acquision policy; system and services acquision procedures; procedures addressing development process, standards, and tools; procedures addressing the integraon of security and privacy requirements during the development process; solicitaon documentaon; acquision documentaon; crical component inventory documentaon; service level agreements; acquision contracts for the system, system component, or system service; system developer documentaon lisng tool opons/conﬁguraon guides; conﬁguraon management policy; conﬁguraon management records; documentaon of development process reviews using maturity models; change control records; conﬁguraon control records; documented reviews of the development process, standards, tools, and tool opons/conﬁguraons; system security plan; privacy plan; privacy impact assessment; privacy risk assessment documentaon; other relevant documents or records].

SA-15-Interview

[SELECT FROM: Organizaonal personnel with system and service acquision responsibilies; organizaonal personnel with informaon security and privacy responsibilies; system developer].

DEVELOPMENT PROCESS, STANDARDS, AND TOOLS | QUALITY METRICS ASSESSMENT OBJECTIVE: Determine if:

SA-15(01)_ODP[01]

one or more of the following PARAMETER VALUES is/are selected: {<SA-15(01)_ODP[02] frequency>; <SA-15(01)_ODP[03] program review>; upon delivery};

SA-15(01)_ODP[02]

frequency at which to provide evidence of meeng the quality metrics is deﬁned (if selected);

SA-15(01)_ODP[03]

program review milestones are deﬁned (if selected);

SA-15(01)(a)

the developer of the system, system component, or system service is required to deﬁne quality metrics at the beginning of the development process;

SA-15(01)(b)

the developer of the system, system component, or system service is required to provide evidence of meeng the quality metrics <SA-15(01)_ODP[01] SELECTED PARAMETER VALUE(S)>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

SA-15(01)-Examine

[SELECT FROM: System and services acquision policy; procedures addressing development process, standards, and tools; procedures addressing the integraon of security requirements into the acquision process; solicitaon documentaon; acquision documentaon; service level agreements; acquision contracts for the system, system component, or system service; list of quality metrics; documentaon evidence of meeng quality metrics; system security plan; other relevant documents or records].

SA-15(01)-Interview

[SELECT FROM: Organizaonal personnel with system and service acquision responsibilies; organizaonal personnel with informaon security responsibilies; system developer].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 503

NIST SP 800-53A, REV. 5

SA-15(02)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

DEVELOPMENT PROCESS, STANDARDS, AND TOOLS | SECURITY AND PRIVACY TRACKING TOOLS ASSESSMENT OBJECTIVE: Determine if:

SA-15(02)[01]

the developer of the system, system component, or system service is required to select and employ security tracking tools for use during the development process;

SA-15(02)[02]

the developer of the system, system component, or system service is required to select and employ privacy tracking tools for use during the development process.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SA-15(03)

SA-15(02)-Examine

[SELECT FROM: System and services acquision policy; system and services acquision procedures; procedures addressing development process, standards, and tools; procedures addressing the integraon of security and privacy requirements into the acquision process; solicitaon documentaon; acquision documentaon; service level agreements; acquision contracts for the system, system component, or system service; documentaon of the selecon of security and privacy tracking tools; evidence of employing security and privacy tracking tools; system security plan; privacy plan; privacy impact assessment; privacy risk assessment documentaon; other relevant documents or records].

SA-15(02)-Interview

[SELECT FROM: Organizaonal personnel with system and service acquision responsibilies; organizaonal personnel with informaon security responsibilies; system developer; organizaonal personnel with privacy responsibilies].

DEVELOPMENT PROCESS, STANDARDS, AND TOOLS | CRITICALITY ANALYSIS ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

SA-15(03)_ODP[01]

decision points in the system development life cycle are deﬁned;

SA-15(03)_ODP[02]

the breadth of cricality analysis is deﬁned;

SA-15(03)_ODP[03]

the depth of cricality analysis is deﬁned;

SA-15(03)(a)

the developer of the system, system component, or system service is required to perform a cricality analysis at <SA-15(03)_ODP[01] decision points> in the system development life cycle;

SA-15(03)(b)[01]

the developer of the system, system component, or system service is required to perform a cricality analysis at the following rigor level: <SA-15(03)_ODP[02] breadth>;

SA-15(03)(b)[02]

the developer of the system, system component, or system service is required to perform a cricality analysis at the following rigor level: <SA-15(03)_ODP[03] depth> .

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 504

NIST SP 800-53A, REV. 5

SA-15(03)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

DEVELOPMENT PROCESS, STANDARDS, AND TOOLS | CRITICALITY ANALYSIS POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SA-15(04)

SA-15(03)-Examine

[SELECT FROM: Supply chain risk management plan; system and services acquision policy; procedures addressing development process, standards, and tools; procedures addressing cricality analysis requirements for the system, system component, or system service; solicitaon documentaon; acquision documentaon; service level agreements; acquision contracts for the system, system component, or system service; cricality analysis documentaon; business impact analysis documentaon; soware development life cycle documentaon; system security plan; other relevant documents or records].

SA-15(03)-Interview

[SELECT FROM: Organizaonal personnel with system and service acquision responsibilies; organizaonal personnel with informaon security responsibilies; organizaonal personnel responsible for performing cricality analysis; system developer; organizaonal personnel with supply chain risk management responsibilies].

SA-15(03)-Test

[SELECT FROM: Organizaonal processes for performing cricality analysis; mechanisms supporng and/or implemenng cricality analysis].

DEVELOPMENT PROCESS, STANDARDS, AND TOOLS | THREAT MODELING AND VULNERABILITY ANALYSIS [WITHDRAWN: Incorporated into SA-11(02).]

SA-15(05)

DEVELOPMENT PROCESS, STANDARDS, AND TOOLS | ATTACK SURFACE REDUCTION ASSESSMENT OBJECTIVE: Determine if:

SA-15(05)_ODP

thresholds to which aack surfaces are to be reduced are deﬁned;

SA-15(05)

the developer of the system, system component, or system service is required to reduce aack surfaces to <SA-15(05)_ODP thresholds>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

SA-15(05)-Examine

[SELECT FROM: System and services acquision policy; procedures addressing development process, standards, and tools; procedures addressing aack surface reducon; solicitaon documentaon; acquision documentaon; service level agreements; acquision contracts for the system or system service; system design documentaon; network diagram; system conﬁguraon sengs and associated documentaon establishing/enforcing organizaon-deﬁned thresholds for reducing aack surfaces; list of restricted ports, protocols, funcons, and services; system security plan; other relevant documents or records].

SA-15(05)-Interview

[SELECT FROM: Organizaonal personnel with system and service acquision responsibilies; organizaonal personnel with informaon security responsibilies; organizaonal personnel responsible for aack surface reducon thresholds; system developer].

SA-15(05)-Test

[SELECT FROM: Organizaonal processes for deﬁning aack surface reducon thresholds].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 505

NIST SP 800-53A, REV. 5

SA-15(06)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

DEVELOPMENT PROCESS, STANDARDS, AND TOOLS | CONTINUOUS IMPROVEMENT ASSESSMENT OBJECTIVE: Determine if: SA-15(06)

the developer of the system, system component, or system service is required to implement an explicit process to connuously improve the development process.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SA-15(07)

SA-15(06)-Examine

[SELECT FROM: System and services acquision policy; system and services acquision procedures; procedures addressing development process, standards, and tools; solicitaon documentaon; acquision documentaon; service level agreements; acquision contracts for the system, system component, or system service; quality goals and metrics for improving the system development process; security assessments; quality control reviews of system development process; plans of acon and milestones for improving the system development process; system security plan; privacy plan; privacy impact assessment; privacy risk assessment documentaon; other relevant documents or records].

SA-15(06)-Interview

[SELECT FROM: Organizaonal personnel with system and service acquision responsibilies; organizaonal personnel with informaon security and privacy responsibilies; system developer].

DEVELOPMENT PROCESS, STANDARDS, AND TOOLS | AUTOMATED VULNERABILITY ANALYSIS ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

SA-15(07)_ODP[01]

frequency at which to conduct vulnerability analysis is deﬁned;

SA-15(07)_ODP[02]

tools used to perform automated vulnerability analysis are deﬁned;

SA-15(07)_ODP[03]

personnel or roles to whom the outputs of tools and results of the analysis are to be delivered is/are deﬁned;

SA-15(07)(a)

the developer of the system, system component, or system service is required to perform automated vulnerability analysis <SA-15(07)_ODP[01] frequency> using <SA-15(07)_ODP[02] tools>;

SA-15(07)(b)

the developer of the system, system component, or system service is required to determine the exploitaon potenal for discovered vulnerabilies <SA-15(07)_ODP[01] frequency>;

SA-15(07)(c)

the developer of the system, system component, or system service is required to determine potenal risk migaons <SA-15(07)_ODP[01] frequency> for delivered vulnerabilies;

SA-15(07)(d)

the developer of the system, system component, or system service is required to deliver the outputs of the tools and results of the analysis <SA-15(07)_ODP[01] frequency> to <SA-15(07)_ODP[03] personnel or roles>.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 506

NIST SP 800-53A, REV. 5

SA-15(07)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

DEVELOPMENT PROCESS, STANDARDS, AND TOOLS | AUTOMATED VULNERABILITY ANALYSIS POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SA-15(08)

SA-15(07)-Examine

[SELECT FROM: System and services acquision policy; procedures addressing development process, standards, and tools; solicitaon documentaon; acquision documentaon; service level agreements; acquision contracts for the system, system component, or system service; vulnerability analysis tools and associated documentaon; risk assessment reports; vulnerability analysis results; vulnerability migaon reports; risk migaon strategy documentaon; system security plan; other relevant documents or records].

SA-15(07)-Interview

SA-15(07)-Test

[SELECT FROM: Organizaonal processes for vulnerability analysis of systems, system components, or system services under development; mechanisms supporng and/or implemenng vulnerability analysis of systems, system components, or system services under development].

DEVELOPMENT PROCESS, STANDARDS, AND TOOLS | REUSE OF THREAT AND VULNERABILITY INFORMATION ASSESSMENT OBJECTIVE: Determine if:

SA-15(08)[01]

the developer of the system, system component, or system service is required to use threat modeling from similar systems, components, or services to inform the current development process;

SA-15(08)[02]

the developer of the system, system component, or system service is required to use vulnerability analyses from similar systems, components, or services to inform the current development process.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

SA-15(08)-Examine

[SELECT FROM: System and services acquision policy; supply chain risk management plan; procedures addressing development process, standards, and tools; solicitaon documentaon; acquision documentaon; service level agreements; acquision contracts for the system, system component, or system service; threat modeling and vulnerability analyses from similar systems, system components, or system services; system security plan; other relevant documents or records].

SA-15(08)-Interview

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 507

NIST SP 800-53A, REV. 5

SA-15(09)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

DEVELOPMENT PROCESS, STANDARDS, AND TOOLS | USE OF LIVE DATA [WITHDRAWN: Incorporated into SA-03(02).]

SA-15(10)

DEVELOPMENT PROCESS, STANDARDS, AND TOOLS | INCIDENT RESPONSE PLAN ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SA-15(10)[01]

the developer of the system, system component, or system service is required to provide an incident response plan;

SA-15(10)[02]

the developer of the system, system component, or system service is required to implement an incident response plan;

SA-15(10)[03]

the developer of the system, system component, or system service is required to test an incident response plan.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SA-15(11)

SA-15(10)-Examine

[SELECT FROM: System and services acquision policy; procedures addressing incident response, standards, and tools; solicitaon documentaon; acquision documentaon; service level agreements; acquision contracts for the system, system components or services; acquision documentaon; solicitaon documentaon; service level agreements; developer incident response plan; system security plan; privacy plan; supply chain risk management plan; other relevant documents or records].

SA-15(10)-Interview

DEVELOPMENT PROCESS, STANDARDS, AND TOOLS | ARCHIVE SYSTEM OR COMPONENT ASSESSMENT OBJECTIVE: Determine if: SA-15(11)

the developer of the system or system component is required to archive the system or component to be released or delivered together with the corresponding evidence supporng the ﬁnal security and privacy review.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

SA-15(11)-Examine

[SELECT FROM: System and services acquision policy; procedures addressing development process, standards, and tools; solicitaon documentaon; acquision documentaon; service level agreements; acquision contracts for the system or system component; evidence of archived system or component; system security plan; privacy plan; other relevant documents or records].

SA-15(11)-Interview

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 508

NIST SP 800-53A, REV. 5

SA-15(12)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

DEVELOPMENT PROCESS, STANDARDS, AND TOOLS | MINIMIZE PERSONALLY IDENTIFIABLE INFORMATION ASSESSMENT OBJECTIVE: Determine if: SA-15(12)

the developer of the system or system component is required to minimize the use of personally idenﬁable informaon in development and test environments.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SA-16

SA-15(12)-Examine

[SELECT FROM: System and services acquision policy; system and services acquision procedures; procedures addressing the development process; procedures addressing the minimizaon of personally idenﬁable informaon in tesng, training, and research; personally idenﬁable informaon processing policy; procedures addressing the authority to test with personally idenﬁable informaon; standards and tools; solicitaon documentaon; service level agreements; acquision contracts for the system or services; system security plan; privacy plan; other relevant documents or records].

SA-15(12)-Interview

[SELECT FROM: Organizaonal personnel with acquision responsibilies; organizaonal personnel with informaon security and privacy responsibilies; system developer].

SA-15(12)-Test

[SELECT FROM: Organizaonal processes for the minimizaon of personally idenﬁable informaon in development and test environments; mechanisms to facilitate the minimizaon of personally idenﬁable informaon in development and test environments].

DEVELOPER-PROVIDED TRAINING ASSESSMENT OBJECTIVE: Determine if: SA-16_ODP

training on the correct use and operaon of the implemented security and privacy funcons, controls, and/or mechanisms provided by the developer of the system, system component, or system service is deﬁned;

SA-16

the developer of the system, system component, or system service is required to provide <SA-16_ODP training> on the correct use and operaon of the implemented security and privacy funcons, controls, and/or mechanisms.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

SA-16-Examine

[SELECT FROM: System and services acquision policy; system and services acquision procedures; procedures addressing developer-provided training; solicitaon documentaon; acquision documentaon; service level agreements; acquision contracts for the system, system component, or system service; organizaonal security and privacy training policy; developer-provided training materials; training records; system security plan; privacy plan; privacy impact assessment; privacy risk assessment documentaon; other relevant documents or records].

SA-16-Interview

[SELECT FROM: Organizaonal personnel with system and service acquision responsibilies; organizaonal personnel with informaon security and privacy responsibilies; system developer; external or internal (in-house) developers with training responsibilies for the system, system component, or informaon system service].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 509

NIST SP 800-53A, REV. 5

SA-17

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

DEVELOPER SECURITY AND PRIVACY ARCHITECTURE AND DESIGN ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SA-17(a)[01]

the developer of the system, system component, or system service is required to produce a design speciﬁcaon and security architecture that are consistent with the organizaon’s security architecture, which is an integral part the organizaon’s enterprise architecture;

SA-17(a)[02]

the developer of the system, system component, or system service is required to produce a design speciﬁcaon and privacy architecture that are consistent with the organizaon’s privacy architecture, which is an integral part the organizaon’s enterprise architecture;

SA-17(b)[01]

the developer of the system, system component, or system service is required to produce a design speciﬁcaon and security architecture that accurately and completely describe the required security funconality and the allocaon of controls among physical and logical components;

SA-17(b)[02]

the developer of the system, system component, or system service is required to produce a design speciﬁcaon and privacy architecture that accurately and completely describe the required privacy funconality and the allocaon of controls among physical and logical components;

SA-17(c)[01]

the developer of the system, system component, or system service is required to produce a design speciﬁcaon and security architecture that express how individual security funcons, mechanisms, and services work together to provide required security capabilies and a uniﬁed approach to protecon;

SA-17(c)[02]

the developer of the system, system component, or system service is required to produce a design speciﬁcaon and privacy architecture that express how individual privacy funcons, mechanisms, and services work together to provide required privacy capabilies and a uniﬁed approach to protecon.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SA-17(01)

SA-17-Examine

[SELECT FROM: System and services acquision policy; system and services acquision procedures; enterprise architecture policy; enterprise architecture documentaon; procedures addressing developer security and privacy architecture and design speciﬁcaons for the system; solicitaon documentaon; acquision documentaon; service level agreements; acquision contracts for the system, system component, or system service; system design documentaon; informaon system conﬁguraon sengs and associated documentaon; system security plan; privacy plan; other relevant documents or records].

SA-17-Interview

[SELECT FROM: Organizaonal personnel with acquision responsibilies; organizaonal personnel with informaon security and privacy responsibilies; system developer].

DEVELOPER SECURITY AND PRIVACY ARCHITECTURE AND DESIGN | FORMAL POLICY MODEL ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

SA-17(01)_ODP[01]

organizaonal security policy to be enforced is deﬁned;

SA-17(01)_ODP[02]

organizaonal privacy policy to be enforced is deﬁned;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 510

NIST SP 800-53A, REV. 5

SA-17(01)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

DEVELOPER SECURITY AND PRIVACY ARCHITECTURE AND DESIGN | FORMAL POLICY MODEL

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SA-17(01)(a)[01]

as an integral part of the development process, the developer of the system, system component, or system service is required to produce a formal policy model describing the <SA-17(01)_ODP[01] organizaonal security policy> to be enforced;

SA-17(01)(a)[02]

SA-17(01)(b)[01]

the developer of the system, system component, or system service is required to prove that the formal policy model is internally consistent and suﬃcient to enforce the deﬁned elements of the organizaonal security policy when implemented;

SA-17(01)(b)[02]

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SA-17(02)

SA-17(01)-Examine

[SELECT FROM: System and services acquision policy; system and services acquision procedures; enterprise architecture policy; enterprise architecture documentaon; procedures addressing developer security and privacy architecture and design speciﬁcaons for the system; solicitaon documentaon; acquision documentaon; service level agreements; acquision contracts for the system, system component, or system service; system design documentaon; system conﬁguraon sengs and associated documentaon; system security plan; privacy plan; other relevant documents or records].

SA-17(01)-Interview

[SELECT FROM: Organizaonal personnel with acquision responsibilies; organizaonal personnel with informaon security and privacy responsibilies; system developer].

DEVELOPER SECURITY AND PRIVACY ARCHITECTURE AND DESIGN | SECURITY-RELEVANT COMPONENTS ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

SA-17(02)(a)[01]

the developer of the system, system component, or system service is required to deﬁne security-relevant hardware;

SA-17(02)(a)[02]

the developer of the system, system component, or system service is required to deﬁne security-relevant soware;

SA-17(02)(a)[03]

the developer of the system, system component, or system service is required to deﬁne security-relevant ﬁrmware;

SA-17(02)(b)

the developer of the system, system component, or system service is required to provide a raonale that the deﬁnion for security-relevant hardware, soware, and ﬁrmware is complete.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 511

NIST SP 800-53A, REV. 5

SA-17(02)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

DEVELOPER SECURITY AND PRIVACY ARCHITECTURE AND DESIGN | SECURITY-RELEVANT COMPONENTS POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SA-17(03)

SA-17(02)-Examine

[SELECT FROM: System and services acquision policy; enterprise architecture policy; procedures addressing developer security architecture and design speciﬁcaons for the system; solicitaon documentaon; acquision documentaon; service level agreements; acquision contracts for the system, system component, or system service; list of security-relevant hardware, soware, and ﬁrmware components; documented raonale of completeness regarding deﬁnions provided for security-relevant hardware, soware, and ﬁrmware; system security plan; other relevant documents or records].

SA-17(02)-Interview

[SELECT FROM: Organizaonal personnel with system and service acquision responsibilies; organizaonal personnel with informaon security responsibilies; system developers; organizaonal personnel with informaon security architecture and design responsibilies].

DEVELOPER SECURITY AND PRIVACY ARCHITECTURE AND DESIGN | FORMAL CORRESPONDENCE ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

SA-17(03)(a)[01]

as an integral part of the development process, the developer of the system, system component, or system service is required to produce a formal top-level speciﬁcaon that speciﬁes the interfaces to security-relevant hardware, soware, and ﬁrmware in terms of excepons;

SA-17(03)(a)[02]

SA-17(03)(a)[03]

SA-17(03)(b)

the developer of the system, system component, or system service is required to show proof that the formal top-level speciﬁcaon is consistent with the formal policy model to the extent feasible with addional informal demonstraon as necessary;

SA-17(03)(c)

the developer of the system, system component, or system service is required to show via informal demonstraon that the formal top-level speciﬁcaon completely covers the interfaces to security-relevant hardware, soware, and ﬁrmware;

SA-17(03)(d)

the developer of the system, system component, or system service is required to show that the formal top-level speciﬁcaon is an accurate descripon of the implemented security-relevant hardware, soware, and ﬁrmware;

SA-17(03)(e)

the developer of the system, system component, or system service is required to describe the security-relevant hardware, soware, and ﬁrmware mechanisms that are not addressed in the formal top-level speciﬁcaon but are strictly internal to the security-relevant hardware, soware, and ﬁrmware.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 512

NIST SP 800-53A, REV. 5

SA-17(03)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

DEVELOPER SECURITY AND PRIVACY ARCHITECTURE AND DESIGN | FORMAL CORRESPONDENCE POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SA-17(04)

SA-17(03)-Examine

[SELECT FROM: System and services acquision policy; enterprise architecture policy; formal policy model; procedures addressing developer security architecture and design speciﬁcaons for the system; solicitaon documentaon; acquision documentaon; service level agreements; acquision contracts for the system, system component, or system service; formal top-level speciﬁcaon documentaon; system security architecture and design documentaon; system design documentaon; system conﬁguraon sengs and associated documentaon; documentaon describing security-relevant hardware, soware, and ﬁrmware mechanisms not addressed in the formal top-level speciﬁcaon documentaon; system security plan; other relevant documents or records].

SA-17(03)-Interview

DEVELOPER SECURITY AND PRIVACY ARCHITECTURE AND DESIGN | INFORMAL CORRESPONDENCE ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

SA-17(04)_ODP

one of the following PARAMETER VALUES is selected: {informal demonstraon, convincing argument with formal methods as feasible};

SA-17(04)(a)[01]

as an integral part of the development process, the developer of the system, system component, or system service is required to produce an informal, descripve top-level speciﬁcaon that speciﬁes the interfaces to security-relevant hardware, soware, and ﬁrmware in terms of excepons;

SA-17(04)(a)[02]

SA-17(04)(a)[03]

SA-17(04)(b)

the developer of the system, system component, or system service is required to show via <SA-17(04)_ODP SELECTED PARAMETER VALUE> that the descripve toplevel speciﬁcaon is consistent with the formal policy model;

SA-17(04)(c)

the developer of the system, system component, or system service is required to show via informal demonstraon that the descripve top-level speciﬁcaon completely covers the interfaces to security-relevant hardware, soware, and ﬁrmware;

SA-17(04)(d)

the developer of the system, system component, or system service is required to show that the descripve top-level speciﬁcaon is an accurate descripon of the interfaces to security-relevant hardware, soware, and ﬁrmware;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 513

NIST SP 800-53A, REV. 5

SA-17(04)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

DEVELOPER SECURITY AND PRIVACY ARCHITECTURE AND DESIGN | INFORMAL CORRESPONDENCE SA-17(04)(e)

the developer of the system, system component, or system service is required to describe the security-relevant hardware, soware, and ﬁrmware mechanisms that are not addressed in the descripve top-level speciﬁcaon but are strictly internal to the security-relevant hardware, soware, and ﬁrmware.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SA-17(05)

SA-17(04)-Examine

[SELECT FROM: System and services acquision policy; enterprise architecture policy; formal policy model; procedures addressing developer security architecture and design speciﬁcaons for the system; solicitaon documentaon; acquision documentaon; service level agreements; acquision contracts for the system, system component, or system service; informal, descripve top-level speciﬁcaon documentaon; system security architecture and design documentaon; system design documentaon; system conﬁguraon sengs and associated documentaon; documentaon describing security-relevant hardware, soware, and ﬁrmware mechanisms not addressed in the informal, descripve top-level speciﬁcaon documentaon; system security plan; other relevant documents or records].

SA-17(04)-Interview

DEVELOPER SECURITY AND PRIVACY ARCHITECTURE AND DESIGN | CONCEPTUALLY SIMPLE DESIGN ASSESSMENT OBJECTIVE: Determine if: SA-17(05)(a)

the developer of the system, system component, or system service is required to design and structure the security-relevant hardware, soware, and ﬁrmware to use a complete, conceptually simple protecon mechanism with precisely deﬁned semancs;

SA-17(05)(b)

the developer of the system, system component, or system service is required to internally structure the security-relevant hardware, soware, and ﬁrmware with speciﬁc regard for this mechanism.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: SA-17(05)-Examine

CHAPTER FOUR

[SELECT FROM: System and services acquision policy; enterprise architecture policy; procedures addressing developer security architecture and design speciﬁcaons for the system; solicitaon documentaon; acquision documentaon; service level agreements; acquision contracts for the system, system component, or system service; system design documentaon; system security architecture documentaon; system conﬁguraon sengs and associated documentaon; developer documentaon describing the design and structure of security-relevant hardware, soware, and ﬁrmware components; system security plan; other relevant documents or records].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 514

NIST SP 800-53A, REV. 5

SA-17(05)

DEVELOPER SECURITY AND PRIVACY ARCHITECTURE AND DESIGN | CONCEPTUALLY SIMPLE DESIGN SA-17(05)-Interview

SA-17(06)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

DEVELOPER SECURITY AND PRIVACY ARCHITECTURE AND DESIGN | STRUCTURE FOR TESTING

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

ASSESSMENT OBJECTIVE: Determine if: SA-17(06)

the developer of the system, system component, or system service is required to structure security-relevant hardware, soware, and ﬁrmware to facilitate tesng.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SA-17(07)

SA-17(06)-Examine

[SELECT FROM: System and services acquision policy; enterprise architecture policy; procedures addressing developer security architecture and design speciﬁcaons for the system; solicitaon documentaon; acquision documentaon; service level agreements; acquision contracts for the system, system component, or system service; system design documentaon; system security architecture documentaon; privacy architecture documentaon; system conﬁguraon sengs and associated documentaon; developer documentaon describing the design and structure of security-relevant hardware, soware, and ﬁrmware components to facilitate tesng; system security plan; privacy plan; other relevant documents or records].

SA-17(06)-Interview

[SELECT FROM: Organizaonal personnel with system and service acquision responsibilies; organizaonal personnel with informaon security and privacy responsibilies; system developer; organizaonal personnel with informaon security and privacy architecture and design responsibilies].

DEVELOPER SECURITY AND PRIVACY ARCHITECTURE AND DESIGN | STRUCTURE FOR LEAST PRIVILEGE ASSESSMENT OBJECTIVE: Determine if: SA-17(07)

CHAPTER FOUR

the developer of the system, system component, or system service is required to structure security-relevant hardware, soware, and ﬁrmware to facilitate controlling access with least privilege.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 515

NIST SP 800-53A, REV. 5

SA-17(07)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

DEVELOPER SECURITY AND PRIVACY ARCHITECTURE AND DESIGN | STRUCTURE FOR LEAST PRIVILEGE POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SA-17(08)

SA-17(07)-Examine

[SELECT FROM: System and services acquision policy; enterprise architecture policy; procedures addressing developer security architecture and design speciﬁcaons for the system; solicitaon documentaon; acquision documentaon; service level agreements; acquision contracts for the system, system component, or system service; system design documentaon; system security architecture documentaon; system conﬁguraon sengs and associated documentaon; developer documentaon describing the design and structure of security-relevant hardware, soware, and ﬁrmware components to facilitate controlling access with least privilege; system security plan; other relevant documents or records].

SA-17(07)-Interview

DEVELOPER SECURITY AND PRIVACY ARCHITECTURE AND DESIGN | ORCHESTRATION ASSESSMENT OBJECTIVE: Determine if:

SA-17(08)_ODP[01]

crical systems or system components are deﬁned;

SA-17(08)_ODP[02]

capabilies to be implemented by systems or components are deﬁned;

SA-17(08)

<SA-17(08)_ODP[01] crical systems> are designed with coordinated behavior to implement <SA-17(08)_ODP[02] capabilies>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SA-17(09)

SA-17(08)-Examine

[SELECT FROM: System and services acquision policy; enterprise architecture policy; procedures addressing developer security and privacy architecture and design; enterprise architecture; security architecture; solicitaon documentaon; acquision documentaon; service level agreements; acquision contracts for the system, system component, or system service; system design documentaon; system conﬁguraon sengs and associated documentaon; developer documentaon describing design orchestraon; system security plan; privacy plan; other relevant documents or records].

SA-17(08)-Interview

[SELECT FROM: Organizaonal personnel with system and service acquision responsibilies; organizaonal personnel with informaon security and privacy responsibilies; system developer; organizaonal personnel with informaon security architecture responsibilies].

DEVELOPER SECURITY AND PRIVACY ARCHITECTURE AND DESIGN | DESIGN DIVERSITY ASSESSMENT OBJECTIVE: Determine if:

SA-17(09)_ODP

CHAPTER FOUR

crical systems or system components to be designed diﬀerently are deﬁned;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 516

NIST SP 800-53A, REV. 5

SA-17(09)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

DEVELOPER SECURITY AND PRIVACY ARCHITECTURE AND DESIGN | DESIGN DIVERSITY SA-17(09)

diﬀerent designs are used for <SA-17(09)_ODP crical systems> to sasfy a common set of requirements or to provide equivalent funconality.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SA-18

SA-17(09)-Examine

[SELECT FROM: System and services acquision policy; enterprise architecture policy; procedures addressing developer security architecture and design diversity for the system; solicitaon documentaon; acquision documentaon; service level agreements; acquision contracts for the system, system component, or system service; system design documentaon; system security architecture documentaon; system conﬁguraon sengs and associated documentaon; developer documentaon describing design diversity; system security plan; other relevant documents or records].

SA-17(09)-Interview

TAMPER RESISTANCE AND DETECTION [WITHDRAWN: Moved to SR-09.]

SA-18(01)

TAMPER RESISTANCE AND DETECTION | MULTIPLE PHASES OF SYSTEM DEVELOPMENT LIFE CYCLE [WITHDRAWN: Moved to SR-09(01).]

SA-18(02)

TAMPER RESISTANCE AND DETECTION | INSPECTION OF SYSTEMS OR COMPONENTS [WITHDRAWN: Moved to SR-10.]

SA-19

COMPONENT AUTHENTICITY [WITHDRAWN: Moved to SR-11.]

SA-19(01)

COMPONENT AUTHENTICITY | ANTI-COUNTERFEIT TRAINING [WITHDRAWN: Moved to SR-11(01).]

CHAPTER FOUR

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 517

NIST SP 800-53A, REV. 5

SA-19(02)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

COMPONENT AUTHENTICITY | CONFIGURATION CONTROL FOR COMPONENT SERVICE AND REPAIR [WITHDRAWN: Moved to SR-11(02).]

SA-19(03)

COMPONENT AUTHENTICITY | COMPONENT DISPOSAL [WITHDRAWN: Moved to SR-12.]

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SA-19(04)

COMPONENT AUTHENTICITY | ANTI-COUNTERFEIT SCANNING [WITHDRAWN: Moved to SR-11(03).]

SA-20

CUSTOMIZED DEVELOPMENT OF CRITICAL COMPONENTS ASSESSMENT OBJECTIVE: Determine if: SA-20_ODP

crical system components to be reimplemented or custom-developed are deﬁned;

SA-20

<SA-20_ODP crical system> are reimplemented or custom-developed.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

SA-20-Examine

[SELECT FROM: Supply chain risk management plan; system and services acquision policy; procedures addressing the customized development of crical system components; system design documentaon; system conﬁguraon sengs and associated documentaon; system development life cycle documentaon addressing the custom development of crical system components; conﬁguraon management records; system audit records; system security plan; other relevant documents or records].

SA-20-Interview

[SELECT FROM: Organizaonal personnel with system and service acquision responsibilies; organizaonal personnel with informaon security responsibilies; organizaonal personnel with responsibility for the reimplementaon or customized development of crical system components].

SA-20-Test

[SELECT FROM: Organizaonal processes for the reimplementaon or customized development of crical system components; mechanisms supporng and/or implemenng the reimplementaon or customized development of crical system components].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 518

NIST SP 800-53A, REV. 5

SA-21

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

DEVELOPER SCREENING ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SA-21_ODP[01]

the system, systems component, or system service that the developer has access to is/are deﬁned;

SA-21_ODP[02]

oﬃcial government dues assigned to the developer are deﬁned;

SA-21_ODP[03]

addional personnel screening criteria for the developer are deﬁned;

SA-21a.

the developer of <SA-21_ODP[01] system, systems component, or system service> is required to have appropriate access authorizaons as determined by assigned <SA-21_ODP[02] oﬃcial government dues>;

SA-21b.

the developer of <SA-21_ODP[01] system, systems component, or system service> is required to sasfy <SA-21_ODP[03] addional personnel screening criteria>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SA-21(01)

SA-21-Examine

[SELECT FROM: System and services acquision policy; personnel security policy and procedures; procedures addressing personnel screening; system design documentaon; acquision documentaon; service level agreements; acquision contracts for developer services; system conﬁguraon sengs and associated documentaon; list of appropriate access authorizaons required by the developers of the system; personnel screening criteria and associated documentaon; system security plan; supply chain risk management plan; other relevant documents or records].

SA-21-Interview

SA-21-Test

[SELECT FROM: Organizaonal processes for developer screening; mechanisms supporng developer screening].

DEVELOPER SCREENING | VALIDATION OF SCREENING [WITHDRAWN: Incorporated into SA-21.]

SA-22

UNSUPPORTED SYSTEM COMPONENTS ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

SA-22_ODP[01]

one or more of the following PARAMETER VALUES is/are selected: {in-house support; <SA-22_ODP[02] support from external providers>};

SA-22_ODP[02]

support from external providers is deﬁned (if selected);

SA-22a.

system components are replaced when support for the components is no longer available from the developer, vendor, or manufacturer;

SA-22b.

<SA-22_ODP[01] SELECTED PARAMETER VALUE(S)> provide opons for alternave sources for connued support for unsupported components.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 519

NIST SP 800-53A, REV. 5

SA-22

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

UNSUPPORTED SYSTEM COMPONENTS POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SA-22(01)

SA-22-Examine

[SELECT FROM: System and services acquision policy; procedures addressing the replacement or connued use of unsupported system components; documented evidence of replacing unsupported system components; documented approvals (including jusﬁcaon) for the connued use of unsupported system components; system security plan; supply chain risk management plan; other relevant documents or records].

SA-22-Interview

[SELECT FROM: Organizaonal personnel with system and service acquision responsibilies; organizaonal personnel with informaon security responsibilies; organizaonal personnel with the responsibility for the system development life cycle; organizaonal personnel responsible for component replacement].

SA-22-Test

[SELECT FROM: Organizaonal processes for replacing unsupported system components; mechanisms supporng and/or implemenng the replacement of unsupported system components].

UNSUPPORTED SYSTEM COMPONENTS | ALTERNATIVE SOURCES FOR CONTINUED SUPPORT [WITHDRAWN: Incorporated into SA-22.]

SA-23

SPECIALIZATION ASSESSMENT OBJECTIVE: Determine if:

SA-23_ODP[01]

one or more of the following PARAMETER VALUES is/are selected: {design modiﬁcaon; augmentaon; reconﬁguraon};

SA-23_ODP[02]

systems or system components supporng mission-essenal services or funcons are deﬁned;

SA-23

<SA-23_ODP[01] SELECTED PARAMETER VALUE(S)> is employed on <SA-23_ODP[02] systems or system components> supporng essenal services or funcons to increase the trustworthiness in those systems or components.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

SA-23-Examine

[SELECT FROM: System and services acquision policy; procedures addressing design modiﬁcaon, augmentaon, or reconﬁguraon of systems or system components; documented evidence of design modiﬁcaon, augmentaon, or reconﬁguraon; system security plan; supply chain risk management plan; other relevant documents or records].

SA-23-Interview

[SELECT FROM: Organizaonal personnel with system and service acquision responsibilies; organizaonal personnel with informaon security responsibilies; organizaonal personnel with the responsibility for security architecture; organizaonal personnel responsible for conﬁguraon management].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 520

NIST SP 800-53A, REV. 5

SA-23

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

SPECIALIZATION SA-23-Test

[SELECT FROM: Organizaonal processes for the modiﬁcaon of design, augmentaon, or reconﬁguraon of systems or system components; mechanisms supporng and/or implemenng design modiﬁcaon, augmentaon, or reconﬁguraon of systems or system components].

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5 CHAPTER FOUR

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 521

NIST SP 800-53A, REV. 5

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

4.18 SYSTEM AND COMMUNICATIONS PROTECTION SC-01

POLICY AND PROCEDURES ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5 CHAPTER FOUR

SC-01_ODP[01]

personnel or roles to whom the system and communicaons protecon policy is to be disseminated is/are deﬁned;

SC-01_ODP[02]

personnel or roles to whom the system and communicaons protecon procedures are to be disseminated is/are deﬁned;

SC-01_ODP[03]

one or more of the following PARAMETER VALUES is/are selected: {organizaonlevel; mission/business-process-level; system-level};

SC-01_ODP[04]

an oﬃcial to manage the system and communicaons protecon policy and procedures is deﬁned;

SC-01_ODP[05]

the frequency at which the current system and communicaons protecon policy is reviewed and updated is deﬁned;

SC-01_ODP[06]

events that would require the current system and communicaons protecon policy to be reviewed and updated are deﬁned;

SC-01_ODP[07]

the frequency at which the current system and communicaons protecon procedures are reviewed and updated is deﬁned;

SC-01_ODP[08]

events that would require the system and communicaons protecon procedures to be reviewed and updated are deﬁned;

SC-01a.[01]

a system and communicaons protecon policy is developed and documented;

SC-01a.[02]

the system and communicaons protecon policy is disseminated to <SC-01_ODP[01] personnel or roles>;

SC-01a.[03]

system and communicaons protecon procedures to facilitate the implementaon of the system and communicaons protecon policy and associated system and communicaons protecon controls are developed and documented;

SC-01a.[04]

the system and communicaons protecon procedures are disseminated to <SC-01_ODP[02] personnel or roles>;

SC-01a.01(a)[01]

the <SC-01_ODP[03] SELECTED PARAMETER VALUE(S)> system and communicaons protecon policy addresses purpose;

SC-01a.01(a)[02]

the <SC-01_ODP[03] SELECTED PARAMETER VALUE(S)> system and communicaons protecon policy addresses scope;

SC-01a.01(a)[03]

the <SC-01_ODP[03] SELECTED PARAMETER VALUE(S)> system and communicaons protecon policy addresses roles;

SC-01a.01(a)[04]

the <SC-01_ODP[03] SELECTED PARAMETER VALUE(S)> system and communicaons protecon policy addresses responsibilies;

SC-01a.01(a)[05]

the <SC-01_ODP[03] SELECTED PARAMETER VALUE(S)> system and communicaons protecon policy addresses management commitment;

SC-01a.01(a)[06]

the <SC-01_ODP[03] SELECTED PARAMETER VALUE(S)> system and communicaons protecon policy addresses coordinaon among organizaonal enes;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 522

NIST SP 800-53A, REV. 5

SC-01

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

POLICY AND PROCEDURES

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SC-01a.01(a)[07]

the <SC-01_ODP[03] SELECTED PARAMETER VALUE(S)> system and communicaons protecon policy addresses compliance;

SC-01a.01(b)

the <SC-01_ODP[03] SELECTED PARAMETER VALUE(S)> system and communicaons protecon policy is consistent with applicable laws, Execuve Orders, direcves, regulaons, policies, standards, and guidelines;

SC-01b.

the <SC-01_ODP[04] oﬃcial> is designated to manage the development, documentaon, and disseminaon of the system and communicaons protecon policy and procedures;

SC-01c.01[01]

the current system and communicaons protecon policy is reviewed and updated <SC-01_ODP[05] frequency>;

SC-01c.01[02]

the current system and communicaons protecon policy is reviewed and updated following <SC-01_ODP[06] events>;

SC-01c.02[01]

the current system and communicaons protecon procedures are reviewed and updated <SC-01_ODP[07] frequency>;

SC-01c.02[02]

the current system and communicaons protecon procedures are reviewed and updated following <SC-01_ODP[08] events>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SC-02

SC-01-Examine

[SELECT FROM: System and communicaons protecon policy; system and communicaons protecon procedures; system security plan; privacy plan; risk management strategy documentaon; audit ﬁndings; other relevant documents or records].

SC-01-Interview

[SELECT FROM: Organizaonal personnel with system and communicaons protecon responsibilies; organizaonal personnel with informaon security and privacy responsibilies].

SEPARATION OF SYSTEM AND USER FUNCTIONALITY ASSESSMENT OBJECTIVE: Determine if: SC-02

user funconality, including user interface services, is separated from system management funconality.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

SC-02-Examine

[SELECT FROM: System and communicaons protecon policy; procedures addressing applicaon paroning; system design documentaon; system conﬁguraon sengs and associated documentaon; system audit records; system security plan; other relevant documents or records].

SC-02-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies; system developer].

SC-02-Test

[SELECT FROM: Separaon of user funconality from system management funconality].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 523

NIST SP 800-53A, REV. 5

SC-02(01)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

SEPARATION OF SYSTEM AND USER FUNCTIONALITY | INTERFACES FOR NON-PRIVILEGED USERS ASSESSMENT OBJECTIVE: Determine if: SC-02(01)

the presentaon of system management funconality is prevented at interfaces to non-privileged users.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SC-02(02)

SC-02(01)-Examine

SC-02(01)-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies; non-privileged users of the system; system developer].

SC-02(01)-Test

[SELECT FROM: Separaon of user funconality from system management funconality].

SEPARATION OF SYSTEM AND USER FUNCTIONALITY | DISASSOCIABILITY ASSESSMENT OBJECTIVE: Determine if: SC-02(02)

state informaon is stored separately from applicaons and soware.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SC-03

SC-02(02)-Examine

[SELECT FROM: System and communicaons protecon policy; procedures addressing applicaon and soware paroning; system design documentaon; system conﬁguraon sengs and associated documentaon; system audit records; system security plan; privacy plan; other relevant documents or records].

SC-02(02)-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security and privacy responsibilies; system developer].

SC-02(02)-Test

[SELECT FROM: Separaon of applicaon state informaon from soware].

SECURITY FUNCTION ISOLATION ASSESSMENT OBJECTIVE: Determine if: SC-03

security funcons are isolated from non-security funcons.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: SC-03-Examine

CHAPTER FOUR

[SELECT FROM: System and communicaons protecon policy; procedures addressing security funcon isolaon; list of security funcons to be isolated from non-security funcons; system design documentaon; system conﬁguraon sengs and associated documentaon; system audit records; system security plan; other relevant documents or records].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 524

NIST SP 800-53A, REV. 5

SC-03

SC-03(01)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

SECURITY FUNCTION ISOLATION SC-03-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies; system developer].

SC-03-Test

[SELECT FROM: Separaon of security funcons from non-security funcons within the system].

SECURITY FUNCTION ISOLATION | HARDWARE SEPARATION

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

ASSESSMENT OBJECTIVE: Determine if: SC-03(01)

hardware separaon mechanisms are employed to implement security funcon isolaon.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SC-03(02)

SC-03(01)-Examine

[SELECT FROM: System and communicaons protecon policy; procedures addressing security funcon isolaon; system design documentaon; hardware separaon mechanisms; system conﬁguraon sengs and associated documentaon; system audit records; system security plan; other relevant documents or records].

SC-03(01)-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies; system developer].

SC-03(01)-Test

[SELECT FROM: Separaon of security funcons from non-security funcons within the system].

SECURITY FUNCTION ISOLATION | ACCESS AND FLOW CONTROL FUNCTIONS ASSESSMENT OBJECTIVE: Determine if:

SC-03(02)[01]

security funcons enforcing access control are isolated from non-security funcons;

SC-03(02)[02]

security funcons enforcing access control are isolated from other security funcons;

SC-03(02)[03]

security funcons enforcing informaon ﬂow control are isolated from non-security funcons;

SC-03(02)[04]

security funcons enforcing informaon ﬂow control are isolated from other security funcons.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

SC-03(02)-Examine

[SELECT FROM: System and communicaons protecon policy; procedures addressing security funcon isolaon; list of crical security funcons; system design documentaon; system conﬁguraon sengs and associated documentaon; system audit records system security plan; other relevant documents or records].

SC-03(02)-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies; system developer].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 525

NIST SP 800-53A, REV. 5

SC-03(02)

SECURITY FUNCTION ISOLATION | ACCESS AND FLOW CONTROL FUNCTIONS SC-03(02)-Test

SC-03(03)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

[SELECT FROM: Isolaon of security funcons enforcing access and informaon ﬂow control].

SECURITY FUNCTION ISOLATION | MINIMIZE NONSECURITY FUNCTIONALITY ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SC-03(03)

the number of non-security funcons included within the isolaon boundary containing security funcons is minimized.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SC-03(04)

SC-03(03)-Examine

[SELECT FROM: System and communicaons protecon policy; procedures addressing security funcon isolaon; system design documentaon; system conﬁguraon sengs and associated documentaon; system audit records; system security plan; other relevant documents or records].

SC-03(03)-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies].

SC-03(03)-Test

[SELECT FROM: Mechanisms supporng and/or implemenng an isolaon boundary].

SECURITY FUNCTION ISOLATION | MODULE COUPLING AND COHESIVENESS ASSESSMENT OBJECTIVE: Determine if:

SC-03(04)[01]

security funcons are implemented as largely independent modules that maximize internal cohesiveness within modules;

SC-03(04)[02]

security funcons are implemented as largely independent modules that minimize coupling between modules.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

SC-03(04)-Examine

SC-03(04)-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies].

SC-03(04)-Test

[SELECT FROM: Organizaonal processes for maximizing internal cohesiveness within modules and minimizing coupling between modules; mechanisms supporng and/or implemenng security funcons as independent modules].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 526

NIST SP 800-53A, REV. 5

SC-03(05)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

SECURITY FUNCTION ISOLATION | LAYERED STRUCTURES ASSESSMENT OBJECTIVE: Determine if: SC-03(05)

security funcons are implemented as a layered structure, minimizing interacons between layers of the design and avoiding any dependence by lower layers on the funconality or correctness of higher layers.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SC-04

SC-03(05)-Examine

SC-03(05)-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies].

SC-03(05)-Test

[SELECT FROM: Organizaonal processes for implemenng security funcons as a layered structure that minimizes interacons between layers and avoids dependence by lower layers on funconality/correctness of higher layers; mechanisms supporng and/or implemenng security funcons as a layered structure].

INFORMATION IN SHARED SYSTEM RESOURCES ASSESSMENT OBJECTIVE: Determine if: SC-04[01]

unauthorized informaon transfer via shared system resources is prevented;

SC-04[02]

unintended informaon transfer via shared system resources is prevented.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SC-04(01)

SC-04-Examine

[SELECT FROM: System and communicaons protecon policy; procedures addressing informaon protecon in shared system resources; system design documentaon; system conﬁguraon sengs and associated documentaon; system audit records; system security plan; other relevant documents or records].

SC-04-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies; system developer].

SC-04-Test

[SELECT FROM: Mechanisms prevenng the unauthorized and unintended transfer of informaon via shared system resources].

INFORMATION IN SHARED SYSTEM RESOURCES | SECURITY LEVELS [WITHDRAWN: Incorporated into SC-04.]

CHAPTER FOUR

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 527

NIST SP 800-53A, REV. 5

SC-04(02)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

INFORMATION IN SHARED SYSTEM RESOURCES | MULTILEVEL OR PERIODS PROCESSING ASSESSMENT OBJECTIVE: Determine if:

SC-04(02)_ODP

procedures to prevent unauthorized informaon transfer via shared resources are deﬁned;

SC-04(02)

unauthorized informaon transfer via shared resources is prevented in accordance with <SC-04(02)_ODP procedures> when system processing explicitly switches between diﬀerent informaon classiﬁcaon levels or security categories.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SC-05

SC-04(02)-Examine

SC-04(02)-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies; system developer].

SC-04(02)-Test

[SELECT FROM: Mechanisms prevenng the unauthorized transfer of informaon via shared system resources].

DENIAL-OF-SERVICE PROTECTION ASSESSMENT OBJECTIVE: Determine if:

SC-05_ODP[01]

types of denial-of-service events to be protected against or limited are deﬁned;

SC-05_ODP[02]

one of the following PARAMETER VALUES is selected: {protect against; limit};

SC-05_ODP[03]

controls to achieve the denial-of-service objecve by type of denial-of-service event are deﬁned;

SC-05a.

the eﬀects of <SC-05_ODP[01] types of denial-of-service events> are <SC-05_ODP[02] SELECTED PARAMETER VALUE>;

SC-05b.

<SC-05_ODP[03] controls by type of denial-of-service event> are employed to achieve the denial-of-service protecon objecve.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

SC-05-Examine

[SELECT FROM: System and communicaons protecon policy; procedures addressing denial-of-service protecon; system design documentaon; list of denial-of-service aacks requiring employment of security safeguards to protect against or limit eﬀects of such aacks; list of security safeguards protecng against or liming the eﬀects of denial-of-service aacks; system conﬁguraon sengs and associated documentaon; system audit records; system security plan; other relevant documents or records].

SC-05-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies; organizaonal personnel with incident response responsibilies; system developer].

SC-05-Test

[SELECT FROM: Mechanisms protecng against or liming the eﬀects of denial-ofservice aacks].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 528

NIST SP 800-53A, REV. 5

SC-05(01)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

DENIAL-OF-SERVICE PROTECTION | RESTRICT ABILITY TO ATTACK OTHER SYSTEMS ASSESSMENT OBJECTIVE: Determine if:

SC-05(01)_ODP

denial-of-service aacks for which to restrict the ability of individuals to launch are deﬁned;

SC-05(01)

the ability of individuals to launch <SC-05(01)_ODP denial-of-service aacks> against other systems is restricted.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SC-05(02)

SC-05(01)-Examine

[SELECT FROM: System and communicaons protecon policy; procedures addressing denial-of-service protecon; system design documentaon; list of denial-of-service aacks launched by individuals against systems; system conﬁguraon sengs and associated documentaon; system audit records; system security plan; other relevant documents or records].

SC-05(01)-Interview

SC-05(01)-Test

[SELECT FROM: Mechanisms restricng the ability to launch denial-of-service aacks against other systems].

DENIAL-OF-SERVICE PROTECTION | CAPACITY, BANDWIDTH, AND REDUNDANCY ASSESSMENT OBJECTIVE: Determine if: SC-05(02)

capacity, bandwidth, or other redundancies to limit the eﬀects of informaon ﬂooding denial-of-service aacks are managed.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SC-05(03)

SC-05(02)-Examine

[SELECT FROM: System and communicaons protecon policy; procedures addressing denial-of-service protecon; system design documentaon; system conﬁguraon sengs and associated documentaon; system audit records; system security plan; other relevant documents or records].

SC-05(02)-Interview

SC-05(02)-Test

[SELECT FROM: Mechanisms implemenng the management of system bandwidth, capacity, and redundancy to limit the eﬀects of informaon ﬂooding denial-ofservice aacks].

DENIAL-OF-SERVICE PROTECTION | DETECTION AND MONITORING ASSESSMENT OBJECTIVE: Determine if:

SC-05(03)_ODP[01]

CHAPTER FOUR

monitoring tools for detecng indicators of denial-of-service aacks are deﬁned;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 529

NIST SP 800-53A, REV. 5

SC-05(03)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

DENIAL-OF-SERVICE PROTECTION | DETECTION AND MONITORING SC-05(03)_ODP[02]

system resources to be monitored to determine if suﬃcient resources exist to prevent eﬀecve denial-of-service aacks are deﬁned;

SC-05(03)(a)

<SC-05(03)_ODP[01] monitoring tools> are employed to detect indicators of denial-of-service aacks against or launched from the system;

SC-05(03)(b)

<SC-05(03)_ODP[02] system resources> are monitored to determine if suﬃcient resources exist to prevent eﬀecve denial-of-service aacks.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SC-06

SC-05(03)-Examine

[SELECT FROM: System and communicaons protecon policy; procedures addressing denial-of-service protecon; system design documentaon; system monitoring tools and techniques documentaon; system conﬁguraon sengs and associated documentaon; system audit records; system security plan; other relevant documents or records].

