NIST SP 800-53B-upd1: Control Baselines for Information Systems and Organizations

NIST Special Publication 800-53B

Control Baselines for Information Systems and Organizations

JOINT TASK FORCE

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53B

NIST Special Publication 800-53B

Control Baselines for Information Systems and Organizations JOINT TASK FORCE

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53B

October 2020

INCLUDES UPDATES AS OF 12-10-2020; SEE PAGE XI

U.S. Department of Commerce

Wilbur L. Ross, Jr., Secretary

National Institute of Standards and Technology

Walter Copan, NIST Director and Under Secretary of Commerce for Standards and Technology

NIST SP 800-53B CONTROL BASELINES FOR INFORMATION SYSTEMS AND ORGANIZATIONS _________________________________________________________________________________________________

Authority This publication has been developed by NIST to further its statutory responsibilities under the Federal Information Security Modernization Act (FISMA), 44 U.S.C. § 3551 et seq., Public Law (P.L.) 113-283. NIST is responsible for developing information security standards and guidelines, including minimum requirements for federal information systems. Such information security standards and guidelines shall not apply to national security systems without the express approval of the appropriate federal officials exercising policy authority over such systems. This guideline is consistent with the requirements of the Office of Management and Budget (OMB) Circular A-130. This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53B

Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on federal agencies by the Secretary of Commerce under statutory authority. Nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, OMB Director, or any other federal official. This publication may be used by nongovernmental organizations on a voluntary basis, and is not subject to copyright in the United States. Attribution would, however, be appreciated by NIST. National Institute of Standards and Technology Special Publication 800-53B Natl. Inst. Stand. Technol. Spec. Publ. 800-53B, 85 pages (October 2020) CODEN: NSPUE2 This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53B

Certain commercial entities, equipment, or materials may be identified in this document to describe an experimental procedure or concept adequately. Such identification is not intended to imply recommendation or endorsement by NIST, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts, practices, and methodologies may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST. Organizations are encouraged to review draft publications during the designated public comment periods and provide feedback to NIST. Many NIST publications, other than the ones noted above, are available at https://csrc.nist.gov/publications.

Comments on this publication may be submitted to: National Institute of Standards and Technology Attn: Computer Security Division, Information Technology Laboratory 100 Bureau Drive (Mail Stop 8930) Gaithersburg, MD 20899-8930 Email: sec-cert@nist.gov

All comments are subject to release under the Freedom of Information Act (FOIA) [FOIA96].

i

NIST SP 800-53B CONTROL BASELINES FOR INFORMATION SYSTEMS AND ORGANIZATIONS _________________________________________________________________________________________________

Reports on Computer Systems Technology

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53B

The National Institute of Standards and Technology (NIST) Information Technology Laboratory (ITL) promotes the U.S. economy and public welfare by providing technical leadership for the Nation’s measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology (IT). ITL’s responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the costeffective security of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL’s research, guidelines, and outreach efforts in information systems security and privacy and its collaborative activities with industry, government, and academic organizations.

Abstract This publication provides security and privacy control baselines for the Federal Government. There are three security control baselines (one for each system impact level—low-impact, moderate-impact, and high-impact), as well as a privacy baseline that is applied to systems irrespective of impact level. In addition to the control baselines, this publication provides tailoring guidance and a set of working assumptions that help guide and inform the control selection process. Finally, this publication provides guidance on the development of overlays to facilitate control baseline customization for specific communities of interest, technologies, and environments of operation.

Keywords Assurance; impact level; privacy control; privacy control baseline; security control; security control baseline; tailoring; control selection; control overlays.

ii

NIST SP 800-53B CONTROL BASELINES FOR INFORMATION SYSTEMS AND ORGANIZATIONS _________________________________________________________________________________________________

Acknowledgements This publication was developed by the Joint Task Force Interagency Working Group. The group includes representatives from the civil, defense, and intelligence communities. The National Institute of Standards and Technology wishes to acknowledge and thank the senior leaders from the Department of Commerce, Department of Defense, the Office of the Director of National Intelligence, the Committee on National Security Systems, and the members of the interagency working group whose dedicated efforts contributed significantly to this publication.

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53B

Department of Defense

Office of the Director of National Intelligence

Dana Deasy Chief Information Officer

Matthew A. Kozma Chief Information Officer

John Sherman Principal Deputy CIO

Michael E. Waschull Deputy Chief Information Officer

Mark Hakun Deputy CIO for Cybersecurity and DoD SISO

Clifford M. Conner Cybersecurity Group and IC CISO

Kevin Dulany Director, Cybersecurity Policy and Partnerships

Vacant Director, Security Coordination Center

National Institute of Standards and Technology

Committee on National Security Systems

Charles H. Romine Director, Information Technology Laboratory

Mark G. Hakun Chair

Kevin Stine Acting Cybersecurity Advisor, ITL

Susan Dorr Co-Chair

Matthew Scholl Chief, Computer Security Division

Kevin Dulany Tri-Chair—Defense Community

Kevin Stine Chief, Applied Cybersecurity Division

Chris Johnson Tri-Chair—Intelligence Community

Ron Ross FISMA Implementation Project Leader

Vicki Michetti Tri-Chair—Civil Agencies

Joint Task Force Working Group Victoria Pillitteri NIST, JTF Leader

McKay Tolboe DoD

Dorian Pappas Intelligence Community

Kelley Dempsey NIST

Ehijele Olumese The MITRE Corporation

Lydia Humphries Booz Allen Hamilton

Daniel Faigin Aerospace Corporation

Naomi Lefkovitz NIST

Esten Porter The MITRE Corporation

Julie Nethery Snyder The MITRE Corporation

Christina Sames The MITRE Corporation

Christian Enloe NIST

David Black The MITRE Corporation

Rich Graubart The MITRE Corporation

Peter Duspiva Intelligence Community

Kaitlin Boeckl NIST

Eduardo Takamura NIST

Ned Goren NIST

Andrew Regenscheid NIST

Jon Boyens NIST

iii

NIST SP 800-53B CONTROL BASELINES FOR INFORMATION SYSTEMS AND ORGANIZATIONS _________________________________________________________________________________________________

In addition to the above acknowledgments, a special note of thanks goes to Jeff Brewer, Jim Foti, and the NIST web team for their outstanding administrative support. The authors also wish to recognize the professional staff from the NIST Computer Security Division and the Applied Cybersecurity Division and the input from representatives from the OMB Office of Information and Regulatory Affairs (OIRA) Privacy Branch and the Federal CIO Council and Interagency Working Group for their contributions in helping to improve the technical content of the publication. Finally, the authors gratefully acknowledge the significant contributions from individuals and organizations in the public and private sectors, nationally and internationally, whose insightful and constructive comments improved the quality, thoroughness, and usefulness of this publication. This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53B

HISTORICAL CONTRIBUTIONS TO NIST SPECIAL PUBLICATION 800-53 The authors wanted to acknowledge the many individuals who contributed to previous versions of Special Publication 800-53 since its inception in 2005. They include Marshall Abrams, Dennis Bailey, Lee Badger, Curt Barker, Matthew Barrett, Nadya Bartol, Frank Belz, Paul Bicknell, Deb Bodeau, Paul Brusil, Brett Burley, Bill Burr, Dawn Cappelli, Roger Caslow, Corinne Castanza, Mike Cooper, Matt Coose, Dominic Cussatt, George Dinolt, Randy Easter, Kurt Eleam, Denise Farrar, Dave Ferraiolo, Cita Furlani, Harriett Goldman, Peter Gouldmann, Tim Grance, Jennifer Guild, Gary Guissanie, Sarbari Gupta, Priscilla Guthrie, Richard Hale, Peggy Himes, Bennett Hodge, William Hunteman, Cynthia Irvine, Arnold Johnson, Roger Johnson, Donald Jones, Lisa Kaiser, Stuart Katzke, Sharon Keller, Tom Kellermann, Cass Kelly, Eustace King, Daniel Klemm, Steve LaFountain, Annabelle Lee, Robert Lentz, Steven Lipner, William MacGregor, Thomas Macklin, Thomas Madden, Robert Martin, Erika McCallister, Tim McChesney, Michael McEvilley, Rosalie McQuaid, Peter Mell, John Mildner, Pam Miller, Sandra Miravalle, Joji Montelibano, Douglas Montgomery, George Moore, Rama Moorthy, Mark Morrison, Harvey Newstrom, Sherrill Nicely, Robert Niemeyer, LouAnna Notargiacomo, Pat O’Reilly, Tim Polk, Karen Quigg, Steve Quinn, Mark Riddle, Ed Roback, Cheryl Roby, George Rogers, Scott Rose, Mike Rubin, Karen Scarfone, Roger Schell, Jackie Snouffer, Ray Snouffer, Murugiah Souppaya, Gary Stoneburner, Keith Stouffer, Marianne Swanson, Pat Toth, Glenda Turner, Patrick Viscuso, Joe Weiss, Richard Wilsher, Mark Wilson, John Woodward, and Carol Woody.

iv

NIST SP 800-53B CONTROL BASELINES FOR INFORMATION SYSTEMS AND ORGANIZATIONS _________________________________________________________________________________________________

Patent Disclosure Notice NOTICE: The Information Technology Laboratory (ITL) has requested that holders of patent claims whose use may be required for compliance with the guidance or requirements of this publication disclose such patent claims to ITL. However, holders of patents are not obligated to respond to ITL calls for patents and ITL has not undertaken a patent search in order to identify which, if any, patents may apply to this publication. As of the date of publication and following call(s) for the identification of patent claims whose use may be required for compliance with the guidance or requirements of this publication, no such patent claims have been identified to ITL. This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53B

No representation is made or implied by ITL that licenses are not required to avoid patent infringement in the use of this publication.

v

NIST SP 800-53B CONTROL BASELINES FOR INFORMATION SYSTEMS AND ORGANIZATIONS _________________________________________________________________________________________________

RISK MANAGEMENT

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53B

Organizations must exercise due diligence in managing information security and privacy risk. This is accomplished, in part, by establishing a comprehensive risk management program that uses the flexibility inherent in NIST publications to categorize systems, select and implement security and privacy controls that meet mission and business needs, assess the effectiveness of the controls, authorize the systems for operation, and continuously monitor the systems. Exercising due diligence and implementing robust and comprehensive information security and privacy risk management programs can facilitate compliance with applicable laws, regulations, executive orders, and government-wide policies. Risk management frameworks and risk management processes are essential in developing, implementing, and maintaining the protection measures necessary to address stakeholder needs and the current threats to organizational operations and assets, individuals, other organizations, and the Nation. Employing effective risk-based processes, procedures, methods, and technologies ensures that information systems and organizations have the necessary trustworthiness and resiliency to support essential mission and business functions, the U.S. critical infrastructure, and continuity of government.

vi

NIST SP 800-53B CONTROL BASELINES FOR INFORMATION SYSTEMS AND ORGANIZATIONS _________________________________________________________________________________________________

COMMON SECURITY AND PRIVACY FOUNDATIONS

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53B

In working with the Office of Management and Budget to develop standards and guidelines required by FISMA, NIST consults with federal agencies; state, local, and tribal governments; and private sector organizations to improve information security and privacy, avoid unnecessary and costly duplication of effort, and help ensure that its publications are complementary with the standards and guidelines used for the protection of national security systems. In addition to a comprehensive and transparent public review and comment process, NIST is engaged in a collaborative partnership with the Office of Management and Budget, Office of the Director of National Intelligence, Department of Defense, Committee on National Security Systems, Federal CIO Council, and Federal Privacy Council to establish a Risk Management Framework (RMF) for information security and privacy for the Federal Government. This common foundation provides the Federal Government and their contractors with cost-effective, flexible, and consistent ways to manage security and privacy risks to organizational operations and assets, individuals, other organizations, and the Nation. The framework provides a basis for the reciprocal acceptance of security and privacy control assessment evidence and authorization decisions and facilitates information sharing and collaboration. NIST continues to work with public and private sector entities to establish mappings and relationships between the standards and guidelines developed by NIST and those developed by other organizations. NIST anticipates using these mappings and the gaps they identify to improve the control catalog.

vii

NIST SP 800-53B CONTROL BASELINES FOR INFORMATION SYSTEMS AND ORGANIZATIONS _________________________________________________________________________________________________

USE OF EXAMPLES IN THIS PUBLICATION Throughout this publication, examples are used to illustrate, clarify, or explain certain items in chapter sections, controls, and control enhancements. These examples are illustrative in nature and are not intended to limit or constrain the application of controls or control enhancements by organizations.