SC-05(03)-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies; organizaonal personnel with detecon and monitoring responsibilies].

SC-05(03)-Test

[SELECT FROM: Mechanisms/tools implemenng system monitoring for denial-ofservice aacks].

RESOURCE AVAILABILITY ASSESSMENT OBJECTIVE: Determine if:

SC-06_ODP[01]

resources to be allocated to protect the availability of resources are deﬁned;

SC-06_ODP[02]

one or more of the following PARAMETER VALUES is/are selected: {priority; quota; <SC-06_ODP[03] controls>};

SC-06_ODP[03]

controls to protect the availability of resources are deﬁned (if selected);

SC-06

the availability of resources is protected by allocang <SC-06_ODP[01] resources> by <SC-06_ODP[02] SELECTED PARAMETER VALUE(S)>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

SC-06-Examine

[SELECT FROM: System and communicaons protecon policy; procedures addressing priorizaon of system resources; system design documentaon; system conﬁguraon sengs and associated documentaon; system audit records; system security plan; other relevant documents or records].

SC-06-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies; system developer].

SC-06-Test

[SELECT FROM: Mechanisms supporng and/or implemenng a resource allocaon capability; safeguards employed to protect availability of resources].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 530

NIST SP 800-53A, REV. 5

SC-07

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

BOUNDARY PROTECTION ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SC-07_ODP

one of the following PARAMETER VALUES is selected: {physically; logically};

SC-07a.[01]

communicaons at external managed interfaces to the system are monitored;

SC-07a.[02]

communicaons at external managed interfaces to the system are controlled;

SC-07a.[03]

communicaons at key internal managed interfaces within the system are monitored;

SC-07a.[04]

communicaons at key internal managed interfaces within the system are controlled;

SC-07b.

subnetworks for publicly accessible system components are <SC-07_ODP SELECTED PARAMETER VALUE> separated from internal organizaonal networks;

SC-07c.

external networks or systems are only connected to through managed interfaces consisng of boundary protecon devices arranged in accordance with an organizaonal security and privacy architecture.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SC-07(01)

SC-07-Examine

[SELECT FROM: System and communicaons protecon policy; procedures addressing boundary protecon; list of key internal boundaries of the system; system design documentaon; boundary protecon hardware and soware; system conﬁguraon sengs and associated documentaon; enterprise security architecture documentaon; system audit records; system security plan; other relevant documents or records].

SC-07-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies; system developer; organizaonal personnel with boundary protecon responsibilies].

SC-07-Test

[SELECT FROM: Mechanisms implemenng boundary protecon capabilies].

BOUNDARY PROTECTION | PHYSICALLY SEPARATED SUBNETWORKS [WITHDRAWN: Incorporated into SC-07.]

SC-07(02)

BOUNDARY PROTECTION | PUBLIC ACCESS [WITHDRAWN: Incorporated into SC-07.]

SC-07(03)

BOUNDARY PROTECTION | ACCESS POINTS ASSESSMENT OBJECTIVE: Determine if: SC-07(03)

CHAPTER FOUR

the number of external network connecons to the system is limited.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 531

NIST SP 800-53A, REV. 5

SC-07(03)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

BOUNDARY PROTECTION | ACCESS POINTS POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SC-07(04)

SC-07(03)-Examine

[SELECT FROM: System and communicaons protecon policy; procedures addressing boundary protecon; system design documentaon; boundary protecon hardware and soware; system architecture and conﬁguraon documentaon; system conﬁguraon sengs and associated documentaon; communicaons and network traﬃc monitoring logs; system audit records; system security plan; other relevant documents or records].

SC-07(03)-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies; organizaonal personnel with boundary protecon responsibilies].

SC-07(03)-Test

[SELECT FROM: Mechanisms implemenng boundary protecon capabilies; mechanisms liming the number of external network connecons to the system].

BOUNDARY PROTECTION | EXTERNAL TELECOMMUNICATIONS SERVICES ASSESSMENT OBJECTIVE: Determine if:

SC-07(04)_ODP

the frequency at which to review excepons to traﬃc ﬂow policy is deﬁned;

SC-07(04)(a)

a managed interface is implemented for each external telecommunicaon service;

SC-07(04)(b)

a traﬃc ﬂow policy is established for each managed interface;

SC-07(04)(c)[01]

the conﬁdenality of the informaon being transmied across each interface is protected;

SC-07(04)(c)[02]

the integrity of the informaon being transmied across each interface is protected;

SC-07(04)(d)

each excepon to the traﬃc ﬂow policy is documented with a supporng mission or business need and duraon of that need;

SC-07(04)(e)[01]

excepons to the traﬃc ﬂow policy are reviewed <SC-07(04)_ODP frequency>;

SC-07(04)(e)[02]

excepons to the traﬃc ﬂow policy that are no longer supported by an explicit mission or business need are removed;

SC-07(04)(f)

unauthorized exchanges of control plan traﬃc with external networks are prevented;

SC-07(04)(g)

informaon is published to enable remote networks to detect unauthorized control plane traﬃc from internal networks;

SC-07(04)(h)

unauthorized control plane traﬃc is ﬁltered from external networks.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: SC-07(04)-Examine

CHAPTER FOUR

[SELECT FROM: System and communicaons protecon policy; traﬃc ﬂow policy; informaon ﬂow control policy; procedures addressing boundary protecon; system security architecture; system design documentaon; boundary protecon hardware and soware; system architecture and conﬁguraon documentaon; system conﬁguraon sengs and associated documentaon; records of traﬃc ﬂow policy excepons; system audit records; system security plan; other relevant documents or records].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 532

NIST SP 800-53A, REV. 5

SC-07(04)

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SC-07(05)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

BOUNDARY PROTECTION | EXTERNAL TELECOMMUNICATIONS SERVICES SC-07(04)-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies; organizaonal personnel with boundary protecon responsibilies].

SC-07(04)-Test

[SELECT FROM: Organizaonal processes for documenng and reviewing excepons to the traﬃc ﬂow policy; organizaonal processes for removing excepons to the traﬃc ﬂow policy; mechanisms implemenng boundary protecon capabilies; managed interfaces implemenng traﬃc ﬂow policy].

BOUNDARY PROTECTION | DENY BY DEFAULT — ALLOW BY EXCEPTION ASSESSMENT OBJECTIVE: Determine if:

SC-07(05)_ODP[01]

one or more of the following PARAMETER VALUES is/are selected: {at managed interfaces; for <SC-07(05)_ODP[02] systems>};

SC-07(05)_ODP[02]

systems for which network communicaons traﬃc is denied by default and network communicaons traﬃc is allowed by excepon are deﬁned (if selected).

SC-07(05)[01]

network communicaons traﬃc is denied by default <SC-07(05)_ODP[01] SELECTED PARAMETER VALUE(S)>;

SC-07(05)[02]

network communicaons traﬃc is allowed by excepon <SC-07(05)_ODP[01] SELECTED PARAMETER VALUE(S)>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SC-07(06)

SC-07(05)-Examine

[SELECT FROM: System and communicaons protecon policy; procedures addressing boundary protecon; system design documentaon; system conﬁguraon sengs and associated documentaon; system audit records; system security plan; other relevant documents or records].

SC-07(05)-Interview

SC-07(05)-Test

[SELECT FROM: Mechanisms implemenng traﬃc management at managed interfaces].

BOUNDARY PROTECTION | RESPONSE TO RECOGNIZED FAILURES [WITHDRAWN: Incorporated into SC-07(18).]

SC-07(07)

BOUNDARY PROTECTION | SPLIT TUNNELING FOR REMOTE DEVICES ASSESSMENT OBJECTIVE: Determine if:

SC-07(07)_ODP

CHAPTER FOUR

safeguards to securely provision split tunneling are deﬁned;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 533

NIST SP 800-53A, REV. 5

SC-07(07)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

BOUNDARY PROTECTION | SPLIT TUNNELING FOR REMOTE DEVICES SC-07(07)

split tunneling is prevented for remote devices connecng to organizaonal systems unless the split tunnel is securely provisioned using <SC-07(07)_ODP safeguards>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SC-07(08)

SC-07(07)-Examine

[SELECT FROM: System and communicaons protecon policy; procedures addressing boundary protecon; system design documentaon; system hardware and soware; system architecture; system conﬁguraon sengs and associated documentaon; system audit records; system security plan; other relevant documents or records].

SC-07(07)-Interview

SC-07(07)-Test

[SELECT FROM: Mechanisms implemenng boundary protecon capabilies; mechanisms supporng/restricng non-remote connecons].

BOUNDARY PROTECTION | ROUTE TRAFFIC TO AUTHENTICATED PROXY SERVERS ASSESSMENT OBJECTIVE: Determine if:

SC-07(08)_ODP[01]

internal communicaons traﬃc to be routed to external networks is deﬁned;

SC-07(08)_ODP[02]

external networks to which internal communicaons traﬃc is to be routed are deﬁned;

SC-07(08)

<SC-07(08)_ODP[01] internal communicaons traﬃc> is routed to <SC-07(08)_ODP[02] external networks> through authencated proxy servers at managed interfaces.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

SC-07(08)-Examine

SC-07(08)-Interview

SC-07(08)-Test

[SELECT FROM: Mechanisms implemenng traﬃc management through authencated proxy servers at managed interfaces].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 534

NIST SP 800-53A, REV. 5

SC-07(09)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

BOUNDARY PROTECTION | RESTRICT THREATENING OUTGOING COMMUNICATIONS TRAFFIC ASSESSMENT OBJECTIVE: Determine if:

SC-07(09)(a)[01]

outgoing communicaons traﬃc posing a threat to external systems is detected;

SC-07(09)(a)[02]

outgoing communicaons traﬃc posing a threat to external systems is denied;

SC-07(09)(b)

the identy of internal users associated with denied communicaons is audited.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SC-07(10)

SC-07(09)-Examine

SC-07(09)-Interview

SC-07(09)-Test

[SELECT FROM: Mechanisms implemenng boundary protecon capabilies; mechanisms implemenng the detecon and denial of threatening outgoing communicaons traﬃc; mechanisms implemenng auding of outgoing communicaons traﬃc].

BOUNDARY PROTECTION | PREVENT EXFILTRATION ASSESSMENT OBJECTIVE: Determine if:

SC-07(10)_ODP

the frequency for conducng exﬁltraon tests is deﬁned;

SC-07(10)(a)

the exﬁltraon of informaon is prevented;

SC-07(10)(b)

exﬁltraon tests are conducted <SC-07(10)_ODP frequency>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

SC-07(10)-Examine

SC-07(10)-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies; organizaonal personnel with boundary protecon responsibilies].

SC-07(10)-Test

[SELECT FROM: Mechanisms implemenng boundary protecon capabilies that prevent the unauthorized exﬁltraon of informaon across managed interfaces].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 535

NIST SP 800-53A, REV. 5

SC-07(11)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

BOUNDARY PROTECTION | RESTRICT INCOMING COMMUNICATIONS TRAFFIC ASSESSMENT OBJECTIVE: Determine if:

SC-07(11)_ODP[01]

authorized sources of incoming communicaons to be routed are deﬁned;

SC-07(11)_ODP[02]

authorized desnaons to which incoming communicaons from authorized sources may be routed are deﬁned;

SC-07(11)

only incoming communicaons from <SC-07(11)_ODP[01] authorized sources> are allowed to be routed to <SC-07(11)_ODP[02] authorized desnaons>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SC-07(12)

SC-07(11)-Examine

SC-07(11)-Interview

SC-07(11)-Test

[SELECT FROM: Mechanisms implemenng boundary protecon capabilies with respect to source/desnaon address pairs].

BOUNDARY PROTECTION | HOST-BASED PROTECTION ASSESSMENT OBJECTIVE: Determine if:

SC-07(12)_ODP[01]

host-based boundary protecon mechanisms to be implemented are deﬁned;

SC-07(12)_ODP[02]

system components where host-based boundary protecon mechanisms are to be implemented are deﬁned;

SC-07(12)

<SC-07(12)_ODP[01] host-based boundary protecon mechanisms> are implemented at <SC-07(12)_ODP[02] system components>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

SC-07(12)-Examine

[SELECT FROM: System and communicaons protecon policy; procedures addressing boundary protecon; system design documentaon; boundary protecon hardware and soware; system conﬁguraon sengs and associated documentaon; system audit records; system security plan; other relevant documents or records].

SC-07(12)-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies; organizaonal personnel with boundary protecon responsibilies; system users].

SC-07(12)-Test

[SELECT FROM: Mechanisms implemenng host-based boundary protecon capabilies].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 536

NIST SP 800-53A, REV. 5

SC-07(13)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

BOUNDARY PROTECTION | ISOLATION OF SECURITY TOOLS, MECHANISMS, AND SUPPORT COMPONENTS ASSESSMENT OBJECTIVE: Determine if:

SC-07(13)_ODP

informaon security tools, mechanisms, and support components to be isolated from other internal system components are deﬁned;

SC-07(13)

<SC-07(13)_ODP informaon security tools, mechanisms, and support components> are isolated from other internal system components by implemenng physically separate subnetworks with managed interfaces to other components of the system.

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SC-07(14)

SC-07(13)-Examine

[SELECT FROM: System and communicaons protecon policy; procedures addressing boundary protecon; system design documentaon; system hardware and soware; system architecture; system conﬁguraon sengs and associated documentaon; list of security tools and support components to be isolated from other internal system components; system audit records; system security plan; other relevant documents or records].

SC-07(13)-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies; organizaonal personnel with boundary protecon responsibilies].

SC-07(13)-Test

[SELECT FROM: Mechanisms supporng and/or implemenng the isolaon of informaon security tools, mechanisms, and support components].

BOUNDARY PROTECTION | PROTECT AGAINST UNAUTHORIZED PHYSICAL CONNECTIONS ASSESSMENT OBJECTIVE: Determine if:

SC-07(14)_ODP

managed interfaces to be protected against unauthorized physical connecons are deﬁned;

SC-07(14)

<SC-07(14)_ODP managed interfaces> are protected against unauthorized physical connecons.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

SC-07(14)-Examine

[SELECT FROM: System and communicaons protecon policy; procedures addressing boundary protecon; system design documentaon; system hardware and soware; system architecture; system conﬁguraon sengs and associated documentaon; facility communicaons and wiring diagram system security plan; other relevant documents or records].

SC-07(14)-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies; organizaonal personnel with boundary protecon responsibilies].

SC-07(14)-Test

[SELECT FROM: Mechanisms supporng and/or implemenng protecon against unauthorized physical connecons].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 537

NIST SP 800-53A, REV. 5

SC-07(15)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

BOUNDARY PROTECTION | NETWORKED PRIVILEGED ACCESSES ASSESSMENT OBJECTIVE: Determine if:

SC-07(15)[01]

networked, privileged accesses are routed through a dedicated, managed interface for purposes of access control;

SC-07(15)[02]

networked, privileged accesses are routed through a dedicated, managed interface for purposes of auding.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SC-07(16)

SC-07(15)-Examine

[SELECT FROM: System and communicaons protecon policy; procedures addressing boundary protecon; system design documentaon; system hardware and soware; system architecture; system conﬁguraon sengs and associated documentaon; audit logs; system security plan; other relevant documents or records].

SC-07(15)-Interview

SC-07(15)-Test

[SELECT FROM: Mechanisms supporng and/or implemenng the roung of networked, privileged access through dedicated, managed interfaces].

BOUNDARY PROTECTION | PREVENT DISCOVERY OF SYSTEM COMPONENTS ASSESSMENT OBJECTIVE: Determine if: SC-07(16)

the discovery of speciﬁc system components that represent a managed interface is prevented.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SC-07(17)

SC-07(16)-Examine

SC-07(16)-Interview

SC-07(16)-Test

[SELECT FROM: Mechanisms supporng and/or implemenng the prevenon of discovery of system components at managed interfaces].

BOUNDARY PROTECTION | AUTOMATED ENFORCEMENT OF PROTOCOL FORMATS ASSESSMENT OBJECTIVE: Determine if: SC-07(17)

CHAPTER FOUR

adherence to protocol formats is enforced.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 538

NIST SP 800-53A, REV. 5

SC-07(17)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

BOUNDARY PROTECTION | AUTOMATED ENFORCEMENT OF PROTOCOL FORMATS POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SC-07(18)

SC-07(17)-Examine

[SELECT FROM: System and communicaons protecon policy; procedures addressing boundary protecon; system design documentaon; system architecture; system conﬁguraon sengs and associated documentaon; system audit records; system security plan; other relevant documents or records].

SC-07(17)-Interview

SC-07(17)-Test

[SELECT FROM: Mechanisms supporng and/or implemenng the enforcement of adherence to protocol formats].

BOUNDARY PROTECTION | FAIL SECURE ASSESSMENT OBJECTIVE: Determine if: SC-07(18)

systems are prevented from entering unsecure states in the event of an operaonal failure of a boundary protecon device.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SC-07(19)

SC-07(18)-Examine

SC-07(18)-Interview

SC-07(18)-Test

[SELECT FROM: Mechanisms supporng and/or implemenng secure failure].

BOUNDARY PROTECTION | BLOCK COMMUNICATION FROM NON-ORGANIZATIONALLY CONFIGURED HOSTS ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

SC-07(19)_ODP

communicaon clients that are independently conﬁgured by end users and external service providers are deﬁned;

SC-07(19)[01]

inbound communicaons traﬃc is blocked between <SC-07(19)_ODP communicaon clients> that are independently conﬁgured by end users and external service providers;

SC-07(19)[02]

outbound communicaons traﬃc is blocked between <SC-07(19)_ODP communicaon clients> that are independently conﬁgured by end users and external service providers.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 539

NIST SP 800-53A, REV. 5

SC-07(19)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

BOUNDARY PROTECTION | BLOCK COMMUNICATION FROM NON-ORGANIZATIONALLY CONFIGURED HOSTS POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SC-07(20)

SC-07(19)-Examine

[SELECT FROM: System and communicaons protecon policy; procedures addressing boundary protecon; system design documentaon; system hardware and soware; system architecture; system conﬁguraon sengs and associated documentaon; list of communicaon clients independently conﬁgured by end users and external service providers; system audit records; system security plan; other relevant documents or records].

SC-07(19)-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies; organizaonal personnel with boundary protecon responsibilies].

SC-07(19)-Test

[SELECT FROM: Mechanisms supporng and/or implemenng the blocking of inbound and outbound communicaons traﬃc between communicaon clients independently conﬁgured by end users and external service providers].

BOUNDARY PROTECTION | DYNAMIC ISOLATION AND SEGREGATION ASSESSMENT OBJECTIVE: Determine if:

SC-07(20)_ODP

system components to be dynamically isolated from other system components are deﬁned;

SC-07(20)

the capability to dynamically isolate <SC-07(20)_ODP system components> from other system components is provided.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SC-07(21)

SC-07(20)-Examine

[SELECT FROM: System and communicaons protecon policy; procedures addressing boundary protecon; system design documentaon; system hardware and soware; system architecture; system conﬁguraon sengs and associated documentaon; list of system components to be dynamically isolated/segregated from other components of the system; system audit records; system security plan; other relevant documents or records].

SC-07(20)-Interview

SC-07(20)-Test

[SELECT FROM: Mechanisms supporng and/or implemenng the capability to dynamically isolate/segregate system components].

BOUNDARY PROTECTION | ISOLATION OF SYSTEM COMPONENTS ASSESSMENT OBJECTIVE: Determine if:

SC-07(21)_ODP[01]

CHAPTER FOUR

system components to be isolated by boundary protecon mechanisms are deﬁned;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 540

NIST SP 800-53A, REV. 5

SC-07(21)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

BOUNDARY PROTECTION | ISOLATION OF SYSTEM COMPONENTS SC-07(21)_ODP[02]

missions and/or business funcons to be supported by system components isolated by boundary protecon mechanisms are deﬁned;

SC-07(21)

boundary protecon mechanisms are employed to isolate <SC-07(21)_ODP[01] system components> supporng <SC-07(21)_ODP[02] missions and/or business funcons>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SC-07(22)

SC-07(21)-Examine

[SELECT FROM: System and communicaons protecon policy; procedures addressing boundary protecon; system design documentaon; system hardware and soware; enterprise architecture documentaon; system architecture; system conﬁguraon sengs and associated documentaon; system audit records; system security plan; other relevant documents or records].

SC-07(21)-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies; organizaonal personnel with boundary protecon responsibilies].

SC-07(21)-Test

[SELECT FROM: Mechanisms supporng and/or implemenng the capability to separate system components supporng organizaonal missions and/or business funcons].

BOUNDARY PROTECTION | SEPARATE SUBNETS FOR CONNECTING TO DIFFERENT SECURITY DOMAINS ASSESSMENT OBJECTIVE: Determine if: SC-07(22)

separate network addresses are implemented to connect to systems in diﬀerent security domains.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SC-07(23)

SC-07(22)-Examine

SC-07(22)-Interview

SC-07(22)-Test

[SELECT FROM: Mechanisms supporng and/or implemenng separate network addresses/diﬀerent subnets].

BOUNDARY PROTECTION | DISABLE SENDER FEEDBACK ON PROTOCOL VALIDATION FAILURE ASSESSMENT OBJECTIVE: Determine if: SC-07(23)

CHAPTER FOUR

feedback to senders is disabled on protocol format validaon failure.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 541

NIST SP 800-53A, REV. 5

SC-07(23)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

BOUNDARY PROTECTION | DISABLE SENDER FEEDBACK ON PROTOCOL VALIDATION FAILURE POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SC-07(24)

SC-07(23)-Examine

SC-07(23)-Interview

SC-07(23)-Test

[SELECT FROM: Mechanisms supporng and/or implemenng the disabling of feedback to senders on protocol format validaon failure].

BOUNDARY PROTECTION | PERSONALLY IDENTIFIABLE INFORMATION ASSESSMENT OBJECTIVE: Determine if:

SC-07(24)_ODP

processing rules for systems that process personally idenﬁable informaon are deﬁned;

SC-07(24)(a)

<SC-07(24)_ODP processing rules> are applied to data elements of personally idenﬁable informaon on systems that process personally idenﬁable informaon;

SC-07(24)(b)[01]

permied processing is monitored at the external interfaces to the systems that process personally idenﬁable informaon;

SC-07(24)(b)[02]

permied processing is monitored at key internal boundaries within the systems that process personally idenﬁable informaon;

SC-07(24)(c)

each processing excepon is documented for systems that process personally idenﬁable informaon;

SC-07(24)(d)[01]

excepons for systems that process personally idenﬁable informaon are reviewed;

SC-07(24)(d)[02]

excepons for systems that process personally idenﬁable informaon that are no longer supported are removed.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

SC-07(24)-Examine

[SELECT FROM: System and communicaons protecon policy; procedures addressing boundary protecon; personally idenﬁable informaon processing policies; list of key internal boundaries of the system; system design documentaon; system conﬁguraon sengs and associated documentaon; enterprise security and privacy architecture documentaon; system audit records; system security plan; privacy plan; personally idenﬁable informaon inventory documentaon; data mapping documentaon; other relevant documents or records].

SC-07(24)-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security and privacy responsibilies; system developer; organizaonal personnel with boundary protecon responsibilies].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 542

NIST SP 800-53A, REV. 5

SC-07(24)

BOUNDARY PROTECTION | PERSONALLY IDENTIFIABLE INFORMATION SC-07(24)-Test

SC-07(25)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

[SELECT FROM: Mechanisms implemenng boundary protecon capabilies].

BOUNDARY PROTECTION | UNCLASSIFIED NATIONAL SECURITY SYSTEM CONNECTIONS ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SC-07(25)_ODP[01]

the unclassiﬁed naonal security system prohibited from directly connecng to an external network is deﬁned;

SC-07(25)_ODP[02]

the boundary protecon device required for a direct connecon to an external network is deﬁned;

SC-07(25)

the direct connecon of <SC-07(25)_ODP[01] unclassiﬁed naonal security system> to an external network without the use of <SC-07(25)_ODP[02] boundary protecon device> is prohibited.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SC-07(26)

SC-07(25)-Examine

SC-07(25)-Interview

SC-07(25)-Test

[SELECT FROM: Mechanisms prohibing the direct connecon of unclassiﬁed naonal security systems to an external network].

BOUNDARY PROTECTION | CLASSIFIED NATIONAL SECURITY SYSTEM CONNECTIONS ASSESSMENT OBJECTIVE: Determine if:

SC-07(26)_ODP

the boundary protecon device required for a direct connecon to an external network is deﬁned;

SC-07(26)

the direct connecon of classiﬁed naonal security system to an external network without the use of a <SC-07(26)_ODP boundary protecon device> is prohibited.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

SC-07(26)-Examine

SC-07(26)-Interview

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 543

NIST SP 800-53A, REV. 5

SC-07(26)

BOUNDARY PROTECTION | CLASSIFIED NATIONAL SECURITY SYSTEM CONNECTIONS SC-07(26)-Test

SC-07(27)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

[SELECT FROM: Mechanisms prohibing the direct connecon of classiﬁed naonal security systems to an external network].

BOUNDARY PROTECTION | UNCLASSIFIED NON-NATIONAL SECURITY SYSTEM CONNECTIONS ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SC-07(27)_ODP[01]

the unclassiﬁed, non-naonal security system prohibited from directly connecng to an external network is deﬁned;

SC-07(27)_ODP[02]

the boundary protecon device required for a direct connecon of unclassiﬁed, non-naonal security system to an external network is deﬁned;

SC-07(27)

the direct connecon of <SC-07(27)_ODP[01] unclassiﬁed, non-naonal security system> to an external network without the use of a <SC-07(27)_ODP[02] boundary protecon device> is prohibited.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SC-07(28)

SC-07(27)-Examine

SC-07(27)-Interview

SC-07(27)-Test

[SELECT FROM: Mechanisms prohibing the direct connecon of unclassiﬁed, nonnaonal security systems to an external network].

BOUNDARY PROTECTION | CONNECTIONS TO PUBLIC NETWORKS ASSESSMENT OBJECTIVE: Determine if:

SC-07(28)_ODP

the system that is prohibited from directly connecng to a public network is deﬁned;

SC-07(28)

the direct connecon of the <SC-07(28)_ODP system> to a public network is prohibited.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: SC-07(28)-Examine

CHAPTER FOUR

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 544

NIST SP 800-53A, REV. 5

SC-07(28)

SC-07(29)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

BOUNDARY PROTECTION | CONNECTIONS TO PUBLIC NETWORKS SC-07(28)-Interview

SC-07(28)-Test

[SELECT FROM: Mechanisms prohibing the direct connecon of systems to an external network].

BOUNDARY PROTECTION | SEPARATE SUBNETS TO ISOLATE FUNCTIONS

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

ASSESSMENT OBJECTIVE: Determine if:

SC-07(29)_ODP[01]

one of the following PARAMETER VALUES is selected: {physically; logically};

SC-07(29)_ODP[02]

crical system components and funcons to be isolated are deﬁned;

SC-07(29)

subnetworks are separated <SC-07(29)_ODP[01] SELECTED PARAMETER VALUE> to isolate <SC-07(29)_ODP[02] crical system components and funcons>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SC-08

SC-07(29)-Examine

[SELECT FROM: System and communicaons protecon policy; procedures addressing boundary protecon; system design documentaon; system hardware and soware; system architecture; system conﬁguraon sengs and associated documentaon; cricality analysis; system audit records; system security plan; other relevant documents or records].

SC-07(29)-Interview

SC-07(29)-Test

[SELECT FROM: Mechanisms separang crical system components and funcons].

TRANSMISSION CONFIDENTIALITY AND INTEGRITY ASSESSMENT OBJECTIVE: Determine if: SC-08_ODP

one or more of the following PARAMETER VALUES is/are selected: {conﬁdenality; integrity};

SC-08

the <SC-08_ODP SELECTED PARAMETER VALUE(S)> of transmied informaon is/ are protected.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

SC-08-Examine

[SELECT FROM: System and communicaons protecon policy; procedures addressing transmission conﬁdenality and integrity; system design documentaon; system conﬁguraon sengs and associated documentaon; system audit records; system security plan; other relevant documents or records].

SC-08-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies; system developer].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 545

NIST SP 800-53A, REV. 5

SC-08

TRANSMISSION CONFIDENTIALITY AND INTEGRITY SC-08-Test

SC-08(01)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

[SELECT FROM: Mechanisms supporng and/or implemenng transmission conﬁdenality and/or integrity].

TRANSMISSION CONFIDENTIALITY AND INTEGRITY | CRYPTOGRAPHIC PROTECTION ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SC-08(01)_ODP

one or more of the following PARAMETER VALUES is/are selected: {prevent unauthorized disclosure of informaon; detect changes to informaon};

SC-08(01)

cryptographic mechanisms are implemented to <SC-08(01)_ODP SELECTED PARAMETER VALUE(S)> during transmission.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SC-08(02)

SC-08(01)-Examine

SC-08(01)-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies; system developer].

SC-08(01)-Test

[SELECT FROM: Cryptographic mechanisms supporng and/or implemenng transmission conﬁdenality and/or integrity; mechanisms supporng and/or implemenng alternave physical safeguards; organizaonal processes for deﬁning and implemenng alternave physical safeguards].

TRANSMISSION CONFIDENTIALITY AND INTEGRITY | PRE- AND POST-TRANSMISSION HANDLING ASSESSMENT OBJECTIVE: Determine if:

SC-08(02)_ODP

one or more of the following PARAMETER VALUES is/are selected: {conﬁdenality; integrity};

SC-08(02)[01]

informaon <SC-08(02)_ODP SELECTED PARAMETER VALUE(S)> is/are maintained during preparaon for transmission;

SC-08(02)[02]

informaon <SC-08(02)_ODP SELECTED PARAMETER VALUE(S)> is/are maintained during recepon.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

SC-08(02)-Examine

SC-08(02)-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies; system developer].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 546

NIST SP 800-53A, REV. 5

SC-08(02)

TRANSMISSION CONFIDENTIALITY AND INTEGRITY | PRE- AND POST-TRANSMISSION HANDLING SC-08(02)-Test

SC-08(03)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

[SELECT FROM: Mechanisms supporng and/or implemenng transmission conﬁdenality and/or integrity].

TRANSMISSION CONFIDENTIALITY AND INTEGRITY | CRYPTOGRAPHIC PROTECTION FOR MESSAGE EXTERNALS ASSESSMENT OBJECTIVE:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

Determine if:

SC-08(03)_ODP

alternave physical controls to protect message externals are deﬁned;

SC-08(03)

cryptographic mechanisms are implemented to protect message externals unless otherwise protected by <SC-08(03)_ODP alternave physical controls>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SC-08(04)

SC-08(03)-Examine

SC-08(03)-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies; system developer].

SC-08(03)-Test

[SELECT FROM: Cryptographic mechanisms supporng and/or implemenng transmission conﬁdenality and/or integrity for message externals; mechanisms supporng and/or implemenng alternave physical safeguards; organizaonal processes for deﬁning and implemenng alternave physical safeguards].

TRANSMISSION CONFIDENTIALITY AND INTEGRITY | CONCEAL OR RANDOMIZE COMMUNICATIONS ASSESSMENT OBJECTIVE: Determine if:

SC-08(04)_ODP

alternave physical controls to protect against unauthorized disclosure of communicaon paerns are deﬁned;

SC-08(04)

cryptographic mechanisms are implemented to conceal or randomize communicaon paerns unless otherwise protected by <SC-08(04)_ODP alternave physical controls>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

SC-08(04)-Examine

SC-08(04)-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies; system developer].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 547

NIST SP 800-53A, REV. 5

SC-08(04)

TRANSMISSION CONFIDENTIALITY AND INTEGRITY | CONCEAL OR RANDOMIZE COMMUNICATIONS SC-08(04)-Test

SC-08(05)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

[SELECT FROM: Cryptographic mechanisms supporng and/or implemenng concealment or randomizaon of communicaon paerns; mechanisms supporng and/or implemenng alternave physical safeguards; organizaonal processes for deﬁning and implemenng alternave physical safeguards].

TRANSMISSION CONFIDENTIALITY AND INTEGRITY | PROTECTED DISTRIBUTION SYSTEM

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

ASSESSMENT OBJECTIVE: Determine if:

SC-08(05)_ODP[01]

the protected distribuon system is deﬁned;

SC-08(05)_ODP[02]

one or more of the following PARAMETER VALUES is/are selected: {prevent unauthorized disclosure of informaon; detect changes to informaon};

SC-08(05)

the <SC-08(05)_ODP[01] protected distribuon system> is implemented to <SC-08(05)_ODP[02] SELECTED PARAMETER VALUE(S)> during transmission.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SC-09

SC-08(05)-Examine

SC-08(05)-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies; system developer].

SC-08(05)-Test

[SELECT FROM: Cryptographic mechanisms supporng and/or implemenng concealment or randomizaon of communicaon paerns; mechanisms supporng and/or implemenng protected distribuon systems].

TRANSMISSION CONFIDENTIALITY [WITHDRAWN: Incorporated into SC-08.]

SC-10

NETWORK DISCONNECT ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

SC-10_ODP

a me period of inacvity aer which the system terminates a network connecon associated with a communicaon session is deﬁned;

SC-10

the network connecon associated with a communicaon session is terminated at the end of the session or aer <SC-10_ODP me period> of inacvity.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 548

NIST SP 800-53A, REV. 5

SC-10

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

NETWORK DISCONNECT POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SC-11

SC-10-Examine

[SELECT FROM: System and communicaons protecon policy; procedures addressing network disconnect; system design documentaon; security plan; system conﬁguraon sengs and associated documentaon; system audit records; system security plan; other relevant documents or records].

SC-10-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies; system developer].

SC-10-Test

[SELECT FROM: Mechanisms supporng and/or implemenng a network disconnect capability].

TRUSTED PATH ASSESSMENT OBJECTIVE: Determine if:

SC-11_ODP[01]

one of the following PARAMETER VALUES is selected: {physically; logically};

SC-11_ODP[02]

security funcons of the system are deﬁned;

SC-11a.

a <SC-11_ODP[01] SELECTED PARAMETER VALUE> isolated trusted communicaon path is provided for communicaons between the user and the trusted components of the system;

SC-11b.

users are permied to invoke the trusted communicaon path for communicaons between the user and the <SC-11_ODP[02] security funcons> of the system, including authencaon and re-authencaon, at a minimum.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SC-11(01)

SC-11-Examine

[SELECT FROM: System and communicaons protecon policy; procedures addressing trusted communicaon paths; security plan; system design documentaon; system conﬁguraon sengs and associated documentaon; assessment results from independent, tesng organizaons; system audit records; system security plan; other relevant documents or records].

SC-11-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies; system developer].

SC-11-Test

[SELECT FROM: Mechanisms supporng and/or implemenng trusted communicaon paths].

TRUSTED PATH | IRREFUTABLE COMMUNICATIONS PATH ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

SC-11(01)_ODP

security funcons of the system are deﬁned;

SC-11(01)(a)

a trusted communicaon path that is irrefutably disnguishable from other communicaon paths is provided;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 549

NIST SP 800-53A, REV. 5

SC-11(01)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

TRUSTED PATH | IRREFUTABLE COMMUNICATIONS PATH SC-11(01)(b)

the trusted communicaon path for communicaons between the <SC-11(01)_ODP security funcons> of the system and the user is iniated.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SC-12

SC-11(01)-Examine

SC-11(01)-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies; system developer].

SC-11(01)-Test

[SELECT FROM: Mechanisms supporng and/or implemenng trusted communicaon paths].

CRYPTOGRAPHIC KEY ESTABLISHMENT AND MANAGEMENT ASSESSMENT OBJECTIVE: Determine if: SC-12_ODP

requirements for key generaon, distribuon, storage, access, and destrucon are deﬁned;

SC-12[01]

cryptographic keys are established when cryptography is employed within the system in accordance with <SC-12_ODP requirements>;

SC-12[02]

cryptographic keys are managed when cryptography is employed within the system in accordance with <SC-12_ODP requirements>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SC-12(01)

SC-12-Examine

[SELECT FROM: System and communicaons protecon policy; procedures addressing cryptographic key establishment and management; system design documentaon; cryptographic mechanisms; system conﬁguraon sengs and associated documentaon; system audit records; system security plan; other relevant documents or records].

SC-12-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies; organizaonal personnel with responsibilies for cryptographic key establishment and/or management].

SC-12-Test

[SELECT FROM: Mechanisms supporng and/or implemenng cryptographic key establishment and management].

CRYPTOGRAPHIC KEY ESTABLISHMENT AND MANAGEMENT | AVAILABILITY ASSESSMENT OBJECTIVE: Determine if: SC-12(01)

CHAPTER FOUR

informaon availability is maintained in the event of the loss of cryptographic keys by users.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 550

NIST SP 800-53A, REV. 5

SC-12(01)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

CRYPTOGRAPHIC KEY ESTABLISHMENT AND MANAGEMENT | AVAILABILITY POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SC-12(02)

SC-12(01)-Examine

[SELECT FROM: System and communicaons protecon policy; procedures addressing cryptographic key establishment, management, and recovery; system design documentaon; system conﬁguraon sengs and associated documentaon; system audit records; system security plan; other relevant documents or records].

SC-12(01)-Interview

SC-12(01)-Test

[SELECT FROM: Mechanisms supporng and/or implemenng cryptographic key establishment and management].

CRYPTOGRAPHIC KEY ESTABLISHMENT AND MANAGEMENT | SYMMETRIC KEYS ASSESSMENT OBJECTIVE: Determine if:

SC-12(02)_ODP

one of the following PARAMETER VALUES is selected: {NIST FIPS-validated; NSAapproved};

SC-12(02)[01]

symmetric cryptographic keys are produced using <SC-12(02)_ODP SELECTED PARAMETER VALUE> key management technology and processes;

SC-12(02)[02]

symmetric cryptographic keys are controlled using <SC-12(02)_ODP SELECTED PARAMETER VALUE> key management technology and processes;

SC-12(02)[03]

symmetric cryptographic keys are distributed using <SC-12(02)_ODP SELECTED PARAMETER VALUE> key management technology and processes.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

SC-12(02)-Examine

[SELECT FROM: System and communicaons protecon policy; procedures addressing cryptographic key establishment and management; system design documentaon; system conﬁguraon sengs and associated documentaon; system audit records; list of FIPS-validated cryptographic products; list of NSAapproved cryptographic products; system security plan; other relevant documents or records].

SC-12(02)-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies; system developer; organizaonal personnel with responsibilies for cryptographic key establishment or management].

SC-12(02)-Test

[SELECT FROM: Mechanisms supporng and/or implemenng symmetric cryptographic key establishment and management].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 551

NIST SP 800-53A, REV. 5

SC-12(03)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

CRYPTOGRAPHIC KEY ESTABLISHMENT AND MANAGEMENT | ASYMMETRIC KEYS ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SC-12(03)_ODP

one of the following PARAMETER VALUES is selected: {NSA-approved key management technology and processes; preposioned keying material; DoDapproved or DoD-issued Medium Assurance PKI cerﬁcates; DoD-approved or DoD-issued Medium Hardware Assurance PKI cerﬁcates and hardware security tokens that protect the user’s private key; cerﬁcates issued in accordance with organizaon-deﬁned requirements};

SC-12(03)[01]

asymmetric cryptographic keys are produced using <SC-12(03)_ODP SELECTED PARAMETER VALUE>;

SC-12(03)[02]

asymmetric cryptographic keys are controlled using <SC-12(03)_ODP SELECTED PARAMETER VALUE>;

SC-12(03)[03]

asymmetric cryptographic keys are distributed using <SC-12(03)_ODP SELECTED PARAMETER VALUE>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SC-12(04)

SC-12(03)-Examine

[SELECT FROM: System and communicaons protecon policy; procedures addressing cryptographic key establishment and management; system design documentaon; system conﬁguraon sengs and associated documentaon; system audit records; list of NSA-approved cryptographic products; list of approved PKI Class 3 and Class 4 cerﬁcates; system security plan; other relevant documents or records].

SC-12(03)-Interview

SC-12(03)-Test

[SELECT FROM: Mechanisms supporng and/or implemenng asymmetric cryptographic key establishment and management].

CRYPTOGRAPHIC KEY ESTABLISHMENT AND MANAGEMENT | PKI CERTIFICATES [WITHDRAWN: Incorporated into SC-12(03).]

SC-12(05)

CRYPTOGRAPHIC KEY ESTABLISHMENT AND MANAGEMENT | PKI CERTIFICATES  HARDWARE TOKENS [WITHDRAWN: Incorporated into SC-12(03).]

CHAPTER FOUR

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 552

NIST SP 800-53A, REV. 5

SC-12(06)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

CRYPTOGRAPHIC KEY ESTABLISHMENT AND MANAGEMENT | PHYSICAL CONTROL OF KEYS ASSESSMENT OBJECTIVE: Determine if: SC-12(06)

physical control of cryptographic keys is maintained when stored informaon is encrypted by external service providers.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SC-13

SC-12(06)-Examine

SC-12(06)-Interview

SC-12(06)-Test

[SELECT FROM: Mechanisms supporng and/or implemenng cryptographic key establishment and management].

CRYPTOGRAPHIC PROTECTION ASSESSMENT OBJECTIVE: Determine if:

SC-13_ODP[01]

cryptographic uses are deﬁned;

SC-13_ODP[02]

types of cryptography for each speciﬁed cryptographic use are deﬁned;

SC-13a.

<SC-13_ODP[01] cryptographic uses> are idenﬁed;

SC-13b.

<SC-13_ODP[02] types of cryptography> for each speciﬁed cryptographic use (deﬁned in SC-13_ODP[01]) are implemented.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SC-13(01)

SC-13-Examine

[SELECT FROM: System and communicaons protecon policy; procedures addressing cryptographic protecon; system design documentaon; system conﬁguraon sengs and associated documentaon; cryptographic module validaon cerﬁcates; list of FIPS-validated cryptographic modules; system audit records; system security plan; other relevant documents or records].

SC-13-Interview

SC-13-Test

[SELECT FROM: Mechanisms supporng and/or implemenng cryptographic protecon].

CRYPTOGRAPHIC PROTECTION | FIPS-VALIDATED CRYPTOGRAPHY [WITHDRAWN: Incorporated into SC-13.]

CHAPTER FOUR

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 553

NIST SP 800-53A, REV. 5

SC-13(02)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

CRYPTOGRAPHIC PROTECTION | NSA-APPROVED CRYPTOGRAPHY [WITHDRAWN: Incorporated into SC-13.]

SC-13(03)

CRYPTOGRAPHIC PROTECTION | INDIVIDUALS WITHOUT FORMAL ACCESS APPROVALS [WITHDRAWN: Incorporated into SC-13.]

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SC-13(04)

CRYPTOGRAPHIC PROTECTION | DIGITAL SIGNATURES [WITHDRAWN: Incorporated into SC-13.]

SC-14

PUBLIC ACCESS PROTECTIONS [WITHDRAWN: Incorporated into AC-02, AC-03, AC-05, AC-06, SI-03, SI-04, SI-05, SI-07, SI-10.]

SC-15

COLLABORATIVE COMPUTING DEVICES AND APPLICATIONS ASSESSMENT OBJECTIVE: Determine if: SC-15_ODP

excepons where remote acvaon is to be allowed are deﬁned;

SC-15a.

remote acvaon of collaborave compung devices and applicaons is prohibited except <SC-15_ODP excepons where remote acvaon is to be allowed>;

SC-15b.

an explicit indicaon of use is provided to users physically present at the devices.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

SC-15-Examine

SC-15-Interview

SC-15-Test

[SELECT FROM: Mechanisms supporng and/or implemenng the management of remote acvaon of collaborave compung devices; mechanisms providing an indicaon of use of collaborave compung devices].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 554

NIST SP 800-53A, REV. 5

SC-15(01)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

COLLABORATIVE COMPUTING DEVICES AND APPLICATIONS | PHYSICAL OR LOGICAL DISCONNECT ASSESSMENT OBJECTIVE: Determine if:

SC-15(01)_ODP

one or more of the following PARAMETER VALUES is/are selected: {physical; logical};

SC-15(01)

the <SC-15(01)_ODP SELECTED PARAMETER VALUE(S)> disconnect of collaborave compung devices is/are provided in a manner that supports ease of use.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SC-15(02)

SC-15(01)-Examine

SC-15(01)-Interview

SC-15(01)-Test

[SELECT FROM: Mechanisms supporng and/or implemenng the physical disconnect of collaborave compung devices].

COLLABORATIVE COMPUTING DEVICES AND APPLICATIONS | BLOCKING INBOUND AND OUTBOUND COMMUNICATIONS TRAFFIC [WITHDRAWN: Incorporated into SC-07.]

SC-15(03)

COLLABORATIVE COMPUTING DEVICES AND APPLICATIONS | DISABLING AND REMOVAL IN SECURE WORK AREAS ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

SC-15(03)_ODP[01]

systems or system components from which collaborave compung devices are to be disabled or removed are deﬁned;

SC-15(03)_ODP[02]

secure work areas where collaborave compung devices are to be disabled or removed from systems or system components are deﬁned;

SC-15(03)

collaborave compung devices and applicaons are disabled or removed from <SC-15(03)_ODP[01] systems or system components> in <SC-15(03)_ODP[02] secure work areas>.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 555

NIST SP 800-53A, REV. 5

SC-15(03)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

COLLABORATIVE COMPUTING DEVICES AND APPLICATIONS | DISABLING AND REMOVAL IN SECURE WORK AREAS POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SC-15(04)

SC-15(03)-Examine

[SELECT FROM: System and communicaons protecon policy; procedures addressing collaborave compung; access control policy and procedures; system design documentaon; system conﬁguraon sengs and associated documentaon; system audit records; list of secure work areas; systems or system components in secured work areas where collaborave compung devices are to be disabled or removed; system security plan; other relevant documents or records].

SC-15(03)-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies; organizaonal personnel with responsibilies for managing collaborave compung devices].

SC-15(03)-Test

[SELECT FROM: Mechanisms supporng and/or implemenng the capability to disable collaborave compung devices].

COLLABORATIVE COMPUTING DEVICES AND APPLICATIONS | EXPLICITLY INDICATE CURRENT PARTICIPANTS ASSESSMENT OBJECTIVE: Determine if:

SC-15(04)_ODP

online meengs and teleconferences for which an explicit indicaon of current parcipants is to be provided are deﬁned;

SC-15(04)

an explicit indicaon of current parcipants in <SC-15(04)_ODP online meengs and teleconferences> is provided.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SC-16

SC-15(04)-Examine

[SELECT FROM: System and communicaons protecon policy; procedures addressing collaborave compung; access control policy and procedures; system design documentaon; system conﬁguraon sengs and associated documentaon; system audit records; list of types of meengs and teleconferences requiring explicit indicaon of current parcipants; system security plan; other relevant documents or records].

SC-15(04)-Interview

SC-15(04)-Test

[SELECT FROM: Mechanisms supporng and/or implemenng the capability to indicate parcipants on collaborave compung devices].

TRANSMISSION OF SECURITY AND PRIVACY ATTRIBUTES ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

SC-16_ODP[01]

security aributes to be associated with informaon exchanged are deﬁned;

SC-16_ODP[02]

privacy aributes to be associated with informaon exchanged are deﬁned;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 556

NIST SP 800-53A, REV. 5

SC-16

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

TRANSMISSION OF SECURITY AND PRIVACY ATTRIBUTES SC-16[01]

<SC-16_ODP[01] security aributes> are associated with informaon exchanged between systems;

SC-16[02]

<SC-16_ODP[01] security aributes> are associated with informaon exchanged between system components;

SC-16[03]

<SC-16_ODP[02] privacy aributes> are associated with informaon exchanged between systems;

SC-16[04]

<SC-16_ODP[02] privacy aributes> are associated with informaon exchanged between system components.

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SC-16(01)

SC-16-Examine

[SELECT FROM: System and communicaons protecon policy; procedures addressing the transmission of security and privacy aributes; access control policy and procedures; informaon ﬂow control policy; system design documentaon; system conﬁguraon sengs and associated documentaon; system audit records; system security plan; privacy plan; other relevant documents or records].

SC-16-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security and privacy responsibilies].

SC-16-Test

[SELECT FROM: Mechanisms supporng and/or implemenng the transmission of security and privacy aributes between systems].

TRANSMISSION OF SECURITY AND PRIVACY ATTRIBUTES | INTEGRITY VERIFICATION ASSESSMENT OBJECTIVE: Determine if:

SC-16(01)[01]

the integrity of transmied security aributes is veriﬁed;

SC-16(01)[02]

the integrity of transmied privacy aributes is veriﬁed.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

SC-16(01)-Examine

[SELECT FROM: System and communicaons protecon policy; procedures addressing the transmission of security and privacy aributes; access control policy and procedures; system design documentaon; system conﬁguraon sengs and associated documentaon; system audit records; system security plan; privacy plan; other relevant documents or records].

SC-16(01)-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security and privacy responsibilies].

SC-16(01)-Test

[SELECT FROM: Mechanisms supporng and/or implemenng veriﬁcaon of the integrity of transmied security and privacy aributes].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 557

NIST SP 800-53A, REV. 5

SC-16(02)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

TRANSMISSION OF SECURITY AND PRIVACY ATTRIBUTES | ANTI-SPOOFING MECHANISMS ASSESSMENT OBJECTIVE: Determine if: SC-16(02)

an-spooﬁng mechanisms are implemented to prevent adversaries from falsifying the security aributes indicang the successful applicaon of the security process.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SC-16(03)

SC-16(02)-Examine

SC-16(02)-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies].

SC-16(02)-Test

[SELECT FROM: Mechanisms supporng and/or implemenng an-spooﬁng mechanisms].

TRANSMISSION OF SECURITY AND PRIVACY ATTRIBUTES | CRYPTOGRAPHIC BINDING ASSESSMENT OBJECTIVE: Determine if:

SC-16(03)_ODP

mechanisms or techniques to bind security and privacy aributes to transmied informaon are deﬁned;

SC-16(03)

<SC-16(03)_ODP mechanisms or techniques> are implemented to bind security and privacy aributes to transmied informaon.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SC-17

SC-16(03)-Examine

SC-16(03)-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies].

SC-16(03)-Test

[SELECT FROM: Mechanisms supporng and/or implemenng an-spooﬁng mechanisms].

PUBLIC KEY INFRASTRUCTURE CERTIFICATES ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

SC-17_ODP

a cerﬁcate policy for issuing public key cerﬁcates is deﬁned;

SC-17a.

public key cerﬁcates are issued under <SC-17_ODP cerﬁcate policy> , or public key cerﬁcates are obtained from an approved service provider;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 558

NIST SP 800-53A, REV. 5

SC-17

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

PUBLIC KEY INFRASTRUCTURE CERTIFICATES SC-17b.

only approved trust anchors are included in trust stores or cerﬁcate stores managed by the organizaon.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SC-18

SC-17-Examine

[SELECT FROM: System and communicaons protecon policy; procedures addressing public key infrastructure cerﬁcates; public key cerﬁcate policy or policies; public key issuing process; system security plan; other relevant documents or records].

SC-17-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies; organizaonal personnel with responsibilies for issuing public key cerﬁcates; service providers].

SC-17-Test

[SELECT FROM: Mechanisms supporng and/or implemenng the management of public key infrastructure cerﬁcates].

MOBILE CODE ASSESSMENT OBJECTIVE: Determine if: SC-18a.[01]

acceptable mobile code is deﬁned;

SC-18a.[02]

unacceptable mobile code is deﬁned;

SC-18a.[03]

acceptable mobile code technologies are deﬁned;

SC-18a.[04]

unacceptable mobile code technologies are deﬁned;

SC-18b.[01]

the use of mobile code is authorized within the system;

SC-18b.[02]

the use of mobile code is monitored within the system;

SC-18b.[03]

the use of mobile code is controlled within the system.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

SC-18-Examine

[SELECT FROM: System and communicaons protecon policy; procedures addressing mobile code; mobile code implementaon policy and procedures; list of acceptable mobile code and mobile code technologies; list of unacceptable mobile code and mobile technologies; authorizaon records; system monitoring records; system audit records; system security plan; other relevant documents or records].

SC-18-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies; organizaonal personnel with responsibilies for managing mobile code].