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53B viii

NIST SP 800-53B CONTROL BASELINES FOR INFORMATION SYSTEMS AND ORGANIZATIONS _________________________________________________________________________________________________

Table of Contents CHAPTER ONE INTRODUCTION ...................................................................................................... 1 1.1 PURPOSE AND APPLICABILITY ................................................................................................... 1 1.2 TARGET AUDIENCE .................................................................................................................. 2 1.3 ORGANIZATIONAL RESPONSIBILITIES......................................................................................... 2 1.4 RELATIONSHIP TO OTHER PUBLICATIONS................................................................................... 3 1.5 REVISIONS AND EXTENSIONS .................................................................................................... 3 1.6 PUBLICATION ORGANIZATION .................................................................................................. 3

CHAPTER TWO THE FUNDAMENTALS ............................................................................................ 5 This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53B

2.1 CONTROL BASELINES ............................................................................................................... 5 2.2 SELECTING CONTROL BASELINES ............................................................................................... 6 2.3 CONTROL BASELINE ASSUMPTIONS........................................................................................... 8 2.4 TAILORING CONTROL BASELINES .............................................................................................. 9 2.5 CAPABILITIES......................................................................................................................... 14

CHAPTER THREE THE CONTROL BASELINES ................................................................................. 15 3.1 ACCESS CONTROL FAMILY ...................................................................................................... 16 3.2 AWARENESS AND TRAINING FAMILY ....................................................................................... 20 3.3 AUDIT AND ACCOUNTABILITY FAMILY ..................................................................................... 21 3.4 ASSESSMENT, AUTHORIZATION, AND MONITORING FAMILY ..................................................... 23 3.5 CONFIGURATION MANAGEMENT FAMILY ................................................................................ 24 3.6 CONTINGENCY PLANNING FAMILY .......................................................................................... 26 3.7 IDENTIFICATION AND AUTHENTICATION FAMILY ...................................................................... 28 3.8 INCIDENT RESPONSE FAMILY .................................................................................................. 30 3.9 MAINTENANCE FAMILY .......................................................................................................... 32 3.10 MEDIA PROTECTION FAMILY................................................................................................. 33 3.11 PHYSICAL AND ENVIRONMENTAL PROTECTION FAMILY .......................................................... 34 3.12 PLANNING FAMILY ............................................................................................................... 36 3.13 PROGRAM MANAGEMENT FAMILY ....................................................................................... 37 3.14 PERSONNEL SECURITY FAMILY .............................................................................................. 39 3.15 PERSONALLY IDENTIFIABLE INFORMATION PROCESSING AND TRANSPARENCY FAMILY ............. 40 3.16 RISK ASSESSMENT FAMILY .................................................................................................... 41 3.17 SYSTEM AND SERVICES ACQUISITION FAMILY ......................................................................... 42 3.18 SYSTEM AND COMMUNICATIONS PROTECTION FAMILY .......................................................... 46 3.19 SYSTEM AND INFORMATION INTEGRITY FAMILY ..................................................................... 51 3.20 SUPPLY CHAIN RISK MANAGEMENT FAMILY ........................................................................... 55

REFERENCES .................................................................................................................................. 56 APPENDIX A GLOSSARY ................................................................................................................ 59 APPENDIX B ACRONYMS .............................................................................................................. 66 APPENDIX C OVERLAYS ................................................................................................................ 67

ix

NIST SP 800-53B CONTROL BASELINES FOR INFORMATION SYSTEMS AND ORGANIZATIONS _________________________________________________________________________________________________

Executive Summary As we push computers to “the edge,” building an increasingly complex world of connected information systems and devices, security and privacy will continue to dominate the national dialogue. In its 2017 report entitled, Task Force on Cyber Deterrence [DSB 2017], the Defense Science Board provides a sobering assessment of the current vulnerabilities in the U.S. critical infrastructure and the information systems that support mission-essential operations and assets in the public and private sectors.

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53B

“…The Task Force notes that the cyber threat to U.S. critical infrastructure is outpacing efforts to reduce pervasive vulnerabilities, so that for the next decade at least the United States must lean significantly on deterrence to address the cyber threat posed by the most capable U.S. adversaries. It is clear that a more proactive and systematic approach to U.S. cyber deterrence is urgently needed…”

There is an urgent need to further strengthen the underlying information systems, component products, and services that the Nation depends on in every sector of the critical infrastructure— ensuring that those systems, components, and services are sufficiently trustworthy and provide the necessary resilience to support the economic and national security interests of the United States. NIST SP 800-53B responds to the call of the Defense Science Board by providing a proactive and systemic approach to developing and making available to federal agencies and private sector organizations a comprehensive set of security and privacy control baselines for all types of computing platforms, including general-purpose computing systems, cyber-physical systems, cloud-based systems, mobile devices, and industrial and process control systems. The control baselines provide a starting point for organizations in the security and privacy control selection process. Using the tailoring guidance and assumptions provided, organizations can customize their security and privacy control baselines to ensure that they have the capability to protect their critical and essential operations and assets.

x

NIST SP 800-53B CONTROL BASELINES FOR INFORMATION SYSTEMS AND ORGANIZATIONS _________________________________________________________________________________________________

Errata This table contains changes that have been incorporated into Special Publication 800-53B. Errata updates can include corrections, clarifications, or other minor changes in the publication that are either editorial or substantive in nature. Any potential updates for this document that are not yet published in an errata update or revision—including additional issues and potential corrections—will be posted as they are identified; see the SP 800-53B publication details.

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53B

DATE

TYPE

REVISION

PAGE

12-10-2020

Editorial

3

12-10-2020

Editorial

12-10-2020

Editorial

12-10-2020 12-10-2020 12-10-2020

Editorial Editorial Editorial

12-10-2020

Editorial

12-10-2020

Editorial

12-10-2020

Editorial

12-10-2020

Editorial

12-10-2020 12-10-2020

Editorial Editorial

12-10-2020

Editorial

12-10-2020

Editorial

12-10-2020 12-10-2020 12-10-2020

Editorial Editorial Editorial

12-10-2020

Editorial

12-10-2020

Editorial

12-10-2020

Editorial

12-10-2020

Editorial

12-10-2020

Editorial

12-10-2020 12-10-2020 12-10-2020 12-10-2020

Editorial Editorial Editorial Editorial

Section 1.4: Change “NIST SP 800-53 [SP 800-53]” to “[SP 800-53]” Section 2.4 (Footnote 26): Change “See [SP 800-37], Task P-4.” to “See [SP 800-37], Task P-4, Organizationally-Tailored Control Baselines and Cybersecurity Framework Profiles (Optional), for additional guidance on tailoring control baselines for organizationwide use. See [SP 800-37], Task S-2, Control Tailoring, for additional guidance on tailoring control baselines for systems and environments of operation.” Section 2.4 (Footnote 28): Change “Guidance on developing privacy plans is forthcoming.” to “Guidance on developing privacy and supply chain risk management plans is forthcoming.” Table 3-1 (AC-3(1)) Title: Change “FUNCTION” to “FUNCTIONS” Table 3-1 (AC-3(6)): Change “MP-4, SC-28” to “MP-4 and SC-28” Table 3-1 (AC-13): Change “AC-2, AU-6” to “AC-2 and AU-6” Table 3-1 (AC-19(5)) Title: Change “FULL DEVICE AND” to “FULL DEVICE OR” Table 3-1 (AC-20(4)) Title: Change “NETWORK-ACCESSIBLE” to “NETWORK ACCESSIBLE” Table 3-2 (AT-3(5)) Title: Change “ACCESSING PERSONALLY” to “PROCESSING PERSONALLY” Table 3-3 (AU-7(2)) Title: Change “SEARCH AND SORT” to “SORT AND SEARCH” Table 3-3 (AU-15): Change “Incorporated into” to “Moved to” Table 3-3 (AU-16) Title: Change “Auditing” to “Audit” Table 3-5 (CM-7(4)) Title: Change “UNAUTHORIZED SOFTWARE” to “UNAUTHORIZED SOFTWARE – DENY-BY-EXCEPTION” Table 3-5 (CM-7(5)) Title: Change “AUTHORIZED SOFTWARE” to “AUTHORIZED SOFTWARE – ALLOW-BY-EXCEPTION” Table 3-6 (CP-2(3)) Title: Change “MISSIONS” to “MISSION” Table 3-6 (CP-2(4)) Title: Change “MISSIONS” to “MISSION” Table 3-6 (CP-2(5)) Title: Change “MISSIONS” to “MISSION” Table 3-6 (CP-9(7)) Title: Change “DUAL AUTHORIZATION” to “DUAL AUTHORIZATION FOR DELETION OR DESTRUCTION” Table 3-6 (CP-10(3)): Change “W: Incorporated into PL-11.” to “W: Addressed through tailoring.” Table 3-7 (IA-2(11)): Change “W: Incorporated into IA-2(1)(2).” to “W: Incorporated into IA-2(6).” Table 3-7 (IA-5(11)): Change “IA-2(1)(2)” to “IA-2(1) and IA-2(2)” Table 3-7 (IA-9(1)): Change “Complete withdrawal.” to “W: Incorporated into IA-9.” Table 3-8 (IR-10): Change “Incorporated into” to “Moved to” Table 3-9 (MA-4(2)): Change “MA-1, MA-4” to “MA-1 and MA-4” Table 3-11 (PE-7): Change “PE-2, PE-3” to “PE-2 and PE-3” Table 3-11 (PE-19(1)) Title: Delete “AND TEMPEST”

xi

9

9 16 16 18 19 19 20 21 22 22 25 25 26 26 26 27 27 28 29 29 31 32 34 35

NIST SP 800-53B CONTROL BASELINES FOR INFORMATION SYSTEMS AND ORGANIZATIONS _________________________________________________________________________________________________

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53B

DATE

TYPE

12-10-2020

Editorial

12-10-2020

Editorial

12-10-2020

Editorial

12-10-2020

Editorial

12-10-2020

Editorial

12-10-2020

Editorial

12-10-2020

Editorial

12-10-2020

Editorial

12-10-2020

Editorial

12-10-2020

Editorial

12-10-2020

Editorial

12-10-2020

Editorial

12-10-2020 12-10-2020 12-10-2020

Editorial Editorial Editorial

12-10-2020

Editorial

12-10-2020 12-10-2020

Editorial Editorial

12-10-2020

Editorial

12-10-2020

Editorial

12-10-2020

Editorial

12-10-2020

Editorial

12-10-2020

Editorial

12-10-2020

Editorial

REVISION Table 3-12 (PL-8(1)) Title: Change “DEFENSE-IN-DEPTH” to “DEFENSE IN DEPTH” Table 3-14 (PS-3(3)) Title: Change “WITH” to “REQUIRING” Table 3-17 (SA-12(14)): Change “SR-4(1)(2)” to “SR-4(1) and SR4(2)” Table 3-17 (SA-17) Title: Change “Security” to “Security and Privacy” Table 3-17 (SA-18(2)): Change “W: Moved to SR-9(2).” to “W: Moved to SR-10.” Table 3-17 (SA-19): Change “W: Moved to SR-10.” to “W: Moved to SR-11.” Table 3-17 (SA-19(1)): Change “W: Moved to SR-10(1).” to “W: Moved to SR-11(1).” Table 3-17 (SA-19(2)): Change “W: Moved to SR-10(2).” to “W: Moved to SR-11(2).” Table 3-17 (SA-19(3)): Change “W: Moved to SR-10(3).” to “W: Moved to SR-12.” Table 3-17 (SA-19(4)): Change “W: Moved to SR-10(4).” to “W: Moved to SR-11(3).” Table 3-18 (SC-5) Title: Change “Denial of Service” to “Denial-ofService” Table 3-18 (SC-7(25)) Title: Change “CONNECTIONS” to “SYSTEM CONNECTIONS” Table 3-18 (SC-12(4)): Change “SC-12” to “SC-12(3)” Table 3-18 (SC-12(5)): Change “SC-12” to “SC-12(3)” Table 3-18 (SC-14): Change “SI-7,” to “SI-7, and” Table 3-18 (SC-19): Change “addressed by other controls for protocols” to “addressed as any other technology or protocol” Table 3-19 (SI-9): Change “AC-5,” to “AC-5, and” Table 3-20 (SR-10) Title: Change “Systems and” to “Systems or” Appendix A Glossary (availability): Change“[44 USC 3552]” to “[FISMA]” Appendix A Glossary (confidentiality): Change“[44 USC 3552]” to “[FISMA]” Appendix A Glossary (integrity): Change“[44 USC 3552]” to “[FISMA]” Appendix B Acronyms: Add “OIRA Office of Information and Regulatory Affairs” Appendix B Acronyms: Add “SCOR Security Control Overlay Repository”

Sections 3.1 through 3.20 (Introduction): Change “w” to “W”

xii

PAGE 36 39 44 45 45 45 45 45 45 45 46 47 47 47 47 48 52 55 59 60 61 66 66 16, 20, 21, 23, 24, 26, 28, 30, 32, 33, 34, 36, 37, 39, 40, 41, 42, 46, 51, 55

NIST SP 800-53B CONTROL BASELINES FOR INFORMATION SYSTEMS AND ORGANIZATIONS _________________________________________________________________________________________________

CHAPTER ONE

INTRODUCTION THE NEED FOR SECURITY AND PRIVACY CONTROL BASELINES

S

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53B

ecurity controls are the safeguards or countermeasures selected and implemented within an information system 1 or an organization to protect the confidentiality, integrity, and availability of the system and its information and to manage information security risk. Privacy controls are the administrative, technical, and physical safeguards employed within a system or an organization to ensure compliance with applicable privacy requirements and to manage privacy risks. 2 Security and privacy controls are selected and implemented to satisfy the security and privacy requirements levied on an information system and/or organization. The requirements are derived from applicable laws, executive orders, directives, regulations, policies, standards, and mission needs to ensure the confidentiality, integrity, and availability of information processed, stored, or transmitted and to manage risks to individual privacy. The selection, design, and effective implementation of controls are important tasks that have significant implications for the operations and assets of organizations as well as the welfare of individuals and the Nation. NIST Special Publication (SP) 800-37 [SP 800-37] defines two approaches for the selection of security and privacy controls: a baseline control selection approach and an organizationgenerated control selection approach. The baseline control selection approach uses control baselines, which are predefined sets of controls specifically assembled to meet the protection needs of a group, organization, or community of interest. The control baselines serve as a starting point for the protection of individuals’ privacy, information, and information systems. The organization-generated control selection approach is not addressed in this publication.