SC-18-Test

[SELECT FROM: Organizaonal process for authorizing, monitoring, and controlling mobile code; mechanisms supporng and/or implemenng the management of mobile code; mechanisms supporng and/or implemenng the monitoring of mobile code].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 559

NIST SP 800-53A, REV. 5

SC-18(01)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

MOBILE CODE | IDENTIFY UNACCEPTABLE CODE AND TAKE CORRECTIVE ACTIONS ASSESSMENT OBJECTIVE: Determine if:

SC-18(01)_ODP[01]

unacceptable mobile code to be idenﬁed is deﬁned;

SC-18(01)_ODP[02]

correcve acons to be taken when unacceptable mobile code is idenﬁed are deﬁned;

SC-18(01)[01]

<SC-18(01)_ODP[01] unacceptable mobile code> is idenﬁed;

SC-18(01)[02]

<SC-18(01)_ODP[02] correcve acons> are taken if unacceptable mobile code is idenﬁed.

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SC-18(02)

SC-18(01)-Examine

[SELECT FROM: System and communicaons protecon policy; procedures addressing mobile code; mobile code usage restricons; mobile code implementaon policy and procedures; system design documentaon; system conﬁguraon sengs and associated documentaon; list of unacceptable mobile code; list of correcve acons to be taken when unacceptable mobile code is idenﬁed; system monitoring records; system audit records; system security plan; other relevant documents or records].

SC-18(01)-Interview

SC-18(01)-Test

[SELECT FROM: Mechanisms supporng and/or implemenng mobile code detecon, inspecon, and correcve capabilies].

MOBILE CODE | ACQUISITION, DEVELOPMENT, AND USE ASSESSMENT OBJECTIVE: Determine if:

SC-18(02)_ODP

mobile code requirements for the acquision, development, and use of mobile code to be deployed in the system are deﬁned;

SC-18(02)[01]

the acquision of mobile code to be deployed in the system meets <SC-18(02)_ODP mobile code requirements>;

SC-18(02)[02]

the development of mobile code to be deployed in the system meets <SC-18(02)_ODP mobile code requirements>;

SC-18(02)[03]

the use of mobile code to be deployed in the system meets <SC-18(02)_ODP mobile code requirements>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: SC-18(02)-Examine

CHAPTER FOUR

[SELECT FROM: System and communicaons protecon policy; procedures addressing mobile code; mobile code requirements; mobile code usage restricons; mobile code implementaon policy and procedures; acquision documentaon; acquision contracts for system, system component, or system service; system development life cycle documentaon; system security plan; other relevant documents or records].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 560

NIST SP 800-53A, REV. 5

SC-18(02)

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SC-18(03)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

MOBILE CODE | ACQUISITION, DEVELOPMENT, AND USE SC-18(02)-Interview

SC-18(02)-Test

[SELECT FROM: Organizaonal processes for the acquision, development, and use of mobile code].

MOBILE CODE | PREVENT DOWNLOADING AND EXECUTION ASSESSMENT OBJECTIVE: Determine if:

SC-18(03)_ODP

unacceptable mobile code to be prevented from downloading and execung is deﬁned;

SC-18(03)[01]

the download of <SC-18(03)_ODP unacceptable mobile code> is prevented;

SC-18(03)[02]

the execuon of <SC-18(03)_ODP unacceptable mobile code> is prevented.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SC-18(04)

SC-18(03)-Examine

[SELECT FROM: System and communicaons protecon policy; procedures addressing mobile code; mobile code usage restricons; mobile code implementaon policy and procedures; system design documentaon; system conﬁguraon sengs and associated documentaon; system audit records; system security plan; other relevant documents or records].

SC-18(03)-Interview

SC-18(03)-Test

[SELECT FROM: Mechanisms prevenng the download and execuon of unacceptable mobile code].

MOBILE CODE | PREVENT AUTOMATIC EXECUTION ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

SC-18(04)_ODP[01]

soware applicaons in which the automac execuon of mobile code is to be prevented are deﬁned;

SC-18(04)_ODP[02]

acons to be enforced by the system prior to execung mobile code are deﬁned;

SC-18(04)[01]

the automac execuon of mobile code in <SC-18(04)_ODP[01] soware applicaons> is prevented;

SC-18(04)[02]

<SC-18(04)_ODP[02] acons> are enforced prior to execung mobile code.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 561

NIST SP 800-53A, REV. 5

SC-18(04)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

MOBILE CODE | PREVENT AUTOMATIC EXECUTION POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SC-18(05)

SC-18(04)-Examine

[SELECT FROM: System and communicaons protecon policy; procedures addressing mobile code; mobile code usage restricons; mobile code implementaon policy and procedures; system design documentaon; system conﬁguraon sengs and associated documentaon; list of soware applicaons in which the automac execuon of mobile code must be prohibited; list of acons required before execuon of mobile code; system security plan; other relevant documents or records].

SC-18(04)-Interview

SC-18(04)-Test

[SELECT FROM: Mechanisms prevenng the automac execuon of unacceptable mobile code; mechanisms enforcing acons to be taken prior to the execuon of the mobile code].

MOBILE CODE | ALLOW EXECUTION ONLY IN CONFINED ENVIRONMENTS ASSESSMENT OBJECTIVE: Determine if: SC-18(05)

execuon of permied mobile code is allowed only in conﬁned virtual machine environments.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SC-19

SC-18(05)-Examine

[SELECT FROM: System and communicaons protecon policy; procedures addressing mobile code; mobile code usage allowances; mobile code usage restricons; system design documentaon; system conﬁguraon sengs and associated documentaon; list of conﬁned virtual machine environments in which the execuon of organizaonally acceptable mobile code is allowed; system audit records; system security plan; other relevant documents or records].

SC-18(05)-Interview

SC-18(05)-Test

[SELECT FROM: Mechanisms allowing for the execuon of permied mobile code in conﬁned virtual machine environments].

VOICE OVER INTERNET PROTOCOL [WITHDRAWN. Technology-speciﬁc; addressed as any other technology or protocol.]

CHAPTER FOUR

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 562

NIST SP 800-53A, REV. 5

SC-20

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

SECURE NAME/ADDRESS RESOLUTION SERVICE (AUTHORITATIVE SOURCE) ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SC-20a.[01]

addional data origin authencaon is provided along with the authoritave name resoluon data that the system returns in response to external name/address resoluon queries;

SC-20a.[02]

integrity veriﬁcaon arfacts are provided along with the authoritave name resoluon data that the system returns in response to external name/address resoluon queries;

SC-20b.[01]

the means to indicate the security status of child zones (and if the child supports secure resoluon services) is provided when operang as part of a distributed, hierarchical namespace;

SC-20b.[02]

the means to enable veriﬁcaon of a chain of trust among parent and child domains when operang as part of a distributed, hierarchical namespace is provided.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SC-20(01)

SC-20-Examine

[SELECT FROM: System and communicaons protecon policy; procedures addressing secure name/address resoluon services (authoritave source); system design documentaon; system conﬁguraon sengs and associated documentaon; system security plan; other relevant documents or records].

SC-20-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies; organizaonal personnel with responsibilies for managing DNS].

SC-20-Test

[SELECT FROM: Mechanisms supporng and/or implemenng secure name/ address resoluon services].

SECURE NAME/ADDRESS RESOLUTION SERVICE (AUTHORITATIVE SOURCE) | CHILD SUBSPACES [WITHDRAWN: Incorporated into SC-20.]

SC-20(02)

SECURE NAME/ADDRESS RESOLUTION SERVICE (AUTHORITATIVE SOURCE) | DATA ORIGIN AND INTEGRITY ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

SC-20(02)[01]

data origin arfacts are provided for internal name/address resoluon queries;

SC-20(02)[02]

integrity protecon arfacts are provided for internal name/address resoluon queries.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 563

NIST SP 800-53A, REV. 5

SC-20(02)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

SECURE NAME/ADDRESS RESOLUTION SERVICE (AUTHORITATIVE SOURCE) | DATA ORIGIN AND INTEGRITY POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SC-21

SC-20(02)-Examine

[SELECT FROM: System and communicaons protecon policy; procedures addressing secure name/address resoluon services (authoritave source); system design documentaon; system conﬁguraon sengs and associated documentaon; system audit records; system security plan; other relevant documents or records].

SC-20(02)-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies; organizaonal personnel with responsibilies for managing DNS].

SC-20(02)-Test

[SELECT FROM: Mechanisms supporng and/or implemenng data origin and integrity protecon for internal name/address resoluon service queries].

SECURE NAME/ADDRESS RESOLUTION SERVICE (RECURSIVE OR CACHING RESOLVER) ASSESSMENT OBJECTIVE: Determine if: SC-21[01]

data origin authencaon is requested for the name/address resoluon responses that the system receives from authoritave sources;

SC-21[02]

data origin authencaon is performed on the name/address resoluon responses that the system receives from authoritave sources;

SC-21[03]

data integrity veriﬁcaon is requested for the name/address resoluon responses that the system receives from authoritave sources;

SC-21[04]

data integrity veriﬁcaon is performed on the name/address resoluon responses that the system receives from authoritave sources.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SC-21(01)

SC-21-Examine

[SELECT FROM: System and communicaons protecon policy; procedures addressing secure name/address resoluon services (recursive or caching resolver); system design documentaon; system conﬁguraon sengs and associated documentaon; system audit records; system security plan; other relevant documents or records].

SC-21-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies; organizaonal personnel with responsibilies for managing DNS].

SC-21-Test

[SELECT FROM: Mechanisms supporng and/or implemenng data origin authencaon and data integrity veriﬁcaon for name/address resoluon services].

SECURE NAME/ADDRESS RESOLUTION SERVICE (RECURSIVE OR CACHING RESOLVER) | DATA ORIGIN AND INTEGRITY [WITHDRAWN: Incorporated into SC-21.]

CHAPTER FOUR

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 564

NIST SP 800-53A, REV. 5

SC-22

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

ARCHITECTURE AND PROVISIONING FOR NAME/ADDRESS RESOLUTION SERVICE ASSESSMENT OBJECTIVE: Determine if: SC-22[01]

the systems that collecvely provide name/address resoluon services for an organizaon are fault-tolerant;

SC-22[02]

the systems that collecvely provide name/address resoluon services for an organizaon implement internal role separaon;

SC-22[03]

the systems that collecvely provide name/address resoluon services for an organizaon implement external role separaon.

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SC-23

SC-22-Examine

[SELECT FROM: System and communicaons protecon policy; procedures addressing architecture and provisioning for name/address resoluon services; access control policy and procedures; system design documentaon; assessment results from independent tesng organizaons; system conﬁguraon sengs and associated documentaon; system audit records; system security plan; other relevant documents or records].

SC-22-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies; organizaonal personnel with responsibilies for managing DNS].

SC-22-Test

[SELECT FROM: Mechanisms supporng and/or implemenng name/address resoluon services for fault tolerance and role separaon].

SESSION AUTHENTICITY ASSESSMENT OBJECTIVE: Determine if: SC-23

the authencity of communicaon sessions is protected.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SC-23(01)

SC-23-Examine

[SELECT FROM: System and communicaons protecon policy; procedures addressing session authencity; system design documentaon; system conﬁguraon sengs and associated documentaon; system audit records; system security plan; other relevant documents or records].

SC-23-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies].

SC-23-Test

[SELECT FROM: Mechanisms supporng and/or implemenng session authencity].

SESSION AUTHENTICITY | INVALIDATE SESSION IDENTIFIERS AT LOGOUT ASSESSMENT OBJECTIVE: Determine if: SC-23(01)

CHAPTER FOUR

session idenﬁers are invalidated upon user logout or other session terminaon.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 565

NIST SP 800-53A, REV. 5

SC-23(01)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

SESSION AUTHENTICITY | INVALIDATE SESSION IDENTIFIERS AT LOGOUT POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SC-23(02)

SC-23(01)-Examine

SC-23(01)-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies].

SC-23(01)-Test

[SELECT FROM: Mechanisms supporng and/or implemenng session idenﬁer invalidaon upon session terminaon].

SESSION AUTHENTICITY | USER-INITIATED LOGOUTS AND MESSAGE DISPLAYS [WITHDRAWN: Incorporated into AC-12(01).]

SC-23(03)

SESSION AUTHENTICITY | UNIQUE SYSTEM-GENERATED SESSION IDENTIFIERS ASSESSMENT OBJECTIVE: Determine if:

SC-23(03)_ODP

randomness requirements for generang a unique session idenﬁer for each session are deﬁned;

SC-23(03)[01]

a unique session idenﬁer is generated for each session with <SC-23(03)_ODP randomness requirements>;

SC-23(03)[02]

only system-generated session idenﬁers are recognized.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SC-23(04)

SC-23(03)-Examine

SC-23(03)-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies].

SC-23(03)-Test

[SELECT FROM: Mechanisms supporng, implemenng, generang, and monitoring unique session idenﬁers; mechanisms supporng and/or implemenng randomness requirements].

SESSION AUTHENTICITY | UNIQUE SESSION IDENTIFIERS WITH RANDOMIZATION [WITHDRAWN: Incorporated into SC-23(03).]

CHAPTER FOUR

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 566

NIST SP 800-53A, REV. 5

SC-23(05)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

SESSION AUTHENTICITY | ALLOWED CERTIFICATE AUTHORITIES ASSESSMENT OBJECTIVE: Determine if:

SC-23(05)_ODP

cerﬁcate authories to be allowed for veriﬁcaon of the establishment of protected sessions are deﬁned;

SC-23(05)

only the use of <SC-23(05)_ODP cerﬁcated authories> for veriﬁcaon of the establishment of protected sessions is allowed.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SC-24

SC-23(05)-Examine

[SELECT FROM: System and communicaons protecon policy; procedures addressing session authencity; system design documentaon; system conﬁguraon sengs and associated documentaon; list of cerﬁcate authories allowed for veriﬁcaon of the establishment of protected sessions; system audit records; system security plan; other relevant documents or records].

SC-23(05)-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies].

SC-23(05)-Test

[SELECT FROM: Mechanisms supporng and/or implemenng the management of cerﬁcate authories].

FAIL IN KNOWN STATE ASSESSMENT OBJECTIVE: Determine if:

SC-24_ODP[01]

types of system failures for which the system components fail to a known state are deﬁned;

SC-24_ODP[02]

known system state to which system components fail in the event of a system failure is deﬁned;

SC-24_ODP[03]

system state informaon to be preserved in the event of a system failure is deﬁned;

SC-24

<SC-24_ODP[01] types of system failures on system components> fail to a <SC-24_ODP[02] known system state> while preserving <SC-24_ODP[03] system state informaon> in failure.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

SC-24-Examine

[SELECT FROM: System and communicaons protecon policy; procedures addressing system failure to known state; system design documentaon; system conﬁguraon sengs and associated documentaon; list of failures requiring system to fail in a known state; state informaon to be preserved in system failure; system audit records; system security plan; other relevant documents or records].

SC-24-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies; system developer].

SC-24-Test

[SELECT FROM: Mechanisms supporng and/or implemenng the fail in known state capability; mechanisms preserving system state informaon in the event of a system failure].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 567

NIST SP 800-53A, REV. 5

SC-25

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

THIN NODES ASSESSMENT OBJECTIVE: Determine if: SC-25_ODP

system components to be employed with minimal funconality and informaon storage are deﬁned;

SC-25[01]

minimal funconality for <SC-25_ODP system components> is employed;

SC-25[02]

minimal informaon storage on <SC-25_ODP system components> is allocated.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SC-26

SC-25-Examine

[SELECT FROM: System and communicaons protecon policy; procedures addressing use of thin nodes; system design documentaon; system conﬁguraon sengs and associated documentaon; system audit records; system security plan; other relevant documents or records].

SC-25-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies].

SC-25-Test

[SELECT FROM: Mechanisms supporng and/or implemenng thin nodes].

DECOYS ASSESSMENT OBJECTIVE: Determine if: SC-26[01]

components within organizaonal systems speciﬁcally designed to be the target of malicious aacks are included to detect such aacks;

SC-26[02]

components within organizaonal systems speciﬁcally designed to be the target of malicious aacks are included to deﬂect such aacks;

SC-26[03]

components within organizaonal systems speciﬁcally designed to be the target of malicious aacks are included to analyze such aacks.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SC-26(01)

SC-26-Examine

[SELECT FROM: System and communicaons protecon policy; procedures addressing the use of decoys; system design documentaon; system conﬁguraon sengs and associated documentaon; system audit records; system security plan; other relevant documents or records].

SC-26-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies; system developer].

SC-26-Test

[SELECT FROM: Mechanisms supporng and/or implemenng decoys].

DECOYS | DETECTION OF MALICIOUS CODE [WITHDRAWN: Incorporated into SC-35.]

CHAPTER FOUR

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 568

NIST SP 800-53A, REV. 5

SC-27

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

PLATFORM-INDEPENDENT APPLICATIONS ASSESSMENT OBJECTIVE: Determine if: SC-27_ODP

plaorm-independent applicaons to be included within organizaonal systems are deﬁned;

SC-27

<SC-27_ODP plaorm-independent applicaons> are included within organizaonal systems.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SC-28

SC-27-Examine

[SELECT FROM: System and communicaons protecon policy; procedures addressing plaorm-independent applicaons; system design documentaon; system conﬁguraon sengs and associated documentaon; list of plaormindependent applicaons; system audit records; system security plan; other relevant documents or records].

SC-27-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies; system developer].

SC-27-Test

[SELECT FROM: Mechanisms supporng and/or implemenng plaormindependent applicaons].

PROTECTION OF INFORMATION AT REST ASSESSMENT OBJECTIVE: Determine if:

SC-28_ODP[01]

one or more of the following PARAMETER VALUES is/are selected: {conﬁdenality; integrity};

SC-28_ODP[02]

informaon at rest requiring protecon is deﬁned;

SC-28

the <SC-28_ODP[01] SELECTED PARAMETER VALUE(S)> of <SC-28_ODP[02] informaon at rest> is/are protected.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

SC-28-Examine

[SELECT FROM: System and communicaons protecon policy; procedures addressing the protecon of informaon at rest; system design documentaon; system conﬁguraon sengs and associated documentaon; cryptographic mechanisms and associated conﬁguraon documentaon; list of informaon at rest requiring conﬁdenality and integrity protecons; system security plan; other relevant documents or records].

SC-28-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies; system developer].

SC-28-Test

[SELECT FROM: Mechanisms supporng and/or implemenng conﬁdenality and integrity protecons for informaon at rest].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 569

NIST SP 800-53A, REV. 5

SC-28(01)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

PROTECTION OF INFORMATION AT REST | CRYPTOGRAPHIC PROTECTION ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SC-28(01)_ODP[01]

informaon requiring cryptographic protecon is deﬁned;

SC-28(01)_ODP[02]

system components or media requiring cryptographic protecon is/are deﬁned;

SC-28(01)[01]

cryptographic mechanisms are implemented to prevent unauthorized disclosure of <SC-28(01)_ODP[01] informaon> at rest on <SC-28(01)_ODP[02] system components or media>;

SC-28(01)[02]

cryptographic mechanisms are implemented to prevent unauthorized modiﬁcaon of <SC-28(01)_ODP[01] informaon> at rest on <SC-28(01)_ODP[02] system components or media>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SC-28(02)

SC-28(01)-Examine

[SELECT FROM: System and communicaons protecon policy; procedures addressing the protecon of informaon at rest; system design documentaon; system conﬁguraon sengs and associated documentaon; cryptographic mechanisms and associated conﬁguraon documentaon; system audit records; system security plan; other relevant documents or records].

SC-28(01)-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies; system developer].

SC-28(01)-Test

[SELECT FROM: Cryptographic mechanisms implemenng conﬁdenality and integrity protecons for informaon at rest].

PROTECTION OF INFORMATION AT REST | OFFLINE STORAGE ASSESSMENT OBJECTIVE: Determine if:

SC-28(02)_ODP

informaon to be removed from online storage and stored oﬄine in a secure locaon is deﬁned;

SC-28(02)[01]

<SC-28(02)_ODP informaon> is removed from online storage;

SC-28(02)[02]

<SC-28(02)_ODP informaon> is stored oﬄine in a secure locaon.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

SC-28(02)-Examine

[SELECT FROM: System and communicaons protecon policy; procedures addressing the protecon of informaon at rest; system design documentaon; system conﬁguraon sengs and associated documentaon; cryptographic mechanisms and associated conﬁguraon documentaon; oﬄine storage locaons for informaon at rest; system audit records; system security plan; other relevant documents or records].

SC-28(02)-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies].

SC-28(02)-Test

[SELECT FROM: Mechanisms supporng and/or implemenng the removal of informaon from online storage; mechanisms supporng and/or implemenng storage of informaon oﬄine].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 570

NIST SP 800-53A, REV. 5

SC-28(03)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

PROTECTION OF INFORMATION AT REST | CRYPTOGRAPHIC KEYS ASSESSMENT OBJECTIVE: Determine if:

SC-28(03)_ODP[01]

one of the following PARAMETER VALUES is selected: {<SC-28(03)_ODP[02] safeguards>; hardware-protected key store};

SC-28(03)_ODP[02]

safeguards for protecng the storage of cryptographic keys are deﬁned (if selected);

SC-28(03)

protected storage for cryptographic keys is provided using <SC-28(03)_ODP[01] SELECTED PARAMETER VALUE>.

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SC-29

SC-28(03)-Examine

[SELECT FROM: System and communicaons protecon policy; procedures addressing the protecon of informaon at rest; system design documentaon; system conﬁguraon sengs and associated documentaon; cryptographic mechanisms and associated conﬁguraon documentaon; system audit records; system security plan; other relevant documents or records].

SC-28(03)-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies].

SC-28(03)-Test

[SELECT FROM: Mechanisms supporng and/or implemenng hardware-based key store protecon].

HETEROGENEITY ASSESSMENT OBJECTIVE: Determine if: SC-29_ODP

system components requiring a diverse set of informaon technologies to be employed in the implementaon of the system are deﬁned;

SC-29

a diverse set of informaon technologies is employed for <SC-29_ODP system components> in the implementaon of the system.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

SC-29-Examine

[SELECT FROM: System and communicaons protecon policy; system design documentaon; system conﬁguraon sengs and associated documentaon; list of technologies deployed in the system; acquision documentaon; acquision contracts for system components or services; system security plan; other relevant documents or records].

SC-29-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies; organizaonal personnel with system acquision, development, and implementaon responsibilies].

SC-29-Test

[SELECT FROM: Mechanisms supporng and/or implemenng the employment of a diverse set of informaon technologies].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 571

NIST SP 800-53A, REV. 5

SC-29(01)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

HETEROGENEITY | VIRTUALIZATION TECHNIQUES ASSESSMENT OBJECTIVE: Determine if:

SC-29(01)_ODP

the frequency at which to change the diversity of operang systems and applicaons deployed using virtualizaon techniques is deﬁned;

SC-29(01)

virtualizaon techniques are employed to support the deployment of a diverse range of operang systems and applicaons that are changed <SC-29(01)_ODP frequency>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SC-30

SC-29(01)-Examine

[SELECT FROM: System and communicaons protecon policy; conﬁguraon management policy and procedures; system design documentaon; system conﬁguraon sengs and associated documentaon; system architecture; list of operang systems and applicaons deployed using virtualizaon techniques; change control records; conﬁguraon management records; system audit records; system security plan; other relevant documents or records].

SC-29(01)-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies; organizaonal personnel with responsibilies for implemenng approved virtualizaon techniques to the system].

SC-29(01)-Test

[SELECT FROM: Mechanisms supporng and/or implemenng the employment of a diverse set of informaon technologies; mechanisms supporng and/or implemenng virtualizaon techniques].

CONCEALMENT AND MISDIRECTION ASSESSMENT OBJECTIVE: Determine if:

SC-30_ODP[01]

concealment and misdirecon techniques to be employed to confuse and mislead adversaries potenally targeng systems are deﬁned;

SC-30_ODP[02]

systems for which concealment and misdirecon techniques are to be employed are deﬁned;

SC-30_ODP[03]

me periods to employ concealment and misdirecon techniques for systems are deﬁned;

SC-30

<SC-30_ODP[01] concealment and misdirecon techniques> are employed for <SC-30_ODP[02] systems> for <SC-30_ODP[03] me periods> to confuse and mislead adversaries.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

SC-30-Examine

[SELECT FROM: System and communicaons protecon policy; procedures addressing concealment and misdirecon techniques for the system; system design documentaon; system conﬁguraon sengs and associated documentaon; system architecture; list of concealment and misdirecon techniques to be employed for organizaonal systems; system audit records; system security plan; other relevant documents or records].

SC-30-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies; organizaonal personnel with the responsibility to implement concealment and misdirecon techniques for systems].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 572

NIST SP 800-53A, REV. 5

SC-30

CONCEALMENT AND MISDIRECTION SC-30-Test

SC-30(01)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

[SELECT FROM: Mechanisms supporng and/or implemenng concealment and misdirecon techniques].

CONCEALMENT AND MISDIRECTION | VIRTUALIZATION TECHNIQUES [WITHDRAWN: Incorporated into SC-29(01).]

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SC-30(02)

CONCEALMENT AND MISDIRECTION | RANDOMNESS ASSESSMENT OBJECTIVE: Determine if:

SC-30(02)_ODP

techniques employed to introduce randomness into organizaonal operaons and assets are deﬁned;

SC-30(02)

<SC-30(02)_ODP techniques> are employed to introduce randomness into organizaonal operaons and assets.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SC-30(03)

SC-30(02)-Examine

[SELECT FROM: System and communicaons protecon policy; procedures addressing concealment and misdirecon techniques for the system; system design documentaon; system conﬁguraon sengs and associated documentaon; system architecture; list of techniques to be employed to introduce randomness into organizaonal operaons and assets; system audit records; system security plan; other relevant documents or records].

SC-30(02)-Interview

SC-30(02)-Test

[SELECT FROM: Mechanisms supporng and/or implemenng randomness as a concealment and misdirecon technique].

CONCEALMENT AND MISDIRECTION | CHANGE PROCESSING AND STORAGE LOCATIONS ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

SC-30(03)_ODP[01]

processing and/or storage locaons to be changed are deﬁned;

SC-30(03)_ODP[02]

one of the following PARAMETER VALUES is selected: {<SC-30(03)_ODP[03] me frequency>; random me intervals};

SC-30(03)_ODP[03]

me frequency at which to change the locaon of processing and/or storage is deﬁned (if selected);

SC-30(03)

the locaon of <SC-30(03)_ODP[01] processing and/or storage> is changed <SC-30(03)_ODP[02] SELECTED PARAMETER VALUE>.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 573

NIST SP 800-53A, REV. 5

SC-30(03)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

CONCEALMENT AND MISDIRECTION | CHANGE PROCESSING AND STORAGE LOCATIONS POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SC-30(04)

SC-30(03)-Examine

[SELECT FROM: System and communicaons protecon policy; conﬁguraon management policy and procedures; procedures addressing concealment and misdirecon techniques for the system; list of processing/storage locaons to be changed at organizaonal me intervals; change control records; conﬁguraon management records; system audit records; system security plan; other relevant documents or records].

SC-30(03)-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies; organizaonal personnel with the responsibility to change processing and/or storage locaons].

SC-30(03)-Test

[SELECT FROM: Mechanisms supporng and/or implemenng changing processing and/or storage locaons].

CONCEALMENT AND MISDIRECTION | MISLEADING INFORMATION ASSESSMENT OBJECTIVE: Determine if:

SC-30(04)_ODP

system components for which realisc but misleading informaon about their security state or posture is employed are deﬁned;

SC-30(04)

realisc but misleading informaon about the security state or posture of <SC-30(04)_ODP system components> is employed.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SC-30(05)

SC-30(04)-Examine

[SELECT FROM: System and communicaons protecon policy; conﬁguraon management policy and procedures; procedures addressing concealment and misdirecon techniques for the system; system design documentaon; system conﬁguraon sengs and associated documentaon; system audit records; system security plan; other relevant documents or records].

SC-30(04)-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies; organizaonal personnel with the responsibility to deﬁne and employ realisc but misleading informaon about the security posture of system components].

SC-30(04)-Test

[SELECT FROM: Mechanisms supporng and/or implemenng the employment of realisc but misleading informaon about the security posture of system components].

CONCEALMENT AND MISDIRECTION | CONCEALMENT OF SYSTEM COMPONENTS ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

SC-30(05)_ODP[01]

techniques to be employed to hide or conceal system components are deﬁned;

SC-30(05)_ODP[02]

system components to be hidden or concealed using techniques (deﬁned in SC-30(05)_ODP[01]) are deﬁned;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 574

NIST SP 800-53A, REV. 5

SC-30(05)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

CONCEALMENT AND MISDIRECTION | CONCEALMENT OF SYSTEM COMPONENTS SC-30(05)

<SC-30(05)_ODP[01] techniques> are employed to hide or conceal <SC-30(05)_ODP[02] system components>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SC-31

SC-30(05)-Examine

[SELECT FROM: System and communicaons protecon policy; conﬁguraon management policy and procedures; procedures addressing concealment and misdirecon techniques for the system; system design documentaon; system conﬁguraon sengs and associated documentaon; list of techniques employed to hide or conceal system components; list of system components to be hidden or concealed; system security plan; other relevant documents or records].

SC-30(05)-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies; organizaonal personnel with the responsibility to conceal system components].

SC-30(05)-Test

[SELECT FROM: Mechanisms supporng and/or implemenng techniques for the concealment of system components].

COVERT CHANNEL ANALYSIS ASSESSMENT OBJECTIVE: Determine if: SC-31_ODP

one or more of the following PARAMETER VALUES is/are selected: {storage; ming};

SC-31a.

a covert channel analysis is performed to idenfy those aspects of communicaons within the system that are potenal avenues for covert <SC-31_ODP SELECTED PARAMETER VALUE(S)> channels;

SC-31b.

the maximum bandwidth of those channels is esmated.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

SC-31-Examine

[SELECT FROM: System and communicaons protecon policy; procedures addressing covert channel analysis; system design documentaon; system conﬁguraon sengs and associated documentaon; covert channel analysis documentaon; system audit records; system security plan; other relevant documents or records].

SC-31-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies; organizaonal personnel with covert channel analysis responsibilies; system developers/integrators].

SC-31-Test

[SELECT FROM: Organizaonal process for conducng covert channel analysis; mechanisms supporng and/or implemenng covert channel analysis; mechanisms supporng and/or implemenng the capability to esmate the bandwidth of covert channels].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 575

NIST SP 800-53A, REV. 5

SC-31(01)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

COVERT CHANNEL ANALYSIS | TEST COVERT CHANNELS FOR EXPLOITABILITY ASSESSMENT OBJECTIVE: Determine if: SC-31(01)

a subset of the idenﬁed covert channels is tested to determine the channels that are exploitable.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SC-31(02)

SC-31(01)-Examine

[SELECT FROM: System and communicaons protecon policy; procedures addressing covert channel analysis; system design documentaon; system conﬁguraon sengs and associated documentaon; list of covert channels; covert channel analysis documentaon; system audit records; system security plan; other relevant documents or records].

SC-31(01)-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies; organizaonal personnel with covert channel analysis responsibilies].

SC-31(01)-Test

[SELECT FROM: Organizaonal process for tesng covert channels; mechanisms supporng and/or implemenng the tesng of covert channel analysis].

COVERT CHANNEL ANALYSIS | MAXIMUM BANDWIDTH ASSESSMENT OBJECTIVE: Determine if:

SC-31(02)_ODP[01]

one or more of the following PARAMETER VALUES is/are selected: {storage; ming};

SC-31(02)_ODP[02]

values for the maximum bandwidth for idenﬁed covert channels are deﬁned;

SC-31(02)

the maximum bandwidth for idenﬁed covert <SC-31(02)_ODP[01] SELECTED PARAMETER VALUE(S)> channels is reduced to <SC-31(02)_ODP[02] values>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

SC-31(02)-Examine

[SELECT FROM: System and communicaons protecon policy; procedures addressing covert channel analysis; acquision contracts for systems or services; acquision documentaon; system design documentaon; system conﬁguraon sengs and associated documentaon; covert channel analysis documentaon; system audit records; system security plan; other relevant documents or records].

SC-31(02)-Interview

SC-31(02)-Test

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 576

NIST SP 800-53A, REV. 5

SC-31(03)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

COVERT CHANNEL ANALYSIS | MEASURE BANDWIDTH IN OPERATIONAL ENVIRONMENTS ASSESSMENT OBJECTIVE: Determine if:

SC-31(03)_ODP

subset of idenﬁed covert channels whose bandwidth is to be measured in the operaonal environment of the system is deﬁned;

SC-31(03)

the bandwidth of <SC-31(03)_ODP subset of idenﬁed covert channels> is measured in the operaonal environment of the system.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SC-32

SC-31(03)-Examine

SC-31(03)-Interview

SC-31(03)-Test

SYSTEM PARTITIONING ASSESSMENT OBJECTIVE: Determine if:

SC-32_ODP[01]

system components to reside in separate physical or logical domains or environments based on circumstances for the physical or logical separaon of components are deﬁned;

SC-32_ODP[02]

one of the following PARAMETER VALUES is selected: {physical; logical};

SC-32_ODP[03]

circumstances for the physical or logical separaon of components are deﬁned;

SC-32

the system is paroned into <SC-32_ODP[01] system components> residing in separate <SC-32_ODP[02] SELECTED PARAMETER VALUE> domains or environments based on <SC-32_ODP[03] circumstances for the physical or logical separaon of components>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

SC-32-Examine

[SELECT FROM: System and communicaons protecon policy; procedures addressing system paroning; system design documentaon; system conﬁguraon sengs and associated documentaon; system architecture; list of system physical domains (or environments); system facility diagrams; system network diagrams; system security plan; other relevant documents or records].

SC-32-Interview

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 577

NIST SP 800-53A, REV. 5

SC-32

SYSTEM PARTITIONING SC-32-Test

SC-32(01)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

[SELECT FROM: Mechanisms supporng and/or implemenng the physical separaon of system components].

SYSTEM PARTITIONING | SEPARATE PHYSICAL DOMAINS FOR PRIVILEGED FUNCTIONS ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SC-32(01)

privileged funcons are paroned into separate physical domains.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SC-33

SC-32-Examine

SC-32-Interview

SC-32-Test

[SELECT FROM: Mechanisms supporng and/or implemenng the physical separaon of system components].

TRANSMISSION PREPARATION INTEGRITY [WITHDRAWN: Incorporated into SC-08.]

SC-34

NON-MODIFIABLE EXECUTABLE PROGRAMS ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

SC-34_ODP[01]

system components for which the operang environment and applicaons are to be loaded and executed from hardware-enforced, read-only media are deﬁned;

SC-34_ODP[02]

applicaons to be loaded and executed from hardware-enforced, read-only media are deﬁned;

SC-34a.

the operang environment for <SC-34_ODP[01] system components> is loaded and executed from hardware-enforced, read-only media;

SC-34b.

<SC-34_ODP[02] applicaons> for <SC-34_ODP[01] system components> are loaded and executed from hardware-enforced, read-only media.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 578

NIST SP 800-53A, REV. 5

SC-34

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

NON-MODIFIABLE EXECUTABLE PROGRAMS POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SC-34(01)

SC-34-Examine

[SELECT FROM: System and communicaons protecon policy; procedures addressing non-modiﬁable executable programs; system design documentaon; system conﬁguraon sengs and associated documentaon; system architecture; list of operang system components to be loaded from hardware-enforced, read-only media; list of applicaons to be loaded from hardware-enforced, readonly media; media used to load and execute the system operang environment; media used to load and execute system applicaons; system audit records; system security plan; other relevant documents or records].

SC-34-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies; system developer; organizaonal personnel installing, conﬁguring, and/or maintaining the system; system developers/ integrators].

SC-34-Test

[SELECT FROM: Mechanisms supporng and/or implemenng, loading, and execung the operang environment from hardware-enforced, read-only media; mechanisms supporng and/or implemenng, loading, and execung applicaons from hardware-enforced, read-only media].

NON-MODIFIABLE EXECUTABLE PROGRAMS | NO WRITABLE STORAGE ASSESSMENT OBJECTIVE: Determine if:

SC-34(01)_ODP

system components to be employed with no writeable storage are deﬁned;

SC-34(01)

<SC-34(01)_ODP system components> are employed with no writeable storage that is persistent across component restart or power on/oﬀ.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

SC-34(01)-Examine

SC-34(01)-Interview

SC-34(01)-Test

[SELECT FROM: Mechanisms supporng and/or implemenng the employment of components with no writeable storage; mechanisms supporng and/or implemenng persistent non-writeable storage across component restart and power on/oﬀ].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 579

NIST SP 800-53A, REV. 5

SC-34(02)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

NON-MODIFIABLE EXECUTABLE PROGRAMS | INTEGRITY PROTECTION ON READ-ONLY MEDIA ASSESSMENT OBJECTIVE: Determine if:

SC-34(02)[01]

the integrity of informaon is protected prior to storage on read-only media;

SC-34(02)[02]

the media is controlled aer such informaon has been recorded onto the media;

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SC-34(03)

SC-34(02)-Examine

SC-34(02)-Interview

SC-34(02)-Test

[SELECT FROM: Mechanisms supporng and/or implemenng the capability to protect informaon integrity on read-only media prior to storage and aer informaon has been recorded onto the media].

NON-MODIFIABLE EXECUTABLE PROGRAMS | HARDWARE-BASED PROTECTION [WITHDRAWN: Moved to SC-51.]

SC-35

EXTERNAL MALICIOUS CODE IDENTIFICATION ASSESSMENT OBJECTIVE: Determine if: SC-35

system components that proacvely seek to idenfy network-based malicious code or malicious websites are included.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

SC-35-Examine

[SELECT FROM: System and communicaons protecon policy; procedures addressing external malicious code idenﬁcaon; system design documentaon; system conﬁguraon sengs and associated documentaon; system components deployed to idenfy malicious websites and/or web-based malicious code; system audit records; system security plan; other relevant documents or records].

SC-35-Interview

SC-35-Test

[SELECT FROM: Automated mechanisms supporng and/or implemenng external malicious code idenﬁcaon].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 580

NIST SP 800-53A, REV. 5

SC-36

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

DISTRIBUTED PROCESSING AND STORAGE ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SC-36_ODP[01]

processing components to be distributed across mulple locaons/domains are deﬁned;

SC-36_ODP[02]

one of the following PARAMETER VALUES is selected: {physical locaons; logical domains};

SC-36_ODP[03]

storage components to be distributed across mulple locaons/domains are deﬁned;

SC-36_ODP[04]

one of the following PARAMETER VALUES is selected: {physical locaons; logical domains};

SC-36[01]

<SC-36_ODP[01] processing components> are distributed across <SC-36_ODP[02] SELECTED PARAMETER VALUE>;

SC-36[02]

<SC-36_ODP[03] storage components> are distributed across <SC-36_ODP[04] SELECTED PARAMETER VALUE>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SC-36(01)

SC-36-Examine

[SELECT FROM: System and communicaons protecon policy; conngency planning policy and procedures; conngency plan; system design documentaon; system conﬁguraon sengs and associated documentaon; system architecture; list of system physical locaons (or environments) with distributed processing and storage; system facility diagrams; processing site agreements; storage site agreements; system security plan; other relevant documents or records].

SC-36-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies; organizaonal personnel installing, conﬁguring, and/or maintaining the system; organizaonal personnel with conngency planning and plan implementaon responsibilies; system developers/ integrators].

SC-36-Test

[SELECT FROM: Organizaonal processes for distributed processing and storage across mulple physical locaons; mechanisms supporng and/or implemenng the capability to distribute processing and storage across mulple physical locaons].

DISTRIBUTED PROCESSING AND STORAGE | POLLING TECHNIQUES ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

SC-36(01)_ODP[01]

distributed processing and storage components for which polling techniques are to be employed to idenfy potenal faults, errors, or compromises are deﬁned;

SC-36(01)_ODP[02]

acons to be taken in response to idenﬁed faults, errors, or compromise are deﬁned;

SC-36(01)(a)

polling techniques are employed to idenfy potenal faults, errors, or compromises to <SC-36(01)_ODP[01] distributed processing and storage components>;

SC-36(01)(b)

<SC-36(01)_ODP[02] acons> are taken in response to idenﬁed faults, errors, or compromise.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 581

NIST SP 800-53A, REV. 5

SC-36(01)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

DISTRIBUTED PROCESSING AND STORAGE | POLLING TECHNIQUES POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SC-36(02)

SC-36(01)-Examine

[SELECT FROM: System and communicaons protecon policy; system design documentaon; system conﬁguraon sengs and associated documentaon; system architecture; list of distributed processing and storage components subject to polling; system polling techniques and associated documentaon or records; system audit records; system security plan; other relevant documents or records].

SC-36(01)-Interview

SC-36(01)-Test

[SELECT FROM: Mechanisms supporng and/or implemenng polling techniques].

DISTRIBUTED PROCESSING AND STORAGE | SYNCHRONIZATION ASSESSMENT OBJECTIVE: Determine if:

SC-36(02)_ODP

duplicate systems or system components to be synchronized are deﬁned;

SC-36(02)

<SC-36(02)_ODP duplicate systems or system components> are synchronized.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SC-37

SC-36(02)-Examine

SC-36(02)-Interview

SC-36(02)-Test

[SELECT FROM: Mechanisms supporng and/or implemenng duplicate system or system component synchronizaon].

OUT-OF-BAND CHANNELS ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

SC-37_ODP[01]

out-of-band channels to be employed for the physical delivery or electronic transmission of informaon, system components, or devices to individuals or the system are deﬁned;

SC-37_ODP[02]

informaon, system components, or devices to employ out-of-band-channels for physical delivery or electronic transmission are deﬁned;

SC-37_ODP[03]

individuals or systems to which physical delivery or electronic transmission of informaon, system components, or devices is to be achieved via the employment of out-of-band channels are deﬁned;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 582

NIST SP 800-53A, REV. 5

SC-37

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

OUT-OF-BAND CHANNELS SC-37

<SC-37_ODP[01] out-of-band channels> are employed for the physical delivery or electronic transmission of <SC-37_ODP[02] informaon, system components, or devices> to <SC-37_ODP[03] individuals or systems>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SC-37(01)

SC-37-Examine

[SELECT FROM: System and communicaons protecon policy; procedures addressing the use of out-of-band channels; access control policy and procedures; idenﬁcaon and authencaon policy and procedures; system design documentaon; system architecture; system conﬁguraon sengs and associated documentaon; list of out-of-band channels; types of informaon, system components, or devices requiring the use of out-of-band channels for physical delivery or electronic transmission to authorized individuals or systems; physical delivery records; electronic transmission records; system audit records; system security plan; other relevant documents or records].

SC-37-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies; organizaonal personnel installing, conﬁguring, and/or maintaining the system; organizaonal personnel authorizing, installing, conﬁguring, operang, and/or using out-of-band channels; system developers/integrators].

SC-37-Test

[SELECT FROM: Organizaonal processes for the use of out-of-band channels; mechanisms supporng and/or implemenng the use of out-of-band channels].

OUT-OF-BAND CHANNELS | ENSURE DELIVERY AND TRANSMISSION ASSESSMENT OBJECTIVE: Determine if:

SC-37(01)_ODP[01]

controls to be employed to ensure that only designated individuals or systems receive speciﬁc informaon, system components, or devices are deﬁned;

SC-37(01)_ODP[02]

individuals or systems designated to receive speciﬁc informaon, system components, or devices are deﬁned;

SC-37(01)_ODP[03]

informaon, system components, or devices that only individuals or systems are designated to receive are deﬁned;

SC-37(01)

<SC-37(01)_ODP[01] controls> are employed to ensure that only <SC-37(01)_ODP[02] individuals or systems> receive <SC-37(01)_ODP[03] informaon, system components, or devices>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: SC-37(01)-Examine

CHAPTER FOUR

[SELECT FROM: System and communicaons protecon policy; procedures addressing the use of out-of-band channels; access control policy and procedures; idenﬁcaon and authencaon policy and procedures; system design documentaon; system architecture; system conﬁguraon sengs and associated documentaon; list of security safeguards to be employed to ensure that designated individuals or systems receive organizaon-deﬁned informaon, system components, or devices; list of security safeguards for delivering designated informaon, system components, or devices to designated individuals or systems; list of informaon, system components, or devices to be delivered to designated individuals or systems; system audit records; system security plan; other relevant documents or records].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 583

NIST SP 800-53A, REV. 5

SC-37(01)

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SC-38

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

OUT-OF-BAND CHANNELS | ENSURE DELIVERY AND TRANSMISSION SC-37(01)-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies; organizaonal personnel installing, conﬁguring, and/or maintaining the system; organizaonal personnel authorizing, installing, conﬁguring, operang, and/or using out-of-band channels; system developers/integrators].

SC-37(01)-Test

[SELECT FROM: Organizaonal processes for the use of out-of-band channels; mechanisms supporng and/or implemenng the use of out-of-band channels; mechanisms supporng/implemenng safeguards to ensure the delivery of designated informaon, system components, or devices].

OPERATIONS SECURITY ASSESSMENT OBJECTIVE: Determine if: SC-38_ODP

operaons security controls to be employed to protect key organizaonal informaon throughout the system development life cycle are deﬁned;

SC-38

<SC-38_ODP operaons security controls> are employed to protect key organizaonal informaon throughout the system development life cycle.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SC-39

SC-38-Examine

[SELECT FROM: System and communicaons protecon policy; procedures addressing operaons security; security plan; list of operaons security safeguards; security control assessments; risk assessments; threat and vulnerability assessments; plans of acon and milestones; system development life cycle documentaon; system security plan; other relevant documents or records].

SC-38-Interview

SC-38-Test

[SELECT FROM: Organizaonal processes for protecng organizaonal informaon throughout the system development life cycle; mechanisms supporng and/or implemenng safeguards to protect organizaonal informaon throughout the system development life cycle].

PROCESS ISOLATION ASSESSMENT OBJECTIVE: Determine if: SC-39

a separate execuon domain is maintained for each execung system process.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

SC-39-Examine

[SELECT FROM: System design documentaon; system architecture; independent veriﬁcaon and validaon documentaon; tesng and evaluaon documentaon; other relevant documents or records].

SC-39-Interview

[SELECT FROM: System developers/integrators; system security architect].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 584

NIST SP 800-53A, REV. 5

SC-39

PROCESS ISOLATION SC-39-Test

SC-39(01)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

[SELECT FROM: Mechanisms supporng and/or implemenng separate execuon domains for each execung process].

PROCESS ISOLATION | HARDWARE SEPARATION ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SC-39(01)

hardware separaon is implemented to facilitate process isolaon.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SC-39(02)

SC-39(01)-Examine

[SELECT FROM: System and communicaons protecon policy; system design documentaon; system conﬁguraon sengs and associated documentaon; system architecture; system documentaon for hardware separaon mechanisms; system documentaon from vendors, manufacturers, or developers; independent veriﬁcaon and validaon documentaon; system security plan; other relevant documents or records].

SC-39(01)-Interview

SC-39(01)-Test

[SELECT FROM: System capability implemenng underlying hardware separaon mechanisms for process separaon].

PROCESS ISOLATION | SEPARATE EXECUTION DOMAIN PER THREAD ASSESSMENT OBJECTIVE: Determine if:

SC-39(02)_ODP

mul-thread processing for which a separate execuon domain is to be maintained for each thread is deﬁned;

SC-39(02)

a separate execuon domain is maintained for each thread in <SC-39(02)_ODP mul-threaded processing>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

SC-39(02)-Examine

[SELECT FROM: System and communicaons protecon policy; system design documentaon; system conﬁguraon sengs and associated documentaon; system architecture; list of system execuon domains for each thread in multhreaded processing; system documentaon for mul-threaded processing; system documentaon from vendors, manufacturers, or developers; independent veriﬁcaon and validaon documentaon; system security plan; other relevant documents or records].

SC-39(02)-Interview

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 585

NIST SP 800-53A, REV. 5

SC-39(02)

PROCESS ISOLATION | SEPARATE EXECUTION DOMAIN PER THREAD SC-39(02)-Test

SC-40

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

[SELECT FROM: System capability implemenng a separate execuon domain for each thread in mul-threaded processing].

WIRELESS LINK PROTECTION ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SC-40_ODP[01]

external wireless links to be protected from parcular types of signal parameter aacks are deﬁned;

SC-40_ODP[02]

types of signal parameter aacks or references to sources for such aacks from which to protect external wireless links are deﬁned;

SC-40_ODP[03]

internal wireless links to be protected from parcular types of signal parameter aacks are deﬁned;

SC-40_ODP[04]

types of signal parameter aacks or references to sources for such aacks from which to protect internal wireless links are deﬁned;

SC-40[01]

external <SC-40_ODP[01] wireless links> are protected from <SC-40_ODP[02] types of signal parameter aacks or references to sources for such aacks>.

SC-40[02]

internal <SC-40_ODP[03] wireless links> are protected from <SC-40_ODP[04] types of signal parameter aacks or references to sources for such aacks>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SC-40(01)

SC-40-Examine

[SELECT FROM: System and communicaons protecon policy; access control policy and procedures; procedures addressing wireless link protecon; system design documentaon; wireless network diagrams; system conﬁguraon sengs and associated documentaon; system architecture; list of internal and external wireless links; list of signal parameter aacks or references to sources for aacks; system audit records; system security plan; other relevant documents or records].

SC-40-Interview

SC-40-Test

[SELECT FROM: Mechanisms supporng and/or implemenng the protecon of wireless links].

WIRELESS LINK PROTECTION | ELECTROMAGNETIC INTERFERENCE ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

SC-40(01)_ODP

level of protecon to be employed against the eﬀects of intenonal electromagnec interference is deﬁned;

SC-40(01)

cryptographic mechanisms that achieve <SC-40(01)_ODP level of protecon> against the eﬀects of intenonal electromagnec interference are implemented.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 586

NIST SP 800-53A, REV. 5

SC-40(01)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

WIRELESS LINK PROTECTION | ELECTROMAGNETIC INTERFERENCE POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SC-40(02)

SC-40(01)-Examine

[SELECT FROM: System and communicaons protecon policy; access control policy and procedures; procedures addressing wireless link protecon; system design documentaon; wireless network diagrams; system conﬁguraon sengs and associated documentaon; system architecture; system communicaons hardware and soware; security categorizaon results; system audit records; system security plan; other relevant documents or records].

SC-40(01)-Interview

SC-40(01)-Test

[SELECT FROM: Cryptographic mechanisms enforcing protecons against eﬀects of intenonal electromagnec interference].

WIRELESS LINK PROTECTION | REDUCE DETECTION POTENTIAL ASSESSMENT OBJECTIVE: Determine if:

SC-40(02)_ODP

the level of reducon to be achieved to reduce the detecon potenal of wireless links is deﬁned;

SC-40(02)

cryptographic mechanisms to reduce the detecon potenal of wireless links to <SC-40(02)_ODP level of reducon> are implemented.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

SC-40(02)-Examine

[SELECT FROM: System and communicaons protecon policy; access control policy and procedures; procedures addressing wireless link protecon; system design documentaon; wireless network diagrams; system conﬁguraon sengs and associated documentaon; system architecture; system communicaons hardware and soware; security categorizaon results; system audit records; system security plan; other relevant documents or records].

SC-40(02)-Interview

SC-40(02)-Test

[SELECT FROM: Cryptographic mechanisms enforcing protecons to reduce the detecon of wireless links].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 587

NIST SP 800-53A, REV. 5

SC-40(03)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

WIRELESS LINK PROTECTION | IMITATIVE OR MANIPULATIVE COMMUNICATIONS DECEPTION ASSESSMENT OBJECTIVE: Determine if: SC-40(03)

cryptographic mechanisms are implemented to idenfy and reject wireless transmissions that are deliberate aempts to achieve imitave or manipulave communicaons decepon based on signal parameters.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SC-40(04)

SC-40(03)-Examine

[SELECT FROM: System and communicaons protecon policy; access control policy and procedures; procedures addressing system design documentaon; wireless network diagrams; system conﬁguraon sengs and associated documentaon; system architecture; system communicaons hardware and soware; system audit records; system security plan; other relevant documents or records].

SC-40(03)-Interview

SC-40(03)-Test

[SELECT FROM: Cryptographic mechanisms enforcing wireless link protecons against imitave or manipulave communicaons decepon].