1.1 PURPOSE AND APPLICABILITY This publication establishes security and privacy control baselines for federal information systems and organizations and provides tailoring guidance for those baselines. The control baselines can be implemented by any organization that processes, stores, or transmits information (e.g., federal, state, local, and tribal governments, as well as private sector organizations). Implementation of a minimum set of controls selected from NIST SP 800-53, Revision 5 [SP 800-53] is mandatory to protect federal information and information systems 3 in accordance with the Office of Management and Budget (OMB) Circular A-130 [OMB A-130] and the provisions of the Federal Information Security Modernization Act 4 [FISMA]. Whereas use of 1 An information system is a discrete set of information resources organized for the collection, processing,

maintenance, use, sharing, dissemination, or disposition of information. 2 [OMB A-130] defines security controls and privacy controls. 3 A federal information system is an information system used or operated by an agency, a contractor of an agency, or another organization on behalf of an agency. 4 Information systems that have been designated as national security systems (as defined in 44 U.S.C., Section 3542) are not subject to the requirements in [FISMA]. However, the controls established in this publication may be selected for national security systems as otherwise required (e.g., the Privacy Act of 1974) or with the approval of federal officials exercising policy authority over such systems. CNSS Policy No. 22 [CNSSP 22] and CNSS Instruction No. 1253 [CNSSI 1253] provide guidance for national security systems. DoD Instruction 8510.01 [DODI 8510.01] provides guidance for the Department of Defense.

CHAPTER ONE

PAGE 1

NIST SP 800-53B CONTROL BASELINES FOR INFORMATION SYSTEMS AND ORGANIZATIONS _________________________________________________________________________________________________

the privacy control baseline is not mandated by law or [OMB A-130], SP 800-53B—along with other supporting NIST publications—is designed to help organizations identify the security and privacy controls needed to manage risk and to satisfy the security and privacy requirements in FISMA, the Privacy Act of 1974 [PRIVACT], selected OMB policies (e.g., [OMB A-130]), and designated Federal Information Processing Standards (FIPS), among others.

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53B

This publication satisfies security and privacy requirements by applying assumptions that inform the development of the security and privacy control baselines, as described in Section 2.3. The baselines serve as a starting point to meet the protection needs of organizations. The controls in the baselines are tailored following the process described in Section 2.4 to further facilitate the management of security and privacy risk specific to the organization. The tailoring process can be guided and informed by many factors, including organizational mission and business needs, stakeholder protection needs, and assessments of risk. The combination of control baseline selection and control tailoring processes can help organizations satisfy their stated security and privacy requirements.

1.2 TARGET AUDIENCE This publication is intended to serve a diverse audience, including: •

Individuals with system, information security, privacy, or risk management and oversight responsibilities, including authorizing officials, chief information officers, senior agency information security officers, and senior agency officials for privacy

•

Individuals with system development responsibilities, including mission owners, program managers, system engineers, system security engineers, privacy engineers, hardware and software developers, system integrators, and acquisition or procurement officials

•

Individuals with logistical or disposition-related responsibilities, including program managers, procurement officials, system integrators, and property managers

•

Individuals with security and privacy implementation and operations responsibilities, including mission or business owners, system owners, information owners or stewards, system administrators, and system security or privacy officers

•

Individuals with security and privacy assessment and monitoring responsibilities, including auditors, Inspectors General, system evaluators, control assessors, independent verifiers and validators, and analysts

•

Commercial entities, including industry partners, who produce component products and systems and develop security and privacy technologies

1.3 ORGANIZATIONAL RESPONSIBILITIES Organizations have the responsibility to choose a control selection approach in accordance with [SP 800-37]. 5 If the baseline control selection approach is chosen, organizations select a security 5 In the baseline control selection approach and organization-generated control selection approach, organizations

develop a well-defined set of security and privacy requirements using a life cycle-based systems engineering process, as described in the Risk Management Framework (RMF) Prepare—System Level step, Task P-15, Requirements Definition. The requirements definition process generates a set of requirements that can be used to guide and inform the selection of controls to satisfy the requirements.

CHAPTER ONE

PAGE 2

NIST SP 800-53B CONTROL BASELINES FOR INFORMATION SYSTEMS AND ORGANIZATIONS _________________________________________________________________________________________________

control baseline and privacy control baseline as described in Chapter Three. Once the control baseline is selected, organizations apply the tailoring guidance provided in Chapter Two to help ensure that the resulting controls are necessary and sufficient to manage security risk 6 and privacy risk. 7

1.4 RELATIONSHIP TO OTHER PUBLICATIONS This publication establishes security and privacy control baselines derived from the controls in [SP 800-53]. The control baselines in this publication are in accordance with requirements for federal information and information systems included in [OMB A-130], 8 Federal Information Processing Standard 199 [FIPS 199], and Federal Information Processing Standard 200 [FIPS 200]. [SP 800-37] provides guidance on control selection approaches. This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53B

1.5 REVISIONS AND EXTENSIONS The security and privacy controls specified in the baselines represent the state-of-the-practice protection measures for individuals, information systems, and organizations. The controls comprising the baselines are periodically reviewed and revised to reflect the experience gained from using the controls; new or revised laws, executive orders, directives, regulations, policies, and standards; changing security and privacy requirements; emerging threats, vulnerabilities, attacks, and information processing methods; and the availability of new technologies. Thus, the security and privacy controls specified in the baselines are also expected to change over time as controls are withdrawn, revised, and added. In addition to the need for change, the need for stability is addressed by requiring that proposed changes to the baseline undergo a rigorous and transparent public review process to obtain public and private sector feedback and to build a consensus for baseline changes. The public review process provides a stable, flexible, and technically sound set of security and privacy control baselines.

1.6 PUBLICATION ORGANIZATION The remainder of this special publication is organized as follows: •

Chapter Two describes the fundamental concepts associated with control baselines, selecting the appropriate baseline, baseline assumptions, tailoring baselines, overlays, and capabilities.

•

Chapter Three provides a set of tables organized by control family that contain the controls that comprise the low-impact, moderate-impact, and high-impact security control baselines as well as the privacy control baseline.

•

A list of informative References 9 is provided after Chapter Three.

•

Supporting appendices include: -

Appendix A: Glossary

6 [SP 800-30] provides guidance on the risk assessment process. 7 [IR 8062] introduces privacy risk assessment concepts. 8 [OMB A-130] establishes policy for the planning, budgeting, governance, acquisition, and management of federal

information, personnel, equipment, funds, IT resources, and supporting infrastructure and services. 9 Unless otherwise stated, all references to NIST publications refer to the most recent version of those publications.

CHAPTER ONE

PAGE 3

NIST SP 800-53B CONTROL BASELINES FOR INFORMATION SYSTEMS AND ORGANIZATIONS _________________________________________________________________________________________________

-

Appendix B: Acronyms

-

Appendix C: Overlay Guidance

SECURITY AND PRIVACY CONTROL BASELINES

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53B

Security and privacy control baselines are predefined sets of controls specifically assembled to address the protection needs of groups, organizations, or communities of interest. The control baselines serve as a starting point for the protection of individuals’ privacy, information, and information systems and can be tailored (i.e., customized)—appropriately taking into account organizational missions and business functions, specific and credible threat information, the environment in which the organization operates, and individuals’ privacy interests.

CHAPTER ONE

PAGE 4

NIST SP 800-53B CONTROL BASELINES FOR INFORMATION SYSTEMS AND ORGANIZATIONS _________________________________________________________________________________________________

CHAPTER TWO

THE FUNDAMENTALS CONTROL BASELINES, TAILORING, OVERLAYS, AND CAPABILITIES

T

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53B

his chapter presents the fundamental concepts associated with security and privacy control baselines, including the purpose of control baselines, how control baselines are selected, assumptions associated with control baselines, how the tailoring process is used to customize controls and baselines, the purpose of overlays and how they are used to address the security and privacy needs of communities of interest, and how the concept of capabilities can facilitate the grouping of mutually reinforcing controls.

2.1 CONTROL BASELINES A significant challenge for organizations is selecting a set of security and privacy controls that can protect their mission and business functions and provide the capability to manage security and privacy risk. The selected controls, if correctly implemented and determined to be effective, meet security and privacy requirements defined by applicable laws, executive orders, policies, regulations, and directives. There is no single set of controls that addresses all security and privacy concerns in every situation. However, choosing the most appropriate controls for a specific situation or system to adequately respond to risk requires a fundamental understanding of the organization’s mission and business priorities, the mission and business functions that the systems will support, and the environments in which the systems will operate. It also requires close collaboration with key organizational stakeholders. With that understanding, organizations can demonstrate how to efficiently and cost-effectively assure the confidentiality, integrity, and availability of organizational information and systems, as well as the privacy of individuals in the context of supporting the organization’s mission and business functions. The concept of a control baseline is introduced to assist organizations in selecting a set of controls for their systems that is commensurate with security and privacy risk. A control baseline is a collection of controls from [SP 800-53] assembled to address the protection needs of a group, organization, or community of interest. 10 It provides a generalized set of controls that represents a starting point for the subsequent tailoring activities that are applied to the baseline to produce a targeted or customized security and privacy solution for the entity that the baseline is intended to serve. Control baselines are tailored based on a variety of factors, including threat information, mission or business requirements, types of systems, sector-specific requirements, specific technologies, operating environments, organizational assumptions and constraints, individuals’ privacy interests, laws, executive orders, regulations, policies, directives, standards, or industry best practices. Tailoring activities are described in greater detail in Section 2.4.

10 The U.S. Government—in accordance with the requirements set forth in [FISMA], [OMB A-130], and Federal

Information Processing Standards—has established federally mandated security control baselines. The control baselines for non-national security systems are listed in Chapter Three.

CHAPTER TWO

PAGE 5

NIST SP 800-53B CONTROL BASELINES FOR INFORMATION SYSTEMS AND ORGANIZATIONS _________________________________________________________________________________________________

2.2 SELECTING CONTROL BASELINES Information security programs are responsible for protecting information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction (i.e., unauthorized system activity or behavior) in order to provide confidentiality, integrity, and availability. Privacy programs are responsible for managing the risks to individuals associated with the creation, collection, use, processing, dissemination, storage, maintenance, disclosure, or disposal (collectively referred to as “processing”) of personally identifiable information (PII) and for ensuring compliance with applicable privacy requirements. 11 When a system processes PII, the information security and privacy programs have a shared responsibility to manage the impacts to individuals that arise from security risks and collaborate to determine the security categorization and the selection and tailoring of controls from the security control baselines. This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53B

Security Control Baselines In preparation for selecting and tailoring the appropriate security control baselines for organizational systems and their respective environments of operation, organizations first determine the criticality and sensitivity of the information to be processed, stored, or transmitted by those systems. The process of determining information criticality and sensitivity is known as security categorization and is described in [FIPS 199]. 12 The results of security categorization help guide and inform the selection of security control baselines to protect systems and information. The control baselines selected for systems are commensurate with the potential adverse impact on organizational operations, organizational assets, individuals, other organizations, or the Nation if there is a loss of confidentiality, integrity, or availability. [FIPS 199] requires organizations to categorize systems as low-impact, moderate-impact, or highimpact for the stated security objectives of confidentiality, integrity, and availability. 13 Since the potential impact values for confidentiality, integrity, and availability may not always be the same for a particular system, the high water mark concept (introduced in [FIPS 199]) is used in [FIPS 200] to determine the impact level of the system. The impact level of the system, in turn, is used for the express purpose of selecting the applicable security control baseline from one of the three baselines identified in Chapter Three. 14 Thus, a low-impact system is defined as a system in which all three of the security objectives are low. A moderate-impact system is a system in which at least one of the security objectives is moderate and no security objective is high. Finally, a high-impact system is a system in which at least one security objective is high.

11 Privacy programs may also choose to consider the risks to individuals that may arise from their interactions with

information systems where the processing of PII may be less impactful than the effect that the system has on individuals’ behavior or activities. Such effects would constitute risks to individual autonomy, and organizations may need to take steps to manage those risks in addition to information security and privacy risks. 12 [CNSSI 1253] provides security categorization and control selection guidance for national security systems. 13 NIST SP 800-60 (Volumes 1 and 2) [SP 800-60-1] [SP 800-60-2] provides guidance for the assignment of security categories to information systems. [SP 800-37] provides guidance for the specific tasks of the Risk Management Framework (RMF) Categorize step. 14 The high water mark concept is employed because there are significant dependencies among the security objectives of confidentiality, integrity, and availability. In most cases, a compromise in one security objective ultimately affects the other security objectives as well. Accordingly, security controls are not categorized by security objective. Rather, the security controls are grouped into baselines to provide a general protection capability for classes of systems based on impact level.

CHAPTER TWO

PAGE 6

NIST SP 800-53B CONTROL BASELINES FOR INFORMATION SYSTEMS AND ORGANIZATIONS _________________________________________________________________________________________________

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53B

Once the impact level of the system is determined, organizations select the appropriate security control baseline. 15 The selection of the security control baseline is based on the [FIPS 200] impact level of the system as determined by the security categorization process described above. The organization selects one of three security control baselines from Chapter Three corresponding to the low-impact, moderate-impact, or high-impact categorization of the system. Note that not all controls or control enhancements identified in [SP 800-53] are assigned to control baselines as indicated in the tables in Chapter Three. The controls and control enhancements that are assigned to baselines are indicated by an “x” in the low, moderate, or high columns in Tables 3-1 through 3-20. The use of the term control baseline is intentional. The controls and control enhancements in the baselines are a starting point from which controls or enhancements may be removed, added, or specialized based on the tailoring guidance in Section 2.4. 16

Privacy Control Baseline In addition to the three security control baselines, Chapter Three provides an initial privacy control baseline for federal agencies to address privacy requirements and manage privacy risks that arise from the processing of PII based on privacy program responsibilities under [OMB A130]. 17 The controls and control enhancements that are assigned to the privacy baseline are indicated by an “x.” 18 Not all controls or control enhancements that address privacy risk are assigned to the privacy control baseline. This approach provides a starting point from which controls or control enhancements may be removed, added, or specialized based on the tailoring guidance in Section 2.4. 19 Organizations conduct privacy risk assessments that consider the nature of the PII processing and its impact on individuals to guide the tailoring of the privacy control baseline for their programs and systems. Privacy risk assessments include evaluating the applicability of legal and policy requirements for their programs. For example, organizations may remove controls or control enhancements related to legal or policy requirements that are not applicable to them unless they determine that, based on a privacy risk assessment, the controls or control enhancements would be helpful in mitigating identified privacy risks. In addition, organizations may add unassigned controls or control enhancements to mitigate privacy risks specific to their information systems as determined by their privacy risk assessments. 15 The general control baseline selection process may be augmented or further detailed by additional sector-specific

guidance, such as for a community with common risk management objectives or an industry sub-sector, as described in Appendix C, Overlays. 16 Specialization refers to the modification of controls or control enhancements (including organization-defined parameters), or supplemental guidance to allow an organization to further refine the control baseline to address specific requirements, technologies, mission or business functions, or environments of operation. To address the need for specialized sets of controls for communities of interest, systems, and organizations, the overlay concept is introduced. For more information on overlays, see Appendix C. 17 Federal agencies should not assume that the implementation of the privacy control baseline means that they have met all of their obligations under [OMB A-130]. Agencies may need to take additional, separate steps to fully comply with OMB privacy requirements. 18 Privacy control enhancements in Tables 3-1 through 3-20 in Chapter Three cannot be selected and implemented without the selection and implementation of the associated base control. Such actions may require collaboration with security programs in cases where the security program has responsibility for the base control. Organizations ensure that the responsibility for the selection and implementation of controls is clearly defined between the information security and privacy programs. 19 See footnote 16.

CHAPTER TWO

PAGE 7

NIST SP 800-53B CONTROL BASELINES FOR INFORMATION SYSTEMS AND ORGANIZATIONS _________________________________________________________________________________________________

2.3 CONTROL BASELINE ASSUMPTIONS

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53B

The control baselines in Chapter Three address the protection needs of a diverse set of constituencies, including individual users and organizations. Thus, certain working assumptions generally underlie the control baselines in Chapter Three. These assumptions, made when determining the baselines in Chapter Three, consider the environments in which organizational information systems operate, including legislative, regulatory, or policy obligations; the nature of organizational operations; the specific functionality employed within the systems; the types of threats confronting organizations, mission and business processes, and systems; individuals’ privacy interests; and the types of information processed, stored, or transmitted by systems. 20 Articulating the underlying assumptions is a key element in the Risk Framing step of the risk management process described in [SP 800-39] and reinforced in the Prepare step in [SP 800-37]. Specific assumptions that underlie the control baselines in Chapter Three include: •

Information in organizational systems is relatively persistent. 21

•

Organizational systems are multi-user (either serially or concurrently) in operation.

•

Some information in organizational systems is not shareable with other users who have authorized access to the same systems.

•

Organizational systems exist in networked environments and are general purpose in nature.

•

Organizations have the necessary structure, resources, and infrastructure to implement the controls. 22

If any of the above assumptions are not valid, then some of the security controls allocated to the control baselines in Chapter Three may not be applicable—a situation that can be addressed by applying the tailoring guidance in Section 2.4 and the results of organization- and system-level risk assessments. Additional assumptions that are not addressed in the baselines include: •

Insider threats exist within organizations.

•

Classified information is processed, stored, or transmitted by organizational systems. 23

•

Advanced persistent threats (APTs) exist within organizations.

•

Information requires specialized protection based on legislation, directives, regulations, or policies.

•

Organizational systems communicate with other systems across different security domains.

If any of these assumptions apply, then additional controls from [SP 800-53] are likely needed to ensure adequate protection—a situation that can also be effectively addressed by applying the tailoring guidance in Section 2.4 (specifically, security control supplementation) and the results of organization- and system-level assessments of risk. 20

The control baselines consider the nature of threats to the extent feasible given the dynamic nature of threats.

21 Persistent data/information refers to data/information with utility for a relatively long duration (e.g., days, weeks). 22 In general, federal departments and agencies satisfy this assumption. However, the assumption can become an

issue for nonfederal entities, such as municipalities, first responders, and small businesses. Such entities may not be large enough or sufficiently resourced to have elements dedicated to providing the range of security or privacy capabilities that are assumed by the baselines. Organizations consider such factors in their risk-based decisions. 23 See NIST SP 800-59 [SP 800-59] and CNSS Instruction 1253 [CNSSI 1253].

CHAPTER TWO

PAGE 8

NIST SP 800-53B CONTROL BASELINES FOR INFORMATION SYSTEMS AND ORGANIZATIONS _________________________________________________________________________________________________

2.4 TAILORING CONTROL BASELINES After selecting an appropriate control baseline, organizations initiate a tailoring process to align the controls more closely with the specific security and privacy requirements identified by the organization. The tailoring process is part of an organization-wide risk management process that includes framing, assessing, responding to, and monitoring information security and privacy risks. Tailoring decisions are dependent on organizational or system-specific factors. While tailoring decisions are focused on security and privacy considerations, the decisions are typically aligned with other risk-related issues that organizations must routinely address. Risk-related issues such as cost, schedule, and performance are considered in the determination of which controls to employ and how to implement controls in organizational systems and environments of operation. 24 The tailoring process can include but is not limited to the following activities: 25 This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53B

•

Identifying and designating common controls

•

Applying scoping considerations

•

Selecting compensating controls

•

Assigning values to organization-defined control parameters via explicit assignment and selection operations

•

Supplementing baselines with additional controls and control enhancements

•

Providing specification information for control implementation

Organizations use risk management guidance to facilitate risk-based decision making regarding the applicability of the controls in the baselines. Ultimately, organizations employ the tailoring process to achieve cost-effective solutions that support organizational mission and business needs and provide security and privacy protections commensurate with risk. Organizations have the flexibility to tailor at the organization level for systems in support of a line of business or a mission or business process, at the individual system level, or by using a combination of the two. 26 However, organizations do not arbitrarily remove security and privacy controls from baselines. Tailoring decisions are expected to be defensible based on mission and business needs, a sound rationale, and explicit risk-based determinations. 27 Tailoring decisions, including the risk-based justification for the decisions, are documented in the system security and privacy plans for organizational systems. 28 Every control from the selected control baseline is accounted for by the organization. If certain controls are tailored out, the rationale is recorded in the system security and privacy plans and subsequently 24 It is inappropriate for organizations to tailor out security or privacy controls that pertain to applicable federal legislative, regulatory, or policy requirements. 25 See Section 2.2, Privacy Control Baseline, for additional guidance on tailoring privacy controls. 26 See [SP 800-37], Task P-4, Organizationally-Tailored Control Baselines and Cybersecurity Framework Profiles (Optional), for additional guidance on tailoring control baselines for organization-wide use. See [SP 800-37], Task S-2, Control Tailoring, for additional guidance on tailoring control baselines for systems and environments of operation. 27 Tailoring decisions can be based on the timing and applicability of selected controls under certain conditions. That is, security and privacy controls may not apply in every situation, or the parameter values for assignment operations may change under certain circumstances. Federal agencies conduct baseline tailoring activities in accordance with OMB policy. In certain situations, OMB may prohibit agencies from tailoring specific security or privacy controls. 28 [SP 800-18] provides guidance on developing system security plans. Guidance on developing privacy and supply chain risk management plans is forthcoming.

CHAPTER TWO

PAGE 9

NIST SP 800-53B CONTROL BASELINES FOR INFORMATION SYSTEMS AND ORGANIZATIONS _________________________________________________________________________________________________

approved by the responsible officials within the organization as part of the approval process for the plans. Documenting risk management decisions during the baseline tailoring process is imperative for organizational officials to have the necessary information to make credible, riskbased decisions regarding security and privacy and to do so in a manner that fully supports transparency, traceability, and accountability.

Identifying and Designating Common Controls

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53B

Common controls are controls that may be inherited by one or more organizational systems. If a system inherits a common control provided by another entity (internal or external), there is no need to implement the control within that system. Organizational decisions on which controls are designated as common controls may affect the responsibilities of individual system owners with regard to the implementation of the controls in a baseline. 29 Common control providers ensure that current implementation information and assessment results are available to facilitate decision making by system owners and authorizing officials. System owners and authorizing officials determine if the common controls available for inheritance actually provide protection commensurate with risk for inheriting systems. 30 Common control designation and control implementation can affect organizations’ resource expenditures. That is, in general, the greater the number of common controls implemented, the greater the potential cost savings since the protective measures are amortized over many systems. Additionally, the deployment of controls as common controls often provides a more standardized, stable, scalable, and secure implementation across the organization as opposed to the same control implemented separately on multiple individual systems.

Applying Scoping Considerations Scoping considerations, when applied in conjunction with risk management guidance, provide organizations with a more granular foundation on which to make risk-based decisions. 31 The application of these scoping considerations can eliminate unnecessary controls from the initial control baselines and ensure that organizations select only those controls that are needed to provide a level of protection that is commensurate with risk. Organizations may apply the scoping considerations described below as needed to assist with making risk-based decisions regarding control selection and specification. - Control Implementation, Applicability, and Placement Considerations The growing complexity of systems requires careful analysis in the implementation of security and privacy controls. Controls in the initial baselines may not be applicable to every component in the system. Controls are applicable only to system components that provide or support the security or privacy functions or capabilities addressed by the controls. 32 Organizations make 29 See the Organizational Prepare Step, Task P-5, Common Control Identification, in [SP 800-37] for more information

about organizational decisions on designating common controls. See Section 2.3 in [SP 800-53] for more information about common controls as a control implementation approach. 30 Organizations may also leverage the use of hybrid controls. Hybrid controls are partially implemented by one or more common control providers and partially implemented by the system. 31 The scoping considerations listed in this section are examples and not intended to limit organizations in rendering risk-based decisions based on other organization-defined considerations with appropriate justification or rationale. 32 For example, auditing controls are typically applied to components of a system that provide auditing capabilities and are not necessarily applied to every user-level component within the organization.