WIRELESS LINK PROTECTION | SIGNAL PARAMETER IDENTIFICATION ASSESSMENT OBJECTIVE: Determine if:

SC-40(04)_ODP

wireless transmiers for which cryptographic mechanisms are to be implemented are deﬁned;

SC-40(04)

cryptographic mechanisms are implemented to prevent the idenﬁcaon of <SC-40(04)_ODP wireless transmiers> by using the transmier signal parameters.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

SC-40(04)-Examine

SC-40(04)-Interview

SC-40(04)-Test

[SELECT FROM: Cryptographic mechanisms prevenng the idenﬁcaon of wireless transmiers].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 588

NIST SP 800-53A, REV. 5

SC-41

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

PORT AND I/O DEVICE ACCESS ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SC-41_ODP[01]

connecon ports or input/output devices to be disabled or removed are deﬁned;

SC-41_ODP[02]

one of the following PARAMETER VALUES is selected: {physically; logically};

SC-41_ODP[03]

systems or system components with connecon ports or input/output devices to be disabled or removed are deﬁned;

SC-41

<SC-41_ODP[01] connecon ports or input/output devices> are <SC-41_ODP[02] SELECTED PARAMETER VALUE> disabled or removed on <SC-41_ODP[03] systems or system components>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SC-42

SC-41-Examine

[SELECT FROM: System and communicaons protecon policy; access control policy and procedures; procedures addressing port and input/output device access; system design documentaon; system conﬁguraon sengs and associated documentaon; system architecture; systems or system components; list of connecon ports or input/output devices to be physically disabled or removed on systems or system components; system security plan; other relevant documents or records].

SC-41-Interview

SC-41-Test

[SELECT FROM: Mechanisms supporng and/or implemenng the disabling of connecon ports or input/output devices].

SENSOR CAPABILITY AND DATA ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

SC-42_ODP[01]

one or more of the following PARAMETER VALUES is/are selected: {the use of devices possessing <SC-42_ODP[02] environmental sensing capabilies> in <SC-42_ODP[03] facilies, areas, or systems>; the remote acvaon of environmental sensing capabilies on organizaonal systems or system components with the following excepons: <SC-42_ODP[04] excepons where remote acvaon of sensors is allowed>};

SC-42_ODP[02]

environmental sensing capabilies in devices are deﬁned (if selected);

SC-42_ODP[03]

facilies, areas, or systems where the use of devices possessing environmental sensing capabilies is prohibited are deﬁned (if selected);

SC-42_ODP[04]

excepons where remote acvaon of sensors is allowed are deﬁned (if selected);

SC-42_ODP[05]

group of users to whom an explicit indicaon of sensor use is to be provided is deﬁned;

SC-42a.

<SC-42_ODP[01] SELECTED PARAMETER VALUE(S)> is/are prohibited;

SC-42b.

an explicit indicaon of sensor use is provided to <SC-42_ODP[05] group of users>.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 589

NIST SP 800-53A, REV. 5

SC-42

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

SENSOR CAPABILITY AND DATA POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SC-42(01)

SC-42-Examine

[SELECT FROM: System and communicaons protecon policy; procedures addressing sensor capabilies and data collecon; access control policy and procedures; system design documentaon; system conﬁguraon sengs and associated documentaon; system audit records; system security plan; privacy plan; other relevant documents or records].

SC-42-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security and privacy responsibilies; system developer; organizaonal personnel installing, conﬁguring, and/or maintaining the system; organizaonal personnel responsible for sensor capabilies].

SC-42-Test

[SELECT FROM: Mechanisms implemenng access controls for the remote acvaon of system sensor capabilies; mechanisms implemenng the capability to indicate sensor use].

SENSOR CAPABILITY AND DATA | REPORTING TO AUTHORIZED INDIVIDUALS OR ROLES ASSESSMENT OBJECTIVE: Determine if:

SC-42(01)_ODP

sensors to be used to collect data or informaon are deﬁned;

SC-42(01)

the system is conﬁgured so that data or informaon collected by the <SC-42(01)_ODP sensors> is only reported to authorized individuals or roles.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SC-42(02)

SC-42(01)-Examine

[SELECT FROM: System and communicaons protecon policy; access control policy and procedures; procedures addressing sensor capability and data collecon; personally idenﬁable informaon processing policy; system design documentaon; system conﬁguraon sengs and associated documentaon; system architecture; system audit records; system security plan; privacy plan; other relevant documents or records].

SC-42(01)-Interview

SC-42(01)-Test

[SELECT FROM: Mechanisms restricng the reporng of sensor informaon to those authorized; sensor data collecon and reporng capabilies for the system].

SENSOR CAPABILITY AND DATA | AUTHORIZED USE ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

SC-42(02)_ODP

measures to be employed so that data or informaon collected by sensors is only used for authorized purposes are deﬁned;

SC-42(02)

<SC-42(02)_ODP measures> are employed so that data or informaon collected by <SC-42(01)_ODP sensors> is only used for authorized purposes.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 590

NIST SP 800-53A, REV. 5

SC-42(02)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

SENSOR CAPABILITY AND DATA | AUTHORIZED USE POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SC-42(03)

SC-42(02)-Examine

SC-42(02)-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security and privacy responsibilies; organizaonal personnel installing, conﬁguring, and/or maintaining the system; organizaonal personnel responsible for sensor capabilies].

SC-42(02)-Test

[SELECT FROM: Mechanisms supporng and/or implemenng measures to ensure that sensor informaon is only used for authorized purposes; sensor informaon collecon capability for the system].

SENSOR CAPABILITY AND DATA | PROHIBIT USE OF DEVICES [WITHDRAWN: Incorporated into SC-42.]

SC-42(04)

SENSOR CAPABILITY AND DATA | NOTICE OF COLLECTION ASSESSMENT OBJECTIVE: Determine if:

SC-42(04)_ODP[01]

measures to facilitate an individual’s awareness that personally idenﬁable informaon is being collected are deﬁned;

SC-42(04)_ODP[02]

sensors that collect personally idenﬁable informaon are deﬁned;

SC-42(04)

<SC-42(04)_ODP[01] measures> are employed to facilitate an individual’s awareness that personally idenﬁable informaon is being collected by <SC-42(04)_ODP[02] sensors>

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

SC-42(04)-Examine

[SELECT FROM: System and communicaons protecon policy; access control policy and procedures; personally idenﬁable informaon processing policy; sensor capability and data collecon policy and procedures; system design documentaon; system conﬁguraon sengs and associated documentaon; privacy risk assessment documentaon; privacy impact assessments; system architecture; list of measures to be employed to ensure that individuals are aware that personally idenﬁable informaon is being collected by sensors; examples of noﬁcaons provided to individuals that personally idenﬁable informaon is being collected by sensors; system audit records; system security plan; privacy plan; other relevant documents or records].

SC-42(04)-Interview

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 591

NIST SP 800-53A, REV. 5

SC-42(04)

SENSOR CAPABILITY AND DATA | NOTICE OF COLLECTION SC-42(04)-Test

SC-42(05)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

[SELECT FROM: Mechanisms supporng and/or implemenng measures to facilitate an individual’s awareness that personally idenﬁable informaon is being collected by sensors; sensor informaon collecon capabilies for the system].

SENSOR CAPABILITY AND DATA | COLLECTION MINIMIZATION ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SC-42(05)_ODP

the sensors that are conﬁgured to minimize the collecon of unneeded informaon about individuals are deﬁned;

SC-42(05)

the <SC-42(05)_ODP sensors> conﬁgured to minimize the collecon of informaon about individuals that is not needed are employed.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SC-43

SC-42(05)-Examine

[SELECT FROM: System and communicaons protecon policy; access control policy and procedures; personally idenﬁable informaon processing policy; sensor capability and data collecon policy and procedures; system design documentaon; system conﬁguraon sengs and associated documentaon; privacy risk assessment documentaon; privacy impact assessments; system architecture; list of informaon being collected by sensors; list of sensor conﬁguraons that minimize the collecon of personally idenﬁable informaon (e.g., obscure human features); system audit records; system security plan; privacy plan; other relevant documents or records].

SC-42(05)-Interview

SC-42(05)-Test

[SELECT FROM: Mechanisms supporng and/or implemenng measures to facilitate the review of informaon that is being collected by sensors; sensor informaon collecon capabilies for the system].

USAGE RESTRICTIONS ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

SC-43_ODP

the components for which usage restricons and implementaon guidance are to be established are deﬁned;

SC-43a.

usage restricons and implementaon guidelines are established for <SC-43_ODP components>;

SC-43b.[01]

the use of <SC-43_ODP components> is authorized within the system;

SC-43b.[02]

the use of <SC-43_ODP components> is monitored within the system;

SC-43b.[03]

the use of <SC-43_ODP components> is controlled within the system.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 592

NIST SP 800-53A, REV. 5

SC-43

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

USAGE RESTRICTIONS POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SC-44

SC-43-Examine

[SELECT FROM: System and communicaons protecon policy; usage restricons; procedures addressing usage restricons; implementaon policy and procedures; authorizaon records; system monitoring records; system audit records; system security plan; other relevant documents or records].

SC-43-Interview

SC-43-Test

[SELECT FROM: Organizaonal processes for authorizing, monitoring, and controlling the use of components with usage restricons; mechanisms supporng and/or implemenng, authorizing, monitoring, and controlling the use of components with usage restricons].

DETONATION CHAMBERS ASSESSMENT OBJECTIVE: Determine if: SC-44_ODP

the system, system component, or locaon where a detonaon chamber capability is to be employed is deﬁned;

SC-44

a detonaon chamber capability is employed within the <SC-44_ODP system, system component, or locaon>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SC-45

SC-44-Examine

[SELECT FROM: System and communicaons protecon policy; procedures addressing detonaon chambers; system design documentaon; system conﬁguraon sengs and associated documentaon; system audit records; system security plan; other relevant documents or records].

SC-44-Interview

SC-44-Test

[SELECT FROM: Mechanisms supporng and/or implemenng the detonaon chamber capability].

SYSTEM TIME SYNCHRONIZATION ASSESSMENT OBJECTIVE: Determine if: SC-45

CHAPTER FOUR

system clocks are synchronized within and between systems and system components.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 593

NIST SP 800-53A, REV. 5

SC-45

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

SYSTEM TIME SYNCHRONIZATION POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SC-45(01)

SC-45-Examine

[SELECT FROM: System and communicaons protecon policy; procedures addressing me synchronizaon; system design documentaon; system conﬁguraon sengs and associated documentaon; system audit records; system security plan; other relevant documents or records].

SC-45-Interview

SC-45-Test

[SELECT FROM: Mechanisms supporng and/or implemenng system me synchronizaon].

SYSTEM TIME SYNCHRONIZATION | SYNCHRONIZATION WITH AUTHORITATIVE TIME SOURCE ASSESSMENT OBJECTIVE: Determine if:

SC-45(01)_ODP[01]

the frequency at which to compare the internal system clocks with the authoritave me source is deﬁned;

SC-45(01)_ODP[02]

the authoritave me source to which internal system clocks are to be compared is deﬁned;

SC-45(01)_ODP[03]

the me period to compare the internal system clocks with the authoritave me source is deﬁned;

SC-45(01)(a)

the internal system clocks are compared <SC-45(01)_ODP[01] frequency> with <SC-45(01)_ODP[02] authoritave me source>;

SC-45(01)(b)

the internal system clocks are synchronized with the authoritave me source when the me diﬀerence is greater than <SC-45(01)_ODP[03] me period>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

SC-45(01)-Examine

SC-45(01)-Interview

SC-45(01)-Test

[SELECT FROM: Mechanisms supporng and/or implemenng system me synchronizaon].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 594

NIST SP 800-53A, REV. 5

SC-45(02)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

SYSTEM TIME SYNCHRONIZATION | SECONDARY AUTHORITATIVE TIME SOURCE ASSESSMENT OBJECTIVE: Determine if: SC-45(02)(a)

a secondary authoritave me source is idenﬁed that is in a diﬀerent geographic region than the primary authoritave me source;

SC-45(02)(b)

the internal system clocks are synchronized to the secondary authoritave me source if the primary authoritave me source is unavailable.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SC-46

SC-45(02)-Examine

SC-45(02)-Interview

SC-45(02)-Test

[SELECT FROM: Mechanisms supporng and/or implemenng system me synchronizaon with secondary authoritave me sources].

CROSS DOMAIN POLICY ENFORCEMENT ASSESSMENT OBJECTIVE: Determine if: SC-46_ODP

one of the following PARAMETER VALUES is selected: {physically; logically};

SC-46

a policy enforcement mechanism is <SC-46_ODP SELECTED PARAMETER VALUE> implemented between the physical and/or network interfaces for the connecng security domains.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

SC-46-Examine

[SELECT FROM: System and communicaons protecon policy; procedures addressing cross-domain policy enforcement; system design documentaon; system conﬁguraon sengs and associated documentaon; system audit records; system security plan; other relevant documents or records].

SC-46-Interview

SC-46-Test

[SELECT FROM: Mechanisms supporng and/or implemenng cross-domain policy enforcement].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 595

NIST SP 800-53A, REV. 5

SC-47

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

ALTERNATE COMMUNICATIONS PATHS ASSESSMENT OBJECTIVE: Determine if: SC-47_ODP

alternate communicaon paths for system operaons and operaonal command and control are deﬁned;

SC-47

<SC-47_ODP alternate communicaon paths> are established for system operaons and operaonal command and control.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SC-48

SC-47-Examine

[SELECT FROM: System and communicaons protecon policy; procedures addressing communicaon paths; system design documentaon; system conﬁguraon sengs and associated documentaon; system audit records; system security plan; other relevant documents or records].

SC-47-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies; system developers].

SC-47-Test

[SELECT FROM: Mechanisms supporng and/or implemenng alternate communicaon paths for system operaons].

SENSOR RELOCATION ASSESSMENT OBJECTIVE: Determine if:

SC-48_ODP[01]

sensors and monitoring capabilies to be relocated are deﬁned;

SC-48_ODP[02]

locaons to where sensors and monitoring capabilies are to be relocated are deﬁned;

SC-48_ODP[03]

condions or circumstances for relocang sensors and monitoring capabilies are deﬁned;

SC-48

<SC-48_ODP[01] sensors and monitoring capabilies> are relocated to <SC-48_ODP[02] locaons> under <SC-48_ODP[03] condions or circumstances>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

SC-48-Examine

[SELECT FROM: System and communicaons protecon policy; procedures addressing sensor and monitoring capability relocaon; list of sensors/monitoring capabilies to be relocated; change control records; conﬁguraon management records; system design documentaon; system conﬁguraon sengs and associated documentaon; system audit records; system security plan; other relevant documents or records].

SC-48-Interview

SC-48-Test

[SELECT FROM: Mechanisms supporng and/or implemenng sensor relocaon].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 596

NIST SP 800-53A, REV. 5

SC-48(01)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

SENSOR RELOCATION | DYNAMIC RELOCATION OF SENSORS OR MONITORING CAPABILITIES ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SC-48(01)_ODP[01]

sensors and monitoring capabilies to be dynamically relocated are deﬁned;

SC-48(01)_ODP[02]

locaons to where sensors and monitoring capabilies are to be dynamically relocated are deﬁned;

SC-48(01)_ODP[03]

condions or circumstances for dynamically relocang sensors and monitoring capabilies are deﬁned;

SC-48(01)

<SC-48(01)_ODP[01] sensors and monitoring capabilies> are dynamically relocated to <SC-48(01)_ODP[02] locaons> under <SC-48(01)_ODP[03] condions or circumstances>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SC-49

SC-48(01)-Examine

SC-48(01)-Interview

SC-48(01)-Test

[SELECT FROM: SELECT FROM: Mechanisms supporng and/or implemenng sensor relocaon].

HARDWARE-ENFORCED SEPARATION AND POLICY ENFORCEMENT ASSESSMENT OBJECTIVE: Determine if: SC-49_ODP

security domains requiring hardware-enforced separaon and policy enforcement mechanisms are deﬁned;

SC-49

hardware-enforced separaon and policy enforcement mechanisms are implemented between <SC-49_ODP security domains>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

SC-49-Examine

SC-49-Interview

SC-49-Test

[SELECT FROM: Mechanisms supporng and/or implemenng hardware-enforced security domain separaon and policy enforcement].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 597

NIST SP 800-53A, REV. 5

SC-50

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

SOFTWARE-ENFORCED SEPARATION AND POLICY ENFORCEMENT ASSESSMENT OBJECTIVE: Determine if: SC-50_ODP

security domains requiring soware-enforced separaon and policy enforcement mechanisms are deﬁned;

SC-50

soware-enforced separaon and policy enforcement mechanisms are implemented between <SC-50_ODP security domains>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SC-51

SC-50-Examine

SC-50-Interview

SC-50-Test

[SELECT FROM: Mechanisms supporng and/or implemenng soware-enforced separaon and policy enforcement].

HARDWARE-BASED PROTECTION ASSESSMENT OBJECTIVE: Determine if:

SC-51_ODP[01]

system ﬁrmware components requiring hardware-based write-protect are deﬁned;

SC-51_ODP[02]

authorized individuals requiring procedures for disabling and re-enabling hardware write-protect are deﬁned;

SC-51a.

hardware-based write-protect for <SC-51_ODP[01] system ﬁrmware components> is employed;

SC-51b.[01]

speciﬁc procedures are implemented for <SC-51_ODP[02] authorized individuals> to manually disable hardware write-protect for ﬁrmware modiﬁcaons;

SC-51b.[02]

speciﬁc procedures are implemented for <SC-51_ODP[02] authorized individuals> to re-enable the write-protect prior to returning to operaonal mode.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

SC-51-Examine

[SELECT FROM: System and communicaons protecon policy; procedures addressing ﬁrmware modiﬁcaons; system design documentaon; system conﬁguraon sengs and associated documentaon; system architecture; system audit records; system security plan; other relevant documents or records].

SC-51-Interview

SC-51-Test

[SELECT FROM: Organizaonal processes for modifying system ﬁrmware; mechanisms supporng and/or implemenng hardware-based write-protecon for system ﬁrmware].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 598

NIST SP 800-53A, REV. 5

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

4.19 SYSTEM AND INFORMATION INTEGRITY SI-01

POLICY AND PROCEDURES ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5 CHAPTER FOUR

SI-01_ODP[01]

personnel or roles to whom the system and informaon integrity policy is to be disseminated is/are deﬁned;

SI-01_ODP[02]

personnel or roles to whom the system and informaon integrity procedures are to be disseminated is/are deﬁned;

SI-01_ODP[03]

one or more of the following PARAMETER VALUES is/are selected: {organizaonlevel; mission/business process-level; system-level};

SI-01_ODP[04]

an oﬃcial to manage the system and informaon integrity policy and procedures is deﬁned;

SI-01_ODP[05]

the frequency at which the current system and informaon integrity policy is reviewed and updated is deﬁned;

SI-01_ODP[06]

events that would require the current system and informaon integrity policy to be reviewed and updated are deﬁned;

SI-01_ODP[07]

the frequency at which the current system and informaon integrity procedures are reviewed and updated is deﬁned;

SI-01_ODP[08]

events that would require the system and informaon integrity procedures to be reviewed and updated are deﬁned;

SI-01a.[01]

a system and informaon integrity policy is developed and documented;

SI-01a.[02]

the system and informaon integrity policy is disseminated to <SI-01_ODP[01] personnel or roles>;

SI-01a.[03]

system and informaon integrity procedures to facilitate the implementaon of the system and informaon integrity policy and associated system and informaon integrity controls are developed and documented;

SI-01a.[04]

the system and informaon integrity procedures are disseminated to <SI-01_ODP[02] personnel or roles>;

SI-01a.01(a)[01]

the <SI-01_ODP[03] SELECTED PARAMETER VALUE(S)> system and informaon integrity policy addresses purpose;

SI-01a.01(a)[02]

the <SI-01_ODP[03] SELECTED PARAMETER VALUE(S)> system and informaon integrity policy addresses scope;

SI-01a.01(a)[03]

the <SI-01_ODP[03] SELECTED PARAMETER VALUE(S)> system and informaon integrity policy addresses roles;

SI-01a.01(a)[04]

the <SI-01_ODP[03] SELECTED PARAMETER VALUE(S)> system and informaon integrity policy addresses responsibilies;

SI-01a.01(a)[05]

the <SI-01_ODP[03] SELECTED PARAMETER VALUE(S)> system and informaon integrity policy addresses management commitment;

SI-01a.01(a)[06]

the <SI-01_ODP[03] SELECTED PARAMETER VALUE(S)> system and informaon integrity policy addresses coordinaon among organizaonal enes;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 599

NIST SP 800-53A, REV. 5

SI-01

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

POLICY AND PROCEDURES

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SI-01a.01(a)[07]

the <SI-01_ODP[03] SELECTED PARAMETER VALUE(S)> system and informaon integrity policy addresses compliance;

SI-01a.01(b)

the <SI-01_ODP[03] SELECTED PARAMETER VALUE(S)> system and informaon integrity policy is consistent with applicable laws, Execuve Orders, direcves, regulaons, policies, standards, and guidelines;

SI-01b.

the <SI-01_ODP[04] oﬃcial> is designated to manage the development, documentaon, and disseminaon of the system and informaon integrity policy and procedures;

SI-01c.01[01]

the current system and informaon integrity policy is reviewed and updated <SI-01_ODP[05] frequency>;

SI-01c.01[02]

the current system and informaon integrity policy is reviewed and updated following <SI-01_ODP[06] events>;

SI-01c.02[01]

the current system and informaon integrity procedures are reviewed and updated <SI-01_ODP[07] frequency>;

SI-01c.02[02]

the current system and informaon integrity procedures are reviewed and updated following <SI-01_ODP[08] events>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SI-02

SI-01-Examine

[SELECT FROM: System and informaon integrity policy; system and informaon integrity procedures; system security plan; privacy plan; other relevant documents or records].

SI-01-Interview

[SELECT FROM: Organizaonal personnel with system and informaon integrity responsibilies; organizaonal personnel with informaon security and privacy responsibilies].

FLAW REMEDIATION ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

SI-02_ODP

me period within which to install security-relevant soware updates aer the release of the updates is deﬁned;

SI-02a.[01]

system ﬂaws are idenﬁed;

SI-02a.[02]

system ﬂaws are reported;

SI-02a.[03]

system ﬂaws are corrected;

SI-02b.[01]

soware updates related to ﬂaw remediaon are tested for eﬀecveness before installaon;

SI-02b.[02]

soware updates related to ﬂaw remediaon are tested for potenal side eﬀects before installaon;

SI-02b.[03]

ﬁrmware updates related to ﬂaw remediaon are tested for eﬀecveness before installaon;

SI-02b.[04]

ﬁrmware updates related to ﬂaw remediaon are tested for potenal side eﬀects before installaon;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 600

NIST SP 800-53A, REV. 5

SI-02

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

FLAW REMEDIATION SI-02c.[01]

security-relevant soware updates are installed within <SI-02_ODP me period> of the release of the updates;

SI-02c.[02]

security-relevant ﬁrmware updates are installed within <SI-02_ODP me period> of the release of the updates;

SI-02d.

ﬂaw remediaon is incorporated into the organizaonal conﬁguraon management process.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SI-02(01)

SI-02-Examine

[SELECT FROM: System and informaon integrity policy; system and informaon integrity procedures; procedures addressing ﬂaw remediaon; procedures addressing conﬁguraon management; list of ﬂaws and vulnerabilies potenally aﬀecng the system; list of recent security ﬂaw remediaon acons performed on the system (e.g., list of installed patches, service packs, hot ﬁxes, and other soware updates to correct system ﬂaws); test results from the installaon of soware and ﬁrmware updates to correct system ﬂaws; installaon/change control records for security-relevant soware and ﬁrmware updates; system security plan; privacy plan; other relevant documents or records].

SI-02-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security and privacy responsibilies; organizaonal personnel responsible for installing, conﬁguring, and/or maintaining the system; organizaonal personnel responsible for ﬂaw remediaon; organizaonal personnel with conﬁguraon management responsibilies].

SI-02-Test

[SELECT FROM: Organizaonal processes for idenfying, reporng, and correcng system ﬂaws; organizaonal process for installing soware and ﬁrmware updates; mechanisms supporng and/or implemenng the reporng and correcng of system ﬂaws; mechanisms supporng and/or implemenng tesng soware and ﬁrmware updates].

FLAW REMEDIATION | CENTRAL MANAGEMENT [WITHDRAWN: Incorporated into PL-09.]

SI-02(02)

FLAW REMEDIATION | AUTOMATED FLAW REMEDIATION STATUS ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

SI-02(02)_ODP[01]

automated mechanisms to determine if applicable security-relevant soware and ﬁrmware updates are installed on system components are deﬁned;

SI-02(02)_ODP[02]

the frequency at which to determine if applicable security-relevant soware and ﬁrmware updates are installed on system components is deﬁned;

SI-02(02)

system components have applicable security-relevant soware and ﬁrmware updates installed <SI-02(02)_ODP[02] frequency> using <SI-02(02)_ODP[01] automated mechanisms>.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 601

NIST SP 800-53A, REV. 5

SI-02(02)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

FLAW REMEDIATION | AUTOMATED FLAW REMEDIATION STATUS POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SI-02(03)

SI-02(02)-Examine

[SELECT FROM: System and informaon integrity policy; system and informaon integrity procedures; procedures addressing ﬂaw remediaon; automated mechanisms supporng centralized management of ﬂaw remediaon; system design documentaon; system conﬁguraon sengs and associated documentaon; system audit records; system security plan; other relevant documents or records].

SI-02(02)-Interview

SI-02(02)-Test

[SELECT FROM: Automated mechanisms used to determine the state of system components with regard to ﬂaw remediaon].

FLAW REMEDIATION | TIME TO REMEDIATE FLAWS AND BENCHMARKS FOR CORRECTIVE ACTIONS ASSESSMENT OBJECTIVE: Determine if:

SI-02(03)_ODP

the benchmarks for taking correcve acons are deﬁned;

SI-02(03)(a)

the me between ﬂaw idenﬁcaon and ﬂaw remediaon is measured;

SI-02(03)(b)

<SI-02(03)_ODP benchmarks> for taking correcve acons have been established.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SI-02(04)

SI-02(03)-Examine

[SELECT FROM: System and informaon integrity policy; system and informaon integrity procedures; procedures addressing ﬂaw remediaon; system design documentaon; system conﬁguraon sengs and associated documentaon; list of benchmarks for taking correcve acon on idenﬁed ﬂaws; records that provide mestamps of ﬂaw idenﬁcaon and subsequent ﬂaw remediaon acvies; system security plan; other relevant documents or records].

SI-02(03)-Interview

SI-02(03)-Test

[SELECT FROM: Organizaonal processes for idenfying, reporng, and correcng system ﬂaws; mechanisms used to measure the me between ﬂaw idenﬁcaon and ﬂaw remediaon].

FLAW REMEDIATION | AUTOMATED PATCH MANAGEMENT TOOLS ASSESSMENT OBJECTIVE: Determine if:

SI-02(04)_ODP

CHAPTER FOUR

the system components requiring automated patch management tools to facilitate ﬂaw remediaon are deﬁned;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 602

NIST SP 800-53A, REV. 5

SI-02(04)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

FLAW REMEDIATION | AUTOMATED PATCH MANAGEMENT TOOLS SI-02(04)

automated patch management tools are employed to facilitate ﬂaw remediaon to <SI-02(04)_ODP components>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SI-02(05)

SI-02(04)-Examine

[SELECT FROM: System and informaon integrity policy; system and informaon integrity procedures; procedures addressing ﬂaw remediaon; mechanisms supporng ﬂaw remediaon and automac soware/ﬁrmware updates; system design documentaon; system conﬁguraon sengs and associated documentaon; list of system ﬂaws; records of recent security-relevant soware and ﬁrmware updates that are automacally installed to system components; system audit records; system security plan; other relevant documents or records].

SI-02(04)-Interview

SI-02(04)-Test

[SELECT FROM: Automated patch management tools; mechanisms implemenng automac soware/ﬁrmware updates; mechanisms facilitang ﬂaw remediaon to system components].

FLAW REMEDIATION | AUTOMATIC SOFTWARE AND FIRMWARE UPDATES ASSESSMENT OBJECTIVE: Determine if:

SI-02(05)_ODP[01]

security-relevant soware and ﬁrmware updates to be automacally installed to system components are deﬁned;

SI-02(05)_ODP[02]

system components requiring security-relevant soware updates to be automacally installed are deﬁned;

SI-02(05)

<SI-02(05)_ODP[01] security-relevant soware and ﬁrmware updates> are installed automacally to <SI-02(05)_ODP[02] system components>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

SI-02(05)-Examine

[SELECT FROM: System and informaon integrity policy; system and informaon integrity procedures; procedures addressing ﬂaw remediaon; mechanisms supporng ﬂaw remediaon and automac soware/ﬁrmware updates; system design documentaon; system conﬁguraon sengs and associated documentaon; records of recent security-relevant soware and ﬁrmware updates automacally installed to system components; system audit records; system security plan; other relevant documents or records].

SI-02(05)-Interview

SI-02(05)-Test

[SELECT FROM: Mechanisms implemenng automac soware/ﬁrmware updates].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 603

NIST SP 800-53A, REV. 5

SI-02(06)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

FLAW REMEDIATION | REMOVAL OF PREVIOUS VERSIONS OF SOFTWARE AND FIRMWARE ASSESSMENT OBJECTIVE: Determine if:

SI-02(06)_ODP

soware and ﬁrmware components to be removed aer updated versions have been installed are deﬁned;

SI-02(06)

previous versions of <SI-02(06)_ODP soware and ﬁrmware components> are removed aer updated versions have been installed.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SI-03

SI-02(06)-Examine

[SELECT FROM: System and informaon integrity policy; system and informaon integrity procedures; procedures addressing ﬂaw remediaon; mechanisms supporng ﬂaw remediaon; system design documentaon; system conﬁguraon sengs and associated documentaon; records of soware and ﬁrmware component removals aer updated versions are installed; system audit records; system security plan; other relevant documents or records].

SI-02(06)-Interview

SI-02(06)-Test

[SELECT FROM: Mechanisms supporng and/or implemenng the removal of previous versions of soware/ﬁrmware].

MALICIOUS CODE PROTECTION ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

SI-03_ODP[01]

one or more of the following PARAMETER VALUES is/are selected: {signaturebased; non-signature-based};

SI-03_ODP[02]

the frequency at which malicious code protecon mechanisms perform scans is deﬁned;

SI-03_ODP[03]

one or more of the following PARAMETER VALUES is/are selected: {endpoint; network entry and exit points};

SI-03_ODP[04]

one or more of the following PARAMETER VALUES is/are selected: {block malicious code; quaranne malicious code; take <SI-03_ODP[05] acon>};

SI-03_ODP[05]

acon to be taken in response to malicious code detecon are deﬁned (if selected);

SI-03_ODP[06]

personnel or roles to be alerted when malicious code is detected is/are deﬁned;

SI-03a.[01]

<SI-03_ODP[01] SELECTED PARAMETER VALUE(S)> malicious code protecon mechanisms are implemented at system entry and exit points to detect malicious code;

SI-03a.[02]

<SI-03_ODP[01] SELECTED PARAMETER VALUE(S)> malicious code protecon mechanisms are implemented at system entry and exit points to eradicate malicious code;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 604

NIST SP 800-53A, REV. 5

SI-03

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

MALICIOUS CODE PROTECTION

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SI-03b.

malicious code protecon mechanisms are updated automacally as new releases are available in accordance with organizaonal conﬁguraon management policy and procedures;

SI-03c.01[01]

malicious code protecon mechanisms are conﬁgured to perform periodic scans of the system <SI-03_ODP[02] frequency>;

SI-03c.01[02]

malicious code protecon mechanisms are conﬁgured to perform real-me scans of ﬁles from external sources at <SI-03_ODP[03] SELECTED PARAMETER VALUE(S)> as the ﬁles are downloaded, opened, or executed in accordance with organizaonal policy;

SI-03c.02[01]

malicious code protecon mechanisms are conﬁgured to <SI-03_ODP[04] SELECTED PARAMETER VALUE(S)> in response to malicious code detecon;

SI-03c.02[02]

malicious code protecon mechanisms are conﬁgured to send alerts to <SI-03_ODP[06] personnel or roles> in response to malicious code detecon;

SI-03d.

the receipt of false posives during malicious code detecon and eradicaon and the resulng potenal impact on the availability of the system are addressed.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SI-03(01)

SI-03-Examine

[SELECT FROM: System and informaon integrity policy; system and informaon integrity procedures; conﬁguraon management policy and procedures; procedures addressing malicious code protecon; malicious code protecon mechanisms; records of malicious code protecon updates; system design documentaon; system conﬁguraon sengs and associated documentaon; scan results from malicious code protecon mechanisms; record of acons iniated by malicious code protecon mechanisms in response to malicious code detecon; system audit records; system security plan; other relevant documents or records].

SI-03-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies; organizaonal personnel installing, conﬁguring, and/or maintaining the system; organizaonal personnel responsible for malicious code protecon; organizaonal personnel with conﬁguraon management responsibilies].

SI-03-Test

[SELECT FROM: Organizaonal processes for employing, updang, and conﬁguring malicious code protecon mechanisms; organizaonal processes for addressing false posives and resulng potenal impacts; mechanisms supporng and/or implemenng, employing, updang, and conﬁguring malicious code protecon mechanisms; mechanisms supporng and/or implemenng malicious code scanning and subsequent acons].

MALICIOUS CODE PROTECTION | CENTRAL MANAGEMENT [WITHDRAWN: Incorporated into PL-09.]

SI-03(02)

MALICIOUS CODE PROTECTION | AUTOMATIC UPDATES [WITHDRAWN: Incorporated into SI-03.]

CHAPTER FOUR

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 605

NIST SP 800-53A, REV. 5

SI-03(03)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

MALICIOUS CODE PROTECTION | NON-PRIVILEGED USERS [WITHDRAWN: Incorporated into AC-06(10).]

SI-03(04)

MALICIOUS CODE PROTECTION | UPDATES ONLY BY PRIVILEGED USERS ASSESSMENT OBJECTIVE: Determine if: SI-03(04)

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

malicious code protecon mechanisms are updated only when directed by a privileged user.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SI-03(05)

SI-03(04)-Examine

[SELECT FROM: System and informaon integrity policy; system and informaon integrity procedures; procedures addressing malicious code protecon; list of privileged users on system; system design documentaon; malicious code protecon mechanisms; records of malicious code protecon updates; system conﬁguraon sengs and associated documentaon; system audit records; system security plan; other relevant documents or records].

SI-03(04)-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies; system developers; organizaonal personnel installing, conﬁguring, and/or maintaining the system; organizaonal personnel responsible for malicious code protecon].

SI-03(04)-Test

[SELECT FROM: Mechanisms supporng and/or implemenng malicious code protecon capabilies].

MALICIOUS CODE PROTECTION | PORTABLE STORAGE DEVICES [WITHDRAWN: Incorporated into MP-07.]

SI-03(06)

MALICIOUS CODE PROTECTION | TESTING AND VERIFICATION ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

SI-03(06)_ODP

the frequency at which to test malicious code protecon mechanisms is deﬁned;

SI-03(06)(a)

malicious code protecon mechanisms are tested <SI-03(06)_ODP frequency> by introducing known benign code into the system;

SI-03(06)(b)[01]

the detecon of (benign test) code occurs;

SI-03(06)(b)[02]

the associated incident reporng occurs.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 606

NIST SP 800-53A, REV. 5

SI-03(06)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

MALICIOUS CODE PROTECTION | TESTING AND VERIFICATION POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SI-03(07)

SI-03(06)-Examine

[SELECT FROM: System and informaon integrity policy; system and informaon integrity procedures; procedures addressing malicious code protecon; system design documentaon; system conﬁguraon sengs and associated documentaon; test cases; records providing evidence of test cases executed on malicious code protecon mechanisms; system audit records; system security plan; other relevant documents or records].

SI-03(06)-Interview

SI-03(06)-Test

[SELECT FROM: Mechanisms supporng and/or implemenng the tesng and veriﬁcaon of malicious code protecon capabilies].

MALICIOUS CODE PROTECTION | NONSIGNATURE-BASED DETECTION [WITHDRAWN: Incorporated into SI-03.]

SI-03(08)

MALICIOUS CODE PROTECTION | DETECT UNAUTHORIZED COMMANDS ASSESSMENT OBJECTIVE: Determine if:

SI-03(08)_ODP[01]

system hardware components for which unauthorized operang system commands are to be detected through the kernel applicaon programming interface are deﬁned;

SI-03(08)_ODP[02]

unauthorized operang system commands to be detected are deﬁned;

SI-03(08)_ODP[03]

one or more of the following PARAMETER VALUES is/are selected: {issue a warning; audit the command execuon; prevent the execuon of the command};

SI-03(08)(a)

<SI-03(08)_ODP[01] unauthorized operang system commands> are detected through the kernel applicaon programming interface on <SI-03(08)_ODP[02] system hardware components>;

SI-03(08)(b)

<SI-03(08)_ODP[03] SELECTED PARAMETER VALUE(S)> is/are performed.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

SI-03(08)-Examine

[SELECT FROM: System and informaon integrity policy; system and informaon integrity procedures; procedures addressing malicious code protecon; system design documentaon; malicious code protecon mechanisms; warning messages sent upon the detecon of unauthorized operang system command execuon; system conﬁguraon sengs and associated documentaon; system audit records; system security plan; other relevant documents or records].

SI-03(08)-Interview

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 607

NIST SP 800-53A, REV. 5

SI-03(08)

MALICIOUS CODE PROTECTION | DETECT UNAUTHORIZED COMMANDS SI-03(08)-Test

SI-03(09)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

[SELECT FROM: Mechanisms supporng and/or implemenng malicious code protecon capabilies; mechanisms supporng and/or implemenng the detecon of unauthorized operang system commands through the kernel applicaon programming interface].

MALICIOUS CODE PROTECTION | AUTHENTICATE REMOTE COMMANDS [WITHDRAWN: Moved to AC-17(10).]

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SI-03(10)

MALICIOUS CODE PROTECTION | MALICIOUS CODE ANALYSIS ASSESSMENT OBJECTIVE: Determine if:

SI-03(10)_ODP

tools and techniques to be employed to analyze the characteriscs and behavior of malicious code are deﬁned;

SI-03(10)(a)

<SI-03(10)_ODP tools and techniques> are employed to analyze the characteriscs and behavior of malicious code;

SI-03(10)(b)[01]

the results from malicious code analysis are incorporated into organizaonal incident response processes;

SI-03(10)(b)[02]

the results from malicious code analysis are incorporated into organizaonal ﬂaw remediaon processes.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

SI-03(10)-Examine

[SELECT FROM: System and informaon integrity policy; system and informaon integrity procedures; procedures addressing malicious code protecon; procedures addressing incident response; procedures addressing ﬂaw remediaon; system design documentaon; malicious code protecon mechanisms, tools, and techniques; system conﬁguraon sengs and associated documentaon; results from malicious code analyses; records of ﬂaw remediaon events resulng from malicious code analyses; system audit records; system security plan; other relevant documents or records].

SI-03(10)-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies; organizaonal personnel installing, conﬁguring, and/or maintaining the system; organizaonal personnel responsible for malicious code protecon; organizaonal personnel responsible for ﬂaw remediaon; organizaonal personnel responsible for incident response/ management].

SI-03(10)-Test

[SELECT FROM: Organizaonal process for incident response; organizaonal process for ﬂaw remediaon; mechanisms supporng and/or implemenng malicious code protecon capabilies; tools and techniques for the analysis of malicious code characteriscs and behavior].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 608

NIST SP 800-53A, REV. 5

SI-04

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

SYSTEM MONITORING ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SI-04_ODP[01]

monitoring objecves to detect aacks and indicators of potenal aacks on the system are deﬁned;

SI-04_ODP[02]

techniques and methods used to idenfy unauthorized use of the system are deﬁned;

SI-04_ODP[03]

system monitoring informaon to be provided to personnel or roles is deﬁned;

SI-04_ODP[04]

personnel or roles to whom system monitoring informaon is to be provided is/ are deﬁned;

SI-04_ODP[05]

one or more of the following PARAMETER VALUES is/are selected: {as needed; <SI-04_ODP[06] frequency>};

SI-04_ODP[06]

a frequency for providing system monitoring to personnel or roles is deﬁned (if selected);

SI-04a.01

the system is monitored to detect aacks and indicators of potenal aacks in accordance with <SI-04_ODP[01] monitoring objecves>;

SI-04a.02[01]

the system is monitored to detect unauthorized local connecons;

SI-04a.02[02]

the system is monitored to detect unauthorized network connecons;

SI-04a.02[03]

the system is monitored to detect unauthorized remote connecons;

SI-04b.

unauthorized use of the system is idenﬁed through <SI-04_ODP[02] techniques and methods>;

SI-04c.01

internal monitoring capabilies are invoked or monitoring devices are deployed strategically within the system to collect organizaon-determined essenal informaon;

SI-04c.02

internal monitoring capabilies are invoked or monitoring devices are deployed at ad hoc locaons within the system to track speciﬁc types of transacons of interest to the organizaon;

SI-04d.[01]

detected events are analyzed;

SI-04d.[02]

detected anomalies are analyzed;

SI-04e.

the level of system monitoring acvity is adjusted when there is a change in risk to organizaonal operaons and assets, individuals, other organizaons, or the Naon;

SI-04f.

a legal opinion regarding system monitoring acvies is obtained;

SI-04g.

<SI-04_ODP[03] system monitoring informaon> is provided to <SI-04_ODP[04] personnel or roles> <SI-04_ODP[05] SELECTED PARAMETER VALUE(S)>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: SI-04-Examine

CHAPTER FOUR

[SELECT FROM: System and informaon integrity policy; system and informaon integrity procedures; procedures addressing system monitoring tools and techniques; connuous monitoring strategy; facility diagram/layout; system design documentaon; system monitoring tools and techniques documentaon; locaons within the system where monitoring devices are deployed; system conﬁguraon sengs and associated documentaon; system security plan; other relevant documents or records].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 609

NIST SP 800-53A, REV. 5

SI-04

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SI-04(01)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

SYSTEM MONITORING SI-04-Interview

SI-04-Test

[SELECT FROM: Organizaonal processes for system monitoring; mechanisms supporng and/or implemenng system monitoring capabilies].

SYSTEM MONITORING | SYSTEM-WIDE INTRUSION DETECTION SYSTEM ASSESSMENT OBJECTIVE: Determine if:

SI-04(01)[01]

individual intrusion detecon tools are connected to a system-wide intrusion detecon system;

SI-04(01)[02]

individual intrusion detecon tools are conﬁgured into a system-wide intrusion detecon system.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SI-04(02)

SI-04(01)-Examine

SI-04(01)-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies; organizaonal personnel installing, conﬁguring, and/or maintaining the system; organizaonal personnel responsible for monitoring the system; organizaonal personnel responsible for the intrusion detecon system].

SI-04(01)-Test

[SELECT FROM: Organizaonal processes for intrusion detecon and system monitoring; mechanisms supporng and/or implemenng intrusion detecon capabilies].

SYSTEM MONITORING | AUTOMATED TOOLS AND MECHANISMS FOR REAL-TIME ANALYSIS ASSESSMENT OBJECTIVE: Determine if: SI-04(02)

CHAPTER FOUR

automated tools and mechanisms are employed to support a near real-me analysis of events.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 610

NIST SP 800-53A, REV. 5

SI-04(02)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

SYSTEM MONITORING | AUTOMATED TOOLS AND MECHANISMS FOR REAL-TIME ANALYSIS POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SI-04(03)

SI-04(02)-Examine

[SELECT FROM: System and informaon integrity policy; system and informaon integrity procedures; procedures addressing system monitoring tools and techniques; system design documentaon; system monitoring tools and techniques documentaon; system conﬁguraon sengs and associated documentaon; system audit records; system security plan; privacy plan; privacy program plan; privacy impact assessment; privacy risk management documentaon; other relevant documents or records].

SI-04(02)-Interview

SI-04(02)-Test

[SELECT FROM: Organizaonal processes for the near real-me analysis of events; organizaonal processes for system monitoring; mechanisms supporng and/ or implemenng system monitoring; mechanisms/tools supporng and/or implemenng an analysis of events].

SYSTEM MONITORING | AUTOMATED TOOL AND MECHANISM INTEGRATION ASSESSMENT OBJECTIVE: Determine if:

SI-04(03)[01]

automated tools and mechanisms are employed to integrate intrusion detecon tools and mechanisms into access control mechanisms;

SI-04(03)[02]

automated tools and mechanisms are employed to integrate intrusion detecon tools and mechanisms into ﬂow control mechanisms.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

SI-04(03)-Examine

[SELECT FROM: System and informaon integrity policy; system and informaon integrity procedures; access control policy and procedures; procedures addressing system monitoring tools and techniques; system design documentaon; system monitoring tools and techniques documentaon; system conﬁguraon sengs and associated documentaon; system audit records; system security plan; other relevant documents or records].

SI-04(03)-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies; organizaonal personnel installing, conﬁguring, and/or maintaining the system; organizaonal personnel responsible for monitoring the system; organizaonal personnel responsible for the intrusion detecon system].

SI-04(03)-Test

[SELECT FROM: Organizaonal processes for intrusion detecon and system monitoring; mechanisms supporng and/or implemenng the intrusion detecon and system monitoring capability; mechanisms and tools supporng and/or implemenng the access and ﬂow control capabilies; mechanisms and tools supporng and/or implemenng the integraon of intrusion detecon tools into the access and ﬂow control mechanisms].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 611

NIST SP 800-53A, REV. 5

SI-04(04)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

SYSTEM MONITORING | INBOUND AND OUTBOUND COMMUNICATIONS TRAFFIC ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SI-04(04)_ODP[01]

the frequency at which to monitor inbound communicaons traﬃc for unusual or unauthorized acvies or condions is deﬁned;

SI-04(04)_ODP[02]

unusual or unauthorized acvies or condions that are to be monitored in inbound communicaons traﬃc are deﬁned;

SI-04(04)_ODP[03]

the frequency at which to monitor outbound communicaons traﬃc for unusual or unauthorized acvies or condions is deﬁned;

SI-04(04)_ODP[04]

unusual or unauthorized acvies or condions that are to be monitored in outbound communicaons traﬃc are deﬁned;

SI-04(04)(a)[01]

criteria for unusual or unauthorized acvies or condions for inbound communicaons traﬃc are deﬁned;

SI-04(04)(a)[02]

criteria for unusual or unauthorized acvies or condions for outbound communicaons traﬃc are deﬁned;

SI-04(04)(b)[01]

inbound communicaons traﬃc is monitored <SI-04(04)_ODP[01] frequency> for <SI-04(04)_ODP[02] unusual or unauthorized acvies or condions>;

SI-04(04)(b)[02]

outbound communicaons traﬃc is monitored <SI-04(04)_ODP[03] frequency> for <SI-04(04)_ODP[04] unusual or unauthorized acvies or condions>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SI-04(05)

SI-04(04)-Examine

SI-04(04)-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies; organizaonal personnel installing, conﬁguring, and/or maintaining the system; organizaonal personnel responsible for monitoring the system; organizaonal personnel responsible for the intrusion detecon system].

SI-04(04)-Test

[SELECT FROM: Organizaonal processes for intrusion detecon and system monitoring; mechanisms supporng and/or implemenng intrusion detecon and system monitoring capabilies; mechanisms supporng and/or implemenng the monitoring of inbound and outbound communicaons traﬃc].

SYSTEM MONITORING | SYSTEM-GENERATED ALERTS ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

SI-04(05)_ODP[01]

personnel or roles to be alerted when indicaons of compromise or potenal compromise occur is/are deﬁned;

SI-04(05)_ODP[02]

compromise indicators are deﬁned;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 612

NIST SP 800-53A, REV. 5

SI-04(05)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

SYSTEM MONITORING | SYSTEM-GENERATED ALERTS SI-04(05)

<SI-04(05)_ODP[01] personnel or roles> are alerted when system-generated <SI-04(05)_ODP[02] compromise indicators> occur.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SI-04(06)

SI-04(05)-Examine

[SELECT FROM: System and informaon integrity policy; system and informaon integrity procedures; procedures addressing system monitoring tools and techniques; system monitoring tools and techniques documentaon; system conﬁguraon sengs and associated documentaon; list of personnel selected to receive alerts; documentaon of alerts generated based on compromise indicators; system audit records; system security plan; privacy plan; other relevant documents or records].

SI-04(05)-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security and privacy responsibilies; system developers; organizaonal personnel installing, conﬁguring, and/or maintaining the system; organizaonal personnel responsible for monitoring the system; organizaonal personnel on the system alert noﬁcaon list; organizaonal personnel responsible for the intrusion detecon system].

SI-04(05)-Test

SYSTEM MONITORING | RESTRICT NON-PRIVILEGED USERS [WITHDRAWN: Incorporated into AC-06(10).]

SI-04(07)

SYSTEM MONITORING | AUTOMATED RESPONSE TO SUSPICIOUS EVENTS ASSESSMENT OBJECTIVE: Determine if:

SI-04(07)_ODP[01]

incident response personnel (idenﬁed by name and/or by role) to be noﬁed of detected suspicious events is/are deﬁned;

SI-04(07)_ODP[02]

least-disrupve acons to terminate suspicious events are deﬁned;

SI-04(07)(a)

<SI-04(07)_ODP[01] incident response personnel> are noﬁed of detected suspicious events;

SI-04(07)(b)

<SI-04(07)_ODP[02] least-disrupve acons> are taken upon the detecon of suspicious events.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: SI-04(07)-Examine

CHAPTER FOUR

[SELECT FROM: System and informaon integrity policy; system and informaon integrity procedures; procedures addressing system monitoring tools and techniques; system design documentaon; system monitoring tools and techniques documentaon; system conﬁguraon sengs and associated documentaon; alerts and noﬁcaons generated based on detected suspicious events; records of acons taken to terminate suspicious events; system audit records; system security plan; other relevant documents or records].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 613

NIST SP 800-53A, REV. 5

SI-04(07)

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SI-04(08)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

SYSTEM MONITORING | AUTOMATED RESPONSE TO SUSPICIOUS EVENTS SI-04(07)-Interview

SI-04(07)-Test

[SELECT FROM: Organizaonal processes for intrusion detecon and system monitoring; mechanisms supporng and/or implemenng intrusion detecon and system monitoring capabilies; mechanisms supporng and/or implemenng noﬁcaons to incident response personnel; mechanisms supporng and/or implemenng acons to terminate suspicious events].

SYSTEM MONITORING | PROTECTION OF MONITORING INFORMATION [WITHDRAWN: Incorporated into SI-04.]

SI-04(09)

SYSTEM MONITORING | TESTING OF MONITORING TOOLS AND MECHANISMS ASSESSMENT OBJECTIVE: Determine if:

SI-04(09)_ODP

a frequency at which to test intrusion-monitoring tools and mechanisms is deﬁned;

SI-04(09)

intrusion-monitoring tools and mechanisms are tested <SI-04(09)_ODP frequency>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SI-04(10)

SI-04(09)-Examine

[SELECT FROM: System and informaon integrity policy; system and informaon integrity procedures; procedures addressing the tesng of system monitoring tools and techniques; documentaon providing evidence of tesng intrusion-monitoring tools; system security plan; other relevant documents or records].

SI-04(09)-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies; organizaonal personnel installing, conﬁguring, and/or maintaining the system; organizaonal personnel responsible for monitoring the system; organizaonal personnel responsible for the intrusion detecon system].

SI-04(09)-Test

SYSTEM MONITORING | VISIBILITY OF ENCRYPTED COMMUNICATIONS ASSESSMENT OBJECTIVE: Determine if:

SI-04(10)_ODP[01]

CHAPTER FOUR

encrypted communicaons traﬃc to be made visible to system monitoring tools and mechanisms is deﬁned;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 614

NIST SP 800-53A, REV. 5

SI-04(10)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

SYSTEM MONITORING | VISIBILITY OF ENCRYPTED COMMUNICATIONS SI-04(10)_ODP[02]

system monitoring tools and mechanisms to be provided access to encrypted communicaons traﬃc are deﬁned;

SI-04(10)

provisions are made so that <SI-04(10)_ODP[01] encrypted communicaons traﬃc> is visible to <SI-04(10)_ODP[02] system monitoring tools and mechanisms>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SI-04(11)

SI-04(10)-Examine

SI-04(10)-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies; organizaonal personnel installing, conﬁguring, and/or maintaining the system; organizaonal personnel responsible for monitoring the system; organizaonal personnel responsible for the intrusion detecon system].