CHAPTER TWO

PAGE 10

NIST SP 800-53B CONTROL BASELINES FOR INFORMATION SYSTEMS AND ORGANIZATIONS _________________________________________________________________________________________________

explicit risk-based decisions about where to apply or allocate specific controls in organizational systems to achieve the needed security or privacy function or capability and to satisfy security and privacy requirements. - Operational and Environmental Considerations

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53B

Certain controls in the control baselines assume the existence of operational or environmental factors. Where operational or environmental factors are absent or significantly diverge from the baseline assumptions described in Section 2.3, it is justifiable to tailor the baseline. Common operational and environmental factors include mobile devices and operations; single-user systems and operations; data connectivity and bandwidth; air-gapped systems; systems that have very limited or sporadic bandwidth, such as tactical systems that support warfighter or law enforcement missions; cyber-physical systems, sensors, and Internet of Things (IoT) devices; limited functionality systems, such as facsimile machines, printers, and digital cameras; systems that process, store, or transmit non-persistent information or that use virtualization techniques to establish non-persistent instantiations of operating systems and applications; and systems that require public access. - Technology Considerations Controls that refer to specific technologies—such as wireless, cryptography, or public key infrastructure—are applicable only if those technologies are implemented or required for use within organizational systems. Controls that can be effectively supported by automated mechanisms do not require the development of such mechanisms if the mechanisms do not already exist or are not readily available in commercial or government off-the-shelf products. If automated mechanisms are not available, cost-effective, or technically feasible, compensating controls implemented through non-automated mechanisms or procedures can be implemented to satisfy specified controls or control enhancements. - Mission and Business Considerations Certain controls may not be appropriate if implementing those controls has the potential to degrade, debilitate, or interfere with organizational mission or business functions, including endangering or harming individuals. However, decisions on the appropriateness of control implementation always consider legislative, regulatory, and policy requirements. - Security Objective Considerations Controls that support only one or two of the security objectives (i.e., confidentiality, integrity, or availability) may be downgraded to the corresponding control in a lower baseline (or modified or eliminated if not defined in a lower baseline) only if the downgrading action reflects the [FIPS 199] security category for the supported security objectives before considering the [FIPS 200] impact level (i.e., high water mark), is supported by an organizational assessment of risk, and does not adversely affect the level of protection for the security-relevant information within the system. For example, if a system is categorized as moderate-impact using the high water mark concept because confidentiality and/or integrity are moderate but availability is low, there are several controls that only support the availability security objective and that could potentially be downgraded to the low baseline controls. In this scenario, it may be appropriate to refrain from implementing CP-2(1) because the control enhancement only supports availability and is selected in the moderate baseline but not in the low baseline. The following security controls and control enhancements are candidates for downgrading for each of the security categories:

CHAPTER TWO

PAGE 11

NIST SP 800-53B CONTROL BASELINES FOR INFORMATION SYSTEMS AND ORGANIZATIONS _________________________________________________________________________________________________

•

Support Only Confidentiality: AC-21, MA-3(3), MP-3, MP-4, MP-5, MP-6(1), MP-6(2), PE-4, PE-5, SC-4

•

Support Only Integrity: CM-5, CM-5(1), CM-5(3), SI-7, SI-7(1), SI-7(5), SI-10

•

Support Only Availability: CP-2(1), CP-2(2), CP-2(3), CP-2(5), CP-2(8), CP-3(1), CP-4(1), CP4(2), CP-6, CP-6(1), CP-6(2), CP-6(3), CP-7, CP-7(1), CP-7(2), CP-7(3), CP-7(4), CP-7(6), CP-8, CP-8(1), CP-8(2), CP-8(3), CP-8(4), CP-8(5), CP-9(2), CP-9(3), CP-9(5), CP-9(6), CP-10(2), CP10(4), CP-11, MA-6, PE-9, PE-10, PE-11, PE-11(1), PE-13(1), PE-13(2), PE-15(1)

- Legal and Policy Considerations

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53B

Although controls that are used to meet legislative, regulatory, or policy requirements are not to be tailored out of control baselines, some legislative, regulatory, or policy requirements may only apply in specified circumstances. It is justifiable to tailor the baseline when these circumstances are not applicable to an organization or certain systems.

Selecting Compensating Controls Compensating controls are used by organizations in lieu of specific controls in control baselines. The use of compensating controls is appropriate when controls are tailored out of the control baseline by necessity, but the protection provided by the controls is still needed to reduce risk to an acceptable level. Compensating controls are often chosen when implementing a baseline control is technically infeasible, not cost effective, or the control implementation negatively affects organizational mission or business functions. 33 For technology-based scoping considerations, compensating controls may be temporary and used only until the system is updated. Compensating controls are intended to provide equivalent or comparable protection 34 for systems, organizations, and individuals. 35 Compensating controls are selected after applying the scoping considerations in the tailoring process. To use compensating controls, organizations: •

Select compensating controls from the control catalog in [SP 800-53].

•

Provide a rationale for how compensating controls satisfy security or privacy requirements and why the baseline controls could not be implemented.

•

Adopt suitable compensating controls from other sources if appropriate compensating controls are not available in [SP 800-53]. 36

•

Assess and accept the security and privacy risks associated with implementing compensating controls.

33 For example, additional physical security controls may be implemented in lieu of a device lock in certain real-time

mission or business applications. In a small organization, more frequent auditing, targeted role-based training, or stronger personnel screening may be implemented in lieu of separation of duties. Well-defined procedures, targeted role-based training, and more frequent auditing may be implemented in lieu of automated mechanisms. 34 Compensating controls are not used to avoid the need to comply with requirements. Rather, the use of such controls provides alternative and suitable security and privacy protections to facilitate risk management. 35 More than one compensating control may be required to provide the equivalent protection for a control that has been tailored out from a control baseline. 36 Organizations make every attempt to select compensating controls from the consolidated control catalog in [SP 800-53]. Organization-defined compensating controls are employed only when organizations determine that the control catalog does not contain suitable compensating controls.

CHAPTER TWO

PAGE 12

NIST SP 800-53B CONTROL BASELINES FOR INFORMATION SYSTEMS AND ORGANIZATIONS _________________________________________________________________________________________________

Assigning Control Parameter Values Controls and control enhancements containing embedded parameters (i.e., assignment and selection operations) give organizations the flexibility to specify values for certain portions of controls and control enhancements to support specific organizational requirements. After the application of scoping considerations and the selection of compensating controls, organizations review the controls and control enhancements for assignment or selection operations and determine the appropriate organization-defined values for the identified parameters. The parameter values may be driven by mission or business requirements, or the values may be prescribed by laws, executive orders, directives, regulations, policies, standards, guidelines, or industry best practices. This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53B

Once organizations specify the parameter values for the controls and control enhancements, the specified assignment and selection values become a permanent part of the control and control enhancement. As such, they are documented in security and privacy program plans or system security and privacy plans, as appropriate. Organizations can specify the parameter values before selecting compensating controls since the parameter specification completes the control definitions and may affect the need for compensating controls. There can be significant benefits to collaborating on the development of parameter values for controls. For organizations that work together on a frequent basis or regularly conduct exchanges of information, it may be useful to develop a mutually agreeable set of control parameter values.

Supplementing Control Baselines In certain situations, additional controls or control enhancements beyond the controls and enhancements contained in the control baselines in Chapter Three may be required to address specific threats to organizations, mission and business processes, and systems; to address specific types of PII processing and associated privacy risks; and to satisfy the requirements of laws, executive orders, directives, policies, regulations, standards, and guidelines. Organizational assessments of risk provide information for determining the necessity and sufficiency of the controls and control enhancements in the control baselines. Organizations are encouraged to make maximum use of the control catalog in [SP 800-53] to supplement control baselines with additional controls or control enhancements.

Providing Additional Specification Information for Control Implementation Since controls and control enhancements are statements of security or privacy functions or capabilities that are conveyed at higher levels of abstraction, the controls may lack sufficient information for implementation. Therefore, additional details may be necessary to fully define the intent of a given control for implementation purposes and to ensure that the security and privacy requirements related to that control are satisfied. For example, additional information may be provided as part of the process of moving from control to specification requirements and may involve refinement of implementation details, refinement of scope, or iteration to apply the same control differently to different scopes. The need to provide control specification information occurs routinely when controls are employed in a systems engineering process as part of requirements engineering. Organizations ensure that if existing control information is not sufficient to define the intended implementation details for the control, such information is provided to system owners and common control providers. Organizations have the flexibility to determine whether control specification information is included as part of the control statement

CHAPTER TWO

PAGE 13

NIST SP 800-53B CONTROL BASELINES FOR INFORMATION SYSTEMS AND ORGANIZATIONS _________________________________________________________________________________________________

or in a separate control addendum section. When providing additional detail, organizations are cautioned not to change the intent of the base control or modify the original language in the control. Implementation information is documented in the system security and privacy plans.

2.5 CAPABILITIES

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53B

Organizations consider defining a set of capabilities as a precursor to the control selection process. The concept of capability recognizes that satisfying security or privacy requirements seldom derives from a single control but rather from a set of mutually reinforcing controls. For example, organizations may wish to define a capability for secure remote authentication. This capability can be achieved by the selection and implementation of a set of controls from [SP 800-53], such as IA-2 (1), IA-2 (2), IA-2 (8), IA-2 (9), and SC-8 (1). Moreover, capabilities can address a variety of areas that can include technical means, physical means, procedural means, or any combination thereof. In addition to the above capability for secure remote access, organizations may also need security capabilities that address physical means, such as tamper detection on a cryptographic module or anomaly detection/analysis on an orbiting spacecraft. As the number of controls in [SP 800-53] grows in response to an increasingly sophisticated threat space, it is important for organizations to have the ability to describe key capabilities needed to protect organizational missions and business functions, and to subsequently select controls that—if properly designed, developed, and implemented—produce such capabilities. The use of capabilities simplifies how the protection problem is viewed conceptually. Using the construct of a capability provides a method of grouping controls that are employed for a common purpose or to achieve a common objective. For example, the grouping of controls is an important consideration when assessing controls for effectiveness. 37 Traditionally, assessments have been conducted on a control-by-control basis, producing results that are characterized as pass (i.e., control satisfied) or fail (i.e., control not satisfied). However, the failure of a single control, or in some cases, multiple controls may not affect the overall capability needed by an organization. Moreover, employing the broader construct of a capability allows an organization to assess the severity of the vulnerabilities in its systems and determine if the failure of a particular control or the decision not to deploy a control affects the capability needed for mission and business protection. It also facilitates conducting root cause analyses to determine if the failure of one control can be traced to the failure of other controls based on the established control relationships. Ultimately, authorization decisions (i.e., risk acceptance decisions) are made based on the degree to which the desired capabilities have been effectively achieved and are meeting the security and privacy requirements defined by an organization. These risk-based decisions are directly related to the organizational risk tolerance that is defined as part of an organization’s risk management strategy.

37 NIST Interagency Report 8011, Vol. 1 [IR 8011 v1], describes grouping controls by purpose to facilitate automated

control assessments.

CHAPTER TWO

PAGE 14

NIST SP 800-53B CONTROL BASELINES FOR INFORMATION SYSTEMS AND ORGANIZATIONS _________________________________________________________________________________________________

CHAPTER THREE

THE CONTROL BASELINES SECURITY AND PRIVACY CONTROL BASELINES

T

ables 3-1 through 3-20 provide a listing of the controls and control enhancements assigned to the control families in [SP 800-53] and the respective control allocations to the privacy control baseline and the low-impact, moderate-impact, and high-impact security control baselines. Section 2.2 (Privacy Control Baseline) provides additional information on the privacy control selection criteria. This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53B

SECURITY AND PRIVACY CONTROL BASELINE RELATIONSHIPS •

Controls and control enhancements that are assigned to security control baselines are used to manage risks arising from the loss of confidentiality, integrity, and availability. Since Senior Agency Officials for Privacy (SAOPs) have the responsibility for managing privacy risk in accordance with [OMB A-130], and since privacy risks arise from both the processing of PII and the loss of confidentiality, integrity, and availability of PII, it is important that organizations consider how privacy and security programs collaborate in activities related to these controls, such as categorization, tailoring, implementation, and assessment.

•

Controls and control enhancements that are assigned only to the privacy control baseline and not to the security control baselines are important for managing privacy program responsibilities under [OMB A-130] but do not generally support the management of risks that arise from the loss of confidentiality, integrity, and availability.

•

Controls and control enhancements that are assigned to both the privacy and security control baselines are used to manage privacy program responsibilities under [OMB A-130] and risks that arise from the loss of confidentiality, integrity, and availability (including PII).

•

Some controls and control enhancements are not assigned to any control baseline. Through tailoring, organizations make their own determinations as to whether the controls and control enhancements are needed to meet applicable requirements or are useful for managing risks that arise from the loss of confidentiality, integrity, and availability or the processing of PII.

CHAPTER THREE

PAGE 15

NIST SP 800-53B CONTROL BASELINES FOR INFORMATION SYSTEMS AND ORGANIZATIONS _________________________________________________________________________________________________

3.1 ACCESS CONTROL FAMILY Table 3-1 provides a summary of the controls and control enhancements assigned to the Access Control Family. The controls are allocated to the low-impact, moderate-impact, and high-impact security control baselines and the privacy control baseline, as appropriate. A control or control enhancement that has been withdrawn from the control catalog is indicated by a “W” and an explanation of the control or control enhancement disposition in light gray text.

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53B

CONTROL NUMBER

CONTROL NAME CONTROL ENHANCEMENT NAME

AC-1 AC-2 AC-2(1) AC-2(2) AC-2(3) AC-2(4) AC-2(5) AC-2(6) AC-2(7) AC-2(8) AC-2(9) AC-2(10) AC-2(11) AC-2(12) AC-2(13) AC-3 AC-3(1) AC-3(2) AC-3(3) AC-3(4) AC-3(5) AC-3(6) AC-3(7) AC-3(8)

Policy and Procedures Account Management

AC-3(9) AC-3(10) AC-3(11) AC-3(12) AC-3(13) AC-3(14) AC-3(15) AC-4 AC-4(1)

CONTROLLED RELEASE

CHAPTER THREE

PRIVACY CONTROL BASELINE

TABLE 3-1: ACCESS CONTROL FAMILY

x

SECURITY CONTROL BASELINES LOW

MOD

HIGH

x x

x x x x x x x

x x x x x x x

AUTOMATED SYSTEM ACCOUNT MANAGEMENT AUTOMATED TEMPORARY AND EMERGENCY ACCOUNT MANAGEMENT DISABLE ACCOUNTS AUTOMATED AUDIT ACTIONS INACTIVITY LOGOUT DYNAMIC PRIVILEGE MANAGEMENT PRIVILEGED USER ACCOUNTS DYNAMIC ACCOUNT MANAGEMENT RESTRICTIONS ON USE OF SHARED AND GROUP ACCOUNTS SHARED AND GROUP ACCOUNT CREDENTIAL CHANGE

W: Incorporated into AC-2k.