SI-04(10)-Test

[SELECT FROM: Organizaonal processes for intrusion detecon and system monitoring; mechanisms supporng and/or implemenng intrusion detecon and system monitoring capabilies; mechanisms supporng and/or implemenng the visibility of encrypted communicaons traﬃc to monitoring tools].

SYSTEM MONITORING | ANALYZE COMMUNICATIONS TRAFFIC ANOMALIES ASSESSMENT OBJECTIVE: Determine if:

SI-04(11)_ODP

interior points within the system where communicaons traﬃc is to be analyzed are deﬁned;

SI-04(11)[01]

outbound communicaons traﬃc at the external interfaces to the system is analyzed to discover anomalies;

SI-04(11)[02]

outbound communicaons traﬃc at <SI-04(11)_ODP interior points> is analyzed to discover anomalies.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

SI-04(11)-Examine

[SELECT FROM: System and informaon integrity policy; system and informaon integrity procedures; procedures addressing system monitoring tools and techniques; system design documentaon; network diagram; system monitoring tools and techniques documentaon; system conﬁguraon sengs and associated documentaon; system monitoring logs or records; system audit records; system security plan; other relevant documents or records].

SI-04(11)-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies; organizaonal personnel installing, conﬁguring, and/or maintaining the system; organizaonal personnel responsible for monitoring the system; organizaonal personnel responsible for the intrusion detecon system].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 615

NIST SP 800-53A, REV. 5

SI-04(11)

SYSTEM MONITORING | ANALYZE COMMUNICATIONS TRAFFIC ANOMALIES SI-04(11)-Test

SI-04(12)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

SYSTEM MONITORING | AUTOMATED ORGANIZATION-GENERATED ALERTS ASSESSMENT OBJECTIVE:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

Determine if:

SI-04(12)_ODP[01]

personnel or roles to be alerted when indicaons of inappropriate or unusual acvity with security or privacy implicaons occur is/are deﬁned;

SI-04(12)_ODP[02]

automated mechanisms used to alert personnel or roles are deﬁned;

SI-04(12)_ODP[03]

acvies that trigger alerts to personnel or are deﬁned;

SI-04(12)

<SI-04(12)_ODP[01] personnel or roles> is/are alerted using <SI-04(12)_ODP[02] automated mechanisms> when <SI-04(12)_ODP[03] acvies that trigger alerts> indicate inappropriate or unusual acvies with security or privacy implicaons.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SI-04(13)

SI-04(12)-Examine

[SELECT FROM: System and informaon integrity policy; system and informaon integrity procedures; procedures addressing system monitoring tools and techniques; system design documentaon; system monitoring tools and techniques documentaon; system conﬁguraon sengs and associated documentaon; list of inappropriate or unusual acvies with security and privacy implicaons that trigger alerts; suspicious acvity reports; alerts provided to security and privacy personnel; system monitoring logs or records; system audit records; system security plan; privacy plan; other relevant documents or records].

SI-04(12)-Interview

SI-04(12)-Test

[SELECT FROM: Organizaonal processes for intrusion detecon and system monitoring; automated mechanisms supporng and/or implemenng intrusion detecon and system monitoring capabilies; automated mechanisms supporng and/or implemenng automated alerts to security personnel].

SYSTEM MONITORING | ANALYZE TRAFFIC AND EVENT PATTERNS ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

SI-04(13)(a)[01]

communicaons traﬃc for the system is analyzed;

SI-04(13)(a)[02]

event paerns for the system are analyzed;

SI-04(13)(b)[01]

proﬁles represenng common traﬃc are developed;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 616

NIST SP 800-53A, REV. 5

SI-04(13)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

SYSTEM MONITORING | ANALYZE TRAFFIC AND EVENT PATTERNS SI-04(13)(b)[02]

proﬁles represenng event paerns are developed;

SI-04(13)(c)[01]

traﬃc proﬁles are used in tuning system-monitoring devices;

SI-04(13)(c)[02]

event proﬁles are used in tuning system-monitoring devices.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SI-04(14)

SI-04(13)-Examine

[SELECT FROM: System and informaon integrity policy; system and informaon integrity procedures; procedures addressing system monitoring tools and techniques; system design documentaon; system monitoring tools and techniques documentaon; system conﬁguraon sengs and associated documentaon; list of proﬁles represenng common traﬃc paerns and/or events; system protocols documentaon; list of acceptable thresholds for false posives and false negaves; system security plan; other relevant documents or records].

SI-04(13)-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies; organizaonal personnel installing, conﬁguring, and/or maintaining the system; organizaonal personnel responsible for monitoring the system; organizaonal personnel responsible for the intrusion detecon system].

SI-04(13)-Test

[SELECT FROM: Organizaonal processes for intrusion detecon and system monitoring; mechanisms supporng and/or implemenng intrusion detecon and system monitoring capabilies; mechanisms supporng and/or implemenng the analysis of communicaons traﬃc and event paerns].

SYSTEM MONITORING | WIRELESS INTRUSION DETECTION ASSESSMENT OBJECTIVE: Determine if:

SI-04(14)[01]

a wireless intrusion detecon system is employed to idenfy rogue wireless devices;

SI-04(14)[02]

a wireless intrusion detecon system is employed to detect aack aempts on the system;

SI-04(14)[03]

a wireless intrusion detecon system is employed to detect potenal compromises or breaches to the system.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

SI-04(14)-Examine

SI-04(14)-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies; organizaonal personnel installing, conﬁguring, and/or maintaining the system; organizaonal personnel responsible for monitoring the system; organizaonal personnel responsible for the intrusion detecon system].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 617

NIST SP 800-53A, REV. 5

SI-04(14)

SYSTEM MONITORING | WIRELESS INTRUSION DETECTION SI-04(14)-Test

SI-04(15)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

[SELECT FROM: Organizaonal processes for intrusion detecon; mechanisms supporng and/or implemenng a wireless intrusion detecon capability].

SYSTEM MONITORING | WIRELESS TO WIRELINE COMMUNICATIONS ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SI-04(15)

an intrusion detecon system is employed to monitor wireless communicaons traﬃc as the traﬃc passes from wireless to wireline networks.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SI-04(16)

SI-04(15)-Examine

SI-04(15)-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies; organizaonal personnel installing, conﬁguring, and/or maintaining the system; organizaonal personnel responsible for monitoring the system; organizaonal personnel responsible for the intrusion detecon system].

SI-04(15)-Test

SYSTEM MONITORING | CORRELATE MONITORING INFORMATION ASSESSMENT OBJECTIVE: Determine if: SI-04(16)

informaon from monitoring tools and mechanisms employed throughout the system is correlated.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

SI-04(16)-Examine

SI-04(16)-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies; organizaonal personnel installing, conﬁguring, and/or maintaining the system; organizaonal personnel responsible for monitoring the system; organizaonal personnel responsible for the intrusion detecon system].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 618

NIST SP 800-53A, REV. 5

SI-04(16)

SYSTEM MONITORING | CORRELATE MONITORING INFORMATION SI-04(16)-Test

SI-04(17)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

[SELECT FROM: Organizaonal processes for intrusion detecon and system monitoring; mechanisms supporng and/or implemenng intrusion detecon and system monitoring capabilies; mechanisms supporng and/or implemenng the correlaon of informaon from monitoring tools].

SYSTEM MONITORING | INTEGRATED SITUATIONAL AWARENESS ASSESSMENT OBJECTIVE:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

Determine if: SI-04(17)

informaon from monitoring physical, cyber, and supply chain acvies are correlated to achieve integrated, organizaon-wide situaonal awareness.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SI-04(18)

SI-04(17)-Examine

[SELECT FROM: System and informaon integrity policy; system and informaon integrity procedures; procedures addressing system monitoring tools and techniques; system design documentaon; system monitoring tools and techniques documentaon; system conﬁguraon sengs and associated documentaon; event correlaon logs or records resulng from physical, cyber, and supply chain acvies; system audit records; system security plan; supply chain risk management plan; other relevant documents or records].

SI-04(17)-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies; organizaonal personnel installing, conﬁguring, and/or maintaining the system; organizaonal personnel responsible for monitoring the system; organizaonal personnel responsible for the intrusion detecon system].

SI-04(17)-Test

[SELECT FROM: Organizaonal processes for intrusion detecon and system monitoring; mechanisms supporng and/or implemenng intrusion detecon and system monitoring capabilies; mechanisms supporng and/or implemenng the correlaon of informaon from monitoring tools].

SYSTEM MONITORING | ANALYZE TRAFFIC AND COVERT EXFILTRATION ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

SI-04(18)_ODP

interior points within the system where communicaons traﬃc is to be analyzed are deﬁned;

SI-04(18)[01]

outbound communicaons traﬃc is analyzed at interfaces external to the system to detect covert exﬁltraon of informaon;

SI-04(18)[02]

outbound communicaons traﬃc is analyzed at <SI-04(18)_ODP interior points> to detect covert exﬁltraon of informaon.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 619

NIST SP 800-53A, REV. 5

SI-04(18)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

SYSTEM MONITORING | ANALYZE TRAFFIC AND COVERT EXFILTRATION POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SI-04(19)

SI-04(18)-Examine

[SELECT FROM: System and informaon integrity policy; system and informaon integrity procedures; procedures addressing system monitoring tools and techniques; system design documentaon; network diagram; system monitoring tools and techniques documentaon; system conﬁguraon sengs and associated documentaon; system monitoring logs or records; system audit records; system security plan; other relevant documents or records].

SI-04(18)-Interview

[SELECT FROM: System/network administrators; organizaonal personnel with informaon security responsibilies; organizaonal personnel installing, conﬁguring, and/or maintaining the system; organizaonal personnel responsible for monitoring the system; organizaonal personnel responsible for the intrusion detecon system].

SI-04(18)-Test

SYSTEM MONITORING | RISK FOR INDIVIDUALS ASSESSMENT OBJECTIVE: Determine if:

SI-04(19)_ODP[01]

addional monitoring of individuals who have been idenﬁed as posing an increased level of risk is deﬁned;

SI-04(19)_ODP[02]

sources that idenfy individuals who pose an increased level of risk are deﬁned;

SI-04(19)

<SI-04(19)_ODP[01] addional monitoring> is implemented on individuals who have been idenﬁed by <SI-04(19)_ODP[02] sources> as posing an increased level of risk.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

SI-04(19)-Examine

[SELECT FROM: System and informaon integrity policy; system and informaon integrity procedures; procedures addressing system monitoring; system design documentaon; system monitoring tools and techniques documentaon; system conﬁguraon sengs and associated documentaon; system audit records; system security plan; privacy plan; other relevant documents or records].

SI-04(19)-Interview

SI-04(19)-Test

[SELECT FROM: Organizaonal processes for system monitoring; mechanisms supporng and/or implemenng a system monitoring capability].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 620

NIST SP 800-53A, REV. 5

SI-04(20)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

SYSTEM MONITORING | PRIVILEGED USERS ASSESSMENT OBJECTIVE: Determine if:

SI-04(20)_ODP

addional monitoring of privileged users is deﬁned;

SI-04(20)

<SI-04(20)_ODP addional monitoring> of privileged users is implemented.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SI-04(21)

SI-04(20)-Examine

SI-04(20)-Interview

SI-04(20)-Test

[SELECT FROM: Organizaonal processes for system monitoring; mechanisms supporng and/or implemenng a system monitoring capability].

SYSTEM MONITORING | PROBATIONARY PERIODS ASSESSMENT OBJECTIVE: Determine if:

SI-04(21)_ODP[01]

addional monitoring to be implemented on individuals during probaonary periods is deﬁned;

SI-04(21)_ODP[02]

the probaonary period of individuals is deﬁned;

SI-04(21)

<SI-04(21)_ODP[01] addional monitoring> of individuals is implemented during <SI-04(21)_ODP[02] probaonary period>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

SI-04(21)-Examine

[SELECT FROM: System and informaon integrity policy; system and informaon integrity procedures; procedures addressing system monitoring; system design documentaon; system monitoring tools and techniques documentaon; system conﬁguraon sengs and associated documentaon; system monitoring logs or records; system audit records; system security plan; other relevant documents or records].

SI-04(21)-Interview

SI-04(21)-Test

[SELECT FROM: Organizaonal processes for system monitoring; mechanisms supporng and/or implemenng a system monitoring capability].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 621

NIST SP 800-53A, REV. 5

SI-04(22)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

SYSTEM MONITORING | UNAUTHORIZED NETWORK SERVICES ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SI-04(22)_ODP[01]

authorizaon or approval processes for network services are deﬁned;

SI-04(22)_ODP[02]

one or more of the following PARAMETER VALUES is/are selected: {audit; alert <SI-04(22)_ODP[03] personnel or roles>};

SI-04(22)_ODP[03]

personnel or roles to be alerted upon the detecon of network services that have not been authorized or approved by authorizaon or approval processes is/are deﬁned (if selected);

SI-04(22)(a)

network services that have not been authorized or approved by <SI-04(22)_ODP[01] authorizaon or approval processes> are detected;

SI-04(22)(b)

<SI-04(22)_ODP[02] SELECTED PARAMETER VALUE(S)> is/are iniated when network services that have not been authorized or approved by authorizaon or approval processes are detected.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SI-04(23)

SI-04(22)-Examine

[SELECT FROM: System and informaon integrity policy; system and informaon integrity procedures; procedures addressing system monitoring tools and techniques; system design documentaon; system monitoring tools and techniques documentaon; system conﬁguraon sengs and associated documentaon; documented authorizaon/approval of network services; noﬁcaons or alerts of unauthorized network services; system monitoring logs or records; system audit records; system security plan; other relevant documents or records].

SI-04(22)-Interview

SI-04(22)-Test

[SELECT FROM: Organizaonal processes for system monitoring; mechanisms supporng and/or implemenng a system monitoring capability; mechanisms for auding network services; mechanisms for providing alerts].

SYSTEM MONITORING | HOST-BASED DEVICES ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

SI-04(23)_ODP[01]

host-based monitoring mechanisms to be implemented on system components are deﬁned;

SI-04(23)_ODP[02]

system components where host-based monitoring is to be implemented are deﬁned;

SI-04(23)

<SI-04(23)_ODP[01] host-based monitoring mechanisms> are implemented on <SI-04(23)_ODP[02] system components>.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 622

NIST SP 800-53A, REV. 5

SI-04(23)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

SYSTEM MONITORING | HOST-BASED DEVICES POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SI-04(24)

SI-04(23)-Examine

[SELECT FROM: System and informaon integrity policy; system and informaon integrity procedures; procedures addressing system monitoring tools and techniques; system design documentaon; host-based monitoring mechanisms; system monitoring tools and techniques documentaon; system conﬁguraon sengs and associated documentaon; list of system components requiring hostbased monitoring; system monitoring logs or records; system audit records; system security plan; other relevant documents or records].

SI-04(23)-Interview

SI-04(23)-Test

[SELECT FROM: Organizaonal processes for system monitoring; mechanisms supporng and/or implemenng a host-based monitoring capability].

SYSTEM MONITORING | INDICATORS OF COMPROMISE ASSESSMENT OBJECTIVE: Determine if:

SI-04(24)_ODP[01]

sources that provide indicators of compromise are deﬁned;

SI-04(24)_ODP[02]

personnel or roles to whom indicators of compromise are to be distributed is/are deﬁned;

SI-04(24)[01]

indicators of compromise provided by <SI-04(24)_ODP[01] sources> are discovered;

SI-04(24)[02]

indicators of compromise provided by <SI-04(24)_ODP[01] sources> are collected;

SI-04(24)[03]

indicators of compromise provided by <SI-04(24)_ODP[01] sources> are distributed to <SI-04(24)_ODP[02] personnel or roles>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

SI-04(24)-Examine

[SELECT FROM: System and informaon integrity policy; system and informaon integrity procedures; procedures addressing system monitoring; system design documentaon; system monitoring tools and techniques documentaon; system conﬁguraon sengs and associated documentaon; system monitoring logs or records; system audit records; system security plan; other relevant documents or records].

SI-04(24)-Interview

SI-04(24)-Test

[SELECT FROM: Organizaonal processes for system monitoring; organizaonal processes for the discovery, collecon, distribuon, and use of indicators of compromise; mechanisms supporng and/or implemenng a system monitoring capability; mechanisms supporng and/or implemenng the discovery, collecon, distribuon, and use of indicators of compromise].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 623

NIST SP 800-53A, REV. 5

SI-04(25)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

SYSTEM MONITORING | OPTIMIZE NETWORK TRAFFIC ANALYSIS ASSESSMENT OBJECTIVE: Determine if:

SI-04(25)[01]

visibility into network traﬃc at external system interfaces is provided to opmize the eﬀecveness of monitoring devices;

SI-04(25)[02]

visibility into network traﬃc at key internal system interfaces is provided to opmize the eﬀecveness of monitoring devices.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SI-05

SI-04(25)-Examine

[SELECT FROM: System and informaon integrity policy; system and informaon integrity procedures; procedures addressing system monitoring; system design documentaon; system monitoring tools and techniques documentaon; system conﬁguraon sengs and associated documentaon; system monitoring logs or records; system architecture; system audit records; network traﬃc reports; system security plan; other relevant documents or records].

SI-04(25)-Interview

SI-04(25)-Test

SECURITY ALERTS, ADVISORIES, AND DIRECTIVES ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

SI-05_ODP[01]

external organizaons from whom system security alerts, advisories, and direcves are to be received on an ongoing basis are deﬁned;

SI-05_ODP[02]

one or more of the following PARAMETER VALUES is/are selected: {<SI-05_ODP[03] personnel or roles>; <SI-05_ODP[04] elements>; <SI-05_ODP[05] external organizaons>};

SI-05_ODP[03]

personnel or roles to whom security alerts, advisories, and direcves are to be disseminated is/are deﬁned (if selected);

SI-05_ODP[04]

elements within the organizaon to whom security alerts, advisories, and direcves are to be disseminated are deﬁned (if selected);

SI-05_ODP[05]

external organizaons to whom security alerts, advisories, and direcves are to be disseminated are deﬁned (if selected);

SI-05a.

system security alerts, advisories, and direcves are received from <SI-05_ODP[01] external organizaons> on an ongoing basis;

SI-05b.

internal security alerts, advisories, and direcves are generated as deemed necessary;

SI-05c.

security alerts, advisories, and direcves are disseminated to <SI-05_ODP[02] SELECTED PARAMETER VALUE(S)>;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 624

NIST SP 800-53A, REV. 5

SI-05

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

SECURITY ALERTS, ADVISORIES, AND DIRECTIVES SI-05d.

security direcves are implemented in accordance with established me frames or if the issuing organizaon is noﬁed of the degree of noncompliance.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SI-05(01)

SI-05-Examine

[SELECT FROM: System and informaon integrity policy; system and informaon integrity procedures; procedures addressing security alerts, advisories, and direcves; records of security alerts and advisories; system security plan; other relevant documents or records].

SI-05-Interview

[SELECT FROM: Organizaonal personnel with security alert and advisory responsibilies; organizaonal personnel implemenng, operang, maintaining, and using the system; organizaonal personnel, organizaonal elements, and/ or external organizaons to whom alerts, advisories, and direcves are to be disseminated; system/network administrators; organizaonal personnel with informaon security responsibilies].

SI-05-Test

[SELECT FROM: Organizaonal processes for deﬁning, receiving, generang, disseminang, and complying with security alerts, advisories, and direcves; mechanisms supporng and/or implemenng the deﬁnion, receipt, generaon, and disseminaon of security alerts, advisories, and direcves; mechanisms supporng and/or implemenng security direcves].

SECURITY ALERTS, ADVISORIES, AND DIRECTIVES | AUTOMATED ALERTS AND ADVISORIES ASSESSMENT OBJECTIVE: Determine if:

SI-05(01)_ODP

automated mechanisms used to broadcast security alert and advisory informaon throughout the organizaon are deﬁned;

SI-05(01)

<SI-05(01)_ODP automated mechanisms> are used to broadcast security alert and advisory informaon throughout the organizaon.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

SI-05(01)-Examine

[SELECT FROM: System and informaon integrity policy; system and informaon integrity procedures; procedures addressing security alerts, advisories, and direcves; system design documentaon; system conﬁguraon sengs and associated documentaon; automated mechanisms supporng the distribuon of security alert and advisory informaon; records of security alerts and advisories; system audit records; system security plan; other relevant documents or records].

SI-05(01)-Interview

[SELECT FROM: Organizaonal personnel with security alert and advisory responsibilies; organizaonal personnel implemenng, operang, maintaining, and using the system; organizaonal personnel, organizaonal elements, and/ or external organizaons to whom alerts and advisories are to be disseminated; system/network administrators; organizaonal personnel with informaon security responsibilies].

SI-05(01)-Test

[SELECT FROM: Organizaonal processes for deﬁning, receiving, generang, and disseminang security alerts and advisories; automated mechanisms supporng and/or implemenng the disseminaon of security alerts and advisories].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 625

NIST SP 800-53A, REV. 5

SI-06

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

SECURITY AND PRIVACY FUNCTION VERIFICATION ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SI-06_ODP[01]

security funcons to be veriﬁed for correct operaon are deﬁned;

SI-06_ODP[02]

privacy funcons to be veriﬁed for correct operaon are deﬁned;

SI-06_ODP[03]

one or more of the following PARAMETER VALUES is/are selected: {<SI-06_ODP[04] system transional states>; upon command by user with appropriate privilege; <SI-06_ODP[05] frequency>};

SI-06_ODP[04]

system transional states requiring the veriﬁcaon of security and privacy funcons are deﬁned; (if selected)

SI-06_ODP[05]

frequency at which to verify the correct operaon of security and privacy funcons is deﬁned; (if selected)

SI-06_ODP[06]

personnel or roles to be alerted of failed security and privacy veriﬁcaon tests is/ are deﬁned;

SI-06_ODP[07]

one or more of the following PARAMETER VALUES is/are selected: {shut the system down; restart the system; <SI-06_ODP[08] alternave acon(s)>};

SI-06_ODP[08]

alternave acon(s) to be performed when anomalies are discovered are deﬁned (if selected);

SI-06a.[01]

<SI-06_ODP[01] security funcons> are veriﬁed to be operang correctly;

SI-06a.[02]

<SI-06_ODP[02] privacy funcons> are veriﬁed to be operang correctly;

SI-06b.[01]

<SI-06_ODP[01] security funcons> are veriﬁed <SI-06_ODP[03] SELECTED PARAMETER VALUE(S)>;

SI-06b.[02]

<SI-06_ODP[02] privacy funcons> are veriﬁed <SI-06_ODP[03] SELECTED PARAMETER VALUE(S)>;

SI-06c.[01]

<SI-06_ODP[06] personnel or roles> is/are alerted to failed security veriﬁcaon tests;

SI-06c.[02]

<SI-06_ODP[06] personnel or roles> is/are alerted to failed privacy veriﬁcaon tests;

SI-06d.

<SI-06_ODP[07] SELECTED PARAMETER VALUE(S)> is/are iniated when anomalies are discovered.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

SI-06-Examine

[SELECT FROM: System and informaon integrity policy; system and informaon integrity procedures; procedures addressing security and privacy funcon veriﬁcaon; system design documentaon; system conﬁguraon sengs and associated documentaon; alerts/noﬁcaons of failed security veriﬁcaon tests; list of system transion states requiring security funconality veriﬁcaon; system audit records; system security plan; privacy plan; other relevant documents or records].

SI-06-Interview

[SELECT FROM: Organizaonal personnel with security and privacy funcon veriﬁcaon responsibilies; organizaonal personnel implemenng, operang, and maintaining the system; system/network administrators; organizaonal personnel with informaon security and privacy responsibilies; system developer].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 626

NIST SP 800-53A, REV. 5

SI-06

SECURITY AND PRIVACY FUNCTION VERIFICATION SI-06-Test

SI-06(01)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

[SELECT FROM: Organizaonal processes for security and privacy funcon veriﬁcaon; mechanisms supporng and/or implemenng the security and privacy funcon veriﬁcaon capability].

SECURITY AND PRIVACY FUNCTION VERIFICATION | NOTIFICATION OF FAILED SECURITY TESTS [WITHDRAWN: Incorporated into SI-06.]

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SI-06(02)

SECURITY AND PRIVACY FUNCTION VERIFICATION | AUTOMATION SUPPORT FOR DISTRIBUTED TESTING ASSESSMENT OBJECTIVE: Determine if:

SI-06(02)[01]

automated mechanisms are implemented to support the management of distributed security funcon tesng;

SI-06(02)[02]

automated mechanisms are implemented to support the management of distributed privacy funcon tesng.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SI-06(03)

SI-06(02)-Examine

[SELECT FROM: System and informaon integrity policy; system and informaon integrity procedures; procedures addressing security and privacy funcon veriﬁcaon; system design documentaon; system conﬁguraon sengs and associated documentaon; system audit records; system security plan; privacy plan; other relevant documents or records].

SI-06(02)-Interview

SI-06(02)-Test

[SELECT FROM: Organizaonal processes for security and privacy funcon veriﬁcaon; automated mechanisms supporng and/or implemenng the management of distributed security and privacy tesng].

SECURITY AND PRIVACY FUNCTION VERIFICATION | REPORT VERIFICATION RESULTS ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

SI-06(03)_ODP

personnel or roles designated to receive the results of security and privacy funcon veriﬁcaon is/are deﬁned;

SI-06(03)[01]

the results of security funcon veriﬁcaon are reported to <SI-06(03)_ODP personnel or roles>;

SI-06(03)[02]

the results of privacy funcon veriﬁcaon are reported to <SI-06(03)_ODP personnel or roles>.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 627

NIST SP 800-53A, REV. 5

SI-06(03)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

SECURITY AND PRIVACY FUNCTION VERIFICATION | REPORT VERIFICATION RESULTS POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SI-07

SI-06(03)-Examine

[SELECT FROM: System and informaon integrity policy; system and informaon integrity procedures; procedures addressing security and privacy funcon veriﬁcaon; system design documentaon; system conﬁguraon sengs and associated documentaon; reports of security and privacy funcon veriﬁcaon results; system audit records; system security plan; privacy plan; other relevant documents or records].

SI-06(03)-Interview

[SELECT FROM: Organizaonal personnel with security and privacy funcon veriﬁcaon responsibilies; organizaonal personnel who are recipients of security and privacy funcon veriﬁcaon reports; organizaonal personnel with informaon security and privacy responsibilies].

SI-06(03)-Test

[SELECT FROM: Organizaonal processes for reporng security and privacy funcon veriﬁcaon results; mechanisms supporng and/or implemenng the reporng of security and privacy funcon veriﬁcaon results].

SOFTWARE, FIRMWARE, AND INFORMATION INTEGRITY ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

SI-07_ODP[01]

soware requiring integrity veriﬁcaon tools to be employed to detect unauthorized changes is deﬁned;

SI-07_ODP[02]

ﬁrmware requiring integrity veriﬁcaon tools to be employed to detect unauthorized changes is deﬁned;

SI-07_ODP[03]

informaon requiring integrity veriﬁcaon tools to be employed to detect unauthorized changes is deﬁned;

SI-07_ODP[04]

acons to be taken when unauthorized changes to soware are detected are deﬁned;

SI-07_ODP[05]

acons to be taken when unauthorized changes to ﬁrmware are detected are deﬁned;

SI-07_ODP[06]

acons to be taken when unauthorized changes to informaon are detected are deﬁned;

SI-07a.[01]

integrity veriﬁcaon tools are employed to detect unauthorized changes to <SI-07_ODP[01] soware>;

SI-07a.[02]

integrity veriﬁcaon tools are employed to detect unauthorized changes to <SI-07_ODP[02] ﬁrmware>;

SI-07a.[03]

integrity veriﬁcaon tools are employed to detect unauthorized changes to <SI-07_ODP[03] informaon>;

SI-07b.[01]

<SI-07_ODP[04] acons> are taken when unauthorized changes to the soware, are detected;

SI-07b.[02]

<SI-07_ODP[05] acons> are taken when unauthorized changes to the ﬁrmware are detected;

SI-07b.[03]

<SI-07_ODP[06] acons> are taken when unauthorized changes to the informaon are detected.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 628

NIST SP 800-53A, REV. 5

SI-07

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

SOFTWARE, FIRMWARE, AND INFORMATION INTEGRITY POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SI-07(01)

SI-07-Examine

[SELECT FROM: System and informaon integrity policy; system and informaon integrity procedures; procedures addressing soware, ﬁrmware, and informaon integrity; personally idenﬁable informaon processing policy; system design documentaon; system conﬁguraon sengs and associated documentaon; integrity veriﬁcaon tools and associated documentaon; records generated or triggered by integrity veriﬁcaon tools regarding unauthorized soware, ﬁrmware, and informaon changes; system audit records; system security plan; privacy plan; other relevant documents or records].

SI-07-Interview

[SELECT FROM: Organizaonal personnel responsible for soware, ﬁrmware, and/ or informaon integrity; organizaonal personnel with informaon security and privacy responsibilies; system/network administrators].

SI-07-Test

[SELECT FROM: Soware, ﬁrmware, and informaon integrity veriﬁcaon tools].

SOFTWARE, FIRMWARE, AND INFORMATION INTEGRITY | INTEGRITY CHECKS ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

SI-07(01)_ODP[01]

soware on which an integrity check is to be performed is deﬁned;

SI-07(01)_ODP[02]

one or more of the following PARAMETER VALUES is/are selected: {at startup; at <SI-07(01)_ODP[03] transional states or security-relevant events>; <SI-07(01)_ODP[04] frequency>};

SI-07(01)_ODP[03]

transional states or security-relevant events requiring integrity checks (on soware) are deﬁned (if selected);

SI-07(01)_ODP[04]

frequency with which to perform an integrity check (on soware) is deﬁned (if selected);

SI-07(01)_ODP[05]

ﬁrmware on which an integrity check is to be performed is deﬁned;

SI-07(01)_ODP[06]

one or more of the following PARAMETER VALUES is/are selected: {at startup; at <SI-07(01)_ODP[07] transional states or security-relevant events>; <SI-07(01)_ODP[08] frequency>};

SI-07(01)_ODP[07]

transional states or security-relevant events requiring integrity checks (on ﬁrmware) are deﬁned (if selected);

SI-07(01)_ODP[08]

frequency with which to perform an integrity check (on ﬁrmware) is deﬁned (if selected);

SI-07(01)_ODP[09]

informaon on which an integrity check is to be performed is deﬁned;

SI-07(01)_ODP[10]

one or more of the following PARAMETER VALUES is/are selected: {at startup; at <SI-07(01)_ODP[11] transional states or security-relevant events>; <SI-07(01)_ODP[12] frequency>};

SI-07(01)_ODP[11]

transional states or security-relevant events requiring integrity checks (of informaon) are deﬁned (if selected);

SI-07(01)_ODP[12]

frequency with which to perform an integrity check (of informaon) is deﬁned (if selected);

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 629

NIST SP 800-53A, REV. 5

SI-07(01)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

SOFTWARE, FIRMWARE, AND INFORMATION INTEGRITY | INTEGRITY CHECKS SI-07(01)[01]

an integrity check of <SI-07(01)_ODP[01] soware> is performed <SI-07(01)_ODP[02] SELECTED PARAMETER VALUE(S)>;

SI-07(01)[02]

an integrity check of <SI-07(01)_ODP[05] ﬁrmware> is performed <SI-07(01)_ODP[06] SELECTED PARAMETER VALUE(S)>;

SI-07(01)[03]

an integrity check of <SI-07(01)_ODP[09] informaon> is performed <SI-07(01)_ODP[10] SELECTED PARAMETER VALUE(S)>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SI-07(02)

SI-07(01)-Examine

[SELECT FROM: System and informaon integrity policy; system and informaon integrity procedures; procedures addressing soware, ﬁrmware, and informaon integrity tesng; system design documentaon; system conﬁguraon sengs and associated documentaon; integrity veriﬁcaon tools and associated documentaon; records of integrity scans; system security plan; other relevant documents or records].

SI-07(01)-Interview

[SELECT FROM: Organizaonal personnel responsible for soware, ﬁrmware, and/or informaon integrity; organizaonal personnel with informaon security responsibilies; system/network administrators; system developer].

SI-07(01)-Test

[SELECT FROM: Soware, ﬁrmware, and informaon integrity veriﬁcaon tools].

SOFTWARE, FIRMWARE, AND INFORMATION INTEGRITY | AUTOMATED NOTIFICATIONS OF INTEGRITY VIOLATIONS ASSESSMENT OBJECTIVE: Determine if:

SI-07(02)_ODP

personnel or roles to whom noﬁcaon is to be provided upon discovering discrepancies during integrity veriﬁcaon is/are deﬁned;

SI-07(02)

automated tools that provide noﬁcaon to <SI-07(02)_ODP personnel or roles> upon discovering discrepancies during integrity veriﬁcaon are employed.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

SI-07(02)-Examine

[SELECT FROM: System and informaon integrity policy; system and informaon integrity procedures; procedures addressing soware, ﬁrmware, and informaon integrity; personally idenﬁable informaon processing policy; system design documentaon; system conﬁguraon sengs and associated documentaon; integrity veriﬁcaon tools and associated documentaon; records of integrity scans; automated tools supporng alerts and noﬁcaons for integrity discrepancies; noﬁcaons provided upon discovering discrepancies during integrity veriﬁcaons; system audit records; system security plan; privacy plan; other relevant documents or records].

SI-07(02)-Interview

SI-07(02)-Test

[SELECT FROM: Soware, ﬁrmware, and informaon integrity veriﬁcaon tools; mechanisms providing integrity discrepancy noﬁcaons].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 630

NIST SP 800-53A, REV. 5

SI-07(03)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

SOFTWARE, FIRMWARE, AND INFORMATION INTEGRITY | CENTRALLY MANAGED INTEGRITY TOOLS ASSESSMENT OBJECTIVE: Determine if: SI-07(03)

centrally managed integrity veriﬁcaon tools are employed.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SI-07(04)

SI-07(03)-Examine

SI-07(03)-Interview

[SELECT FROM: Organizaonal personnel responsible for the central management of integrity veriﬁcaon tools; organizaonal personnel with informaon security responsibilies].

SI-07(03)-Test

[SELECT FROM: Mechanisms supporng and/or implemenng the central management of integrity veriﬁcaon tools].

SOFTWARE, FIRMWARE, AND INFORMATION INTEGRITY | TAMPER-EVIDENT PACKAGING [WITHDRAWN: Incorporated into SR-09.]

SI-07(05)

SOFTWARE, FIRMWARE, AND INFORMATION INTEGRITY | AUTOMATED RESPONSE TO INTEGRITY VIOLATIONS ASSESSMENT OBJECTIVE: Determine if:

SI-07(05)_ODP[01]

one or more of the following PARAMETER VALUES is/are selected: {shut down the system; restart the system; implement <SI-07(05)_ODP[02] controls>};

SI-07(05)_ODP[02]

controls to be implemented automacally when integrity violaons are discovered are deﬁned (if selected);

SI-07(05)

<SI-07(05)_ODP[01] SELECTED PARAMETER VALUE(S)> are automacally performed when integrity violaons are discovered.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

SI-07(05)-Examine

[SELECT FROM: System and informaon integrity policy; system and informaon integrity procedures; procedures addressing soware, ﬁrmware, and informaon integrity; system design documentaon; system conﬁguraon sengs and associated documentaon; integrity veriﬁcaon tools and associated documentaon; records of integrity scans; records of integrity checks and responses to integrity violaons; audit records; system security plan; other relevant documents or records].

SI-07(05)-Interview

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 631

NIST SP 800-53A, REV. 5

SI-07(05)

SOFTWARE, FIRMWARE, AND INFORMATION INTEGRITY | AUTOMATED RESPONSE TO INTEGRITY VIOLATIONS SI-07(05)-Test

SI-07(06)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

[SELECT FROM: Soware, ﬁrmware, and informaon integrity veriﬁcaon tools; mechanisms providing an automated response to integrity violaons; mechanisms supporng and/or implemenng security safeguards to be implemented when integrity violaons are discovered].

SOFTWARE, FIRMWARE, AND INFORMATION INTEGRITY | CRYPTOGRAPHIC PROTECTION

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

ASSESSMENT OBJECTIVE: Determine if:

SI-07(06)[01]

cryptographic mechanisms are implemented to detect unauthorized changes to soware;

SI-07(06)[02]

cryptographic mechanisms are implemented to detect unauthorized changes to ﬁrmware;

SI-07(06)[03]

cryptographic mechanisms are implemented to detect unauthorized changes to informaon.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SI-07(07)

SI-07(06)-Examine

[SELECT FROM: System and informaon integrity policy; system and informaon integrity procedures; procedures addressing soware, ﬁrmware, and informaon integrity; system design documentaon; system conﬁguraon sengs and associated documentaon; cryptographic mechanisms and associated documentaon; records of detected unauthorized changes to soware, ﬁrmware, and informaon; system audit records; system security plan; other relevant documents or records].

SI-07(06)-Interview

SI-07(06)-Test

[SELECT FROM: Soware, ﬁrmware, and informaon integrity veriﬁcaon tools; cryptographic mechanisms implemenng soware, ﬁrmware, and informaon integrity].

SOFTWARE, FIRMWARE, AND INFORMATION INTEGRITY | INTEGRATION OF DETECTION AND RESPONSE ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

SI-07(07)_ODP

security-relevant changes to the system are deﬁned;

SI-07(07)

the detecon of <SI-07(07)_ODP changes> are incorporated into the organizaonal incident response capability.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 632

NIST SP 800-53A, REV. 5

SI-07(07)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

SOFTWARE, FIRMWARE, AND INFORMATION INTEGRITY | INTEGRATION OF DETECTION AND RESPONSE POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SI-07(08)

SI-07(07)-Examine

[SELECT FROM: System and informaon integrity policy; system and informaon integrity procedures; procedures addressing soware, ﬁrmware, and informaon integrity; procedures addressing incident response; system design documentaon; system conﬁguraon sengs and associated documentaon; incident response records; audit records; system security plan; other relevant documents or records].

SI-07(07)-Interview

SI-07(07)-Test

[SELECT FROM: Organizaonal processes for incorporang the detecon of unauthorized security-relevant changes into the incident response capability; soware, ﬁrmware, and informaon integrity veriﬁcaon tools; mechanisms supporng and/or implemenng the incorporaon of detecon of unauthorized security-relevant changes into the incident response capability].

SOFTWARE, FIRMWARE, AND INFORMATION INTEGRITY | AUDITING CAPABILITY FOR SIGNIFICANT EVENTS ASSESSMENT OBJECTIVE: Determine if:

SI-07(08)_ODP[01]

one or more of the following PARAMETER VALUES is/are selected: {generate an audit record; alert current user; alert <SI-07(08)_ODP[02] personnel or roles>; <SI-07(08)_ODP[03] other acons>};

SI-07(08)_ODP[02]

personnel or roles to be alerted upon the detecon of a potenal integrity violaon is/are deﬁned (if selected);

SI-07(08)_ODP[03]

other acons to be taken upon the detecon of a potenal integrity violaon are deﬁned (if selected);

SI-07(08)[01]

the capability to audit an event upon the detecon of a potenal integrity violaon is provided;

SI-07(08)[02]

<SI-07(08)_ODP[01] SELECTED PARAMETER VALUE(S)> is/are iniated upon the detecon of a potenal integrity violaon.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

SI-07(08)-Examine

[SELECT FROM: System and informaon integrity policy; system and informaon integrity procedures; procedures addressing soware, ﬁrmware, and informaon integrity; system design documentaon; system conﬁguraon sengs and associated documentaon; integrity veriﬁcaon tools and associated documentaon; records of integrity scans; incident response records; list of security-relevant changes to the system; automated tools supporng alerts and noﬁcaons if unauthorized security changes are detected; system audit records; system security plan; other relevant documents or records].

SI-07(08)-Interview

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 633

NIST SP 800-53A, REV. 5

SI-07(08)

SOFTWARE, FIRMWARE, AND INFORMATION INTEGRITY | AUDITING CAPABILITY FOR SIGNIFICANT EVENTS SI-07(08)-Test

SI-07(09)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

[SELECT FROM: Soware, ﬁrmware, and informaon integrity veriﬁcaon tools; mechanisms supporng and/or implemenng the capability to audit potenal integrity violaons; mechanisms supporng and/or implemenng alerts about potenal integrity violaons].

SOFTWARE, FIRMWARE, AND INFORMATION INTEGRITY | VERIFY BOOT PROCESS

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

ASSESSMENT OBJECTIVE: Determine if:

SI-07(09)_ODP

system components requiring integrity veriﬁcaon of the boot process are deﬁned;

SI-07(09)

the integrity of the boot process of <SI-07(09)_ODP system components> is veriﬁed.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SI-07(10)

SI-07(09)-Examine

[SELECT FROM: System and informaon integrity policy; system and informaon integrity procedures; procedures addressing soware, ﬁrmware, and informaon integrity; system design documentaon; system conﬁguraon sengs and associated documentaon; integrity veriﬁcaon tools and associated documentaon; documentaon; records of integrity veriﬁcaon scans; system audit records; system security plan; other relevant documents or records].

SI-07(09)-Interview

[SELECT FROM: Organizaonal personnel responsible for soware, ﬁrmware, and/or informaon integrity; organizaonal personnel with informaon security responsibilies; system developer].

SI-07(09)-Test

[SELECT FROM: Soware, ﬁrmware, and informaon integrity veriﬁcaon tools; mechanisms supporng and/or implemenng integrity veriﬁcaon of the boot process].

SOFTWARE, FIRMWARE, AND INFORMATION INTEGRITY | PROTECTION OF BOOT FIRMWARE ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

SI-07(10)_ODP[01]

mechanisms to be implemented to protect the integrity of boot ﬁrmware in system components are deﬁned;

SI-07(10)_ODP[02]

system components requiring mechanisms to protect the integrity of boot ﬁrmware are deﬁned;

SI-07(10)

<SI-07(10)_ODP[01] mechanisms> are implemented to protect the integrity of boot ﬁrmware in <SI-07(10)_ODP[02] system components>.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 634

NIST SP 800-53A, REV. 5

SI-07(10)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

SOFTWARE, FIRMWARE, AND INFORMATION INTEGRITY | PROTECTION OF BOOT FIRMWARE POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SI-07(11)

SI-07(10)-Examine

[SELECT FROM: System and informaon integrity policy; system and informaon integrity procedures; procedures addressing soware, ﬁrmware, and informaon integrity; system design documentaon; system conﬁguraon sengs and associated documentaon; integrity veriﬁcaon tools and associated documentaon; records of integrity veriﬁcaon scans; system audit records; system security plan; other relevant documents or records].

SI-07(10)-Interview

SI-07(10)-Test

[SELECT FROM: Soware, ﬁrmware, and informaon integrity veriﬁcaon tools; mechanisms supporng and/or implemenng protecon of the integrity of boot ﬁrmware; safeguards implemenng protecon of the integrity of boot ﬁrmware].

SOFTWARE, FIRMWARE, AND INFORMATION INTEGRITY | CONFINED ENVIRONMENTS WITH LIMITED PRIVILEGES [WITHDRAWN: Moved to CM-07(06).]

SI-07(12)

SOFTWARE, FIRMWARE, AND INFORMATION INTEGRITY | INTEGRITY VERIFICATION ASSESSMENT OBJECTIVE: Determine if:

SI-07(12)_ODP

user-installed soware requiring integrity veriﬁcaon prior to execuon is deﬁned;

SI-07(12)

the integrity of <SI-07(12)_ODP user-installed soware> is veriﬁed prior to execuon.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

SI-07(12)-Examine

SI-07(12)-Interview

[SELECT FROM: Organizaonal personnel responsible for soware, ﬁrmware, and/or informaon integrity; organizaonal personnel with informaon security responsibilies].

SI-07(12)-Test

[SELECT FROM: Soware, ﬁrmware, and informaon integrity veriﬁcaon tools; mechanisms supporng and/or implemenng veriﬁcaon of the integrity of userinstalled soware prior to execuon].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 635

NIST SP 800-53A, REV. 5

SI-07(13)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

SOFTWARE, FIRMWARE, AND INFORMATION INTEGRITY | CODE EXECUTION IN PROTECTED ENVIRONMENTS [WITHDRAWN: Moved to CM-07(07).]

SI-07(14)

SOFTWARE, FIRMWARE, AND INFORMATION INTEGRITY | BINARY OR MACHINE EXECUTABLE CODE [WITHDRAWN: Moved to CM-07(08).]

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SI-07(15)

SOFTWARE, FIRMWARE, AND INFORMATION INTEGRITY | CODE AUTHENTICATION ASSESSMENT OBJECTIVE: Determine if:

SI-07(15)_ODP

soware or ﬁrmware components to be authencated by cryptographic mechanisms prior to installaon are deﬁned;

SI-07(15)

cryptographic mechanisms are implemented to authencate <SI-07(15)_ODP soware or ﬁrmware components> prior to installaon.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SI-07(16)

SI-07(15)-Examine

SI-07(15)-Interview

SI-07(15)-Test

[SELECT FROM: Cryptographic mechanisms authencang soware and ﬁrmware prior to installaon].

SOFTWARE, FIRMWARE, AND INFORMATION INTEGRITY | TIME LIMIT ON PROCESS EXECUTION WITHOUT SUPERVISION ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

SI-07(16)_ODP

the maximum me period permied for processes to execute without supervision is deﬁned;

SI-07(16)

processes are prohibited from execung without supervision for more than <SI-07(16)_ODP me period>.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 636

NIST SP 800-53A, REV. 5

SI-07(16)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

SOFTWARE, FIRMWARE, AND INFORMATION INTEGRITY | TIME LIMIT ON PROCESS EXECUTION WITHOUT SUPERVISION POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SI-07(17)

SI-07(16)-Examine

[SELECT FROM: System and informaon integrity policy; system and informaon integrity procedures; procedures addressing soware and informaon integrity; system design documentaon; system conﬁguraon sengs and associated documentaon; system audit records; system security plan; other relevant documents or records].

SI-07(16)-Interview

SI-07(16)-Test

[SELECT FROM: Soware, ﬁrmware, and informaon integrity veriﬁcaon tools; mechanisms supporng and/or implemenng me limits on process execuon without supervision].

SOFTWARE, FIRMWARE, AND INFORMATION INTEGRITY | RUNTIME APPLICATION SELFPROTECTION ASSESSMENT OBJECTIVE: Determine if:

SI-07(17)_ODP

controls to be implemented for applicaon self-protecon at runme are deﬁned;

SI-07(17)

<SI-07(17)_ODP controls> are implemented for applicaon self-protecon at runme.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SI-08

SI-07(17)-Examine

[SELECT FROM: System and informaon integrity policy; system and informaon integrity procedures; procedures addressing soware and informaon integrity; system design documentaon; system conﬁguraon sengs and associated documentaon; list of known vulnerabilies addressed by runme instrumentaon; system security plan; other relevant documents or records].

SI-07(17)-Interview

SI-07(17)-Test

[SELECT FROM: Soware, ﬁrmware, and informaon integrity veriﬁcaon tools; mechanisms supporng and/or implemenng runme applicaon self-protecon].

SPAM PROTECTION ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

SI-08a.[01]

spam protecon mechanisms are employed at system entry points to detect unsolicited messages;

SI-08a.[02]

spam protecon mechanisms are employed at system exit points to detect unsolicited messages;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 637

NIST SP 800-53A, REV. 5

SI-08

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

SPAM PROTECTION SI-08a.[03]

spam protecon mechanisms are employed at system entry points to act on unsolicited messages;

SI-08a.[04]

spam protecon mechanisms are employed at system exit points to act on unsolicited messages;

SI-08b.

spam protecon mechanisms are updated when new releases are available in accordance with organizaonal conﬁguraon management policies and procedures.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SI-08(01)

SI-08-Examine

[SELECT FROM: System and informaon integrity policy; system and informaon integrity procedures; conﬁguraon management policies and procedures (CM-01); procedures addressing spam protecon; spam protecon mechanisms; records of spam protecon updates; system design documentaon; system conﬁguraon sengs and associated documentaon; system audit records; system security plan; other relevant documents or records].

SI-08-Interview

[SELECT FROM: Organizaonal personnel responsible for spam protecon; organizaonal personnel with informaon security responsibilies; system/network administrators; system developer].

SI-08-Test

[SELECT FROM: Organizaonal processes for implemenng spam protecon; mechanisms supporng and/or implemenng spam protecon].

SPAM PROTECTION | CENTRAL MANAGEMENT [WITHDRAWN: Incorporated into PL-09.]

SI-08(02)

SPAM PROTECTION | AUTOMATIC UPDATES ASSESSMENT OBJECTIVE: Determine if:

SI-08(02)_ODP

the frequency at which to automacally update spam protecon mechanisms is deﬁned;

SI-08(02)

spam protecon mechanisms are automacally updated <SI-08(02)_ODP frequency>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

SI-08(02)-Examine

[SELECT FROM: System and informaon integrity policy; system and informaon integrity procedures; procedures addressing spam protecon; spam protecon mechanisms; records of spam protecon updates; system design documentaon; system conﬁguraon sengs and associated documentaon; system audit records; system security plan; other relevant documents or records].

SI-08(02)-Interview

[SELECT FROM: Organizaonal personnel responsible for spam protecon; organizaonal personnel with informaon security responsibilies; system/network administrators; system developer].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 638

NIST SP 800-53A, REV. 5

SI-08(02)

SPAM PROTECTION | AUTOMATIC UPDATES SI-08(02)-Test

SI-08(03)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

[SELECT FROM: Organizaonal processes for spam protecon; mechanisms supporng and/or implemenng automac updates to spam protecon mechanisms].

SPAM PROTECTION | CONTINUOUS LEARNING CAPABILITY ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SI-08(03)

spam protecon mechanisms with a learning capability are implemented to more eﬀecvely idenfy legimate communicaons traﬃc.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SI-09

SI-08(03)-Examine

[SELECT FROM: System and informaon integrity policy; system and informaon integrity procedures; procedures addressing spam protecon; spam protecon mechanisms; system design documentaon; system conﬁguraon sengs and associated documentaon; system audit records; system security plan; other relevant documents or records].

SI-08(03)-Interview

[SELECT FROM: Organizaonal personnel responsible for spam protecon; organizaonal personnel with informaon security responsibilies; system/network administrators; system developer].

SI-08(03)-Test

[SELECT FROM: Organizaonal processes for spam protecon; mechanisms supporng and/or implemenng spam protecon mechanisms with a learning capability].

INFORMATION INPUT RESTRICTIONS [WITHDRAWN: Incorporated into AC-02, AC-03, AC-05, AC-06.]

SI-10

INFORMATION INPUT VALIDATION ASSESSMENT OBJECTIVE: Determine if: SI-10_ODP

informaon inputs to the system requiring validity checks are deﬁned;

SI-10

the validity of the <SI-10_ODP informaon inputs> is checked.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: SI-10-Examine

CHAPTER FOUR

[SELECT FROM: System and informaon integrity policy; system and informaon integrity procedures; access control policy and procedures; separaon of dues policy and procedures; procedures addressing informaon input validaon; documentaon for automated tools and applicaons to verify the validity of informaon; list of informaon inputs requiring validity checks; system design documentaon; system conﬁguraon sengs and associated documentaon; system audit records; system security plan; other relevant documents or records].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 639

NIST SP 800-53A, REV. 5

SI-10

SI-10(01)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

INFORMATION INPUT VALIDATION SI-10-Interview

[SELECT FROM: Organizaonal personnel responsible for informaon input validaon; organizaonal personnel with informaon security responsibilies; system/network administrators; system developer].

SI-10-Test

[SELECT FROM: Mechanisms supporng and/or implemenng validity checks on informaon inputs].

INFORMATION INPUT VALIDATION | MANUAL OVERRIDE CAPABILITY

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

ASSESSMENT OBJECTIVE: Determine if:

SI-10(01)_ODP

authorized individuals who can use the manual override capability are deﬁned;

SI-10(01)(a)

a manual override capability for the validaon of <SI-10_ODP informaon inputs> is provided;

SI-10(01)(b)

the use of the manual override capability is restricted to only <SI-10(01)_ODP authorized individuals>;

SI-10(01)(c)

the use of the manual override capability is audited.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SI-10(02)

SI-10(01)-Examine

[SELECT FROM: System and informaon integrity policy; system and informaon integrity procedures; access control policy and procedures; separaon of dues policy and procedures; procedures addressing informaon input validaon; system design documentaon; system conﬁguraon sengs and associated documentaon; system audit records; system security plan; other relevant documents or records].

SI-10(01)-Interview

SI-10(01)-Test

[SELECT FROM: Organizaonal processes for the use of a manual override capability; mechanisms supporng and/or implemenng a manual override capability for input validaon; mechanisms supporng and/or implemenng auding of the use of a manual override capability].

INFORMATION INPUT VALIDATION | REVIEW AND RESOLVE ERRORS ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

SI-10(02)_ODP[01]

the me period within which input validaon errors are to be reviewed is deﬁned;

SI-10(02)_ODP[02]

the me period within which input validaon errors are to be resolved is deﬁned;

SI-10(02)[01]

input validaon errors are reviewed within <SI-10(02)_ODP[01] me period>;

SI-10(02)[02]

input validaon errors are resolved within <SI-10(02)_ODP[02] me period>.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 640

NIST SP 800-53A, REV. 5

SI-10(02)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

INFORMATION INPUT VALIDATION | REVIEW AND RESOLVE ERRORS POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SI-10(03)

SI-10(02)-Examine

[SELECT FROM: System and informaon integrity policy; system and informaon integrity procedures; procedures addressing informaon input validaon; system design documentaon; system conﬁguraon sengs and associated documentaon; review records of informaon input validaon errors and resulng resoluons; informaon input validaon error logs or records; system audit records; system security plan; other relevant documents or records].

SI-10(02)-Interview

[SELECT FROM: Organizaonal personnel responsible for informaon input validaon; organizaonal personnel with informaon security responsibilies; system/network administrators].

SI-10(02)-Test

[SELECT FROM: Organizaonal processes for the review and resoluon of input validaon errors; mechanisms supporng and/or implemenng the review and resoluon of input validaon errors].

INFORMATION INPUT VALIDATION | PREDICTABLE BEHAVIOR ASSESSMENT OBJECTIVE: Determine if:

SI-10(03)[01]

the system behaves in a predictable manner when invalid inputs are received;

SI-10(03)[02]

the system behaves in a documented manner when invalid inputs are received.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SI-10(04)

SI-10(03)-Examine

[SELECT FROM: System and informaon integrity policy; system and informaon integrity procedures; procedures addressing informaon input validaon; system design documentaon; system conﬁguraon sengs and associated documentaon; system audit records; system security plan; other relevant documents or records].

SI-10(03)-Interview

SI-10(03)-Test

[SELECT FROM: Automated mechanisms supporng and/or implemenng predictable behavior when invalid inputs are received].

INFORMATION INPUT VALIDATION | TIMING INTERACTIONS ASSESSMENT OBJECTIVE: Determine if: SI-10(04)

CHAPTER FOUR

ming interacons among system components are accounted for in determining appropriate responses for invalid inputs.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 641

NIST SP 800-53A, REV. 5

SI-10(04)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

INFORMATION INPUT VALIDATION | TIMING INTERACTIONS POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SI-10(05)

SI-10(04)-Examine

[SELECT FROM: System and informaon integrity policy; system and informaon integrity procedures; procedures addressing informaon input validaon; system design documentaon; system conﬁguraon sengs and associated documentaon; system audit records; system security plan; other relevant documents or records].

SI-10(04)-Interview

SI-10(04)-Test

[SELECT FROM: Organizaonal processes for determining appropriate responses to invalid inputs; automated mechanisms supporng and/or implemenng responses to invalid inputs].

INFORMATION INPUT VALIDATION | RESTRICT INPUTS TO TRUSTED SOURCES AND APPROVED FORMATS ASSESSMENT OBJECTIVE: Determine if:

SI-10(05)_ODP[01]

trusted sources to which the use of informaon inputs is to be restricted are deﬁned;

SI-10(05)_ODP[02]

formats to which the use of informaon inputs is to be restricted are deﬁned;

SI-10(05)

the use of informaon inputs is restricted to <SI-10(05)_ODP[01] trusted sources> and/or <SI-10(05)_ODP[02] formats>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SI-10(06)

SI-10(05)-Examine

[SELECT FROM: System and informaon integrity policy; system and informaon integrity procedures; procedures addressing informaon input validaon; system design documentaon; system conﬁguraon sengs and associated documentaon; list of trusted sources for informaon inputs; list of acceptable formats for input restricons; system audit records; system security plan; other relevant documents or records].

SI-10(05)-Interview

SI-10(05)-Test

[SELECT FROM: Organizaonal processes for restricng informaon inputs; automated mechanisms supporng and/or implemenng restricon of informaon inputs].

INFORMATION INPUT VALIDATION | INJECTION PREVENTION ASSESSMENT OBJECTIVE: Determine if: SI-10(06)

CHAPTER FOUR

untrusted data injecons are prevented.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 642

NIST SP 800-53A, REV. 5

SI-10(06)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

INFORMATION INPUT VALIDATION | INJECTION PREVENTION POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SI-11

SI-10(06)-Examine

[SELECT FROM: System and informaon integrity policy; system and informaon integrity procedures; procedures addressing informaon input validaon; system design documentaon; system conﬁguraon sengs and associated documentaon; list of trusted sources for informaon inputs; list of acceptable formats for input restricons; system audit records; system security plan; other relevant documents or records].

SI-10(06)-Interview

SI-10(06)-Test

[SELECT FROM: Organizaonal processes for prevenng untrusted data injecons; automated mechanisms supporng and/or implemenng injecon prevenon].

ERROR HANDLING ASSESSMENT OBJECTIVE: Determine if: SI-11_ODP

personnel or roles to whom error messages are to be revealed is/are deﬁned;

SI-11a.

error messages that provide the informaon necessary for correcve acons are generated without revealing informaon that could be exploited;

SI-11b.

error messages are revealed only to <SI-11_ODP personnel or roles>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SI-12

SI-11-Examine

[SELECT FROM: System and informaon integrity policy; system and informaon integrity procedures; procedures addressing system error handling; system design documentaon; system conﬁguraon sengs and associated documentaon; documentaon providing the structure and content of error messages; system audit records; system security plan; other relevant documents or records].

SI-11-Interview

SI-11-Test

[SELECT FROM: Organizaonal processes for error handling; automated mechanisms supporng and/or implemenng error handling; automated mechanisms supporng and/or implemenng the management of error messages].

INFORMATION MANAGEMENT AND RETENTION ASSESSMENT OBJECTIVE: Determine if: SI-12[01]

CHAPTER FOUR

informaon within the system is managed in accordance with applicable laws, Execuve Orders, direcves, regulaons, policies, standards, guidelines, and operaonal requirements;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 643

NIST SP 800-53A, REV. 5

SI-12

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

INFORMATION MANAGEMENT AND RETENTION SI-12[02]

informaon within the system is retained in accordance with applicable laws, Execuve Orders, direcves, regulaons, policies, standards, guidelines, and operaonal requirements;

SI-12[03]

informaon output from the system is managed in accordance with applicable laws, Execuve Orders, direcves, regulaons, policies, standards, guidelines, and operaonal requirements;

SI-12[04]

informaon output from the system is retained in accordance with applicable laws, Execuve Orders, direcves, regulaons, policies, standards, guidelines, and operaonal requirements.

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SI-12(01)

SI-12-Examine

[SELECT FROM: System and informaon integrity policy; system and informaon integrity procedures; personally idenﬁable informaon processing policy; records retenon and disposion policy; records retenon and disposion procedures; federal laws, Execuve Orders, direcves, policies, regulaons, standards, and operaonal requirements applicable to informaon management and retenon; media protecon policy; media protecon procedures; audit ﬁndings; system security plan; privacy plan; privacy program plan; personally idenﬁable informaon inventory; privacy impact assessment; privacy risk assessment documentaon; other relevant documents or records].

SI-12-Interview

[SELECT FROM: Organizaonal personnel with informaon and records management, retenon, and disposion responsibilies; organizaonal personnel with informaon security and privacy responsibilies; network administrators].

SI-12-Test

[SELECT FROM: Organizaonal processes for informaon management, retenon, and disposion; automated mechanisms supporng and/or implemenng informaon management, retenon, and disposion].

INFORMATION MANAGEMENT AND RETENTION | LIMIT PERSONALLY IDENTIFIABLE INFORMATION ELEMENTS ASSESSMENT OBJECTIVE: Determine if:

SI-12(01)_ODP

elements of personally idenﬁable informaon being processed in the informaon life cycle are deﬁned;

SI-12(01)

personally idenﬁable informaon being processed in the informaon life cycle is limited to <SI-12(01)_ODP elements of personally idenﬁable informaon>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: SI-12(01)-Examine

CHAPTER FOUR

[SELECT FROM: System and informaon integrity policy; system and informaon integrity procedures; personally idenﬁable informaon processing policy; personally idenﬁable informaon processing procedures; records retenon and disposion policy; records retenon and disposion procedures; federal laws, Execuve Orders, direcves, policies, regulaons, standards, and operaonal requirements applicable to liming personally idenﬁable informaon elements; personally idenﬁable informaon inventory; system audit records; audit ﬁndings; system security plan; privacy plan; privacy program plan; privacy impact assessment; privacy risk assessment documentaon; data mapping documentaon; other relevant documents or records].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 644

NIST SP 800-53A, REV. 5

SI-12(01)

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SI-12(02)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

INFORMATION MANAGEMENT AND RETENTION | LIMIT PERSONALLY IDENTIFIABLE INFORMATION ELEMENTS SI-12(01)-Interview

[SELECT FROM: Organizaonal personnel with informaon and records management, retenon, and disposion responsibilies; organizaonal personnel with security and privacy responsibilies; network administrators].

SI-12(01)-Test

[SELECT FROM: Organizaonal processes for informaon management and retenon (including liming personally idenﬁable informaon processing); automated mechanisms supporng and/or implemenng limits to personally idenﬁable informaon processing].

INFORMATION MANAGEMENT AND RETENTION | MINIMIZE PERSONALLY IDENTIFIABLE INFORMATION IN TESTING, TRAINING, AND RESEARCH ASSESSMENT OBJECTIVE: Determine if:

SI-12(02)_ODP[01]

techniques used to minimize the use of personally idenﬁable informaon for research are deﬁned;

SI-12(02)_ODP[02]

techniques used to minimize the use of personally idenﬁable informaon for tesng are deﬁned;

SI-12(02)_ODP[03]

techniques used to minimize the use of personally idenﬁable informaon for training are deﬁned;

SI-12(02)[01]

<SI-12(02)_ODP[01] techniques> are used to minimize the use of personally idenﬁable informaon for research;

SI-12(02)[02]

<SI-12(02)_ODP[02] techniques> are used to minimize the use of personally idenﬁable informaon for tesng;

SI-12(02)[03]

<SI-12(02)_ODP[03] techniques> are used to minimize the use of personally idenﬁable informaon for training.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

SI-12(02)-Examine

[SELECT FROM: System and informaon integrity policy; system and informaon integrity procedures; personally idenﬁable informaon processing policy; personally idenﬁable informaon processing procedures; federal laws, Execuve Orders, direcves, policies, regulaons, standards, and operaonal requirements applicable to minimizing the use of personally idenﬁable informaon in tesng, training, and research; policy for the minimizaon of personally idenﬁable informaon used in tesng, training, and research; procedures for the minimizaon of personally idenﬁable informaon used in tesng, training, and research; documentaon supporng minimizaon policy implementaon (e.g., templates for tesng, training, and research); data sets used for tesng, training, and research; system security plan; privacy plan; privacy impact assessment; privacy risk assessment documentaon; other relevant documents or records].

SI-12(02)-Interview

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 645

NIST SP 800-53A, REV. 5

SI-12(02)

INFORMATION MANAGEMENT AND RETENTION | MINIMIZE PERSONALLY IDENTIFIABLE INFORMATION IN TESTING, TRAINING, AND RESEARCH SI-12(02)-Test

SI-12(03)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

[SELECT FROM: Organizaonal processes for the minimizaon of personally idenﬁable informaon used in tesng, training, and research; automated mechanisms supporng and/or implemenng the minimizaon of personally idenﬁable informaon used in tesng, training, and research].

INFORMATION MANAGEMENT AND RETENTION | INFORMATION DISPOSAL

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

ASSESSMENT OBJECTIVE: Determine if:

SI-12(03)_ODP[01]

techniques used to dispose of informaon following the retenon period are deﬁned;

SI-12(03)_ODP[02]

techniques used to destroy informaon following the retenon period are deﬁned;

SI-12(03)_ODP[03]

techniques used to erase informaon following the retenon period are deﬁned;

SI-12(03)[01]

<SI-12(03)_ODP[01] techniques> are used to dispose of informaon following the retenon period;

SI-12(03)[02]

<SI-12(03)_ODP[02] techniques> are used to destroy informaon following the retenon period;

SI-12(03)[03]

<SI-12(03)_ODP[03] techniques> are used to erase informaon following the retenon period.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SI-13

SI-12(03)-Examine

[SELECT FROM: System and informaon integrity policy; system and informaon integrity procedures; personally idenﬁable informaon processing policy; personally idenﬁable informaon processing procedures; records retenon and disposion policy; records retenon and disposion procedures; laws, Execuve Orders, direcves, policies, regulaons, standards, and operaonal requirements applicable to informaon disposal; media protecon policy; media protecon procedures; system audit records; audit ﬁndings; informaon disposal records; system security plan; privacy plan; privacy impact assessment; privacy risk assessment documentaon; other relevant documents or records].

SI-12(03)-Interview

SI-12(03)-Test

[SELECT FROM: Organizaonal processes for informaon disposion; automated mechanisms supporng and/or implemenng informaon disposion].

PREDICTABLE FAILURE PREVENTION ASSESSMENT OBJECTIVE: Determine if:

SI-13_ODP[01]

CHAPTER FOUR

system components for which mean me to failure (MTTF) should be determined are deﬁned;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 646

NIST SP 800-53A, REV. 5

SI-13

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

PREDICTABLE FAILURE PREVENTION SI-13_ODP[02]

mean me to failure (MTTF) substuon criteria to be used as a means to exchange acve and standby components are deﬁned;

SI-13a.

mean me to failure (MTTF) is determined for <SI-13_ODP[01] system components> in speciﬁc environments of operaon;

SI-13b.

substute system components and a means to exchange acve and standby components are provided in accordance with <SI-13_ODP[02] mean me to failure (MTTF) substuon criteria>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SI-13(01)

SI-13-Examine

[SELECT FROM: System and informaon integrity policy; system and informaon integrity procedures; procedures addressing predictable failure prevenon; system design documentaon; system conﬁguraon sengs and associated documentaon; list of MTTF substuon criteria; system audit records; system security plan; other relevant documents or records].

SI-13-Interview

[SELECT FROM: Organizaonal personnel responsible for MTTF determinaons and acvies; organizaonal personnel with informaon security responsibilies; system/network administrators; organizaonal personnel with conngency planning responsibilies].

SI-13-Test

[SELECT FROM: Organizaonal processes for managing MTTF].

PREDICTABLE FAILURE PREVENTION | TRANSFERRING COMPONENT RESPONSIBILITIES ASSESSMENT OBJECTIVE: Determine if:

SI-13(01)_ODP

the fracon or percentage of mean me to failure within which to transfer the responsibilies of a system component to a substute component is deﬁned;

SI-13(01)

system components are taken out of service by transferring component responsibilies to substute components no later than <SI-13(01)_ODP fracon or percentage> of mean me to failure.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

SI-13(01)-Examine

[SELECT FROM: System and informaon integrity policy; system and informaon integrity procedures; procedures addressing predictable failure prevenon; system design documentaon; system conﬁguraon sengs and associated documentaon; system audit records; system security plan; other relevant documents or records].

SI-13(01)-Interview

[SELECT FROM: Organizaonal personnel responsible for MTTF acvies; organizaonal personnel with informaon security responsibilies; system/ network administrators; organizaonal personnel with conngency planning responsibilies].

SI-13(01)-Test

[SELECT FROM: Organizaonal processes for managing MTTF; automated mechanisms supporng and/or implemenng the transfer of component responsibilies to substute components].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 647

NIST SP 800-53A, REV. 5

SI-13(02)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

PREDICTABLE FAILURE PREVENTION | TIME LIMIT ON PROCESS EXECUTION WITHOUT SUPERVISION [WITHDRAWN: Incorporated into SI-07(16).]

SI-13(03)

PREDICTABLE FAILURE PREVENTION | MANUAL TRANSFER BETWEEN COMPONENTS ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SI-13(03)_ODP

the percentage of the mean me to failure for transfers to be manually iniated is deﬁned;

SI-13(03)

transfers are iniated manually between acve and standby system components when the use of the acve component reaches <SI-13(03)_ODP percentage> of the mean me to failure.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SI-13(04)

SI-13(03)-Examine

[SELECT FROM: System and informaon integrity policy; system and informaon integrity procedures; procedures addressing predictable failure prevenon; system design documentaon; system conﬁguraon sengs and associated documentaon; system audit records; system security plan; other relevant documents or records].

SI-13(03)-Interview

SI-13(03)-Test

[SELECT FROM: Organizaonal processes for managing MTTF and conducng the manual transfer between acve and standby components].

PREDICTABLE FAILURE PREVENTION | STANDBY COMPONENT INSTALLATION AND NOTIFICATION ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

SI-13(04)_ODP[01]

me period for standby components to be installed is deﬁned;

SI-13(04)_ODP[02]

one or more of the following PARAMETER VALUES is/are selected: {acvate <SI-13(04)_ODP[03] alarm>; automacally shut down the system; <SI-13(04)_ODP[04] acon>};

SI-13(04)_ODP[03]

alarm to be acvated when system component failures are detected is deﬁned (if selected);

SI-13(04)_ODP[04]

acon to be taken when system component failures are detected is deﬁned (if selected);

SI-13(04)(a)

the standby components are successfully and transparently installed within <SI-13(04)_ODP[01] me period> if system component failures are detected;

SI-13(04)(b)

<SI-13(04)_ODP[02] SELECTED PARAMETER VALUE(S)> are performed if system component failures are detected.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 648

NIST SP 800-53A, REV. 5

SI-13(04)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

PREDICTABLE FAILURE PREVENTION | STANDBY COMPONENT INSTALLATION AND NOTIFICATION POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SI-13(05)

SI-13(04)-Examine

[SELECT FROM: System and informaon integrity policy; system and informaon integrity procedures; procedures addressing predictable failure prevenon; system design documentaon; system conﬁguraon sengs and associated documentaon; list of acons to be taken once system component failure is detected; system audit records; system security plan; other relevant documents or records].

SI-13(04)-Interview

SI-13(04)-Test

[SELECT FROM: Organizaonal processes for managing MTTF; automated mechanisms supporng and/or implemenng the transparent installaon of standby components; automated mechanisms supporng and/or implemenng alarms or system shutdown if component failures are detected].

PREDICTABLE FAILURE PREVENTION | FAILOVER CAPABILITY ASSESSMENT OBJECTIVE: Determine if:

SI-13(05)_ODP[01]

one of the following PARAMETER VALUES is selected: {real-me; near real-me};

SI-13(05)_ODP[02]

a failover capability for the system has been deﬁned;

SI-13(05)

<SI-13(05)_ODP[01] SELECTED PARAMETER VALUE> <SI-13(05)_ODP[02] failover capability> is provided for the system.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

SI-13(05)-Examine

[SELECT FROM: System and informaon integrity policy; system and informaon integrity procedures; procedures addressing predictable failure prevenon; system design documentaon; system conﬁguraon sengs and associated documentaon; documentaon describing the failover capability provided for the system; system audit records; system security plan; other relevant documents or records].

SI-13(05)-Interview

[SELECT FROM: Organizaonal personnel responsible for the failover capability; organizaonal personnel with informaon security responsibilies; system/ network administrators; organizaonal personnel with conngency planning responsibilies].

SI-13(05)-Test

[SELECT FROM: Organizaonal processes for managing the failover capability; automated mechanisms supporng and/or implemenng the failover capability].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 649

NIST SP 800-53A, REV. 5

SI-14

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

NON-PERSISTENCE ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SI-14_ODP[01]

non-persistent system components and services to be implemented are deﬁned;

SI-14_ODP[02]

one or more of the following PARAMETER VALUES is/are selected: {upon end of session of use; <SI-14_ODP[03] frequency>};

SI-14_ODP[03]

the frequency at which to terminate non-persistent components and services that are iniated in a known state is deﬁned (if selected);

SI-14[01]

non-persistent <SI-14_ODP[01] system components and services> that are iniated in a known state are implemented;

SI-14[02]

non-persistent <SI-14_ODP[01] system components and services> are terminated <SI-14_ODP[02] SELECTED PARAMETER VALUE(S)>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SI-14(01)

SI-14-Examine

[SELECT FROM: System and informaon integrity policy; system and informaon integrity procedures; procedures addressing non-persistence for system components; system design documentaon; system conﬁguraon sengs and associated documentaon; system audit records; system security plan; other relevant documents or records].

SI-14-Interview

[SELECT FROM: Organizaonal personnel responsible for non-persistence; organizaonal personnel with informaon security responsibilies; system/network administrators; system developer].

SI-14-Test

[SELECT FROM: Automated mechanisms supporng and/or implemenng the iniaon and terminaon of non-persistent components].

NON-PERSISTENCE | REFRESH FROM TRUSTED SOURCES ASSESSMENT OBJECTIVE: Determine if:

SI-14(01)_ODP

trusted sources to obtain soware and data for system component and service refreshes are deﬁned;

SI-14(01)

the soware and data employed during system component and service refreshes are obtained from <SI-14(01)_ODP trusted sources>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

SI-14(01)-Examine

SI-14(01)-Interview

[SELECT FROM: Organizaonal personnel responsible for obtaining component and service refreshes from trusted sources; organizaonal personnel with informaon security responsibilies].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 650

NIST SP 800-53A, REV. 5

SI-14(01)

NON-PERSISTENCE | REFRESH FROM TRUSTED SOURCES SI-14(01)-Test

SI-14(02)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

[SELECT FROM: Organizaonal processes for deﬁning and obtaining component and service refreshes from trusted sources; automated mechanisms supporng and/or implemenng component and service refreshes].

NON-PERSISTENCE | NON-PERSISTENT INFORMATION ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SI-14(02)_ODP[01]

one of the following PARAMETER VALUES is selected: {refresh <SI-14(02)_ODP[02] informaon> <SI-14(02)_ODP[03] frequency>; generate <SI-14(02)_ODP[04] informaon> on demand};

SI-14(02)_ODP[02]

the informaon to be refreshed is deﬁned (if selected);

SI-14(02)_ODP[03]

the frequency at which to refresh informaon is deﬁned (if selected);

SI-14(02)_ODP[04]

the informaon to be generated is deﬁned (if selected);

SI-14(02)(a)

<SI-14(02)_ODP[01] SELECTED PARAMETER VALUE> is performed;

SI-14(02)(b)

informaon is deleted when no longer needed.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SI-14(03)

SI-14(02)-Examine

SI-14(02)-Interview

[SELECT FROM: Organizaonal personnel responsible for ensuring that informaon is and remains non-persistent; organizaonal personnel with informaon security responsibilies].

SI-14(02)-Test

[SELECT FROM: Organizaonal processes for ensuring that informaon is and remains non-persistent; automated mechanisms supporng and/or implemenng component and service refreshes].

NON-PERSISTENCE | NON-PERSISTENT CONNECTIVITY ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

SI-14(03)_ODP

one of the following PARAMETER VALUES is selected: {compleon of a request; a period of non-use};

SI-14(03)[01]

connecons to the system are established on demand;

SI-14(03)[02]

connecons to the system are terminated aer <SI-14(03)_ODP SELECTED PARAMETER VALUE>.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 651

NIST SP 800-53A, REV. 5

SI-14(03)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

NON-PERSISTENCE | NON-PERSISTENT CONNECTIVITY POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SI-15

SI-14(03)-Examine

SI-14(03)-Interview

[SELECT FROM: Organizaonal personnel responsible for liming persistent connecons; organizaonal personnel with informaon security responsibilies].

SI-14(03)-Test

[SELECT FROM: Organizaonal processes for liming persistent connecons; automated mechanisms supporng and/or implemenng non-persistent connecvity].

INFORMATION OUTPUT FILTERING ASSESSMENT OBJECTIVE: Determine if: SI-15_ODP

soware programs and/or applicaons whose informaon output requires validaon are deﬁned;

SI-15

informaon output from <SI-15_ODP soware programs and/or applicaons> is validated to ensure that the informaon is consistent with the expected content.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SI-16

SI-15-Examine

[SELECT FROM: System and informaon integrity policy; system and informaon integrity procedures; procedures addressing informaon output ﬁltering; system design documentaon; system conﬁguraon sengs and associated documentaon; system audit records; system security plan; other relevant documents or records].

SI-15-Interview

[SELECT FROM: Organizaonal personnel responsible for validang informaon output; organizaonal personnel with informaon security responsibilies; system/ network administrators; system developer].

SI-15-Test

[SELECT FROM: Organizaonal processes for validang informaon output; automated mechanisms supporng and/or implemenng informaon output validaon].

MEMORY PROTECTION ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

SI-16_ODP

controls to be implemented to protect the system memory from unauthorized code execuon are deﬁned;

SI-16

<SI-16_ODP controls> are implemented to protect the system memory from unauthorized code execuon.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 652

NIST SP 800-53A, REV. 5

SI-16

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

MEMORY PROTECTION POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SI-17

SI-16-Examine

[SELECT FROM: System and informaon integrity policy; system and informaon integrity procedures; procedures addressing memory protecon for the system; system design documentaon; system conﬁguraon sengs and associated documentaon; list of security safeguards protecng system memory from unauthorized code execuon; system audit records; system security plan; other relevant documents or records].

SI-16-Interview

[SELECT FROM: Organizaonal personnel responsible for memory protecon; organizaonal personnel with informaon security responsibilies; system/network administrators; system developer].

SI-16-Test

[SELECT FROM: Automated mechanisms supporng and/or implemenng safeguards to protect the system memory from unauthorized code execuon].

FAIL-SAFE PROCEDURES ASSESSMENT OBJECTIVE: Determine if:

SI-17_ODP[01]

fail-safe procedures associated with failure condions are deﬁned;

SI-17_ODP[02]

a list of failure condions requiring fail-safe procedures is deﬁned;

SI-17

<SI-17_ODP[01] fail-safe procedures> are implemented when <SI-17_ODP[02] list of failure condions> occur.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SI-18

SI-17-Examine

[SELECT FROM: System and informaon integrity policy; system and informaon integrity procedures; documentaon addressing fail-safe procedures for the system; system design documentaon; system conﬁguraon sengs and associated documentaon; list of security safeguards protecng the system memory from unauthorized code execuon; system audit records; system security plan; other relevant documents or records].

SI-17-Interview

[SELECT FROM: Organizaonal personnel responsible for fail-safe procedures; organizaonal personnel with informaon security responsibilies; system/network administrators; system developer].

SI-17-Test

[SELECT FROM: Organizaonal fail-safe procedures; automated mechanisms supporng and/or implemenng fail-safe procedures].

PERSONALLY IDENTIFIABLE INFORMATION QUALITY OPERATIONS ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

SI-18_ODP[01]

the frequency at which to check the accuracy of personally idenﬁable informaon across the informaon life cycle is deﬁned;

SI-18_ODP[02]

the frequency at which to check the relevance of personally idenﬁable informaon across the informaon life cycle is deﬁned;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 653

NIST SP 800-53A, REV. 5

SI-18

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

PERSONALLY IDENTIFIABLE INFORMATION QUALITY OPERATIONS

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SI-18_ODP[03]

the frequency at which to check the meliness of personally idenﬁable informaon across the informaon life cycle is deﬁned;

SI-18_ODP[04]

the frequency at which to check the completeness of personally idenﬁable informaon across the informaon life cycle is deﬁned;

SI-18a.[01]

the accuracy of personally idenﬁable informaon across the informaon life cycle is checked <SI-18_ODP[01] frequency>;

SI-18a.[02]

the relevance of personally idenﬁable informaon across the informaon life cycle is checked <SI-18_ODP[02] frequency>;

SI-18a.[03]

the meliness of personally idenﬁable informaon across the informaon life cycle is checked <SI-18_ODP[03] frequency>;

SI-18a.[04]

the completeness of personally idenﬁable informaon across the informaon life cycle is checked <SI-18_ODP[04] frequency>;

SI-18b.

inaccurate or outdated personally idenﬁable informaon is corrected or deleted.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SI-18(01)

SI-18-Examine

[SELECT FROM: System and informaon integrity policy; system and informaon integrity procedures; personally idenﬁable informaon processing policy; documentaon addressing personally idenﬁable informaon quality operaons; quality reports; maintenance logs; system audit records; audit ﬁndings; system security plan; privacy plan; privacy impact assessment; privacy risk assessment documentaon; other relevant documents or records].

SI-18-Interview

[SELECT FROM: Organizaonal personnel responsible for performing personally idenﬁable informaon quality inspecons; organizaonal personnel with informaon security responsibilies; organizaonal personnel with privacy responsibilies].

SI-18-Test

[SELECT FROM: Organizaonal processes for personally idenﬁable informaon quality inspecon; automated mechanisms supporng and/or implemenng personally idenﬁable informaon quality operaons].

PERSONALLY IDENTIFIABLE INFORMATION QUALITY OPERATIONS | AUTOMATION SUPPORT ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

SI-18(01)_ODP

automated mechanisms used to correct or delete personally idenﬁable informaon that is inaccurate, outdated, incorrectly determined regarding impact, or incorrectly de-idenﬁed are deﬁned;

SI-18(01)

<SI-18(01)_ODP automated mechanisms> are used to correct or delete personally idenﬁable informaon that is inaccurate, outdated, incorrectly determined regarding impact, or incorrectly de-idenﬁed.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 654

NIST SP 800-53A, REV. 5

SI-18(01)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

PERSONALLY IDENTIFIABLE INFORMATION QUALITY OPERATIONS | AUTOMATION SUPPORT POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SI-18(02)

SI-18(01)-Examine

SI-18(01)-Interview

SI-18(01)-Test

PERSONALLY IDENTIFIABLE INFORMATION QUALITY OPERATIONS | DATA TAGS ASSESSMENT OBJECTIVE: Determine if: SI-18(02)

data tags are employed to automate the correcon or deleon of personally idenﬁable informaon across the informaon life cycle within organizaonal systems.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SI-18(03)

SI-18(02)-Examine

[SELECT FROM: System and informaon integrity policy; system and informaon integrity procedures; personally idenﬁable informaon processing policy; procedures addressing data tagging; personally idenﬁable informaon inventory; system audit records; audit ﬁndings; system security plan; privacy plan; privacy impact assessment; privacy risk assessment documentaon; other relevant documents or records].

SI-18(02)-Interview

[SELECT FROM: Organizaonal personnel responsible for tagging data; organizaonal personnel with informaon security and privacy responsibilies].

SI-18(02)-Test

[SELECT FROM: Data tagging mechanisms; automated mechanisms supporng and/ or implemenng data tagging].

PERSONALLY IDENTIFIABLE INFORMATION QUALITY OPERATIONS | COLLECTION ASSESSMENT OBJECTIVE: Determine if: SI-18(03)

CHAPTER FOUR

personally idenﬁable informaon is collected directly from the individual.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 655

NIST SP 800-53A, REV. 5

SI-18(03)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

PERSONALLY IDENTIFIABLE INFORMATION QUALITY OPERATIONS | COLLECTION POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SI-18(04)

SI-18(03)-Examine

[SELECT FROM: System and informaon integrity policy; system and informaon integrity procedures; personally idenﬁable informaon processing policy; system conﬁguraon documentaon; system audit records; user interface where personally idenﬁable informaon is collected; system security plan; privacy plan; privacy impact assessment; privacy risk assessment documentaon; other relevant documents or records].

SI-18(03)-Interview

[SELECT FROM: Organizaonal personnel responsible for data collecon; organizaonal personnel with informaon security and privacy responsibilies].

SI-18(03)-Test

[SELECT FROM: Data collecon mechanisms; automated mechanisms supporng and/or validang collecon directly from the individual].

PERSONALLY IDENTIFIABLE INFORMATION QUALITY OPERATIONS | INDIVIDUAL REQUESTS ASSESSMENT OBJECTIVE: Determine if: SI-18(04)

personally idenﬁable informaon is corrected or deleted upon request by individuals or their designated representaves.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SI-18(05)

SI-18(04)-Examine

[SELECT FROM: System and informaon integrity policy; system and informaon integrity procedures; personally idenﬁable informaon processing policy; system conﬁguraon; individual requests; records of correcon or deleon acons performed; system audit records; system security plan; privacy plan; privacy impact assessment; privacy risk assessment documentaon; other relevant documents or records].

SI-18(04)-Interview

[SELECT FROM: Organizaonal personnel responsible for responding to individual requests for personally idenﬁable informaon correcon or deleon; organizaonal personnel with informaon security and privacy responsibilies].

SI-18(04)-Test

[SELECT FROM: Request mechanisms; automated mechanisms supporng and/or implemenng individual requests for correcon or deleon].

PERSONALLY IDENTIFIABLE INFORMATION QUALITY OPERATIONS | NOTICE OF CORRECTION OR DELETION ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

SI-18(05)_ODP

recipients of personally idenﬁable informaon to be noﬁed when the personally idenﬁable informaon has been corrected or deleted are deﬁned;

SI-18(05)

<SI-18(05)_ODP recipients> and individuals are noﬁed when the personally idenﬁable informaon has been corrected or deleted.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 656

NIST SP 800-53A, REV. 5

SI-18(05)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

PERSONALLY IDENTIFIABLE INFORMATION QUALITY OPERATIONS | NOTICE OF CORRECTION OR DELETION POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SI-19

SI-18(05)-Examine

[SELECT FROM: System and informaon integrity policy; system and informaon integrity procedures; personally idenﬁable informaon processing policy; system conﬁguraon; individual requests for correcons or deleons; noﬁcaons of correcon or deleon acon; system audit records; system security plan; privacy plan; privacy impact assessment; privacy risk assessment documentaon; other relevant documents or records].

SI-18(05)-Interview

[SELECT FROM: Organizaonal personnel responsible for sending correcon or deleon noces; organizaonal personnel with informaon security and privacy responsibilies].

SI-18(05)-Test

[SELECT FROM: Organizaonal processes for noﬁcaons of correcon or deleon; automated mechanisms supporng and/or implemenng noﬁcaons of correcon or deleon].

DE-IDENTIFICATION ASSESSMENT OBJECTIVE: Determine if:

SI-19_ODP[01]

elements of personally idenﬁable informaon to be removed from datasets are deﬁned;

SI-19_ODP[02]

the frequency at which to evaluate the eﬀecveness of de-idenﬁcaon is deﬁned;

SI-19a.

<SI-19_ODP[01] elements> are removed from datasets;

SI-19b.

the eﬀecveness of de-idenﬁcaon is evaluated <SI-19_ODP[02] frequency>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

SI-19-Examine

[SELECT FROM: System and informaon integrity policy; system and informaon integrity procedures; personally idenﬁable informaon processing policy; de-idenﬁcaon procedures; system conﬁguraon; datasets with personally idenﬁable informaon removed; system security plan; privacy plan; privacy impact assessment; privacy risk assessment documentaon; other relevant documents or records].

SI-19-Interview

[SELECT FROM: Organizaonal personnel responsible for idenfying unnecessary idenﬁers; organizaonal personnel responsible for removing personally idenﬁable informaon from datasets; organizaonal personnel with informaon security and privacy responsibilies].

SI-19-Test

[SELECT FROM: Automated mechanisms supporng and/or implemenng the removal of personally idenﬁable informaon elements].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 657

NIST SP 800-53A, REV. 5

SI-19(01)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

DE-IDENTIFICATION | COLLECTION ASSESSMENT OBJECTIVE: Determine if: SI-19(01)

the dataset is de-idenﬁed upon collecon by not collecng personally idenﬁable informaon.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SI-19(02)

SI-19(01)-Examine

[SELECT FROM: System and informaon integrity policy; system and informaon integrity procedures; personally idenﬁable informaon processing policy; deidenﬁcaon procedures; procedures for minimizing the collecon of personally idenﬁable informaon; system conﬁguraon; data collecon mechanisms; system security plan; privacy plan; privacy impact assessment; privacy risk assessment documentaon; other relevant documents or records].

SI-19(01)-Interview

[SELECT FROM: Organizaonal personnel responsible for de-idenfying the dataset; organizaonal personnel with informaon security and privacy responsibilies].

SI-19(01)-Test

[SELECT FROM: Automated mechanisms prevenng the collecon of personally idenﬁable informaon].

DE-IDENTIFICATION | ARCHIVING ASSESSMENT OBJECTIVE: Determine if: SI-19(02)

the archiving of personally idenﬁable informaon elements is prohibited if those elements in a dataset will not be needed aer the dataset is archived.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SI-19(03)

SI-19(02)-Examine

[SELECT FROM: System and informaon integrity policy; system and informaon integrity procedures; personally idenﬁable informaon processing policy; deidenﬁcaon procedures; system conﬁguraon documentaon; data archiving mechanisms; system security plan; privacy plan; privacy impact assessment; privacy risk assessment documentaon; other relevant documents or records].

SI-19(02)-Interview

[SELECT FROM: Organizaonal personnel responsible for de-idenfying the dataset; organizaonal personnel with dataset archival responsibilies; organizaonal personnel with informaon security and privacy responsibilies].

SI-19(02)-Test

[SELECT FROM: Automated mechanisms prohibing the archival of personally idenﬁable informaon elements].

DE-IDENTIFICATION | RELEASE ASSESSMENT OBJECTIVE: Determine if: SI-19(03)

CHAPTER FOUR

personally idenﬁable informaon elements are removed from a dataset prior to its release if those elements in the dataset do not need to be part of the data release.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 658

NIST SP 800-53A, REV. 5

SI-19(03)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

DE-IDENTIFICATION | RELEASE POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SI-19(04)

SI-19(03)-Examine

[SELECT FROM: System and informaon integrity policy; system and informaon integrity procedures; personally idenﬁable informaon processing policy; deidenﬁcaon procedures; procedures for minimizing the release of personally idenﬁable informaon; system conﬁguraon; data release mechanisms; system security plan; privacy plan; privacy impact assessment; privacy risk assessment documentaon; other relevant documents or records].

SI-19(03)-Interview

[SELECT FROM: Organizaonal personnel responsible for de-idenfying the dataset; organizaonal personnel with informaon security and privacy responsibilies].

SI-19(03)-Test

[SELECT FROM: Automated mechanisms supporng and/or implemenng the removal of personally idenﬁable informaon elements from a dataset].

DE-IDENTIFICATION | REMOVAL, MASKING, ENCRYPTION, HASHING, OR REPLACEMENT OF DIRECT IDENTIFIERS ASSESSMENT OBJECTIVE: Determine if: SI-19(04)

direct idenﬁers in a dataset are removed, masked, encrypted, hashed, or replaced.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SI-19(05)

SI-19(04)-Examine

[SELECT FROM: System and informaon integrity policy; system and informaon integrity procedures; personally idenﬁable informaon processing policy; deidenﬁcaon procedures; system conﬁguraon; documentaon of de-idenﬁed datasets; tools for the removal, masking, encrypon, hashing or replacement of direct idenﬁers; system security plan; privacy plan; privacy impact assessment; privacy risk assessment documentaon; other relevant documents or records].

SI-19(04)-Interview

[SELECT FROM: Organizaonal personnel responsible for de-idenfying the dataset; organizaonal personnel with informaon security and privacy responsibilies].

SI-19(04)-Test

[SELECT FROM: Automated mechanisms supporng and/or implemenng the removal, masking, encrypon, hashing or replacement of direct idenﬁers].

DE-IDENTIFICATION | STATISTICAL DISCLOSURE CONTROL ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

SI-19(05)[01]

numerical data is manipulated so that no individual or organizaon is idenﬁable in the results of the analysis;

SI-19(05)[02]

conngency tables are manipulated so that no individual or organizaon is idenﬁable in the results of the analysis;

SI-19(05)[03]

stascal ﬁndings are manipulated so that no individual or organizaon is idenﬁable in the results of the analysis.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 659

NIST SP 800-53A, REV. 5

SI-19(05)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

DE-IDENTIFICATION | STATISTICAL DISCLOSURE CONTROL POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SI-19(06)

SI-19(05)-Examine

[SELECT FROM: System and informaon integrity policy; system and informaon integrity procedures; personally idenﬁable informaon processing policy; deidenﬁcaon procedures; system conﬁguraon; de-idenﬁed datasets; stascal analysis report; tools for the control of stascal disclosure; system security plan; privacy plan; privacy impact assessment; privacy risk assessment documentaon; other relevant documents or records].

SI-19(05)-Interview

[SELECT FROM: Organizaonal personnel responsible for de-idenfying the dataset; organizaonal personnel with informaon security and privacy responsibilies].

SI-19(05)-Test

[SELECT FROM: Automated mechanisms supporng and/or implemenng the control of stascal disclosure].

DE-IDENTIFICATION | DIFFERENTIAL PRIVACY ASSESSMENT OBJECTIVE: Determine if: SI-19(06)

the disclosure of personally idenﬁable informaon is prevented by adding nondeterminisc noise to the results of mathemacal operaons before the results are reported.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SI-19(07)

SI-19(06)-Examine

[SELECT FROM: System and informaon integrity policy; system and informaon integrity procedures; personally idenﬁable informaon processing policy; deidenﬁcaon procedures; system conﬁguraon; de-idenﬁed datasets; diﬀerenal privacy tools; system security plan; privacy plan; privacy impact assessment; privacy risk assessment documentaon; other relevant documents or records].

SI-19(06)-Interview

[SELECT FROM: Organizaonal personnel responsible for de-idenfying the dataset; organizaonal personnel with informaon security and privacy responsibilies].

SI-19(06)-Test

[SELECT FROM: Online query systems; automated mechanisms supporng and/or implemenng diﬀerenal privacy].

DE-IDENTIFICATION | VALIDATED ALGORITHMS AND SOFTWARE ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

SI-19(07)[01]

de-idenﬁcaon is performed using validated algorithms;

SI-19(07)[02]

de-idenﬁcaon is performed using soware that is validated to implement the algorithms.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 660

NIST SP 800-53A, REV. 5

SI-19(07)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

DE-IDENTIFICATION | VALIDATED ALGORITHMS AND SOFTWARE POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SI-19(08)

SI-19(07)-Examine

[SELECT FROM: System and informaon integrity policy; system and informaon integrity procedures; personally idenﬁable informaon processing policy; deidenﬁcaon procedures; system conﬁguraon; de-idenﬁed datasets; algorithm and soware validaon tools; system security plan; privacy plan; privacy impact assessment; privacy risk assessment documentaon; other relevant documents or records].

SI-19(07)-Interview

[SELECT FROM: Organizaonal personnel responsible for de-idenfying the dataset; organizaonal personnel with informaon security and privacy responsibilies].

SI-19(07)-Test

[SELECT FROM: Validated algorithms and soware].

DE-IDENTIFICATION | MOTIVATED INTRUDER ASSESSMENT OBJECTIVE: Determine if: SI-19(08)

a movated intruder test is performed on the de-idenﬁed dataset to determine if the idenﬁed data remains or if the de-idenﬁed data can be re-idenﬁed.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SI-20

SI-19(08)-Examine

[SELECT FROM: System and informaon integrity policy; system and informaon integrity procedures; personally idenﬁable informaon processing policy; de-idenﬁcaon procedures; system conﬁguraon; movated intruder test procedures; de-idenﬁed datasets; system security plan; privacy plan; privacy impact assessment; privacy risk assessment documentaon; other relevant documents or records].

SI-19(08)-Interview

[SELECT FROM: Organizaonal personnel responsible for de-idenfying the dataset; organizaonal personnel with informaon security and privacy responsibilies].

SI-19(08)-Test

[SELECT FROM: Movated intruder test].

TAINTING ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

SI-20_ODP

the systems or system components with data or capabilies to be embedded are deﬁned;

SI-20

data or capabilies are embedded in <SI-20_ODP systems or system components> to determine if organizaonal data has been exﬁltrated or improperly removed from the organizaon.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 661

NIST SP 800-53A, REV. 5

SI-20

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

TAINTING POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SI-21

SI-20-Examine

[SELECT FROM: System and informaon integrity policy; system and informaon integrity procedures; personally idenﬁable informaon processing policy; procedures addressing soware and informaon integrity; system design documentaon; system conﬁguraon sengs and associated documentaon; policy and procedures addressing the systems security engineering technique of decepon; system security plan; privacy plan; other relevant documents or records].

SI-20-Interview

[SELECT FROM: Organizaonal personnel responsible for detecng tainted data; organizaonal personnel with systems security engineering responsibilies; organizaonal personnel with informaon security and privacy responsibilies].

SI-20-Test

[SELECT FROM: Automated mechanisms for post-breach detecon; decoys, traps, lures, and methods for deceiving adversaries; detecon and noﬁcaon mechanisms].

INFORMATION REFRESH ASSESSMENT OBJECTIVE: Determine if:

SI-21_ODP[01]

the informaon to be refreshed is deﬁned;

SI-21_ODP[02]

the frequencies at which to refresh informaon are deﬁned;

SI-21

the <SI-21_ODP[01] informaon> is refreshed <SI-21_ODP[02] frequencies> or is generated on demand and deleted when no longer needed.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SI-22

SI-21-Examine

SI-21-Interview

[SELECT FROM: Organizaonal personnel responsible for refreshing informaon; organizaonal personnel with informaon security and privacy responsibilies; organizaonal personnel with systems security engineering responsibilies; system developers].

SI-21-Test

[SELECT FROM: Mechanisms for informaon refresh; organizaonal processes for informaon refresh].

INFORMATION DIVERSITY ASSESSMENT OBJECTIVE: Determine if:

SI-22_ODP[01]

CHAPTER FOUR

alternave informaon sources for essenal funcons and services are deﬁned;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 662

NIST SP 800-53A, REV. 5

SI-22

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

INFORMATION DIVERSITY SI-22_ODP[02]

essenal funcons and services that require alternave sources of informaon are deﬁned;

SI-22_ODP[03]

systems or system components that require an alternave informaon source for the execuon of essenal funcons or services are deﬁned;

SI-22a.

<SI-22_ODP[01] alternave informaon sources> for <SI-22_ODP[02] essenal funcons and services> are idenﬁed;

SI-22b.

an alternave informaon source is used for the execuon of essenal funcons or services on <SI-22_ODP[03] systems or system components> when the primary source of informaon is corrupted or unavailable.

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SI-23

SI-22-Examine

[SELECT FROM: System and informaon integrity policy; system and informaon integrity procedures; personally idenﬁable informaon processing policy; system design documentaon; system conﬁguraon sengs and associated documentaon; list of informaon sources; system security plan; privacy plan; other relevant documents or records].

SI-22-Interview

[SELECT FROM: Organizaonal personnel with informaon security and privacy responsibilies; organizaonal personnel with systems security engineering responsibilies; system developers].

SI-22-Test

[SELECT FROM: Automated methods and mechanisms to convert informaon from an analog to digital medium].

INFORMATION FRAGMENTATION ASSESSMENT OBJECTIVE: Determine if:

SI-23_ODP[01]

circumstances that require informaon fragmentaon are deﬁned;

SI-23_ODP[02]

the informaon to be fragmented is deﬁned;

SI-23_ODP[03]

systems or system components across which the fragmented informaon is to be distributed are deﬁned;

SI-23a.

under <SI-23_ODP[01] circumstances>, <SI-23_ODP[02] informaon> is fragmented;

SI-23b.

under <SI-23_ODP[01] circumstances> , the fragmented informaon is distributed across <SI-23_ODP[03] systems or system components>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: SI-23-Examine

CHAPTER FOUR

[SELECT FROM: System and informaon integrity policy; system and informaon integrity procedures; personally idenﬁable informaon processing policy; procedures addressing soware and informaon integrity; system design documentaon; system conﬁguraon sengs and associated documentaon; procedures to idenfy informaon for fragmentaon and distribuon across systems/system components; list of distributed and fragmented informaon; list of circumstances requiring informaon fragmentaon; enterprise architecture; system security architecture; system security plan; privacy plan; other relevant documents or records].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 663

NIST SP 800-53A, REV. 5

SI-23

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

INFORMATION FRAGMENTATION SI-23-Interview

[SELECT FROM: Organizaonal personnel with informaon security and privacy responsibilies; organizaonal personnel with systems security engineering responsibilies; system developers; security architects].

SI-23-Test

[SELECT FROM: Organizaonal processes to idenfy informaon for fragmentaon and distribuon across systems/system components; automated mechanisms supporng and/or implemenng informaon fragmentaon and distribuon across systems/system components].

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5 CHAPTER FOUR

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 664

NIST SP 800-53A, REV. 5

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

4.20 SUPPLY CHAIN RISK MANAGEMENT SR-01

POLICY AND PROCEDURES ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5 CHAPTER FOUR

SR-01_ODP[01]

personnel or roles to whom supply chain risk management policy is to be disseminated to is/are deﬁned;

SR-01_ODP[02]

personnel or roles to whom supply chain risk management procedures are disseminated to is/are deﬁned;

SR-01_ODP[03]

one or more of the following PARAMETER VALUES is/are selected: {organizaonlevel; mission/business process-level; system-level};

SR-01_ODP[04]

an oﬃcial to manage the development, documentaon, and disseminaon of the supply chain risk management policy and procedures is deﬁned;

SR-01_ODP[05]

the frequency at which the current supply chain risk management policy is reviewed and updated is deﬁned;

SR-01_ODP[06]

events that require the current supply chain risk management policy to be reviewed and updated are deﬁned;

SR-01_ODP[07]

the frequency at which the current supply chain risk management procedure is reviewed and updated is deﬁned;

SR-01_ODP[08]

events that require the supply chain risk management procedures to be reviewed and updated are deﬁned;

SR-01a.[01]

a supply chain risk management policy is developed and documented;

SR-01a.[02]

the supply chain risk management policy is disseminated to <SR-01_ODP[01] personnel or roles>;

SR-01a.[03]

supply chain risk management procedures to facilitate the implementaon of the supply chain risk management policy and the associated supply chain risk management controls are developed and documented;

SR-01a.[04]

the supply chain risk management procedures are disseminated to <SR-01_ODP[02] personnel or roles>.

SR-01a.01(a)[01]

the <SR-01_ODP[03] SELECTED PARAMETER VALUE(S)> supply chain risk management policy addresses purpose;

SR-01a.01(a)[02]

the <SR-01_ODP[03] SELECTED PARAMETER VALUE(S)> supply chain risk management policy addresses scope;

SR-01a.01(a)[03]

<SR-01_ODP[03] SELECTED PARAMETER VALUE(S)> supply chain risk management policy addresses roles;

SR-01a.01(a)[04]

the <SR-01_ODP[03] SELECTED PARAMETER VALUE(S)> supply chain risk management policy addresses responsibilies;

SR-01a.01(a)[05]

the <SR-01_ODP[03] SELECTED PARAMETER VALUE(S)> supply chain risk management policy addresses management commitment;

SR-01a.01(a)[06]

the <SR-01_ODP[03] SELECTED PARAMETER VALUE(S)> supply chain risk management policy addresses coordinaon among organizaonal enes;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 665

NIST SP 800-53A, REV. 5

SR-01

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

POLICY AND PROCEDURES

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SR-01a.01(a)[07]

the <SR-01_ODP[03] SELECTED PARAMETER VALUE(S)> supply chain risk management policy addresses compliance.

SR-01a.01(b)

the <SR-01_ODP[03] SELECTED PARAMETER VALUE(S)> supply chain risk management policy is consistent with applicable laws, Execuve Orders, direcves, regulaons, policies, standards, and guidelines;

SR-01b.

the <SR-01_ODP[04] oﬃcial> is designated to manage the development, documentaon, and disseminaon of the supply chain risk management policy and procedures;

SR-01c.01[01]

the current supply chain risk management policy is reviewed and updated <SR-01_ODP[05] frequency>;

SR-01c.01[02]

the current supply chain risk management policy is reviewed and updated following <SR-01_ODP[06] events>;

SR-01c.02[01]

the current supply chain risk management procedures are reviewed and updated <SR-01_ODP[07] frequency>;

SR-01c.02[02]

the current supply chain risk management procedures are reviewed and updated following <SR-01_ODP[08] events>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SR-02

SR-01-Examine

[SELECT FROM: Supply chain risk management policy; supply chain risk management procedures; system security plan; privacy plan; other relevant documents or records].