USAGE CONDITIONS ACCOUNT MONITORING FOR ATYPICAL USAGE DISABLE ACCOUNTS FOR HIGH-RISK INDIVIDUALS

Access Enforcement RESTRICTED ACCESS TO PRIVILEGED FUNCTIONS

x

x x

x x x x

W: Incorporated into AC-6.

DUAL AUTHORIZATION MANDATORY ACCESS CONTROL DISCRETIONARY ACCESS CONTROL SECURITY-RELEVANT INFORMATION PROTECTION OF USER AND SYSTEM INFORMATION

W: Incorporated into MP-4 and SC-28.

ROLE-BASED ACCESS CONTROL REVOCATION OF ACCESS AUTHORIZATIONS

AUDITED OVERRIDE OF ACCESS CONTROL MECHANISMS RESTRICT ACCESS TO SPECIFIC INFORMATION TYPES ASSERT AND ENFORCE APPLICATION ACCESS ATTRIBUTE-BASED ACCESS CONTROL INDIVIDUAL ACCESS

x

DISCRETIONARY AND MANDATORY ACCESS CONTROL

Information Flow Enforcement

x

x

OBJECT SECURITY AND PRIVACY ATTRIBUTES

PAGE 16

CONTROL NUMBER

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53B

AC-4(2) AC-4(3) AC-4(4) AC-4(5) AC-4(6) AC-4(7) AC-4(8) AC-4(9) AC-4(10) AC-4(11) AC-4(12) AC-4(13) AC-4(14) AC-4(15) AC-4(16) AC-4(17) AC-4(18) AC-4(19) AC-4(20) AC-4(21) AC-4(22) AC-4(23) AC-4(24) AC-4(25) AC-4(26) AC-4(27) AC-4(28) AC-4(29) AC-4(30) AC-4(31) AC-4(32) AC-5 AC-6 AC-6(1) AC-6(2) AC-6(3) AC-6(4) AC-6(5) AC-6(6) AC-6(7) AC-6(8) AC-6(9)

CHAPTER THREE

CONTROL NAME CONTROL ENHANCEMENT NAME

PRIVACY CONTROL BASELINE

NIST SP 800-53B CONTROL BASELINES FOR INFORMATION SYSTEMS AND ORGANIZATIONS _________________________________________________________________________________________________

SECURITY CONTROL BASELINES LOW

MOD

HIGH

PROCESSING DOMAINS DYNAMIC INFORMATION FLOW CONTROL

x

FLOW CONTROL OF ENCRYPTED INFORMATION EMBEDDED DATA TYPES METADATA ONE-WAY FLOW MECHANISMS SECURITY AND PRIVACY POLICY FILTERS HUMAN REVIEWS ENABLE AND DISABLE SECURITY OR PRIVACY POLICY FILTERS CONFIGURATION OF SECURITY OR PRIVACY POLICY FILTERS DATA TYPE IDENTIFIERS DECOMPOSITION INTO POLICY-RELEVANT SUBCOMPONENTS SECURITY OR PRIVACY POLICY FILTER CONSTRAINTS DETECTION OF UNSANCTIONED INFORMATION INFORMATION TRANSFERS ON INTERCONNECTED SYSTEMS

W: Incorporated into AC-4.

DOMAIN AUTHENTICATION SECURITY ATTRIBUTE BINDING

W: Incorporated into AC-16.

VALIDATION OF METADATA APPROVED SOLUTIONS PHYSICAL OR LOGICAL SEPARATION OF INFORMATION FLOWS ACCESS ONLY MODIFY NON-RELEASABLE INFORMATION INTERNAL NORMALIZED FORMAT DATA SANITIZATION AUDIT FILTERING ACTIONS REDUNDANT/INDEPENDENT FILTERING MECHANISMS LINEAR FILTER PIPELINES FILTER ORCHESTRATION ENGINES FILTER MECHANISMS USING MULTIPLE PROCESSES FAILED CONTENT TRANSFER PREVENTION PROCESS REQUIREMENTS FOR INFORMATION TRANSFER

Separation of Duties Least Privilege AUTHORIZE ACCESS TO SECURITY FUNCTIONS NON-PRIVILEGED ACCESS FOR NONSECURITY FUNCTIONS

x x x x

x x x x x

x

x

x

x

x

x

NETWORK ACCESS TO PRIVILEGED COMMANDS SEPARATE PROCESSING DOMAINS PRIVILEGED ACCOUNTS PRIVILEGED ACCESS BY NON-ORGANIZATIONAL USERS REVIEW OF USER PRIVILEGES PRIVILEGE LEVELS FOR CODE EXECUTION LOG USE OF PRIVILEGED FUNCTIONS

PAGE 17

CONTROL NUMBER

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53B

AC-6(10) AC-7 AC-7(1) AC-7(2) AC-7(3) AC-7(4) AC-8 AC-9 AC-9(1) AC-9(2) AC-9(3) AC-9(4) AC-10 AC-11 AC-11(1) AC-12 AC-12(1) AC-12(2) AC-12(3) AC-13 AC-14 AC-14(1) AC-15 AC-16 AC-16(1) AC-16(2) AC-16(3) AC-16(4) AC-16(5) AC-16(6) AC-16(7) AC-16(8) AC-16(9) AC-16(10) AC-17 AC-17(1) AC-17(2) AC-17(3) AC-17(4) AC-17(5) AC-17(6) AC-17(7)

CHAPTER THREE

CONTROL NAME CONTROL ENHANCEMENT NAME

PRIVACY CONTROL BASELINE

NIST SP 800-53B CONTROL BASELINES FOR INFORMATION SYSTEMS AND ORGANIZATIONS _________________________________________________________________________________________________

SECURITY CONTROL BASELINES LOW

MOD

HIGH

x

x x

x x

PROHIBIT NON-PRIVILEGED USERS FROM EXECUTING PRIVILEGED FUNCTIONS

Unsuccessful Logon Attempts AUTOMATIC ACCOUNT LOCK

W: Incorporated into AC-7.

PURGE OR WIPE MOBILE DEVICE BIOMETRIC ATTEMPT LIMITING USE OF ALTERNATE AUTHENTICATION FACTOR

System Use Notification Previous Logon Notification

x

x

x

x x x

x x x x

UNSUCCESSFUL LOGONS SUCCESSFUL AND UNSUCCESSFUL LOGONS NOTIFICATION OF ACCOUNT CHANGES ADDITIONAL LOGON INFORMATION

Concurrent Session Control Device Lock PATTERN-HIDING DISPLAYS Session Termination USER-INITIATED LOGOUTS TERMINATION MESSAGE TIMEOUT WARNING MESSAGE

Supervision and Review-Access Control Permitted Actions without Identification or Authentication

W: Incorporated into AC-2 and AU-6.

NECESSARY USES

W: Incorporated into AC-14.

Automated Marking Security and Privacy Attributes

W: Incorporated into MP-3.

x

x

x

DYNAMIC ATTRIBUTE ASSOCIATION ATTRIBUTE VALUE CHANGES BY AUTHORIZED INDIVIDUALS MAINTENANCE OF ATTRIBUTE ASSOCIATIONS BY SYSTEM ASSOCIATION OF ATTRIBUTES BY AUTHORIZED INDIVIDUALS ATTRIBUTE DISPLAYS ON OBJECTS TO BE OUTPUT MAINTENANCE OF ATTRIBUTE ASSOCIATION CONSISTENT ATTRIBUTE INTERPRETATION ASSOCIATION TECHNIQUES AND TECHNOLOGIES ATTRIBUTE REASSIGNMENT – REGRADING MECHANISMS ATTRIBUTE CONFIGURATION BY AUTHORIZED INDIVIDUALS

Remote Access MONITORING AND CONTROL PROTECTION OF CONFIDENTIALITY AND INTEGRITY USING ENCRYPTION MANAGED ACCESS CONTROL POINTS PRIVILEGED COMMANDS AND ACCESS MONITORING FOR UNAUTHORIZED CONNECTIONS

x

x x x x x

x x x x x

W: Incorporated into SI-4.

PROTECTION OF MECHANISM INFORMATION ADDITIONAL PROTECTION FOR SECURITY FUNCTION ACCESS

W: Incorporated into AC-3(10).

PAGE 18

CONTROL NUMBER

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53B

AC-17(8) AC-17(9) AC-17(10) AC-18 AC-18(1) AC-18(2) AC-18(3) AC-18(4) AC-18(5) AC-19 AC-19(1) AC-19(2) AC-19(3) AC-19(4) AC-19(5) AC-20 AC-20(1) AC-20(2) AC-20(3) AC-20(4) AC-20(5) AC-21 AC-21(1) AC-21(2) AC-22 AC-23 AC-24 AC-24(1) AC-24(2) AC-25

CHAPTER THREE

CONTROL NAME CONTROL ENHANCEMENT NAME

DISABLE NONSECURE NETWORK PROTOCOLS

PRIVACY CONTROL BASELINE

NIST SP 800-53B CONTROL BASELINES FOR INFORMATION SYSTEMS AND ORGANIZATIONS _________________________________________________________________________________________________

SECURITY CONTROL BASELINES LOW

MOD

HIGH

W: Incorporated into CM-7.

DISCONNECT OR DISABLE ACCESS AUTHENTICATE REMOTE COMMANDS

Wireless Access

x

AUTHENTICATION AND ENCRYPTION MONITORING UNAUTHORIZED CONNECTIONS

x x

W: Incorporated into SI-4.

x

DISABLE WIRELESS NETWORKING RESTRICT CONFIGURATIONS BY USERS ANTENNAS AND TRANSMISSION POWER LEVELS

Access Control for Mobile Devices

x x

x

x

USE OF WRITABLE AND PORTABLE STORAGE DEVICES

W: Incorporated into MP-7.

USE OF PERSONALLY OWNED PORTABLE STORAGE DEVICES

W: Incorporated into MP-7.

USE OF PORTABLE STORAGE DEVICES WITH NO IDENTIFIABLE OWNER

W: Incorporated into MP-7.

x x x x

RESTRICTIONS FOR CLASSIFIED INFORMATION FULL DEVICE OR CONTAINER-BASED ENCRYPTION

Use of External Systems

x

LIMITS ON AUTHORIZED USE PORTABLE STORAGE DEVICES — RESTRICTED USE

x x x x

x x x x

x

x

x

x

NON-ORGANIZATIONALLY OWNED SYSTEMS — RESTRICTED USE NETWORK ACCESSIBLE STORAGE DEVICES — PROHIBITED USE PORTABLE STORAGE DEVICES — PROHIBITED USE

Information Sharing AUTOMATED DECISION SUPPORT INFORMATION SEARCH AND RETRIEVAL

Publicly Accessible Content Data Mining Protection Access Control Decisions

x

TRANSMIT ACCESS AUTHORIZATION INFORMATION NO USER OR PROCESS IDENTITY

Reference Monitor

PAGE 19

NIST SP 800-53B CONTROL BASELINES FOR INFORMATION SYSTEMS AND ORGANIZATIONS _________________________________________________________________________________________________

3.2 AWARENESS AND TRAINING FAMILY Table 3-2 provides a summary of the controls and control enhancements assigned to the Awareness and Training Family. The controls are allocated to the low-impact, moderate-impact, and high-impact security control baselines and the privacy control baseline, as appropriate. A control or control enhancement that has been withdrawn from the control catalog is indicated by a “W” and an explanation of the control or control enhancement disposition in light gray text. TABLE 3-2: AWARENESS AND TRAINING FAMILY

AT-1 AT-2 AT-2(1) AT-2(2) AT-2(3) AT-2(4) AT-2(5) AT-2(6) AT-3 AT-3(1) AT-3(2) AT-3(3) AT-3(4) AT-3(5) AT-4 AT-5 AT-6

CHAPTER THREE

CONTROL NAME CONTROL ENHANCEMENT NAME

Policy and Procedures Literacy Training and Awareness

SECURITY CONTROL BASELINES

PRIVACY CONTROL BASELINE

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53B

CONTROL NUMBER

LOW

MOD

HIGH

x x

x x

x x

x x

X

x x

x x

x

x

x

PRACTICAL EXERCISES INSIDER THREAT SOCIAL ENGINEERING AND MINING SUSPICIOUS COMMUNICATIONS AND ANOMALOUS SYSTEM BEHAVIOR ADVANCED PERSISTENT THREAT CYBER THREAT ENVIRONMENT

Role-Based Training

x

ENVIRONMENTAL CONTROLS PHYSICAL SECURITY CONTROLS PRACTICAL EXERCISES SUSPICIOUS COMMUNICATIONS AND ANOMALOUS SYSTEM BEHAVIOR PROCESSING PERSONALLY IDENTIFIABLE INFORMATION

Training Records Contacts with Security Groups and Associations Training Feedback

W: Incorporated into AT-2(4).

x x

x

x

x

W: Incorporated into PM-15.