SR-01-Interview

[SELECT FROM: Organizaonal personnel with supply chain risk management responsibilies; organizaonal personnel with informaon security and privacy responsibilies; organizaonal personnel with acquision responsibilies; organizaonal personnel with enterprise risk management responsibilies].

SUPPLY CHAIN RISK MANAGEMENT PLAN ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

SR-02_ODP[01]

systems, system components, or system services for which a supply chain risk management plan is developed are deﬁned;

SR-02_ODP[02]

the frequency at which to review and update the supply chain risk management plan is deﬁned;

SR-02a.[01]

a plan for managing supply chain risks is developed;

SR-02a.[02]

the supply chain risk management plan addresses risks associated with the research and development of <SR-02_ODP[01] systems, system components, or system services>;

SR-02a.[03]

the supply chain risk management plan addresses risks associated with the design of <SR-02_ODP[01] systems, system components, or system services>;

SR-02a.[04]

the supply chain risk management plan addresses risks associated with the manufacturing of <SR-02_ODP[01] systems, system components, or system services>;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 666

NIST SP 800-53A, REV. 5

SR-02

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

SUPPLY CHAIN RISK MANAGEMENT PLAN

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SR-02a.[05]

the supply chain risk management plan addresses risks associated with the acquision of <SR-02_ODP[01] systems, system components, or system services>;

SR-02a.[06]

the supply chain risk management plan addresses risks associated with the delivery of <SR-02_ODP[01] systems, system components, or system services>;

SR-02a.[07]

the supply chain risk management plan addresses risks associated with the integraon of <SR-02_ODP[01] systems, system components, or system services>;

SR-02a.[08]

the supply chain risk management plan addresses risks associated with the operaon and maintenance of <SR-02_ODP[01] systems, system components, or system services>;

SR-02a.[09]

the supply chain risk management plan addresses risks associated with the disposal of <SR-02_ODP[01] systems, system components, or system services>;

SR-02b.

the supply chain risk management plan is reviewed and updated <SR-02_ODP[02] frequency> or as required to address threat, organizaonal, or environmental changes;

SR-02c.[01]

the supply chain risk management plan is protected from unauthorized disclosure;

SR-02c.[02]

the supply chain risk management plan is protected from unauthorized modiﬁcaon.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SR-02(01)

SR-02-Examine

[SELECT FROM: Supply chain risk management policy; supply chain risk management procedures; supply chain risk management plan; system and services acquision policy; system and services acquision procedures; procedures addressing supply chain protecon; procedures for protecng the supply chain risk management plan from unauthorized disclosure and modiﬁcaon; system development life cycle procedures; procedures addressing the integraon of informaon security and privacy requirements into the acquision process; acquision documentaon; service level agreements; acquision contracts for the system, system component, or system service; list of supply chain threats; list of safeguards to be taken against supply chain threats; system life cycle documentaon; inter-organizaonal agreements and procedures; system security plan; privacy plan; privacy program plan; other relevant documents or records].

SR-02-Interview

SR-02-Test

[SELECT FROM: Organizaonal processes for deﬁning and documenng the system development life cycle (SDLC); organizaonal processes for idenfying SDLC roles and responsibilies; organizaonal processes for integrang supply chain risk management into the SDLC; mechanisms supporng and/or implemenng the SDLC].

SUPPLY CHAIN RISK MANAGEMENT PLAN | ESTABLISH SCRM TEAM ASSESSMENT OBJECTIVE: Determine if:

SR-02(01)_ODP[01]

CHAPTER FOUR

the personnel, roles, and responsibilies of the supply chain risk management team are deﬁned;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 667

NIST SP 800-53A, REV. 5

SR-02(01)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

SUPPLY CHAIN RISK MANAGEMENT PLAN | ESTABLISH SCRM TEAM SR-02(01)_ODP[02]

supply chain risk management acvies are deﬁned;

SR-02(01)

a supply chain risk management team consisng of <SR-02(01)_ODP[01] personnel, roles and responsibilies> is established to lead and support <SR-02(01)_ODP[02] supply chain risk management acvies>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SR-03

SR-02(01)-Examine

[SELECT FROM: Supply chain risk management policy; supply chain risk management procedures; supply chain risk management team charter documentaon; supply chain risk management strategy; supply chain risk management implementaon plan; procedures addressing supply chain protecon; system security plan; privacy plan; other relevant documents or records].

SR-02(01)-Interview

[SELECT FROM: Organizaonal personnel with acquision responsibilies; organizaonal personnel with informaon security and privacy responsibilies; organizaonal personnel with supply chain risk management responsibilies; organizaonal personnel with enterprise risk management responsibilies; legal counsel; organizaonal personnel with business connuity responsibilies].

SUPPLY CHAIN CONTROLS AND PROCESSES ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

SR-03_ODP[01]

the system or system component requiring a process or processes to idenfy and address weaknesses or deﬁciencies is deﬁned;

SR-03_ODP[02]

supply chain personnel with whom to coordinate the process or processes to idenfy and address weaknesses or deﬁciencies in the supply chain elements and processes is/are deﬁned;

SR-03_ODP[03]

supply chain controls employed to protect against supply chain risks to the system, system component, or system service and to limit the harm or consequences from supply chain-related events are deﬁned;

SR-03_ODP[04]

one or more of the following PARAMETER VALUES is/are selected: {security and privacy plans; supply chain risk management plan; <SR-03_ODP[05] document>};

SR-03_ODP[05]

the document idenfying the selected and implemented supply chain processes and controls is deﬁned (if selected);

SR-03a.[01]

a process or processes is/are established to idenfy and address weaknesses or deﬁciencies in the supply chain elements and processes of <SR-03_ODP[01] system or system component>;

SR-03a.[02]

the process or processes to idenfy and address weaknesses or deﬁciencies in the supply chain elements and processes of <SR-03_ODP[01] system or system component> is/are coordinated with <SR-03_ODP[02] supply chain personnel>;

SR-03b.

<SR-03_ODP[03] supply chain controls> are employed to protect against supply chain risks to the system, system component, or system service and to limit the harm or consequences from supply chain-related events;

SR-03c.

the selected and implemented supply chain processes and controls are documented in <SR-03_ODP[04] SELECTED PARAMETER VALUE(S)>.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 668

NIST SP 800-53A, REV. 5

SR-03

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

SUPPLY CHAIN CONTROLS AND PROCESSES POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SR-03(01)

SR-03-Examine

[SELECT FROM: Supply chain risk management policy; supply chain risk management procedures; supply chain risk management strategy; supply chain risk management plan; systems and crical system components inventory documentaon; system and services acquision policy; system and services acquision procedures; procedures addressing the integraon of informaon security and privacy requirements into the acquision process; solicitaon documentaon; acquision documentaon (including purchase orders); service level agreements; acquision contracts for systems or services; risk register documentaon; system security plan; privacy plan; other relevant documents or records].

SR-03-Interview

SR-03-Test

[SELECT FROM: Organizaonal processes for idenfying and addressing supply chain element and process deﬁciencies].

SUPPLY CHAIN CONTROLS AND PROCESSES | DIVERSE SUPPLY BASE ASSESSMENT OBJECTIVE: Determine if:

SR-03(01)_ODP[01]

system components with a diverse set of sources are deﬁned;

SR-03(01)_ODP[02]

services with a diverse set of sources are deﬁned;

SR-03(01)[01]

a diverse set of sources is employed for <SR-03(01)_ODP[01] system components>;

SR-03(01)[02]

a diverse set of sources is employed for <SR-03(01)_ODP[02] services>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

SR-03(01)-Examine

[SELECT FROM: Supply chain risk management policy and procedures; system and services acquision policy; planning policy; procedures addressing supply chain protecon; physical inventory of crical systems and system components; inventory of crical suppliers, service providers, developers, and contracts; inventory records of crical system components; list of security safeguards ensuring an adequate supply of crical system components; system security plan; other relevant documents or records].

SR-03(01)-Interview

SR-03(01)-Test

[SELECT FROM: Organizaonal processes for deﬁning and employing security safeguards to ensure an adequate supply of crical system components; processes to idenfy crical suppliers; mechanisms supporng and/or implemenng the security safeguards that ensure an adequate supply of crical system components].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 669

NIST SP 800-53A, REV. 5

SR-03(02)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

SUPPLY CHAIN CONTROLS AND PROCESSES | LIMITATION OF HARM ASSESSMENT OBJECTIVE: Determine if:

SR-03(02)_ODP

controls to limit harm from potenal supply chain adversaries are deﬁned;

SR-03(02)

<SR-03(02)_ODP controls> are employed to limit harm from potenal adversaries idenfying and targeng the organizaonal supply chain.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SR-03(03)

SR-03(02)-Examine

[SELECT FROM: Supply chain risk management policy and procedures; supply chain risk management plan; system and services acquision policy; conﬁguraon management policy; procedures addressing supply chain protecon; procedures addressing the integraon of informaon security requirements into the acquision process; procedures addressing the baseline conﬁguraon of the system; conﬁguraon management plan; system design documentaon; system architecture and associated conﬁguraon documentaon; solicitaon documentaon; acquision documentaon; acquision contracts for the system, system component, or system service; threat assessments; vulnerability assessments; list of security safeguards to be taken to protect the organizaonal supply chain against potenal supply chain threats; system security plan; other relevant documents or records].

SR-03(02)-Interview

SR-03(02)-Test

[SELECT FROM: Organizaonal processes for deﬁning and employing safeguards to limit harm from adversaries of the organizaonal supply chain; mechanisms supporng and/or implemenng the deﬁnion and employment of safeguards to protect the organizaonal supply chain].

SUPPLY CHAIN CONTROLS AND PROCESSES | SUB-TIER FLOW DOWN ASSESSMENT OBJECTIVE: Determine if: SR-03(03)

the controls included in the contracts of prime contractors are also included in the contracts of subcontractors.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

SR-03(03)-Examine

[SELECT FROM: Supply chain risk management policy and procedures; supply chain risk management plan; system and services acquision policy; procedures addressing supply chain protecon; acquision documentaon; service level agreements; acquision contracts for the system, system component, or system service; inter-organizaonal agreements and procedures; system security plan; other relevant documents or records].

SR-03(03)-Interview

SR-03(03)-Test

[SELECT FROM: Organizaonal processes for establishing inter-organizaonal agreements and procedures with supply chain enes].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 670

NIST SP 800-53A, REV. 5

SR-04

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

PROVENANCE ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SR-04_ODP

systems, system components, and associated data that require valid provenance are deﬁned;

SR-04[01]

valid provenance is documented for <SR-04_ODP systems, system components, and associated data>;

SR-04[02]

valid provenance is monitored for <SR-04_ODP systems, system components, and associated data>;

SR-04[03]

valid provenance is maintained for <SR-04_ODP systems, system components, and associated data>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SR-04(01)

SR-04-Examine

[SELECT FROM: Supply chain risk management policy; supply chain risk management procedures; supply chain risk management plan; documentaon of crical systems, crical system components, and associated data; documentaon showing the history of ownership, custody, and locaon of and changes to crical systems or crical system components; system architecture; inter-organizaonal agreements and procedures; contracts; system security plan; privacy plan; personally idenﬁable informaon processing policy; other relevant documents or records].

SR-04-Interview

SR-04-Test

[SELECT FROM: Organizaonal processes for idenfying the provenance of crical systems and crical system components; mechanisms used to document, monitor, or maintain provenance].

PROVENANCE | IDENTITY ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

SR-04(01)_ODP

supply chain elements, processes, and personnel associated with systems and crical system components that require unique idenﬁcaon are deﬁned;

SR-04(01)[01]

unique idenﬁcaon of <SR-04(01)_ODP supply chain elements, processes, and personnel> is established;

SR-04(01)[02]

unique idenﬁcaon of <SR-04(01)_ODP supply chain elements, processes, and personnel> is maintained.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 671

NIST SP 800-53A, REV. 5

SR-04(01)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

PROVENANCE | IDENTITY POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SR-04(02)

SR-04(01)-Examine

[SELECT FROM: Supply chain risk management policy and procedures; supply chain risk management plan; system and services acquision policy; procedures addressing supply chain protecon; procedures addressing the integraon of informaon security requirements into the acquision process; list of supply chain elements, processes, and actors (associated with the system, system component, or system service) requiring implementaon of unique idenﬁcaon processes, procedures, tools, mechanisms, equipment, techniques, and/or conﬁguraons; system security plan; other relevant documents or records].

SR-04(01)-Interview

[SELECT FROM: Organizaonal personnel with system and services acquision responsibilies; organizaonal personnel with informaon security responsibilies; organizaonal personnel with supply chain protecon responsibilies; organizaonal personnel with responsibilies for establishing and retaining the unique idenﬁcaon of supply chain elements, processes, and actors].

SR-04(01)-Test

[SELECT FROM: Organizaonal processes for deﬁning, establishing, and retaining unique idenﬁcaon for supply chain elements, processes, and actors; mechanisms supporng and/or implemenng the deﬁnion, establishment, and retenon of unique idenﬁcaon for supply chain elements, processes, and actors].

PROVENANCE | TRACK AND TRACE ASSESSMENT OBJECTIVE: Determine if:

SR-04(02)_ODP

systems and crical system components that require unique idenﬁcaon for tracking through the supply chain are deﬁned;

SR-04(02)[01]

the unique idenﬁcaon of <SR-04(02)_ODP systems and crical system components> is established for tracking through the supply chain;

SR-04(02)[02]

the unique idenﬁcaon of <SR-04(02)_ODP systems and crical system components> is maintained for tracking through the supply chain.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

SR-04(02)-Examine

[SELECT FROM: Supply chain risk management policy and procedures; system and services acquision policy; procedures addressing supply chain protecon; procedures addressing the integraon of informaon security requirements into the acquision process; supply chain risk management plan; list of supply chain elements, processes, and actors (associated with the system, system component, or system service) requiring implementaon of unique idenﬁcaon processes, procedures, tools, mechanisms, equipment, techniques, and/or conﬁguraons; system security plan; other relevant documents or records].

SR-04(02)-Interview

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 672

NIST SP 800-53A, REV. 5

SR-04(02)

PROVENANCE | TRACK AND TRACE SR-04(02)-Test

SR-04(03)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

PROVENANCE | VALIDATE AS GENUINE AND NOT ALTERED ASSESSMENT OBJECTIVE:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

Determine if:

SR-04(03)_ODP[01]

controls to validate that the system or system component received is genuine are deﬁned;

SR-04(03)_ODP[02]

controls to validate that the system or system component received has not been altered are deﬁned;

SR-04(03)[01]

<SR-04(03)_ODP[01] controls> are employed to validate that the system or system component received is genuine;

SR-04(03)[02]

<SR-04(03)_ODP[02] controls> are employed to validate that the system or system component received has not been altered.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SR-04(04)

SR-04(03)-Examine

[SELECT FROM: Supply chain risk management policy and procedures; supply chain risk management plan; system and services acquision policy; procedures addressing supply chain protecon; procedures addressing the security design principle of trusted components used in the speciﬁcaon, design, development, implementaon, and modiﬁcaon of the system; system design documentaon; procedures addressing the integraon of informaon security requirements into the acquision process; solicitaon documentaon; acquision documentaon; service level agreements; acquision contracts for the system, system component, or system service; evidenary documentaon (including applicable conﬁguraons) indicang that the system or system component is genuine and has not been altered; system security plan; other relevant documents or records].

SR-04(03)-Interview

SR-04(03)-Test

[SELECT FROM: Organizaonal processes for deﬁning and employing validaon safeguards; mechanisms supporng and/or implemenng the deﬁnion and employment of validaon safeguards; mechanisms supporng the applicaon of the security design principle of trusted components in system speciﬁcaon, design, development, implementaon, and modiﬁcaon].

PROVENANCE | SUPPLY CHAIN INTEGRITY — PEDIGREE ASSESSMENT OBJECTIVE: Determine if:

SR-04(04)_ODP[01]

CHAPTER FOUR

controls employed to ensure that the integrity of the system and system component are deﬁned;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 673

NIST SP 800-53A, REV. 5

SR-04(04)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

PROVENANCE | SUPPLY CHAIN INTEGRITY — PEDIGREE SR-04(04)_ODP[02]

an analysis method to be conducted to validate the internal composion and provenance of crical or mission-essenal technologies, products, and services to ensure the integrity of the system and system component is deﬁned;

SR-04(04)[01]

<SR-04(04)_ODP[01] controls> are employed to ensure the integrity of the system and system components;

SR-04(04)[02]

<SR-04(04)_ODP[02] analysis method> is conducted to ensure the integrity of the system and system components.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SR-05

SR-04(04)-Examine

[SELECT FROM: Supply chain risk management policy and procedures; supply chain risk management plan; system and services acquision policy; procedures addressing supply chain protecon; bill of materials for crical systems or system components; acquision documentaon; soware idenﬁcaon tags; manufacturer declaraons of plaorm aributes (e.g., serial numbers, hardware component inventory) and measurements (e.g., ﬁrmware hashes) that are ghtly bound to the hardware itself; system security plan; other relevant documents or records].

SR-04(04)-Interview

SR-04(04)-Test

[SELECT FROM: Organizaonal processes for idenfying pedigree informaon; organizaonal processes to determine and validate the integrity of the internal composion of crical systems and crical system components; mechanisms to determine and validate the integrity of the internal composion of crical systems and crical system components].

ACQUISITION STRATEGIES, TOOLS, AND METHODS ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

SR-05_ODP

acquision strategies, contract tools, and procurement methods to protect against, idenfy, and migate supply chain risks are deﬁned;

SR-05[01]

<SR-05_ODP strategies, tools, and methods> are employed to protect against supply chain risks;

SR-05[02]

<SR-05_ODP strategies, tools, and methods> are employed to idenfy supply chain risks;

SR-05[03]

<SR-05_ODP strategies, tools, and methods> are employed to migate supply chain risks.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 674

NIST SP 800-53A, REV. 5

SR-05

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

ACQUISITION STRATEGIES, TOOLS, AND METHODS POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SR-05(01)

SR-05-Examine

[SELECT FROM: Supply chain risk management policy; supply chain risk management procedures; supply chain risk management plan; system and services acquision policy; system and services acquision procedures; procedures addressing supply chain protecon; procedures addressing the integraon of informaon security and privacy requirements into the acquision process; solicitaon documentaon; acquision documentaon (including purchase orders); service level agreements; acquision contracts for systems, system components, or services; documentaon of training, educaon, and awareness programs for personnel regarding supply chain risk; system security plan; privacy plan; other relevant documents or records].

SR-05-Interview

SR-05-Test

[SELECT FROM: Organizaonal processes for deﬁning and employing tailored acquision strategies, contract tools, and procurement methods; mechanisms supporng and/or implemenng the deﬁnion and employment of tailored acquision strategies, contract tools, and procurement methods].

ACQUISITION STRATEGIES, TOOLS, AND METHODS | ADEQUATE SUPPLY ASSESSMENT OBJECTIVE: Determine if:

SR-05(01)_ODP[01]

controls to ensure an adequate supply of crical system components are deﬁned;

SR-05(01)_ODP[02]

crical system components of which an adequate supply is required are deﬁned;

SR-05(01)

<SR-05(01)_ODP[01] controls> are employed to ensure an adequate supply of <SR-05(01)_ODP[02] crical system components>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

SR-05(01)-Examine

[SELECT FROM: Supply chain risk management policy and procedures; supply chain risk management strategy; supply chain risk management plan; conngency planning documents; inventory of crical systems and system components; determinaon of adequate supply; system and services acquision policy; procedures addressing supply chain protecon; procedures addressing the integraon of informaon security requirements into the acquision process; procedures addressing the integraon of acquision strategies, contract tools, and procurement methods into the acquision process; solicitaon documentaon; acquision documentaon; service level agreements; acquision contracts for systems or services; purchase orders/requisions for the system, system component, or system service from suppliers; system security plan; other relevant documents or records].

SR-05(01)-Interview

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 675

NIST SP 800-53A, REV. 5

SR-05(01)

ACQUISITION STRATEGIES, TOOLS, AND METHODS | ADEQUATE SUPPLY SR-05(01)-Test

SR-05(02)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

ACQUISITION STRATEGIES, TOOLS, AND METHODS | ASSESSMENTS PRIOR TO SELECTION, ACCEPTANCE, MODIFICATION, OR UPDATE

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

ASSESSMENT OBJECTIVE: Determine if:

SR-05(02)[01]

the system, system component, or system service is assessed prior to selecon;

SR-05(02)[02]

the system, system component, or system service is assessed prior to acceptance;

SR-05(02)[03]

the system, system component, or system service is assessed prior to modiﬁcaon;

SR-05(02)[04]

the system, system component, or system service is assessed prior to update.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SR-06

SR-05(02)-Examine

[SELECT FROM: System security plan; system and services acquision policy; procedures addressing supply chain protecon; procedures addressing the integraon of informaon security requirements into the acquision process; security test and evaluaon results; vulnerability assessment results; penetraon tesng results; organizaonal risk assessment results; system security plan; other relevant documents or records].

SR-05(02)-Interview

SR-05(02)-Test

[SELECT FROM: Organizaonal processes for conducng assessments prior to selecon, acceptance, or update; mechanisms supporng and/or implemenng the conducng of assessments prior to selecon, acceptance, or update].

SUPPLIER ASSESSMENTS AND REVIEWS ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

SR-06_ODP

the frequency at which to assess and review the supply chain-related risks associated with suppliers or contractors and the systems, system components, or system services they provide is deﬁned;

SR-06

the supply chain-related risks associated with suppliers or contractors and the systems, system components, or system services they provide are assessed and reviewed <SR-06_ODP frequency>.

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 676

NIST SP 800-53A, REV. 5

SR-06

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

SUPPLIER ASSESSMENTS AND REVIEWS POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SR-06(01)

SR-06-Examine

[SELECT FROM: Supply chain risk management policy and procedures; supply chain risk management strategy; supply chain risk management plan; system and services acquision policy; procedures addressing supply chain protecon; procedures addressing the integraon of informaon security requirements into the acquision process; records of supplier due diligence reviews; system security plan; other relevant documents or records].

SR-06-Interview

SR-06-Test

[SELECT FROM: Organizaonal processes for conducng supplier reviews; mechanisms supporng and/or implemenng supplier reviews].

SUPPLIER ASSESSMENTS AND REVIEWS | TESTING AND ANALYSIS ASSESSMENT OBJECTIVE: Determine if:

SR-06(01)_ODP[01]

one or more of the following PARAMETER VALUES is/are selected: {organizaonal analysis; independent third-party analysis; organizaonal tesng; independent third-party tesng};

SR-06(01)_ODP[02]

supply chain elements, processes, and actors to be analyzed and tested are deﬁned;

SR-06(01)

<SR-06(01)_ODP[01] SELECTED PARAMETER VALUE(S)> is/are employed on <SR-06(01)_ODP[02] supply chain elements, processes, and actors> associated with the system, system component, or system service.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

SR-06(01)-Examine

[SELECT FROM: Supply chain risk management policy and procedures; supply chain risk management plan; system and services acquision policy; procedures addressing supply chain protecon; evidence of organizaonal analysis, independent third-party analysis, organizaonal penetraon tesng, and/or independent third-party penetraon tesng; list of supply chain elements, processes, and actors (associated with the system, system component, or system service) subject to analysis and/or tesng; system security plan; other relevant documents or records].

SR-06(01)-Interview

[SELECT FROM: Organizaonal personnel with system and services acquision responsibilies; organizaonal personnel with informaon security responsibilies; organizaonal personnel with supply chain risk management responsibilies; organizaonal personnel with responsibilies for analyzing and/or tesng supply chain elements, processes, and actors].

SR-06(01)-Test

[SELECT FROM: Organizaonal processes for deﬁning and employing methods of analysis/tesng of supply chain elements, processes, and actors; mechanisms supporng and/or implemenng the analysis/tesng of supply chain elements, processes, and actors].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 677

NIST SP 800-53A, REV. 5

SR-07

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

SUPPLY CHAIN OPERATIONS SECURITY ASSESSMENT OBJECTIVE: Determine if: SR-07_ODP

Operaons Security (OPSEC) controls to protect supply chain-related informaon for the system, system component, or system service are deﬁned;

SR-07

<SR-07_ODP OPSEC controls> are employed to protect supply chain-related informaon for the system, system component, or system service.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SR-08

SR-07-Examine

[SELECT FROM: Supply chain risk management plan; supply chain risk management procedures; system and services acquision policy; system and services acquision procedures; procedures addressing supply chain protecon; list of OPSEC controls to be employed; solicitaon documentaon; acquision documentaon; acquision contracts for the system, system component, or system service; records of all-source intelligence analyses; system security plan; privacy plan; other relevant documents or records].

SR-07-Interview

[SELECT FROM: Organizaonal personnel with acquision responsibilies; organizaonal personnel with informaon security and privacy responsibilies; organizaonal personnel with OPSEC responsibilies; organizaonal personnel with supply chain risk management responsibilies].

SR-07-Test

[SELECT FROM: Organizaonal processes for deﬁning and employing OPSEC safeguards; mechanisms supporng and/or implemenng the deﬁnion and employment of OPSEC safeguards].

NOTIFICATION AGREEMENTS ASSESSMENT OBJECTIVE: Determine if:

SR-08_ODP[01]

one or more of the following PARAMETER VALUES is/are selected: {noﬁcaon of supply chain compromises; <SR-08_ODP[02] results of assessments or audits>};

SR-08_ODP[02]

informaon for which agreements and procedures are to be established are deﬁned (if selected);

SR-08

agreements and procedures are established with enes involved in the supply chain for the system, system components, or system service for <SR-08_ODP[01] SELECTED PARAMETER VALUE(S)>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

SR-08-Examine

[SELECT FROM: Supply chain risk management policy and procedures; supply chain risk management plan; system and services acquision policy; procedures addressing supply chain protecon; acquision documentaon; service level agreements; acquision contracts for the system, system component, or system service; inter-organizaonal agreements and procedures; system security plan; other relevant documents or records].

SR-08-Interview

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 678

NIST SP 800-53A, REV. 5

SR-08

NOTIFICATION AGREEMENTS SR-08-Test

SR-09

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

[SELECT FROM: Organizaonal processes for establishing inter-organizaonal agreements and procedures with supply chain enes].

TAMPER RESISTANCE AND DETECTION ASSESSMENT OBJECTIVE: Determine if:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SR-09

a tamper protecon program is implemented for the system, system component, or system service.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SR-09(01)

SR-09-Examine

[SELECT FROM: Supply chain risk management policy and procedures; supply chain risk management plan; system and services acquision policy; procedures addressing supply chain protecon; procedures addressing tamper resistance and detecon; tamper protecon program documentaon; tamper protecon tools and techniques documentaon; tamper resistance and detecon tools and techniques documentaon; acquision documentaon; service level agreements; acquision contracts for the system, system component, or system service; system security plan; other relevant documents or records].

SR-09-Interview

[SELECT FROM: Organizaonal personnel with tamper protecon program responsibilies; organizaonal personnel with informaon security responsibilies; organizaonal personnel with supply chain risk management responsibilies].

SR-09-Test

[SELECT FROM: Organizaonal processes for the implementaon of the tamper protecon program; mechanisms supporng and/or implemenng the tamper protecon program].

TAMPER RESISTANCE AND DETECTION | MULTIPLE STAGES OF SYSTEM DEVELOPMENT LIFE CYCLE ASSESSMENT OBJECTIVE: Determine if: SR-09(01)

an-tamper technologies, tools, and techniques are employed throughout the system development life cycle.

POTENTIAL ASSESSMENT METHODS AND OBJECTS: SR-09(01)-Examine

CHAPTER FOUR

[SELECT FROM: Supply chain risk management policy and procedures; supply chain risk management plan; system and services acquision policy; procedures addressing tamper resistance and detecon; tamper protecon program documentaon; tamper protecon tools and techniques documentaon; tamper resistance and detecon tools (technologies) and techniques documentaon; system development life cycle documentaon; procedures addressing supply chain protecon; system development life cycle procedures; acquision documentaon; service level agreements; acquision contracts for the system, system component, or system service; inter-organizaonal agreements and procedures; system security plan; other relevant documents or records].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 679

NIST SP 800-53A, REV. 5

SR-09(01)

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SR-10

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

TAMPER RESISTANCE AND DETECTION | MULTIPLE STAGES OF SYSTEM DEVELOPMENT LIFE CYCLE SR-09(01)-Interview

[SELECT FROM: Organizaonal personnel with system and services acquision responsibilies; organizaonal personnel with informaon security responsibilies; organizaonal personnel with supply chain risk management responsibilies; organizaonal personnel with SDLC responsibilies].

SR-09(01)-Test

[SELECT FROM: Organizaonal processes for employing an-tamper technologies; mechanisms supporng and/or implemenng an-tamper technologies].

INSPECTION OF SYSTEMS OR COMPONENTS ASSESSMENT OBJECTIVE: Determine if:

SR-10_ODP[01]

systems or system components that require inspecon are deﬁned;

SR-10_ODP[02]

one or more of the following PARAMETER VALUES is/are selected: {at random; at <SR-10_ODP[03] frequency>; upon <SR-10_ODP[04] indicaons of need for inspecon>};

SR-10_ODP[03]

frequency at which to inspect systems or system components is deﬁned (if selected);

SR-10_ODP[04]

indicaons of the need for an inspecon of systems or system components are deﬁned (if selected);

SR-10

<SR-10_ODP[01] systems or system components> are inspected <SR-10_ODP[02] SELECTED PARAMETER VALUE(S)> to detect tampering.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SR-11

SR-10-Examine

[SELECT FROM: Supply chain risk management policy and procedures; supply chain risk management plan; system and services acquision policy; records of random inspecons; inspecon reports/results; assessment reports/results; acquision documentaon; service level agreements; acquision contracts for the system, system component, or system service; inter-organizaonal agreements and procedures; system security plan; other relevant documents or records].

SR-10-Interview

SR-10-Test

[SELECT FROM: Organizaonal processes for establishing inter-organizaonal agreements and procedures with supply chain enes; organizaonal processes to inspect for tampering].

COMPONENT AUTHENTICITY ASSESSMENT OBJECTIVE: Determine if:

SR-11_ODP[01]

CHAPTER FOUR

one or more of the following PARAMETER VALUES is/are selected: {source of counterfeit component; <SR-11_ODP[02] external reporng organizaons>; <SR-11_ODP[03] personnel or roles>};

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 680

NIST SP 800-53A, REV. 5

SR-11

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

COMPONENT AUTHENTICITY

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SR-11_ODP[02]

external reporng organizaons to whom counterfeit system components are to be reported is/are deﬁned (if selected);

SR-11_ODP[03]

personnel or roles to whom counterfeit system components are to be reported is/ are deﬁned (if selected);

SR-11a.[01]

an an-counterfeit policy is developed and implemented;

SR-11a.[02]

an-counterfeit procedures are developed and implemented;

SR-11a.[03]

the an-counterfeit procedures include the means to detect counterfeit components entering the system;

SR-11a.[04]

the an-counterfeit procedures include the means to prevent counterfeit components from entering the system;

SR-11b.

counterfeit system components are reported to <SR-11_ODP[01] SELECTED PARAMETER VALUE(S)>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SR-11(01)

SR-11-Examine

[SELECT FROM: Supply chain risk management policy and procedures; supply chain risk management plan; system and services acquision policy; ancounterfeit plan; an-counterfeit policy and procedures; media disposal policy; media protecon policy; incident response policy; reports nofying developers, manufacturers, vendors, contractors, and/or external reporng organizaons of counterfeit system components; acquision documentaon; service level agreements; acquision contracts for the system, system component, or system service; inter-organizaonal agreements and procedures; records of reported counterfeit system components; system security plan; other relevant documents or records].

SR-11-Interview

[SELECT FROM: Organizaonal personnel with system and service acquision responsibilies; organizaonal personnel with informaon security responsibilies; organizaonal personnel with supply chain risk management responsibilies; organizaonal personnel with responsibilies for an-counterfeit policies, procedures, and reporng].

SR-11-Test

[SELECT FROM: Organizaonal processes for counterfeit prevenon, detecon, and reporng; mechanisms supporng and/or implemenng an-counterfeit detecon, prevenon, and reporng].

COMPONENT AUTHENTICITY | ANTI-COUNTERFEIT TRAINING ASSESSMENT OBJECTIVE: Determine if:

CHAPTER FOUR

SR-11(01)_ODP

personnel or roles requiring training to detect counterfeit system components (including hardware, soware, and ﬁrmware) is/are deﬁned;

SR-11(01)

<SR-11(01)_ODP personnel or roles> are trained to detect counterfeit system components (including hardware, soware, and ﬁrmware).

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 681

NIST SP 800-53A, REV. 5

SR-11(01)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

COMPONENT AUTHENTICITY | ANTI-COUNTERFEIT TRAINING POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SR-11(02)

SR-11(01)-Examine

SR-11(01)-Interview

[SELECT FROM: Organizaonal personnel with informaon security responsibilies; organizaonal personnel with supply chain risk management responsibilies; organizaonal personnel with responsibilies for an-counterfeit policies, procedures, and training].

SR-11(01)-Test

[SELECT FROM: Organizaonal processes for an-counterfeit training].

COMPONENT AUTHENTICITY | CONFIGURATION CONTROL FOR COMPONENT SERVICE AND REPAIR ASSESSMENT OBJECTIVE: Determine if:

SR-11(02)_ODP

system components requiring conﬁguraon control are deﬁned;

SR-11(02)[01]

conﬁguraon control over <SR-11(02)_ODP system components> awaing service or repair is maintained;

SR-11(02)[02]

conﬁguraon control over serviced or repaired <SR-11(02)_ODP system components> awaing return to service is maintained.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

SR-11(03)

SR-11(02)-Examine

[SELECT FROM: Supply chain risk management policy and procedures; supply chain risk management plan; conﬁguraon control procedures; acquision documentaon; service level agreements; acquision contracts for the system component; inter-organizaonal agreements and procedures; system security plan; other relevant documents or records].

SR-11(02)-Interview

SR-11(02)-Test

[SELECT FROM: Organizaonal processes for establishing inter-organizaonal agreements and procedures with supply chain enes; organizaonal conﬁguraon control processes].

COMPONENT AUTHENTICITY | ANTI-COUNTERFEIT SCANNING ASSESSMENT OBJECTIVE: Determine if:

SR-11(03)_ODP

CHAPTER FOUR

the frequency at which to scan for counterfeit system components is deﬁned;

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 682

NIST SP 800-53A, REV. 5

SR-11(03)

ASSESSING SECURITY AND PRIVACY CONTROLS IN INFORMATION SYSTEMS AND ORGANIZATIONS

COMPONENT AUTHENTICITY | ANTI-COUNTERFEIT SCANNING SR-11(03)

scanning for counterfeit system components is conducted <SR-11(03)_ODP frequency>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

This publicaon is available free of charge from: hps://doi.org/10.6028/NIST.SP.800-53Ar5

SR-12

SR-11(03)-Examine

[SELECT FROM: Supply chain risk management policy and procedures; supply chain risk management plan; an-counterfeit policy and procedures; system design documentaon; system conﬁguraon sengs and associated documentaon; scanning tools and associated documentaon; scanning results; procedures addressing supply chain protecon; acquision documentaon; inter-organizaonal agreements and procedures; system security plan; other relevant documents or records].

SR-11(03)-Interview

[SELECT FROM: Organizaonal personnel with system and services acquision responsibilies; organizaonal personnel with informaon security responsibilies; organizaonal personnel with supply chain risk management responsibilies; organizaonal personnel with responsibilies for an-counterfeit policies and procedures; organizaonal personnel with responsibility for an-counterfeit scanning].

SR-11(03)-Test

[SELECT FROM: Organizaonal processes for scanning for counterfeit system components; mechanisms supporng and/or implemenng an-counterfeit scanning].

COMPONENT DISPOSAL ASSESSMENT OBJECTIVE: Determine if:

SR-12_ODP[01]

data, documentaon, tools, or system components to be disposed of are deﬁned;

SR-12_ODP[02]

techniques and methods for disposing of data, documentaon, tools, or system components are deﬁned;

SR-12

<SR-12_ODP[01] data, documentaon, tools, or system components> are disposed of using <SR-12_ODP[02] techniques and methods>.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

CHAPTER FOUR

SR-12-Examine

[SELECT FROM: Supply chain risk management policy and procedures; supply chain risk management plan; disposal procedures addressing supply chain protecon; media disposal policy; media protecon policy; disposal records for system components; documentaon of the system components idenﬁed for disposal; documentaon of the disposal techniques and methods employed for system components; system security plan; other relevant documents or records].

SR-12-Interview

[SELECT FROM: Organizaonal personnel with system component disposal responsibilies; organizaonal personnel with informaon security responsibilies; organizaonal personnel with supply chain protecon responsibilies].

SR-12-Test

[SELECT FROM: Organizaonal techniques and methods for system component disposal; mechanisms supporng and/or implemenng system component disposal].

Reference produced from open data hps://github.com/usnistgov/oscal-content

PAGE 683

REFERENCES LAWS, POLICIES, DIRECTIVES, REGULATIONS, STANDARDS, AND GUIDELINES 52 LAWS AND EXECUTIVE ORDERS

[EGOV]

E-Government Act [includes FISMA] (P.L. 107-347), December 2002. https://www.congress.gov/107/plaws/publ347/PLAW-107publ347.pdf

[FISMA]

Federal Information Security Modernization Act (P.L. 113-283), December 2014.

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53Ar5

https://www.govinfo.gov/app/details/PLAW-113publ283 [FOIA96]

Freedom of Information Act (FOIA), 5 U.S.C. § 552, As Amended By Public Law No. 104-231, 110 Stat. 3048, Electronic Freedom of Information Act Amendments of 1996. https://www.govinfo.gov/content/pkg/PLAW-104publ231/pdf/PLAW104publ231.pdf

[PRIVACT]

Privacy Act (P.L. 93-579), December 1974.

https://www.govinfo.gov/content/pkg/STATUTE-88/pdf/STATUTE-88-Pg1896.pdf [USC 3502]

“Definitions,” Title 44 U.S. Code, Sec. 3502. 2011 ed.

[USC 11101]

“Definitions,” Title 40 U.S. Code, Sec. 11101. 2018 ed.

https://www.govinfo.gov/app/details/USCODE-2011-title44/USCODE-2011-title44chap35-subchapI-sec3502 https://www.govinfo.gov/app/details/USCODE-2018-title40/USCODE-2018-title40subtitleIII-chap111-sec11101 POLICIES, DIRECTIVES, AND INSTRUCTIONS

[OMB A-130]

Office of Management and Budget Memorandum Circular A-130, Managing Information as a Strategic Resource, July 2016. https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/circulars/A130/a13 0revised.pdf

[OMB M-17-12]

Office of Management and Budget Memorandum 17-12, Preparing for and Responding to a Breach of Personally Identifiable Information

https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2017/ m-17-12_0.pdf [CNSSI 1253]

Committee on National Security Systems Instruction No. 1253, Security Categorization and Control Selection for National Security Systems, March 2014. https://www.cnss.gov/CNSS/issuances/Instructions.cfm

[CNSSI 4009]

Committee on National Security Systems Instruction No. 4009, Committee on National Security Systems (CNSS) Glossary, April 2015. https://www.cnss.gov/CNSS/issuances/Instructions.cfm

52 The references cited in this appendix are those external publications that directly support the FISMA and Privacy Projects at NIST. Additional NIST standards, guidelines, and interagency reports are also cited throughout this publication, including in the references section of the applicable control assessment procedures in Chapter Four. Direct links to the NIST website are provided to obtain access to those publications.

REFERENCES

PAGE 684

STANDARDS, GUIDELINES, AND REPORTS

[FIPS 140-3]

National Institute of Standards and Technology (2019) Security Requirements for Cryptographic Modules. (U.S. Department of Commerce, Washington, D.C.), Federal Information Processing Standards Publication (FIPS) 140-3. https://doi.org/10.6028/NIST.FIPS.140-3

[FIPS 199]

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53Ar5

National Institute of Standards and Technology (2004) Standards for Security Categorization of Federal Information and Information Systems. (U.S. Department of Commerce, Washington, D.C.), Federal Information Processing Standards Publication (FIPS) 199. https://doi.org/10.6028/NIST.FIPS.199

[FIPS 200]

National Institute of Standards and Technology (2006) Minimum Security Requirements for Federal Information and Information Systems. (U.S. Department of Commerce, Washington, D.C.), Federal Information Processing Standards Publication (FIPS) 200. https://doi.org/10.6028/NIST.FIPS.200

[ISO 15026]

International Organization for Standardization/International Electrotechnical Commission (2019) ISO/IEC/IEEE 15026-1:2019 — Systems and software engineering — Systems and software assurance — Part 1: Concepts and vocabulary https://www.iso.org/standard/73567.html

[ISO 15288]

International Organization for Standardization/International Electrotechnical Commission/Institute of Electrical and Electronics Engineers (2015) ISO/IEC/IEEE 15288:2015 — Systems and software engineering — Systems life cycle processes. https://www.iso.org/standard/63711.html

[ISO 15408]

[ISO 29100]

International Organization for Standardization/International Electrotechnical Commission (2009) ISO/IEC/IEEE 15408-1:2009 — Information technology — Security techniques — Evaluation criteria for IT security — Part 1: Introduction and general model. https://www.commoncriteriaportal.org/files/ccfiles/CCPART1V3.1R5.pdf International Organization for Standardization/International Electrotechnical Commission 29100:2011, Information technology— Security techniques—Privacy framework, December 2011. https://www.iso.org/standard/45123.html

[SP 800-18]

Swanson MA, Hash J, Bowen P (2006) Guide for Developing Security Plans for Federal Information Systems. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-18, Rev. 1. https://doi.org/10.6028/NIST.SP.800-18r1

[SP 800-30]

Joint Task Force Transformation Initiative (2012) Guide for Conducting Risk Assessments. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-30, Rev. 1. https://doi.org/10.6028/NIST.SP.800-30r1

REFERENCES

PAGE 685

[SP 800-37]

Joint Task Force (2018) Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-37, Rev. 2. https://doi.org/10.6028/NIST.SP.800-37r2

[SP 800-39]

Joint Task Force Transformation Initiative (2011) Managing Information Security Risk: Organization, Mission, and Information System View. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-39. https://doi.org/10.6028/NIST.SP.800-39

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53Ar5

[SP 800-40]

Souppaya MP, Scarfone KA (2013) Guide to Enterprise Patch Management Technologies. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-40, Rev. 3. https://doi.org/10.6028/NIST.SP.800-40r3

[SP 800-47]

Dempsey KL, Pillitteri VY, Regenscheid A (2021) Managing the Security of Information Exchanges. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-47, Rev. 1. https://doi.org/10.6028/NIST.SP.800-47r1

[SP 800-53]

Joint Task Force Transformation Initiative (2020) Security and Privacy Controls for Information Systems and Organizations. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-53, Rev. 5, Includes updates as of December 20, 2020. https://doi.org/10.6028/NIST.SP.800-53r5

[SP 800-53B]

Joint Task Force (2020) Control Baselines and Tailoring Guidance for Federal Information Systems and Organizations. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-53B. https://doi.org/10.6028/NIST.SP.800-53B

[SP 800-60-1]

Stine KM, Kissel RL, Barker WC, Fahlsing J, Gulick J (2008) Guide for Mapping Types of Information and Information Systems to Security Categories. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-60, Vol. 1, Rev. 1. https://doi.org/10.6028/NIST.SP.800-60v1r1

[SP 800-60-2]

Stine KM, Kissel RL, Barker WC, Lee A, Fahlsing J (2008) Guide for Mapping Types of Information and Information Systems to Security Categories: Appendices. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-60, Vol. 2, Rev. 1. https://doi.org/10.6028/NIST.SP.800-60v2r1

[SP 800-115]

Scarfone KA, Souppaya MP, Cody A, Orebaugh AD (2008) Technical Guide to Information Security Testing and Assessment. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-115. https://doi.org/10.6028/NIST.SP.800-115

REFERENCES

PAGE 686

[SP 800-128]

Johnson LA, Dempsey KL, Ross RS, Gupta S, Bailey D (2011) Guide for Security-Focused Configuration Management of Information Systems. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-128, Includes updates as of October 10, 2019. https://doi.org/10.6028/NIST.SP.800-128

[SP 800-137]

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53Ar5

Dempsey KL, Chawla NS, Johnson LA, Johnston R, Jones AC, Orebaugh AD, Scholl MA, Stine KM (2011) Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-137. https://doi.org/10.6028/NIST.SP.800-137

[SP 800-137A]

Dempsey KL, Pillitteri VY, Baer C, Niemeyer R, Rudman R, Urban S (2020) Assessing Information Security Continuous Monitoring (ISCM) Programs: Developing an ISCM Program Assessment. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-137A. https://doi.org/10.6028/NIST.SP.800-137A

[SP 800-161]

Boyens JM, Paulsen C, Moorthy R, Bartol N (2015) Supply Chain Risk Management Practices for Federal Information Systems and Organizations. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-161. https://doi.org/10.6028/NIST.SP.800-161

[SP 800-181]

Petersen R, Santos D, Smith MC, Wetzel KA, Witte G (2020) Workforce Framework for Cybersecurity (NICE Framework). (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-181, Rev. 1. https://doi.org/10.6028/NIST.SP.800-181r1

[IR 8011-1]

Dempsey KL, Eavy P, Moore G (2017) Automation Support for Security Control Assessments: Volume 1: Overview. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Interagency or Internal Report (IR) 8011, Volume 1. https://doi.org/10.6028/NIST.IR.8011-1

[IR 8011-2]

Dempsey KL, Eavy P, Moore G (2017) Automation Support for Security Control Assessments: Volume 2: Hardware Asset Management. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Interagency or Internal Report (IR) 8011, Volume 2. https://doi.org/10.6028/NIST.IR.8011-2

[IR 8011-3]

Dempsey KL, Eavy P, Goren N, Moore G (2018) Automation Support for Security Control Assessments: Volume 3: Software Asset Management. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Interagency or Internal Report (IR) 8011, Volume 3. https://doi.org/10.6028/NIST.IR.8011-3

REFERENCES

PAGE 687

[IR 8011-4]

Dempsey KL, Takamura E, Eavy P, Moore G (2020) Automation Support for Security Control Assessments: Volume 4: Software Vulnerability Management. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Interagency or Internal Report (IR) 8011, Volume 4. https://doi.org/10.6028/NIST.IR.8011-4

[IR 8062]

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53Ar5

Brooks S, Garcia M, Lefkovitz N, Lightman S, Nadeau E (2017) An Introduction to Privacy Engineering and Risk Management in Federal Systems. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Interagency or Internal Report (IR) 8062. https://doi.org/10.6028/NIST.IR.8062

WHITE PAPERS, WEBSITES, AND DATA SETS

[FedRAMP]

General Services Administration (2022) Federal Risk and Authorization Management Program (FedRAMP). https://www.fedramp.gov

[NARA CUI]

National Archives and Records Administration (2022) Controlled Unclassified Information (CUI) Registry. https://www.archives.gov/cui

[OSCAL]

National Institute of Standards and Technology (2022) OSCAL: the Open Security Controls Assessment Language. https://pages.nist.gov/OSCAL/

[OSCAL content]

National Institute of Standards and Technology (2022) oscal-content [usnistgov Git Repository]. https://github.com/usnistgov/oscal-content

[SEI]

Weinstock CB, Lipson HF, Goodenough J (2007) Arguing Security – Creating Security Assurance Cases. (Software Engineering Institute, Carnegie Mellon University, Pittsburg, PA.).

https://resources.sei.cmu.edu/asset_files/WhitePaper/2013_019_001_293637.pdf

REFERENCES

PAGE 688

APPENDIX A

GLOSSARY COMMON TERMS AND DEFINITIONS

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53Ar5

Appendix A provides definitions for terminology used in NIST SP 800-53A. For other terminology in this publication, refer to the glossary in [SP 800-53], Revision 5. Sources for terms used in this publication are cited as applicable. Where no citation is noted, the source of the definition is Special Publication 800-53A. activities

An assessment object that includes specific protection-related pursuits or actions supporting a system that involves people (e.g., conducting system backup operations, monitoring network traffic).

adequate security

Security protections commensurate with the risk resulting from the unauthorized access, use, disclosure, disruption, modification, or destruction of information. This includes ensuring that information hosted on behalf of an agency and information systems and applications used by the agency operate effectively and provide appropriate confidentiality, integrity, and availability protections through the application of cost-effective security controls.

agency

Any executive agency or department, military department, Federal Government corporation, Federal Governmentcontrolled corporation, or other establishment in the Executive Branch of the Federal Government, or any independent regulatory agency. See executive agency.

assessment

See control assessment or risk assessment.

assessment findings

Assessment results produced by the application of an assessment procedure to a security control, privacy control, or control enhancement to achieve an assessment objective; the execution of a determination statement within an assessment procedure by an assessor that results in either a satisfied or other than satisfied condition.

assessment method

One of three types of actions (i.e., examine, interview, test) taken by assessors in obtaining evidence during an assessment.

assessment object

The item (i.e., specifications, mechanisms, activities, individuals) upon which an assessment method is applied during an assessment.

[OMB A-130]

APPENDIX A

PAGE 689

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53Ar5

assessment objective

A set of determination statements that expresses the desired outcome for the assessment of a security control, privacy control, or control enhancement.

assessment plan

The objectives for the security and privacy control assessments and a detailed roadmap of how to conduct such assessments.

assessment procedure

A set of assessment objectives and an associated set of assessment methods and assessment objects.

assessment report

See control assessment report.

assessor

The individual, group, or organization responsible for conducting a security or privacy control assessment.

assignment operation

A control parameter that allows an organization to assign a specific, organization-defined value to the control or control enhancement (e.g., assigning a list of roles to be notified or a value for the frequency of testing). See organization-defined parameters and selection operation.

assurance

Grounds for justified confidence that a [security or privacy] claim has been or will be achieved.

[ISO 15026, Adapted]

Note 1: Assurance is typically obtained relative to a set of specific claims. The scope and focus of such claims may vary (e.g., security claims, safety claims) and the claims themselves may be interrelated. Note 2: Assurance is obtained through techniques and methods that generate credible evidence to substantiate claims.

assurance case [SEI]

A structured set of arguments and a body of evidence showing that a system satisfies specific claims with respect to a given quality attribute.

authorization

Access privileges granted to a user, program, or process or the act of granting those privileges.

authorization boundary

All components of an information system to be authorized for operation by an authorizing official. This excludes separately authorized systems to which the information system is connected.

authorization to operate

The official management decision given by a senior Federal official or officials to authorize operation of an information system and to explicitly accept the risk to agency operations (including mission, functions, image, or reputation), agency assets, individuals, other organizations, and the Nation based on the implementation of an agreed-upon set of security and privacy controls. Authorization also applies to common controls inherited by agency information systems.

[CNSSI 4009]

[OMB A-130]

APPENDIX A

PAGE 690

authorizing official

A senior Federal official or executive with the authority to authorize (i.e., assume responsibility for) the operation of an information system or the use of a designated set of common controls at an acceptable level of risk to agency operations (including mission, functions, image, or reputation), agency assets, individuals, other organizations, and the Nation.

availability [FISMA] baseline

Ensuring timely and reliable access to and use of information.

[OMB A-130]

See control baseline.

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53Ar5

basic testing

A test methodology that assumes no knowledge of the internal structure and implementation detail of the assessment object.

boundary

Physical or logical perimeter of a system. See also authorization boundary and interface.

breach

The loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where: a person other than an authorized user accesses or potentially accesses personally identifiable information; or an authorized user accesses personally identifiable information for another than authorized purpose.

breadth

An attribute associated with an assessment method that addresses the scope or coverage of the assessment objects included with the assessment.

capability

A combination of mutually reinforcing security and/or privacy controls implemented by technical, physical, and procedural means. Such controls are typically selected to achieve a common information security- or privacy-related purpose.

chief information officer

The senior official that provides advice and other assistance to the head of the agency and other senior management personnel of the agency to ensure that IT is acquired and information resources are managed for the agency in a manner that achieves the agency’s strategic goals and information resources management goals; and is responsible for ensuring agency compliance with, and prompt, efficient, and effective implementation of, the information policies and information resources management responsibilities, including the reduction of information collection burdens on the public.

chief information security officer chief privacy officer

See senior agency information security officer.

common control

A security or privacy control that is inherited by multiple information systems or programs.

[CNSSI 4009] [OMB M-17-12]

[OMB A-130]

APPENDIX A

See senior agency official for privacy.

PAGE 691

common control provider

An organizational official responsible for the development, implementation, assessment, and monitoring of common controls (i.e., security or privacy controls inheritable by systems).

compensating controls [SP 800-53B]

The security and privacy controls employed in lieu of the controls in the baselines described in NIST Special Publication 800-53B that provide equivalent or comparable protection for a system or organization.

component

See system component.

comprehensive testing

A test methodology that assumes explicit and substantial knowledge of the internal structure and implementation detail of the assessment object.

confidentiality [FISMA]

Preserving authorized restrictions on information access and disclosure, including means for protecting personal privacy and proprietary information.

[SP 800-137]

continuous monitoring

Maintaining ongoing awareness to support organizational risk decisions.

control

See security control or privacy control.

control assessment

The testing or evaluation of the controls in an information system or an organization to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting the security or privacy requirements for the system or the organization.

control assessment report [SP 800-37]

Documentation of the results of security and privacy control assessments, including information based on assessor findings and recommendations for correcting deficiencies in the implemented controls.

control assessor

See assessor.

control baseline

Predefined sets of controls specifically assembled to address the protection needs of groups, organizations, or communities of interest. See privacy control baseline or security control baseline.

control effectiveness

A measure of whether a security or privacy control contributes to the reduction of information security or privacy risk.

control enhancement

Augmentation of a security or privacy control to build in additional but related functionality to the control, increase the strength of the control, or add assurance to the control.

[SP 800-37]

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53Ar5

[SP 800-37]

[SP 800-53B]

APPENDIX A

PAGE 692

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53Ar5

control inheritance

A situation in which a system or application receives protection from security or privacy controls (or portions of controls) that are developed, implemented, assessed, authorized, and monitored by entities other than those responsible for the system or application; entities either internal or external to the organization where the system or application resides. See common control.

control parameter

See organization-defined l parameter.

countermeasures

Actions, devices, procedures, techniques, or other measures that reduce the vulnerability of a system. Synonymous with security controls and safeguards.

coverage

An attribute associated with an assessment method that addresses the scope or breadth of the assessment objects included in the assessment (e.g., types of objects to be assessed and the number of objects to be assessed by type). The values for the coverage attribute, hierarchically from less coverage to more coverage, are basic, focused, and comprehensive.

depth

An attribute associated with an assessment method that addresses the rigor and level of detail associated with the application of the method.

environment of operation

The physical surroundings in which an information system processes, stores, and transmits information.

examine

A type of assessment method that is characterized by the process of checking, inspecting, reviewing, observing, studying, or analyzing one or more assessment objects to facilitate understanding, achieve clarification, or obtain evidence, the results of which are used to support the determination of security control or privacy control effectiveness over time.

executive agency

An executive department specified in 5 U.S.C., Sec. 101; a military department specified in 5 U.S.C., Sec. 102; an independent establishment as defined in 5 U.S.C., Sec. 104(1); and a wholly owned Government corporation fully subject to the provisions of 31 U.S.C., Chapter 91.

federal agency

See executive agency.

federal information system

An information system used or operated by an executive agency, by a contractor of an executive agency, or by another organization on behalf of an executive agency.

focused testing

A test methodology that assumes some knowledge of the internal structure and implementation detail of the assessment object.

[FIPS 200]

[OMB A-130]

APPENDIX A

PAGE 693

firmware

Computer programs and data stored in hardware – typically in read-only memory (ROM) or programmable read-only memory (PROM) – such that the programs and data cannot be dynamically written or modified during execution of the programs. See hardware and software.

hardware

The material physical components of a system. See software and firmware.

high-impact system

A system in which at least one security objective (i.e., confidentiality, integrity, or availability) is assigned a FIPS Publication 199 potential impact value of high.

[CNSSI 4009]

[CNSSI 4009] [FIPS 200]

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53Ar5

hybrid control [OMB A-130]

individuals

A security or privacy control that is implemented for an information system in part as a common control and in part as a system-specific control. An assessment object that includes people applying specifications, mechanisms, or activities.

impact

The effect on organizational operations, organizational assets, individuals, other organizations, or the Nation (including the national security interests of the United States) of a loss of confidentiality, integrity, or availability of information or a system.

impact value

The assessed worst-case potential impact that could result from a compromise of the confidentiality, integrity, or availability of information expressed as a value of low, moderate, or high.

information

Any communication or representation of knowledge such as facts, data, or opinions in any medium or form, including textual, numerical, graphic, cartographic, narrative, electronic, or audiovisual forms.

information owner

Official with statutory or operational authority for specified information and responsibility for establishing the controls for its generation, collection, processing, dissemination, and disposal.

information resources

Information and related resources, such as personnel, equipment, funds, and information technology.

information security

The protection of information and systems from unauthorized access, use, disclosure, disruption, modification, or destruction in order to provide confidentiality, integrity, and availability.

information security architecture

An embedded, integral part of the enterprise architecture that describes the structure and behavior of the enterprise security processes, security systems, personnel and organizational subunits, showing their alignment with the enterprise’s mission and strategic plans.

[FIPS 199]

[OMB A-130]

[SP 800-37]

[OMB A-130] [OMB A-130]

[OMB A-130]

APPENDIX A

PAGE 694

information security policy

Aggregate of directives, regulations, rules, and practices that prescribes how an organization manages, protects, and distributes information.

information security program plan

Formal document that provides an overview of the security requirements for an organization-wide information security program and describes the program management controls and common controls in place or planned for meeting those requirements.

information security risk

The risk to organizational operations (including mission, functions, image, reputation), organizational assets, individuals, other organizations, and the Nation due to the potential for unauthorized access, use, disclosure, disruption, modification, or destruction of information and/or systems.

information system

A discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information.

information technology

Any services, equipment, or interconnected system(s) or subsystem(s) of equipment, that are used in the automatic acquisition, storage, analysis, evaluation, manipulation, management, movement, control, display, switching, interchange, transmission, or reception of data or information by the agency. For purposes of this definition, such services or equipment if used by the agency directly or is used by a contractor under a contract with the agency that requires its use; or to a significant extent, its use in the performance of a service or the furnishing of a product. Information technology includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including cloud computing and help-desk services or other professional services which support any point of the life cycle of the equipment or service), and related resources. Information technology does not include any equipment that is acquired by a contractor incidental to a contract which does not require its use.

information type

A specific category of information (e.g., privacy, medical, proprietary, financial, investigative, contractor-sensitive, security management) defined by an organization or in some instances, by a specific law, Executive Order, directive, policy, or regulation.

integrity

Guarding against improper information modification or destruction, and includes ensuring information non-repudiation and authenticity.

[CNSSI 4009]

[OMB A-130]

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53Ar5

[SP 800-30]

[USC 3502]

[USC 11101]

[FIPS 199]

[FISMA]

APPENDIX A

PAGE 695

interview

A type of assessment method that is characterized by the process of conducting discussions with individuals or groups within an organization to facilitate understanding, achieve clarification, or lead to the location of evidence, the results of which are used to support the determination of security control and privacy control effectiveness over time.

low-impact system

A system in which all three security objectives (i.e., confidentiality, integrity, and availability) are assigned a FIPS Publication 199 potential impact value of low.

mechanisms

An assessment object that includes specific protection-related items (e.g., hardware, software, or firmware).

moderate-impact system

A system in which at least one security objective (i.e., confidentiality, integrity, or availability) is assigned a FIPS Publication 199 potential impact value of moderate and no security objective is assigned a potential impact value of high.

national security system

Any system (including any telecommunications system) used or operated by an agency or by a contractor of an agency, or other organization on behalf of an agency—(i) the function, operation, or use of which involves intelligence activities; involves cryptologic activities related to national security; involves command and control of military forces; involves equipment that is an integral part of a weapon or weapons system; or is critical to the direct fulfillment of military or intelligence missions (excluding a system that is to be used for routine administrative and business applications, for example, payroll, finance, logistics, and personnel management applications); or (ii) is protected at all times by procedures established for information that have been specifically authorized under criteria established by an Executive Order or an Act of Congress to be kept classified in the interest of national defense or foreign policy.

ongoing assessment

The continuous evaluation of the effectiveness of security control or privacy control implementation; with respect to security controls, a subset of Information Security Continuous Monitoring (ISCM) activities.

organization

An entity of any size, complexity, or positioning within an organizational structure, including federal agencies, private enterprises, academic institutions, state, local, or tribal governments, or as appropriate, any of their operational elements.

[FIPS 200]

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53Ar5

[FIPS 200]

[OMB A-130]

[FIPS 200, Adapted]

APPENDIX A

PAGE 696

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53Ar5

organization-defined parameter

The variable part of a control or control enhancement that is instantiated by an organization during the tailoring process by either assigning an organization-defined value or selecting a value from a predefined list provided as part of the control or control enhancement. See assignment operation and selection operation.

parameter

See organization-defined parameter.

penetration testing

A test methodology in which assessors, typically working under specific constraints, attempt to circumvent or defeat the security features of a system.

personally identifiable information

Information that can be used to distinguish or trace an individual’s identity, either alone or when combined with other information that is linked or linkable to a specific individual.

personally identifiable information processing [ISO 29100, Adapted]

An operation or set of operations performed upon personally identifiable information that can include, but is not limited to, the collection, retention, logging, generation, transformation, use, disclosure, transfer, and disposal of personally identifiable information.

personally identifiable information processing permissions

The requirements for how personally identifiable information can be processed or the conditions under which personally identifiable information can be processed.

plan of action and milestones

A document that identifies tasks that need to be accomplished. It details resources required to accomplish the elements of the plan, milestones for meeting the tasks, and the scheduled completion dates for the milestones.

potential impact

The loss of confidentiality, integrity, or availability could be expected to have a limited adverse effect (FIPS Publication 199 low); a serious adverse effect (FIPS Publication 199 moderate); or a severe or catastrophic adverse effect (FIPS Publication 199 high) on organizational operations, organizational assets, or individuals.

privacy architecture

An embedded, integral part of the enterprise architecture that describes the structure and behavior for an enterprise’s privacy protection processes, technical measures, personnel and organizational sub-units, showing their alignment with the enterprise’s mission and strategic plans.

privacy capability

See capability.

privacy control

The administrative, technical, and physical safeguards employed within an agency to ensure compliance with applicable privacy requirements and manage privacy risks.

[OMB A-130]

[FIPS 199]

[SP 800-37]

[OMB A-130]

APPENDIX A

PAGE 697

privacy control baseline

The set of privacy controls selected based on the privacy selection criteria that provide a starting point for the tailoring process.

privacy impact assessment

An analysis of how information is handled to ensure handling conforms to applicable legal, regulatory, and policy requirements regarding privacy; to determine the risks and effects of creating, collecting, using, processing, storing, maintaining, disseminating, disclosing, and disposing of information in identifiable form in an electronic information system; and to examine and evaluate protections and alternate processes for handling information to mitigate potential privacy concerns. A privacy impact assessment is both an analysis and a formal document detailing the process and the outcome of the analysis.

privacy plan

A formal document that details the privacy controls selected for an information system or environment of operation that are in place or planned for meeting applicable privacy requirements and managing privacy risks, details how the controls have been implemented, and describes the methodologies and metrics that will be used to assess the controls.

privacy program plan

A formal document that provides an overview of an agency’s privacy program, including a description of the structure of the privacy program, the resources dedicated to the privacy program, the role of the Senior Agency Official for Privacy and other privacy officials and staff, the strategic goals and objectives of the privacy program, and the program management controls and common controls in place or planned for meeting applicable privacy requirements and managing privacy risks. Requirements of an organization, information program, or system that are derived from applicable laws, Executive Orders, directives, policies, standards, instructions, regulations, procedures, or organizational mission and business case needs with respect to privacy. Note: The term privacy requirement can be used in a variety of contexts from high-level policy activities to low-level implementation activities in system development and engineering disciplines.

[OMB A-130]

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53Ar5

[OMB A-130]

privacy requirements

reciprocity [SP 800-37]

APPENDIX A

Agreement among participating organizations to accept each other’s security assessments to reuse system resources and/or to accept each other’s assessed security posture to share information.

PAGE 698

records

All recorded information, regardless of form or characteristics, made or received by a Federal agency under Federal law or in connection with the transaction of public business and preserved or appropriate for preservation by that agency or its legitimate successor as evidence of the organization, functions, policies, decisions, procedures, operations, or other activities of the United States Government or because of the informational value of data in them.

risk

A measure of the extent to which an entity is threatened by a potential circumstance or event, and typically is a function of: (i) the adverse impact, or magnitude of harm, that would arise if the circumstance or event occurs; and (ii) the likelihood of occurrence.

risk assessment

The process of identifying risks to organizational operations (including mission, functions, image, reputation), organizational assets, individuals, other organizations, and the Nation, resulting from the operation of a system. Risk management includes threat and vulnerability analyses as well as analyses of adverse effects on individuals arising from information processing and considers mitigations provided by security and privacy controls planned or in place. Synonymous with risk analysis.

[OMB A-130]

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53Ar5

[OMB A-130]

[SP 800-39]

[IR 8062, adapted]

risk executive (function)

An individual or group within an organization that helps to ensure that security risk-related considerations for individual systems, to include the authorization decisions for those systems, are viewed from an organization-wide perspective with regard to the overall strategic goals and objectives of the organization in carrying out its mission and business functions; and managing risk from individual systems is consistent across the organization, reflects organizational risk tolerance, and is considered along with other organizational risks affecting mission or business success.

risk management

The program and supporting processes to manage risk to agency operations (including mission, functions, image, reputation), agency assets, individuals, other organizations, and the Nation, and includes: establishing the context for risk-related activities; assessing risk; responding to risk once determined; and monitoring risk over time.

risk mitigation

Prioritizing, evaluating, and implementing the appropriate riskreducing controls/countermeasures recommended from the risk management process.

risk response

Accepting, avoiding, mitigating, sharing, or transferring risk to agency operations, agency assets, individuals, other organizations, or the Nation.

[SP 800-37]

[OMB A-130]

[CNSSI 4009]

[OMB A-130]

APPENDIX A

PAGE 699

risk tolerance

The level of risk or the degree of uncertainty that is acceptable to an organization.

scoping considerations

A part of tailoring guidance that provides organizations with specific considerations on the applicability and implementation of security and privacy controls in the control baselines. Considerations include policy or regulatory, technology, physical infrastructure, system component allocation, public access, scalability, common control, operational or environmental, and security objective.

security

A condition that results from the establishment and maintenance of protective measures that enable an organization to perform its mission or critical functions despite risks posed by threats to its use of systems. Protective measures may involve a combination of deterrence, avoidance, prevention, detection, recovery, and correction that should form part of the organization’s risk management approach.

security capability

See capability.

security categorization

The process of determining the security category for information or a system. Security categorization methodologies are described in CNSS Instruction 1253 for national security systems and in FIPS Publication 199 for other than national security systems. See security category.

security category

The characterization of information or an information system based on an assessment of the potential impact that a loss of confidentiality, integrity, or availability of such information or information system would have on agency operations, agency assets, individuals, other organizations, and the Nation.

security control

The safeguards or countermeasures prescribed for an information system or an organization to protect the confidentiality, integrity, and availability of the system and its information.

security control baseline

The set of minimum security controls defined for a low-impact, moderate-impact, or high-impact information system.

security functionality

The security-related features, functions, mechanisms, services, procedures, and architectures implemented within organizational information systems or the environments in which those systems operate.

security objective

Confidentiality, integrity, or availability.

[SP 800-39]

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53Ar5

[CNSSI 4009]

[OMB A-130]

[FIPS 199]

APPENDIX A

PAGE 700

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53Ar5

security plan

A formal document that provides an overview of the security requirements for an information system or an information security program and describes the security controls in place or planned for meeting those requirements. The system security plan describes the system components that are included within the system, the environment in which the system operates, how the security requirements are implemented, and the relationships with or connections to other systems. See system security plan.

security requirement

A requirement levied on an information system or an organization that is derived from applicable laws, executive orders, directives, regulations, policies, standards, procedures, or mission/business needs to ensure the confidentiality, integrity, and availability of information that is being processed, stored, or transmitted.

[FIPS 200, Adapted]

Note: Security requirements can be used in a variety of contexts from highlevel policy-related activities to low-level implementation-related activities in system development and engineering disciplines.

selection operation

A control parameter that allows an organization to select a value from a list of predefined values provided as part of the control or control enhancement (e.g., selecting to either restrict an action or prohibit an action). See assignment operation and organization-defined parameter.

senior agency information security officer

Official responsible for carrying out the Chief Information Officer responsibilities under FISMA and serving as the Chief Information Officer’s primary liaison to the agency’s authorizing officials, information system owners, and information system security officers. Note: Organizations subordinate to federal agencies may use the term senior information security officer or chief information security officer to denote individuals who fill positions with similar responsibilities to senior agency information security officers.

senior agency official for privacy

Senior official, designated by the head of each agency, who has agency-wide responsibility for privacy, including implementation of privacy protections; compliance with Federal laws, regulations, and policies relating to privacy; management of privacy risks at the agency; and a central policy-making role in the agency’s development and evaluation of legislative, regulatory, and other policy proposals.

senior information security officer software

See senior agency information security officer.

[OMB A-130]

[CNSSI 4009]

APPENDIX A

Computer programs and associated data that may be dynamically written or modified during execution.

PAGE 701

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53Ar5

specification

An assessment object that includes document-based artifacts (e.g., policies, procedures, plans, system security requirements, functional specifications, architectural designs) associated with a system.

subject

An individual, process, or device that causes information to flow among objects or change to the system state. Also see object.

supply chain

Linked set of resources and processes between and among multiple tiers of organizations, each of which is an acquirer, that begins with the sourcing of products and services and extends through their life cycle.

supply chain risk

The potential for harm or compromise that arises as a result of security risks from suppliers, their supply chains, and their products or services. Supply chain risks include exposures, threats, and vulnerabilities associated with the products and services traversing the supply chain as well as the exposures, threats, and vulnerabilities to the supply chain.

supply chain risk assessment

A systematic examination of supply chain risks, likelihoods of their occurrence, and potential impacts.

supply chain risk management

A systematic process for managing cyber supply chain risk exposures, threats, and vulnerabilities throughout the supply chain and developing risk response strategies to the risks presented by the supplier, the supplied products and services, or the supply chain.

system

Any organized assembly of resources and procedures united and regulated by interaction or interdependence to accomplish a set of specific functions.

[CNSSI 4009]

Note: Systems also include specialized systems such as industrial control systems, telephone switching and private branch exchange (PBX) systems, and environmental control systems.

[ISO 15288]

Combination of interacting elements organized to achieve one or more stated purposes. Note 1: There are many types of systems. Examples include: general and special-purpose information systems; command, control, and communication systems; crypto modules; central processing unit and graphics processor boards; industrial control systems; flight control systems; weapons, targeting, and fire control systems; medical devices and treatment systems; financial, banking, and merchandising transaction systems; and social networking systems. Note 2: The interacting elements in the definition of system include hardware, software, data, humans, processes, facilities, materials, and naturally occurring physical entities. Note 3: System-of-systems is included in the definition of system.

system component [SP 800-128]

APPENDIX A

A discrete identifiable information technology asset that represents a building block of a system and may include hardware, software, and firmware.

PAGE 702

system owner (or program manager)

Official responsible for the overall procurement, development, integration, modification, operation, and maintenance of a system.

system security officer

Individual with assigned responsibility for maintaining the appropriate operational security posture for a system or program.

system security plan

See security plan.

system-related privacy risk

Those risks that arise from the likelihood that a given operation the system is taking when processing PII could create an adverse effect on individuals—and the potential impact on individuals.

system-related security risk

Risk that arises through the loss of confidentiality, integrity, or availability of information or systems and that considers impacts to the organization (including assets, mission, functions, image, or reputation), individuals, other organizations, and the Nation. See risk.

system-specific control

A security or privacy control for an information system that is implemented at the system level and is not inherited by any other information system.

tailored control baseline

A set of controls that result from the application of tailoring guidance to a control baseline. See tailoring.

tailoring [SP 800-53B]

The process by which security control baselines are modified by: identifying and designating common controls, applying scoping considerations on the applicability and implementation of baseline controls, selecting compensating security controls, assigning specific values to organization-defined security control parameters, supplementing baselines with additional security controls or control enhancements, and providing additional specification information for control implementation.

tailoring assessment procedures

The process by which assessment procedures defined in SP 80053A are adjusted or scoped to match the characteristics of a system under assessment, providing organizations with the flexibility needed to meet specific organizational requirements and avoid overly constrained assessment approaches.

test

A type of assessment method that is characterized by the process of exercising one or more assessment objects under specified conditions to compare actual with expected behavior, the results of which are used to support the determination of security control or privacy control effectiveness over time.

threat

Any circumstance or event with the potential to adversely impact organizational operations, organizational assets, individuals, other organizations, or the Nation through a system via unauthorized access, destruction, disclosure, modification of information, and/or denial of service.

[SP 800-37]

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53Ar5

[SP 800-37, Adapted]

[SP 800-30]

[OMB A-130]

[SP 800-30]

APPENDIX A

PAGE 703

threat assessment

Formal description and evaluation of threat to an information system.

threat source

The intent and method targeted at the intentional exploitation of a vulnerability or a situation and method that may accidentally trigger a vulnerability. See threat agent.

trustworthiness

The attribute of a person or enterprise that provides confidence to others of the qualifications, capabilities, and reliability of that entity to perform specific tasks and fulfill assigned responsibilities.

trustworthiness (system)

The degree to which an information system (including the information technology components that are used to build the system) can be expected to preserve the confidentiality, integrity, and availability of the information being processed, stored, or transmitted by the system across the full range of threats. A trustworthy information system is believed to operate within defined levels of risk despite the environmental disruptions, human errors, structural failures, and purposeful attacks that are expected to occur in its environment of operation.

user

Individual, or (system) process acting on behalf of an individual, authorized to access a system. See organizational user and non-organizational user.

[SP 800-30]

vulnerability

Weakness in an information system, system security procedures, internal controls, or implementation that could be exploited or triggered by a threat source.

vulnerability analysis

See vulnerability assessment.

vulnerability assessment

Systematic examination of an information system or product to determine the adequacy of security measures, identify security deficiencies, provide data from which to predict the effectiveness of proposed security measures, and confirm the adequacy of such measures after implementation.

[CNSSI 4009] [FIPS 200]

[CNSSI 4009]

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53Ar5

[CNSSI 4009]

APPENDIX A

PAGE 704

APPENDIX B

ACRONYMS COMMON ABBREVIATIONS

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53Ar5

CDM

Continuous Diagnostics and Mitigation

CIO

Chief Information Officer

CISA

Cybersecurity and Infrastructure Security Agency

CISO

Chief Information Security Officer

CNSSI

Committee on National Security Systems Instruction

CONOPS

Concept of Operations

CUI

Controlled Unclassified Information

DNS

Domain Name System

DoD

Department of Defense

EMP

Electromagnetic pulse

FICAM

Federal Identity, Credential, and Access Management

FIPS

Federal Information Processing Standards

FISMA

Federal Information Security Modernization Act

FOIA

Freedom of Information Act

GSA

General Services Administration

HSPD

Homeland Security Presidential Directive

I/O

Input/Output

IEC

International Electrotechnical Commission

IEEE

Institute of Electrical and Electronics Engineers

Interagency Report or Internal Report

ISA

Interconnection Security Agreement

ISO

International Organization for Standardization

ISCM

Information Security Continuous Monitoring

Information Technology

ITL

Information Technology Laboratory

MOU

Memorandum of Understanding

MTTF

Mean Time to Failure

NIAP

National Information Assurance Partnership

APPENDIX B

PAGE 705

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53Ar5

NICE

National Initiative for Cybersecurity Education

NIST

National Institute of Standards and Technology

NSA

National Security Agency

ODNI

Office of the Director of National Intelligence

ODP

Organization-Defined Parameter

OMB

Office of Management and Budget

OPSEC

Operation Security

OSCAL

Open Security Control Assessment Language

PDF

Portable Document Format

PII

Personally Identifiable Information

PIV

Personal Identity Verification

PIV-I

Personal Identity Verification-Interoperable

PKI

Public Key Infrastructure

RMF

Risk Management Framework

SCRM

Supply Chain Risk Management

SDLC

System Development Life Cycle

Special Publication

UTC

Coordinated Universal Time

APPENDIX B

PAGE 706

APPENDIX C

ASSESSMENT METHOD DESCRIPTIONS ASSESSMENT METHOD DEFINITIONS, APPLICABLE OBJECTS, AND ATTRIBUTES

This appendix defines the three assessment methods that can be used by assessors during security and privacy control assessments: This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53Ar5

1. Examine 2. Interview 3. Test Included in the definition of each assessment method are types of objects to which the method can be applied. The application of each method is described in terms of the attributes of depth and coverage, progressing from basic to focused to comprehensive. The attribute values correlate to the assurance requirements specified by the organization. The depth attribute addresses the rigor and level of detail of the assessment. For the depth attribute, the focused attribute value includes and builds upon the assessment rigor and level of detail defined for the basic attribute value. The comprehensive attribute value includes and builds upon the assessment rigor and level of detail defined for the focused attribute value. The coverage attribute addresses the scope or breadth of the assessment. For the coverage attribute, the focused attribute value includes and builds upon the number and type of assessment objects defined for the basic attribute value. The comprehensive attribute value includes and builds upon the number and type of assessment objects defined for the focused attribute value. The use of bolded text in the assessment method description indicates content that was added and appears for the first time, signifying greater rigor and level of detail for the attribute value.

APPENDIX C

PAGE 707

Assessment Method

Examine

Assessment Objects:

Specifications (e.g., policies, plans, procedures, system requirements, designs) Mechanisms (e.g., functionality implemented in hardware, software, firmware) Activities (e.g., system operations, administration, management, exercises)

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53Ar5

Definition: The process of checking, inspecting, reviewing, observing, studying, or analyzing one or more assessment objects to facilitate understanding, achieve clarification, or obtain evidence, the results of which are used to support the determination of security and privacy control existence, functionality, correctness, completeness, and potential for improvement over time. Supplemental guidance: Typical assessor actions may include reviewing information security and privacy policies, plans, and procedures; analyzing system design documentation and interface specifications; observing system backup operations; reviewing the results of contingency plan exercises; observing incident response activities; studying technical manuals and user/administrator guides; checking, studying, or observing the operation of an information technology mechanism in the system hardware and software; or checking, studying, or observing physical security or privacy measures related to the operation of a system. Attributes: Depth, Coverage •

The depth attribute addresses the rigor of and level of detail in the examination process. There are three possible values for the depth attribute: basic, focused, and comprehensive. Basic examination: Examination that consists of high-level reviews, checks, observations, or inspections of the assessment object. The basic examination is conducted using a limited body of evidence or documentation (e.g., functionallevel descriptions for mechanisms; high-level process descriptions for activities; actual documents for specifications). Basic examinations provide a level of understanding of the security and privacy controls necessary for determining whether the controls are implemented and free of obvious errors. Focused examination: Examination that consists of high-level reviews, checks, observations, or inspections and more in-depth studies/analyses of the assessment object. The focused examination is conducted using a substantial body of evidence or documentation (e.g., functional-level descriptions and, where appropriate and available, high-level design information for mechanisms; high-level process descriptions and implementation procedures for activities; the actual documents and related documents for specifications). Focused examinations provide a level of understanding of the security and privacy controls necessary for determining whether the controls are implemented and free of obvious errors and whether there are increased

APPENDIX C

PAGE 708

grounds for confidence that the controls are implemented correctly and operating as intended.

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53Ar5

Comprehensive examination: Examination that consists of high-level reviews, checks, observations, or inspections and more in-depth, detailed, and thorough studies/analyses of the assessment object. The comprehensive examination is conducted using an extensive body of evidence or documentation (e.g., functional-level descriptions and, where appropriate and available, high-level design information, low-level design information, and implementation information for mechanisms; high-level process descriptions and detailed implementation procedures for activities; the actual documents and related documents for specifications 53). Comprehensive examinations provide a level of understanding of the security and privacy controls necessary for determining whether the controls are implemented and free of obvious errors, there are further increased grounds for confidence that the controls are implemented correctly and operating as intended on an ongoing and consistent basis, and there is support for continuous improvement in the effectiveness of the controls. •

The coverage attribute addresses the scope or breadth of the examination process and includes the types of assessment objects to be examined, the number of objects to be examined (by type), and specific objects to be examined. 54 There are three possible values for the coverage attribute: basic, focused, and comprehensive. Basic examination: Examination that uses a representative sample of assessment objects (by type and number within type) to provide the level of coverage necessary for determining whether the security and privacy controls are implemented and free of obvious errors. Focused examination: Examination that uses a representative sample of assessment objects (by type and number within type) and other specific assessment objects deemed particularly important to achieving the assessment objective to provide the level of coverage necessary for determining whether the security and privacy controls are implemented and free of obvious errors and whether there are increased grounds for confidence that the controls are implemented correctly and operating as intended. Comprehensive examination: Examination that uses a sufficiently large sample of assessment objects (by type and number within type) and other specific assessment objects deemed particularly important to achieving the assessment objective to provide the level of coverage necessary for determining whether

53 While additional documentation is likely needed for mechanisms when moving from basic to focused to

comprehensive examinations, the documentation associated with specifications and activities may be the same or similar for focused and comprehensive examinations, with the rigor of the examinations of these documents being increased at the comprehensive level.

54 The organization considers a variety of factors (e.g., available resources, importance of the assessment, the

organization’s overall assessment goals and objectives), confers with assessors, and provides direction on the type, number, and specific objects to be examined for the particular attribute value described.

APPENDIX C

PAGE 709

the security and privacy controls are implemented and free of obvious errors, there are further increased grounds for confidence that the controls are implemented correctly and operating as intended on an ongoing and consistent basis, and there is support for continuous improvement in the effectiveness of the controls.

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53Ar5 APPENDIX C

PAGE 710

Assessment Method

Interview

Assessment Objects:

Individuals or groups of individuals

Definition: The process of conducting discussions with individuals or groups within an organization to facilitate understanding, achieve clarification, or lead to the location of evidence, the results of which are used to support the determination of security and privacy control existence, functionality, correctness, completeness, and potential for improvement over time. This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53Ar5

Supplemental guidance: Typical assessor actions may include interviewing agency heads, chief information officers, senior agency information security officers, senior agency officials for privacy, authorizing officials, information owners, system and mission owners, system security and privacy officers, system security and privacy managers, personnel officers, human resource managers, legal, facilities managers, emergency management staff, training officers, system operators, network and system administrators, site managers, physical security officers, and users. Attributes: Depth, Coverage •

The depth attribute addresses the rigor of and level of detail in the interview process. There are three possible values for the depth attribute: basic, focused, and comprehensive. Basic interview: Interview that consists of broad-based, high-level discussions with individuals or groups of individuals. The basic interview is conducted using a set of generalized, high-level questions. Basic interviews provide a level of understanding of the security and privacy controls necessary for determining whether the controls are implemented and free of obvious errors. Focused interview: Interview that consists of broad-based, high-level discussions and more in-depth discussions in specific areas with individuals or groups of individuals. The focused interview is conducted using a set of generalized, highlevel questions and more in-depth questions where the need for greater assurance or where responses indicate a need for more in-depth investigation. Focused interviews provide a level of understanding of the security and privacy controls necessary for determining whether the controls are implemented and free of obvious errors and whether there are increased grounds for confidence that the controls are implemented correctly and operating as intended. Comprehensive interview: Interview that consists of broad-based, high-level discussions and more in-depth, probing discussions in specific areas with individuals or groups of individuals. The comprehensive interview is conducted using a set of generalized, high-level questions and more in-depth, probing questions where the need for greater assurance or where responses indicate a need for more in-depth investigation. Comprehensive interviews provide a level of understanding of the security and privacy controls necessary for determining whether the controls are implemented and free of obvious errors, there are further increased grounds for confidence that the controls are

APPENDIX C

PAGE 711

implemented correctly and operating as intended on an ongoing and consistent basis, and there is support for continuous improvement in the effectiveness of the controls. •

The coverage attribute addresses the scope or breadth of the interview process and includes the types of individuals to be interviewed (by organizational role and associated responsibility), the number of individuals to be interviewed (by type), and specific individuals to be interviewed. 55 There are three possible values for the coverage attribute: basic, focused, and comprehensive.

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53Ar5

Basic interview: Interview that uses a representative sample of individuals in key organizational roles to provide the level of coverage necessary for determining whether the security and privacy controls are implemented and free of obvious errors. Focused interview: Interview that uses a representative sample of individuals in key organizational roles and other specific individuals deemed particularly important to achieving the assessment objective to provide the level of coverage necessary for determining whether the security and privacy controls are implemented and free of obvious errors and whether there are increased grounds for confidence that the controls are implemented correctly and operating as intended. Comprehensive interview: Interview that uses a sufficiently large sample of individuals in key organizational roles and other specific individuals deemed particularly important to achieving the assessment objective to provide the level of coverage necessary for determining whether the security and privacy controls are implemented and free of obvious errors, there are further increased grounds for confidence that the controls are implemented correctly and operating as intended on an ongoing and consistent basis, and there is support for continuous improvement in the effectiveness of the controls.

55 The organization considers a variety of factors (e.g., available resources, importance of the assessment, the

organization’s overall assessment goals and objectives), confers with assessors, and provides direction on the type, number, and specific individuals to be interviewed for the particular attribute value described.

APPENDIX C

PAGE 712

Assessment Method Assessment Objects:

Test Mechanisms (e.g., hardware, software, firmware) Activities (e.g., system operations, administration, management, exercises)

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53Ar5

Definition: The process of exercising one or more assessment objects under specified conditions to compare actual with expected/desired behavior, the results of which are used to support the determination of security and privacy control existence, functionality, correctness, completeness, and potential for improvement over time. 56 Supplemental guidance: Typical assessor actions may include testing access control, identification and authentication, and audit mechanisms; testing security and privacy configuration settings; testing physical access control devices; conducting penetration testing of key system components; testing system backup operations; testing the incident response capability; and exercising the contingency planning capability. Attributes: Depth, Coverage •

The depth attribute addresses the types of testing to be conducted. There are three possible values for the depth attribute: basic, focused, and comprehensive. Basic testing: Test methodology that assumes no knowledge of the internal structure and implementation detail of the assessment object. Basic testing is conducted using a functional specification for mechanisms and a high-level process description for activities. Basic testing provides a level of understanding of the security and privacy controls necessary for determining whether the controls are implemented and free of obvious errors. Focused testing: Test methodology that assumes some knowledge of the internal structure and implementation detail of the assessment object. Focused testing is conducted using a functional specification and limited system architectural information (e.g., high-level design) for mechanisms and a highlevel process description and high-level description of integration into the operational environment for activities. Focused testing provides a level of understanding of the security and privacy controls necessary for determining whether the controls are implemented and free of obvious errors and whether there are increased grounds for confidence that the controls are implemented correctly and operating as intended. Comprehensive testing: Test methodology that assumes explicit and substantial knowledge of the internal structure and implementation detail of the assessment object. Comprehensive testing is conducted using a functional

56 Testing is typically used to determine if mechanisms or activities meet a set of predefined specifications. Testing can also be performed to determine characteristics of a security or privacy control that are not commonly associated with predefined specifications, such as penetration testing. Guidelines for conducting penetration testing are provided in Appendix D.

APPENDIX C

PAGE 713

specification, extensive system architectural information (e.g., high-level design, low-level design), implementation representation (e.g., source code, schematics) for mechanisms, and a high-level process description and detailed description of integration into the operational environment for activities. Comprehensive testing provides a level of understanding of the security and privacy controls necessary for determining whether the controls are implemented and free of obvious errors, there are further increased grounds for confidence that the controls are implemented correctly and operating as intended on an ongoing and consistent basis, and there is support for continuous improvement in the effectiveness of the controls. This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53Ar5

•

The coverage attribute addresses the scope or breadth of the testing process and includes the types of assessment objects to be tested, the number of objects to be tested (by type), and specific objects to be tested. 57 There are three possible values for the coverage attribute: basic, focused, and comprehensive. Basic testing: Testing that uses a representative sample of assessment objects (by type and number within type) to provide the level of coverage necessary for determining whether the security and privacy controls are implemented and free of obvious errors. Focused testing: Testing that uses a representative sample of assessment objects (by type and number within type) and other specific assessment objects deemed particularly important to achieving the assessment objective to provide the level of coverage necessary for determining whether the security and privacy controls are implemented and free of obvious errors and whether there are increased grounds for confidence that the controls are implemented correctly and operating as intended. Comprehensive testing: Testing that uses a sufficiently large sample of assessment objects (by type and number within type) and other specific assessment objects deemed particularly important to achieving the assessment objective to provide the level of coverage necessary for determining whether the security and privacy controls are implemented and free of obvious errors, there are further increased grounds for confidence that the controls are implemented correctly and operating as intended on an ongoing and consistent basis, and there is support for continuous improvement in the effectiveness of the controls.

57 The organization considers a variety of factors (e.g., available resources, importance of the assessment, the

organization’s overall assessment goals and objectives), confers with assessors, and provides direction on the type, number, and specific objects to be tested for the particular attribute value described. For mechanism-related testing, the coverage attribute also addresses the extent of the testing conducted (e.g., for software, the number of test cases and modules tested; for hardware, the range of inputs, number of components tested, and range of environmental factors over which the testing is conducted).

APPENDIX C

PAGE 714

APPENDIX D

PENETRATION TESTING ASSESSMENT TOOLS AND TECHNIQUES TO IDENTIFY SYSTEM WEAKNESSES

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53Ar5

Organizations may consider adding controlled penetration testing to their arsenal of tools and techniques used to assess the security and privacy controls in organizational systems. Penetration testing is a specific type of assessment in which assessors simulate the actions of a given class of attacker by using a defined set of documentation (i.e., documentation representative of what that class of attacker is likely to possess) and working under other specific constraints to attempt to circumvent the security or privacy features of a system. Penetration testing is conducted as a controlled attempt to breach the security and privacy controls employed within the system using the attacker’s techniques and appropriate hardware and software tools. Penetration testing represents the results of a specific assessor or group of assessors at a specific point in time using agreed-upon rules of engagement. Considering the complexity of the information technologies commonly employed by organizations today, penetration testing can be viewed not as a means to verify the security and privacy features of a system but rather as a means to enhance the organization’s understanding of the system, uncover weaknesses or deficiencies in the system, and indicate the level of effort required on the part of adversaries to breach the system’s safeguards. Penetration testing exercises can be scheduled and/or random in accordance with organizational policy and organizational assessments of risk. Consideration can be given to performing penetration tests on any newly developed system (or legacy system undergoing a major upgrade) before the system is authorized for operation, after important changes are made to the environment in which the system operates, and when a new type of attack is discovered that may impact the system. Organizations actively monitor the system environment and threat landscape (e.g., new vulnerabilities, attack techniques, new technology deployments, user security, and privacy awareness and training) to identify changes that require out-of-cycle penetration testing. Organizations specify which components within the system are subject to penetration testing as well as the attacker’s profile to be adopted throughout the penetration testing exercises. Organizations train selected personnel in the use and maintenance of penetration testing tools and techniques. Effective penetration testing tools have the capability to readily update the list of attack techniques and exploitable vulnerabilities used during the exercises. Organizations update the list of attack techniques and exploitable vulnerabilities used in penetration testing based on an organizational assessment of risk or when significant new vulnerabilities or threats are identified and reported. Whenever possible, organizations employ tools and attack techniques that include the capability to perform penetration testing exercises on systems and security and privacy controls in an automated manner. 58

58 While automated penetration testing tools provide repeatable results and reduce the resources used, organizations should carefully consider the potential detrimental effects of automated exploits on system availability. Additionally, penetration testing based solely on automated tools may not provide the level of attempted system compromise that organizations might experience from an actual attacker.

APPENDIX D

PAGE 715

The information obtained from the penetration testing process can be shared with appropriate personnel throughout the organization to help prioritize the vulnerabilities in the system that are demonstrably subject to compromise by attackers of a profile equivalent to the ones used in the penetration testing exercises. The prioritization helps to determine effective strategies for eliminating the identified vulnerabilities and mitigating associated risks to the organization’s operations and assets, individuals, other organizations, and the Nation resulting from the operation and use of the system. Penetration testing can be integrated into the network security testing process and the patch and vulnerability management process. 59 Penetration Testing Considerations This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53Ar5

Organizations consider the following criteria when developing and implementing a controlled penetration testing program. An effective penetration test: •

Goes beyond vulnerability scanning to provide explicit proof of mission risks and an indicator of the level of effort that an adversary would need to expend in order to cause harm to the organization’s operations and assets, individuals, other organizations, or the Nation

•

Approaches the system as the adversary would – considering vulnerabilities, incorrect system configurations, trust relationships between organizations, and architectural weaknesses in the environment being tested

•

Has a clearly defined scope and contains as a minimum: o

A definition of the environment subject to testing (e.g., facilities, users, organizational groups)

A definition of the attack surface to be tested (e.g., servers, desktop systems, wireless networks, web applications, intrusion detection and prevention systems, firewalls, email accounts, user security and privacy awareness and training posture, and incident response posture, including breaches of personally identifiable information)

A definition of the threat sources to simulate (e.g., an enumeration of attackers’ profiles to be used, such as an internal attacker, casual attacker, single or group of external targeted attackers, nation/state actor, or criminal organization)

A definition of the objectives for the simulated attacker (e.g., gain domain administrator access on the organization’s LDAP [Lightweight Directory Access Protocol] structure and access and modify information in the organization’s financial system)

A definition of level of effort (e.g., time and resources) to be expended

59 [SP 800-40] provides guidance on patch and vulnerability management. [SP 800-115] provides guidance on

information and network security testing.

APPENDIX D

PAGE 716

A definition of the rules of engagement

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53Ar5

•

Thoroughly documents all activities performed during the test, including all exploited vulnerabilities and how the vulnerabilities were combined into attacks

•

Produces results indicating a likelihood of occurrence for a given attack by using the level of effort that the team needed to expend to penetrate the system as an indicator of the penetration resistance of the system

•

Validates existing security and privacy controls (including risk mitigation mechanisms, such as firewalls and intrusion detection and prevention systems)

•

Provides a verifiable and reproducible log of all the activities performed during the test

•

Provides actionable results with information about possible remediation measures for the successful attacks performed.

APPENDIX D

PAGE 717

APPENDIX E

ASSESSMENT REPORTS DOCUMENTING THE FINDINGS FROM SECURITY AND PRIVACY CONTROL ASSESSMENTS

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53Ar5

The primary purpose of the security and privacy assessment reports is to convey the results of the security and privacy control assessments to appropriate organizational officials. The security assessment report and privacy assessment report are included in the system authorization package along with the system security plan and privacy plan (or equivalent for common controls), plan of action and milestones, and an executive summary to provide authorizing officials with the information necessary to make risk-based decisions on whether to authorize a system to begin operating or continue its operation. As the assessment and authorization process becomes more dynamic in nature, relying to a greater degree on the continuous monitoring aspects of the process as an integrated and tightly coupled part of the system development life cycle, the ability to update the security and privacy assessment reports frequently becomes a critical aspect of information security and privacy programs. It is important to emphasize the relationship among the key artifacts in the authorization package, as described in [SP 800-37]. Artifacts in the authorization package provide a reliable indication of the overall security and privacy risk posture of the system and the ability of the system to protect the organization’s operations and assets, individuals, other organizations, and the Nation to the degree necessary. The key artifacts are updated on an ongoing basis in accordance with the continuous monitoring program established by the organization. The security and privacy assessment reports provide a disciplined and structured approach for documenting the findings of the assessor and the recommendations for correcting any weaknesses or deficiencies in the security and privacy controls. 60 This appendix provides a template for reporting the results from security and privacy control assessments. Organizations are not restricted to the specific template format. However, it is expected that the overall report of an assessment includes information similar to that detailed in the template for each security and privacy control assessed preceded by a summary that provides the list of all security and privacy controls assessed and the overall status of each control. Key Elements for Assessment Reporting The following elements are included in security and privacy assessment reports: 61 • • • • •

System name Security categorization Site(s) assessed and assessment date(s) Assessor’s name/identification Previous assessment results (if reused)

60 While the rationale for each determination made is a part of the formal security and privacy assessment reports,

the complete set of records produced as part of the assessment is likely not included in the report. However, organizations retain the portion of the records necessary for maintaining an audit trail of assessment evidence, facilitating reuse of evidence, and promoting repeatability of assessor actions.

61 Information available in other key organizational documents (e.g., security or privacy plans, risk assessments, plans of action and milestones, or security or privacy assessment plans) need not be duplicated in the security and privacy assessment reports.

APPENDIX E

PAGE 718

• • • • • •

Security/privacy control or control enhancement designator Selected assessment methods and objects Depth and coverage attributes values Assessment finding summary (indicating “satisfied” or “other than satisfied”) Assessor comments (weaknesses or deficiencies noted) Assessor recommendations (priorities, remediation, corrective actions, or improvements)

The Assessment Findings This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53Ar5

Each determination statement executed by an assessor results in one of the following findings: satisfied (S) or other than satisfied (O). Figure 9 provides an example of an assessment finding for CP-03. During an actual security and privacy control assessment, the assessment findings, comments, and recommendations are documented using appropriate organization-defined reporting forms or platforms. Organizations are encouraged to develop standard templates for reporting that contain the key elements for assessment reporting described above. Whenever possible, automation is used to make assessment data collection and reporting cost-effective, timely, and efficient.

APPENDIX E

PAGE 719

CP-03

CONTINGENCY TRAINING

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53Ar5

ASSESSMENT OBJECTIVE Determine if:

ASSESSMENT FINDING

ASSESSOR COMMENTS AND RECOMMENDATIONS

CP-03_ODP[01]

the time period within which to provide contingency training after assuming a contingency role or responsibility is deﬁned;

System ABC con�ngency planning policy iden�ﬁes (organiza�on-deﬁned) �me period as 4 weeks.

CP-03_ODP[02]

frequency at which to provide training to system users with a contingency role or responsibility is deﬁned;

System ABC con�ngency planning policy iden�ﬁes frequency as annually.

CP-03_ODP[03]

frequency at which to review and update contingency training content is deﬁned;

System ABC con�ngency planning policy iden�ﬁes frequency as annually.

CP-03_ODP[04]

events necessitating review and update of contingency training are deﬁned;

No assessment ar�facts iden�fy events necessita�ng review and update of con�ngency training.

CP-03a.01

contingency training is provided to system users consistent with assigned roles and responsibilities within <CP -03_ODP[01] time period> of assuming a contingency role or responsibility;

CP-03a.02

contingency training is provided to system users consistent with assigned roles and responsibilities when required by system changes;

CP-03a.03

contingency training is provided to system users consistent with assigned roles and responsibilities <CP -03_ODP[02] frequency> thereafter;

CP-03b.[01]

the contingency plan training content is reviewed and updated <CP-03_ODP[03] frequency>;

CP-03b.[02]

the contingency plan training content is reviewed and updated following <CP -03_ODP[04] events>.

Marked as “other than sa�sﬁed.” Assessors could not ﬁnd evidence that con�ngency training to system ABC users was provided consistent with their assigned roles and responsibili�es when there were signiﬁcant changes to the system.

CP-03_ODP[04] is not deﬁned; this objec�ve cannot be assessed.

FIGURE 9: SECURITY AND PRIVACY CONTROL ASSESSMENT FINDINGS EXAMPLE

APPENDIX E

PAGE 720

APPENDIX F

ONGOING ASSESSMENT AND AUTOMATION USING AUTOMATED TECHNIQUES TO ACHIEVE MORE EFFICIENT ASSESSMENTS

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53Ar5

Ongoing security and privacy assessment is the continuous evaluation of the effectiveness of security and privacy control implementation. Ongoing assessment is an essential subset of Information Security Continuous Monitoring (ISCM) activities. 62 Ongoing assessment encompasses ISCM Steps 3 and 4 and is initiated as part of ISCM Step 3, Implement, when the collection of security-related information begins in accordance with organization-defined frequencies. Ongoing assessment continues as the security-related information generated as part of ISCM Step 3 is correlated, analyzed, and reported to senior leaders as part of ISCM Step 4. As noted in [SP 800-137], security-related information is generated, correlated, analyzed, and reported using automated tools to the extent that it is possible and practical to do so. When it is not possible and practical to use automated tools, security-related information is generated, correlated, analyzed, and reported using manual or procedural methods. In this way, senior leaders are provided with the security-related information necessary to make credible, riskbased decisions regarding information security risk to the mission and business. 63 Automating assessments is a fundamental element in helping organizations manage information security and privacy risks. Evolving threats and changes in PII processing create a challenge for organizations that design, implement, and operate complex systems compromised of many hardware, firmware, and software components. The ability to assess all implemented security and privacy controls as frequently as needed using manual or procedural methods has become impractical for most organizations due to the size, complexity, and scope of their information technology infrastructures. One strategy to increase the number of security and privacy controls for which assessment and monitoring can be automated depends on defining a desired state specification and expressing the desired state in a form that can be compared automatically (i.e., in data) with the actual state. The desired state is a defined value or specification to which the actual state value can be compared. A mismatch of the two values indicates that a defect is present in the effectiveness of one or more controls. For example, an organizational policy may state that user accounts will be locked after three unsuccessful logon attempts. The desired state specification would be that applicable devices are configured to lock accounts after three unsuccessful logon attempts. If, during automated assessment, the security-related information collected indicates that a specific device is configured such that accounts are locked only after five unsuccessful logon attempts, a mismatch between the desired state (three attempts allowed before lockout) and the actual state (five attempts allowed before lockout) is identified. The mismatch may reflect a problem with the effectiveness of SP 800-53 control AC-7, Unsuccessful Logon Attempts; AC-2, Account Management; and/or CM-2, Baseline Configuration. When a desired state specification

62 [SP 800-137] provides guidance on Information Security Continuous Monitoring (ISCM). [SP 800-137A] provides

guidance on conducting assessments of ISCM Programs.

63 Continuous monitoring can be effectively applied to privacy controls consistent with the concepts, techniques, and

principles described in [SP 800-137]. Senior Agency Officials for Privacy (SAOPs)/Chief Privacy Officers (CPOs) provide guidance on the ongoing monitoring of privacy controls.

APPENDIX F

PAGE 721

strategy is employed, security-related information generated from ISCM activities is equivalent to security control assessment results. In order to effectively automate security and privacy control assessments using the desired state specification strategy, it is important to meet the following prerequisites: • • •

Automated actual state and behavior specifications are defined; Data-based desired state specifications (comparable to the actual state) are defined; and A method to compute or identify defects (i.e., differences between desired and actual state and behavior) is defined.

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53Ar5

When the prerequisites are met, the assessment system can automatically compute where differences between the desired state and actual state (defects) occur, use that information to create security and privacy assessment reports, and deliver those reports to designated personnel via a security and privacy management console (dashboard). When automated tools are used to conduct assessments, the test assessment method is used. 64 The organization determines and documents the specific capabilities 65 and privacy controls that are being assessed by the automated tool, the frequency with which the tool will assess the capabilities or controls, and the analysis and reporting requirements for the capabilities or controls. To help automate ongoing assessment, NIST and the Department of Homeland Security Cybersecurity Infrastructure Security Agency (CISA) collaborated on the development of a process that leverages the test assessment method and is consistent with the Risk Management Framework, as described in SP 800-37 and the ISCM guidance in SP 800-137. The automation process is described in NIST Interagency/Internal Report (NISTIR) 8011, Automation Support for Security Control Assessments: Volume 1: Overview [IR 8011-1] which defines specific security capabilities and describes the overall automated assessment process. Specific methods to automate the assessment of each defined security capability is provided in subsequent NISTIR 8011 volumes. Automation of the test method for security assessments is facilitated by the CISA Continuous Diagnostics and Mitigation (CDM) program.

64 If greater depth and coverage are needed to provide additional assurance, the automated test method may be

supplemented by the use of manual or procedural assessment methods (i.e., interview, examine, or manual test).

65 If a security or privacy capability is defined, a mapping of all individual controls that support the capability is

documented. If organizations define multiple capabilities, a many-to-many relationship between security and privacy controls and capabilities is to be expected. See Section 3.5 for additional information regarding security and privacy capability assessments.

APPENDIX F

PAGE 722

NIST SP 800-53Ar5: Assessing Security and Privacy Controls in Information Systems and Organizations

Analyze & explore related research in Conceptio

Related documents