PAGE 20

NIST SP 800-53B CONTROL BASELINES FOR INFORMATION SYSTEMS AND ORGANIZATIONS _________________________________________________________________________________________________

3.3 AUDIT AND ACCOUNTABILITY FAMILY Table 3-3 provides a summary of the controls and control enhancements assigned to the Audit and Accountability Family. The controls are allocated to the low-impact, moderate-impact, and high-impact security control baselines and the privacy control baseline, as appropriate. A control or control enhancement that has been withdrawn from the control catalog is indicated by a “W” and an explanation of the control or control enhancement disposition in light gray text. TABLE 3-3: AUDIT AND ACCOUNTABILITY FAMILY

AU-1 AU-2 AU-2(1) AU-2(2) AU-2(3) AU-2(4) AU-3 AU-3(1) AU-3(2) AU-3(3) AU-4 AU-4(1) AU-5 AU-5(1) AU-5(2) AU-5(3) AU-5(4) AU-5(5) AU-6 AU-6(1) AU-6(2) AU-6(3) AU-6(4) AU-6(5) AU-6(6) AU-6(7) AU-6(8) AU-6(9) AU-6(10) AU-7 AU-7(1) AU-7(2) AU-8

CHAPTER THREE

CONTROL NAME CONTROL ENHANCEMENT NAME

Policy and Procedures Event Logging

SECURITY CONTROL BASELINES

PRIVACY CONTROL BASELINE

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53B

CONTROL NUMBER

LOW

MOD

HIGH

x x

x x

x x

x x

COMPILATION OF AUDIT RECORDS FROM MULTIPLE SOURCES

W: Incorporated into AU-12.

SELECTION OF AUDIT EVENTS BY COMPONENT

W: Incorporated into AU-12.

REVIEWS AND UPDATES

W: Incorporated into AU-2.

PRIVILEGED FUNCTIONS

W: Incorporated into AC-6(9).

Content of Audit Records

x

ADDITIONAL AUDIT INFORMATION CENTRALIZED MANAGEMENT OF PLANNED AUDIT RECORD CONTENT LIMIT PERSONALLY IDENTIFIABLE INFORMATION ELEMENTS

Audit Log Storage Capacity

x x

x x

W: Incorporated into PL-9.

x x

x

x

x

x

x x x

x

x x

x x

TRANSFER TO ALTERNATE STORAGE

Response to Audit Logging Process Failures STORAGE CAPACITY WARNING REAL-TIME ALERTS CONFIGURABLE TRAFFIC VOLUME THRESHOLDS SHUTDOWN ON FAILURE ALTERNATE AUDIT LOGGING CAPABILITY

Audit Record Review, Analysis, and Reporting AUTOMATED PROCESS INTEGRATION AUTOMATED SECURITY ALERTS

W: Incorporated into SI-4.

x

CORRELATE AUDIT RECORD REPOSITORIES

x

CENTRAL REVIEW AND ANALYSIS

x x

INTEGRATED ANALYSIS OF AUDIT RECORDS CORRELATION WITH PHYSICAL MONITORING PERMITTED ACTIONS FULL TEXT ANALYSIS OF PRIVILEGED COMMANDS CORRELATION WITH INFORMATION FROM NONTECHNICAL SOURCES AUDIT LEVEL ADJUSTMENT

W: Incorporated into AU-6.

Audit Record Reduction and Report Generation

x x

AUTOMATIC PROCESSING AUTOMATIC SORT AND SEARCH

Time Stamps

x x

W: Incorporated into AU-7(1).

x

x

x

PAGE 21

CONTROL NUMBER

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53B

AU-8(1) AU-8(2) AU-9 AU-9(1) AU-9(2) AU-9(3) AU-9(4) AU-9(5) AU-9(6) AU-9(7) AU-10 AU-10(1) AU-10(2) AU-10(3) AU-10(4) AU-10(5) AU-11 AU-11(1) AU-12 AU-12(1) AU-12(2) AU-12(3) AU-12(4) AU-13 AU-13(1) AU-13(2) AU-13(3) AU-14 AU-14(1) AU-14(2) AU-14(3) AU-15 AU-16 AU-16(1) AU-16(2) AU-16(3)

CHAPTER THREE

CONTROL NAME CONTROL ENHANCEMENT NAME

PRIVACY CONTROL BASELINE

NIST SP 800-53B CONTROL BASELINES FOR INFORMATION SYSTEMS AND ORGANIZATIONS _________________________________________________________________________________________________

SECURITY CONTROL BASELINES LOW

MOD

SYNCHRONIZATION WITH AUTHORITATIVE TIME SOURCE

W: Moved to SC-45(1).

SECONDARY AUTHORITATIVE TIME SOURCE

W: Moved to SC-45(2).

Protection of Audit Information HARDWARE WRITE-ONCE MEDIA

x

x

x

x

x x x

STORE ON SEPARATE PHYSICAL SYSTEMS OR COMPONENTS CRYPTOGRAPHIC PROTECTION ACCESS BY SUBSET OF PRIVILEGED USERS

HIGH

DUAL AUTHORIZATION READ-ONLY ACCESS STORE ON COMPONENT WITH DIFFERENT OPERATING SYSTEM

Non-repudiation

x

ASSOCIATION OF IDENTITIES VALIDATE BINDING OF INFORMATION PRODUCER IDENTITY CHAIN OF CUSTODY VALIDATE BINDING OF INFORMATION REVIEWER IDENTITY DIGITAL SIGNATURES

Audit Record Retention LONG-TERM RETRIEVAL CAPABILITY Audit Record Generation SYSTEM-WIDE AND TIME-CORRELATED AUDIT TRAIL

W: Incorporated into SI-7.

x

x

x

x

x

x

x x

STANDARDIZED FORMATS

x

CHANGES BY AUTHORIZED INDIVIDUALS QUERY PARAMETER AUDITS OF PERSONALLY IDENTIFIABLE INFORMATION

Monitoring for Information Disclosure USE OF AUTOMATED TOOLS REVIEW OF MONITORED SITES UNAUTHORIZED REPLICATION OF INFORMATION

Session Audit SYSTEM START-UP CAPTURE AND RECORD CONTENT

W: Incorporated into AU-14.

REMOTE VIEWING AND LISTENING

Alternate Audit Logging Capability Cross-Organizational Audit Logging

W: Moved to AU-5(5).

IDENTITY PRESERVATION SHARING OF AUDIT INFORMATION DISASSOCIABILITY

PAGE 22

NIST SP 800-53B CONTROL BASELINES FOR INFORMATION SYSTEMS AND ORGANIZATIONS _________________________________________________________________________________________________

3.4 ASSESSMENT, AUTHORIZATION, AND MONITORING FAMILY Table 3-4 provides a summary of the controls and control enhancements assigned to the Assessment, Authorization, and Monitoring Family. The controls are allocated to the low-impact, moderate-impact, and high-impact security control baselines and the privacy control baseline, as appropriate. A control or control enhancement that has been withdrawn from the control catalog is indicated by a “W” and an explanation of the control or control enhancement disposition in light gray text. TABLE 3-4: ASSESSMENT, AUTHORIZATION, AND MONITORING FAMILY

CONTROL NAME CONTROL ENHANCEMENT NAME

SECURITY CONTROL BASELINES

PRIVACY CONTROL BASELINE

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53B

CONTROL NUMBER

LOW

MOD

HIGH

x x

x x

x x x

x x x x

x

x

x

CA-1 CA-2 CA-2(1) CA-2(2) CA-2(3) CA-3

Policy and Procedures Control Assessments

CA-3(1) CA-3(2) CA-3(3) CA-3(4) CA-3(5) CA-3(6) CA-3(7) CA-4 CA-5 CA-5(1) CA-6 CA-6(1) CA-6(2) CA-7 CA-7(1) CA-7(2) CA-7(3) CA-7(4) CA-7(5) CA-7(6) CA-8 CA-8(1) CA-8(2) CA-8(3) CA-9 CA-9(1)

UNCLASSIFIED NATIONAL SECURITY SYSTEM CONNECTIONS

W: Moved to SC-7(25).

CLASSIFIED NATIONAL SECURITY SYSTEM CONNECTIONS

W: Moved to SC-7(26).

UNCLASSIFIED NON-NATIONAL SECURITY SYSTEM CONNECTIONS

W: Moved to SC-7(27).

CONNECTIONS TO PUBLIC NETWORKS

W: Moved to SC-7(28).

RESTRICTIONS ON EXTERNAL SYSTEM CONNECTIONS

W: Incorporated into SC-7(5).

CHAPTER THREE

INDEPENDENT ASSESSORS SPECIALIZED ASSESSMENTS LEVERAGING RESULTS FROM EXTERNAL ORGANIZATIONS

Information Exchange

x

TRANSFER AUTHORIZATIONS TRANSITIVE INFORMATION EXCHANGES

Security Certification Plan of Action and Milestones

W: Incorporated into CA-2.

x

x

x

x

x

x

x

x

x

x

x x

x x

AUTOMATION SUPPORT FOR ACCURACY AND CURRENCY

Authorization JOINT AUTHORIZATION — INTRA-ORGANIZATION JOINT AUTHORIZATION — INTER-ORGANIZATION

Continuous Monitoring INDEPENDENT ASSESSMENT TYPES OF ASSESSMENTS

W: Incorporated into CA-2.

TREND ANALYSES RISK MONITORING

x

x

x

x

CONSISTENCY ANALYSIS AUTOMATION SUPPORT FOR MONITORING

Penetration Testing

x x

INDEPENDENT PENETRATION TESTING AGENT OR TEAM RED TEAM EXERCISES FACILITY PENETRATION TESTING

Internal System Connections

x

x

x

COMPLIANCE CHECKS

PAGE 23

NIST SP 800-53B CONTROL BASELINES FOR INFORMATION SYSTEMS AND ORGANIZATIONS _________________________________________________________________________________________________

3.5 CONFIGURATION MANAGEMENT FAMILY Table 3-5 provides a summary of the controls and control enhancements assigned to the Configuration Management Family. The controls are allocated to the low-impact, moderateimpact, and high-impact security control baselines and the privacy control baseline, as appropriate. A control or control enhancement that has been withdrawn from the control catalog is indicated by a “W” and an explanation of the control or control enhancement disposition in light gray text.

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53B

CONTROL NUMBER

CM-1 CM-2 CM-2(1) CM-2(2) CM-2(3) CM-2(4) CM-2(5) CM-2(6) CM-2(7) CM-3 CM-3(1)

CONTROL NAME CONTROL ENHANCEMENT NAME

Policy and Procedures Baseline Configuration REVIEWS AND UPDATES

PRIVACY CONTROL BASELINE

TABLE 3-5: CONFIGURATION MANAGEMENT FAMILY

x

SECURITY CONTROL BASELINES LOW

MOD

HIGH

x x

x x

x x

W: Incorporated into CM-2.

x x

AUTOMATION SUPPORT FOR ACCURACY AND CURRENCY RETENTION OF PREVIOUS CONFIGURATIONS UNAUTHORIZED SOFTWARE

W: Incorporated into CM-7.

AUTHORIZED SOFTWARE

W: Incorporated into CM-7.

x x

DEVELOPMENT AND TEST ENVIRONMENTS CONFIGURE SYSTEMS AND COMPONENTS FOR HIGH-RISK AREAS

Configuration Change Control AUTOMATED DOCUMENTATION, NOTIFICATION, AND PROHIBITION OF

x x

x x x

x

x

x

x

CHANGES

CM-3(2) CM-3(3) CM-3(4) CM-3(5) CM-3(6) CM-3(7) CM-3(8) CM-4 CM-4(1) CM-4(2) CM-5 CM-5(1) CM-5(2) CM-5(3) CM-5(4) CM-5(5) CM-5(6) CM-5(7) CM-6 CM-6(1)

CHAPTER THREE

TESTING, VALIDATION, AND DOCUMENTATION OF CHANGES AUTOMATED CHANGE IMPLEMENTATION SECURITY AND PRIVACY REPRESENTATIVES AUTOMATED SECURITY RESPONSE

x

CRYPTOGRAPHY MANAGEMENT REVIEW SYSTEM CHANGES PREVENT OR RESTRICT CONFIGURATION CHANGES

Impact Analyses

x

x

x

x

x x

SEPARATE TEST ENVIRONMENTS VERIFICATION OF CONTROLS

Access Restrictions for Change AUTOMATED ACCESS ENFORCEMENT AND AUDIT RECORDS REVIEW SYSTEM CHANGES

W: Incorporated into CM-3(7).

SIGNED COMPONENTS

W: Moved to CM-14.

x x x x x

DUAL AUTHORIZATION PRIVILEGE LIMITATION FOR PRODUCTION AND OPERATION LIMIT LIBRARY PRIVILEGES AUTOMATIC IMPLEMENTATION OF SECURITY SAFEGUARDS

Configuration Settings AUTOMATED MANAGEMENT, APPLICATION, AND VERIFICATION

W: Incorporated into SI-7.

x

x

x x

PAGE 24

CONTROL NUMBER

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53B

CM-6(2) CM-6(3) CM-6(4) CM-7 CM-7(1) CM-7(2) CM-7(3) CM-7(4) CM-7(5) CM-7(6) CM-7(7) CM-7(8) CM-7(9) CM-8 CM-8(1) CM-8(2) CM-8(3) CM-8(4) CM-8(5) CM-8(6) CM-8(7) CM-8(8) CM-8(9) CM-9 CM-9(1) CM-10 CM-10(1) CM-11 CM-11(1) CM-11(2) CM-11(3) CM-12 CM-12(1) CM-13 CM-14

CHAPTER THREE

CONTROL NAME CONTROL ENHANCEMENT NAME

PRIVACY CONTROL BASELINE

NIST SP 800-53B CONTROL BASELINES FOR INFORMATION SYSTEMS AND ORGANIZATIONS _________________________________________________________________________________________________

SECURITY CONTROL BASELINES LOW

MOD

x

RESPOND TO UNAUTHORIZED CHANGES UNAUTHORIZED CHANGE DETECTION

W: Incorporated into SI-7.

CONFORMANCE DEMONSTRATION

W: Incorporated into CM-4.

Least Functionality

HIGH

x

PERIODIC REVIEW PREVENT PROGRAM EXECUTION

x x x

x x x

x

x

x x

x x x x x

REGISTRATION COMPLIANCE UNAUTHORIZED SOFTWARE — DENY-BY-EXCEPTION AUTHORIZED SOFTWARE — ALLOW-BY-EXCEPTION CONFINED ENVIRONMENTS WITH LIMITED PRIVILEGES CODE EXECUTION IN PROTECTED ENVIRONMENTS BINARY OR MACHINE EXECUTABLE CODE PROHIBITING THE USE OF UNAUTHORIZED HARDWARE

System Component Inventory

x

UPDATES DURING INSTALLATION AND REMOVAL AUTOMATED MAINTENANCE

x

AUTOMATED UNAUTHORIZED COMPONENT DETECTION ACCOUNTABILITY INFORMATION NO DUPLICATE ACCOUNTING OF COMPONENTS

W: Incorporated into CM-8.

ASSESSED CONFIGURATIONS AND APPROVED DEVIATIONS CENTRALIZED REPOSITORY AUTOMATED LOCATION TRACKING ASSIGNMENT OF COMPONENTS TO SYSTEMS

Configuration Management Plan

x

x

x

x

x

x

x

x

ASSIGNMENT OF RESPONSIBILITY

Software Usage Restrictions OPEN-SOURCE SOFTWARE User-Installed Software ALERTS FOR UNAUTHORIZED INSTALLATIONS

W: Incorporated into CM-8(3).

SOFTWARE INSTALLATION WITH PRIVILEGED STATUS AUTOMATED ENFORCEMENT AND MONITORING

Information Location AUTOMATED TOOLS TO SUPPORT INFORMATION LOCATION

x x

x x

Data Action Mapping Signed Components

PAGE 25

NIST SP 800-53B CONTROL BASELINES FOR INFORMATION SYSTEMS AND ORGANIZATIONS _________________________________________________________________________________________________

3.6 CONTINGENCY PLANNING FAMILY Table 3-6 provides a summary of the controls and control enhancements assigned to the Contingency Planning Family. The controls are allocated to the low-impact, moderate-impact, and high-impact security control baselines and the privacy control baseline, as appropriate. A control or control enhancement that has been withdrawn from the control catalog is indicated by a “W” and an explanation of the control or control enhancement disposition in light gray text.

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53B

CONTROL NUMBER

CP-1 CP-2 CP-2(1) CP-2(2) CP-2(3) CP-2(4) CP-2(5) CP-2(6) CP-2(7) CP-2(8) CP-3 CP-3(1) CP-3(2) CP-4 CP-4(1) CP-4(2) CP-4(3) CP-4(4) CP-4(5) CP-5 CP-6 CP-6(1) CP-6(2) CP-6(3) CP-7 CP-7(1) CP-7(2) CP-7(3) CP-7(4) CP-7(5) CP-7(6) CP-8 CP-8(1)

CHAPTER THREE

CONTROL NAME CONTROL ENHANCEMENT NAME

Policy and Procedures Contingency Plan

PRIVACY CONTROL BASELINE

TABLE 3-6: CONTINGENCY PLANNING FAMILY SECURITY CONTROL BASELINES LOW

MOD

HIGH

x x

x x x

x x x x x

COORDINATE WITH RELATED PLANS CAPACITY PLANNING

x

RESUME MISSION AND BUSINESS FUNCTIONS RESUME ALL MISSION AND BUSINESS FUNCTIONS

W: Incorporated into CP-2(3).

x

CONTINUE MISSION AND BUSINESS FUNCTIONS ALTERNATE PROCESSING AND STORAGE SITES COORDINATE WITH EXTERNAL SERVICE PROVIDERS IDENTIFY CRITICAL ASSETS

Contingency Training

x

x x

x x x

x x

x x x

SIMULATED EVENTS MECHANISMS USED IN TRAINING ENVIRONMENTS

Contingency Plan Testing COORDINATE WITH RELATED PLANS

x

ALTERNATE PROCESSING SITE AUTOMATED TESTING FULL RECOVERY AND RECONSTITUTION SELF-CHALLENGE

Contingency Plan Update Alternate Storage Site SEPARATION FROM PRIMARY SITE

W: Incorporated into CP-2.

x x

RECOVERY TIME AND RECOVERY POINT OBJECTIVES ACCESSIBILITY

Alternate Processing Site SEPARATION FROM PRIMARY SITE ACCESSIBILITY PRIORITY OF SERVICE

x x x x x

PREPARATION FOR USE EQUIVALENT INFORMATION SECURITY SAFEGUARDS

x x x x x x x x x

W: Incorporated into CP-7.

INABILITY TO RETURN TO PRIMARY SITE

Telecommunications Services PRIORITY OF SERVICE PROVISIONS

x x

x x

PAGE 26

CONTROL NUMBER

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53B

CP-8(2) CP-8(3) CP-8(4) CP-8(5) CP-9 CP-9(1) CP-9(2) CP-9(3) CP-9(4) CP-9(5) CP-9(6) CP-9(7) CP-9(8) CP-10 CP-10(1) CP-10(2) CP-10(3) CP-10(4) CP-10(5) CP-10(6) CP-11 CP-12 CP-13

CHAPTER THREE

CONTROL NAME CONTROL ENHANCEMENT NAME

PRIVACY CONTROL BASELINE

NIST SP 800-53B CONTROL BASELINES FOR INFORMATION SYSTEMS AND ORGANIZATIONS _________________________________________________________________________________________________

SECURITY CONTROL BASELINES LOW

SINGLE POINTS OF FAILURE

MOD

HIGH

x

x x x

x x

x x x x

SEPARATION OF PRIMARY AND ALTERNATE PROVIDERS PROVIDER CONTINGENCY PLAN ALTERNATE TELECOMMUNICATION SERVICE TESTING

System Backup

x

TESTING FOR RELIABILITY AND INTEGRITY TEST RESTORATION USING SAMPLING SEPARATE STORAGE FOR CRITICAL INFORMATION PROTECTION FROM UNAUTHORIZED MODIFICATION

W: Incorporated into CP-9.

x

TRANSFER TO ALTERNATE STORAGE SITE REDUNDANT SECONDARY SYSTEM DUAL AUTHORIZATION FOR DELETION OR DESTRUCTION CRYPTOGRAPHIC PROTECTION

System Recovery and Reconstitution CONTINGENCY PLAN TESTING TRANSACTION RECOVERY COMPENSATING SECURITY CONTROLS

x

x x

W: Incorporated into CP-4.

x

x

W: Addressed through tailoring.

x

RESTORE WITHIN TIME PERIOD FAILOVER CAPABILITY

x x

W: Incorporated into SI-13.

COMPONENT PROTECTION

Alternate Communications Protocols Safe Mode Alternative Security Mechanisms

PAGE 27

NIST SP 800-53B CONTROL BASELINES FOR INFORMATION SYSTEMS AND ORGANIZATIONS _________________________________________________________________________________________________

3.7 IDENTIFICATION AND AUTHENTICATION FAMILY Table 3-7 provides a summary of the controls and control enhancements assigned to the Identification and Authentication Family. The controls are allocated to the low-impact, moderate-impact, and high-impact security control baselines and the privacy control baseline, as appropriate. A control or control enhancement that has been withdrawn from the control catalog is indicated by a “W” and an explanation of the control or control enhancement disposition in light gray text.

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53B

CONTROL NUMBER

IA-1 IA-2 IA-2(1) IA-2(2) IA-2(3) IA-2(4) IA-2(5) IA-2(6) IA-2(7) IA-2(8) IA-2(9) IA-2(10) IA-2(11) IA-2(12) IA-2(13) IA-3 IA-3(1) IA-3(2) IA-3(3) IA-3(4) IA-4 IA-4(1) IA-4(2) IA-4(3) IA-4(4) IA-4(5) IA-4(6) IA-4(7) IA-4(8) IA-4(9) IA-5 IA-5(1)

CHAPTER THREE

CONTROL NAME CONTROL ENHANCEMENT NAME

Policy and Procedures Identification and Authentication (Organizational Users) MULTI-FACTOR AUTHENTICATION TO PRIVILEGED ACCOUNTS MULTI-FACTOR AUTHENTICATION TO NON-PRIVILEGED ACCOUNTS

PRIVACY CONTROL BASELINE

TABLE 3-7: IDENTIFICATION AND AUTHENTICATION FAMILY SECURITY CONTROL BASELINES LOW

MOD

HIGH

x x x x

x x x x

x x x x

LOCAL ACCESS TO PRIVILEGED ACCOUNTS

W: Incorporated into IA-2(1)(2).

LOCAL ACCESS TO NON-PRIVILEGED ACCOUNTS

W: Incorporated into IA-2(1)(2).

x

INDIVIDUAL AUTHENTICATION WITH GROUP AUTHENTICATION ACCESS TO ACCOUNTS — SEPARATE DEVICE NETWORK ACCESS TO NON-PRIVILEGED ACCOUNTS — SEPARATE DEVICE ACCESS TO ACCOUNTS — REPLAY RESISTANT NETWORK ACCESS TO NON-PRIVILEGED ACCOUNTS — REPLAY RESISTANT

W: Incorporated into IA-2(6).

x

x

x

W: Incorporated into IA-2(8).

SINGLE SIGN-ON REMOTE ACCESS — SEPARATE DEVICE ACCEPTANCE OF PIV CREDENTIALS

W: Incorporated into IA-2(6).

x

x

x

x

x

OUT-OF-BAND AUTHENTICATION

Device Identification and Authentication CRYPTOGRAPHIC BIDIRECTIONAL AUTHENTICATION CRYPTOGRAPHIC BIDIRECTIONAL NETWORK AUTHENTICATION

W: Incorporated into IA-3(1).

DYNAMIC ADDRESS ALLOCATION DEVICE ATTESTATION

Identifier Management

x

x

x

PROHIBIT ACCOUNT IDENTIFIERS AS PUBLIC IDENTIFIERS SUPERVISOR AUTHORIZATION

W: Incorporated into IA-12(1).

MULTIPLE FORMS OF CERTIFICATION

W: Incorporated into IA-12(2).

x

IDENTIFY USER STATUS

x

DYNAMIC MANAGEMENT CROSS-ORGANIZATION MANAGEMENT IN-PERSON REGISTRATION

W: Incorporated into IA-12(4).

PAIRWISE PSEUDONYMOUS IDENTIFIERS ATTRIBUTE MAINTENANCE AND PROTECTION

Authenticator Management PASSWORD-BASED AUTHENTICATION

x x

x x

x x

PAGE 28

CONTROL NUMBER

CONTROL NAME CONTROL ENHANCEMENT NAME

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53B

IA-5(2) IA-5(3) IA-5(4) IA-5(5) IA-5(6) IA-5(7) IA-5(8) IA-5(9) IA-5(10) IA-5(11)

PUBLIC KEY-BASED AUTHENTICATION

IA-5(12) IA-5(13) IA-5(14) IA-5(15) IA-5(16) IA-5(17) IA-5(18) IA-6 IA-7 IA-8 IA-8(1) IA-8(2) IA-8(3) IA-8(4) IA-8(5) IA-8(6) IA-9 IA-9(1) IA-9(2) IA-10 IA-11 IA-12 IA-12(1) IA-12(2) IA-12(3) IA-12(4) IA-12(5) IA-12(6)

BIOMETRIC AUTHENTICATION PERFORMANCE

CHAPTER THREE

PRIVACY CONTROL BASELINE

NIST SP 800-53B CONTROL BASELINES FOR INFORMATION SYSTEMS AND ORGANIZATIONS _________________________________________________________________________________________________

SECURITY CONTROL BASELINES LOW

MOD

HIGH

x

x

IN-PERSON OR TRUSTED EXTERNAL PARTY REGISTRATION

W: Incorporated into IA-12(4).

AUTOMATED SUPPORT FOR PASSWORD STRENGTH DETERMINATION

W: Incorporated into IA-5(1).

CHANGE AUTHENTICATORS PRIOR TO DELIVERY

x

PROTECTION OF AUTHENTICATORS

x

NO EMBEDDED UNENCRYPTED STATIC AUTHENTICATORS MULTIPLE SYSTEM ACCOUNTS FEDERATED CREDENTIAL MANAGEMENT DYNAMIC CREDENTIAL BINDING HARDWARE TOKEN-BASED AUTHENTICATION

W: Incorporated into IA-2(1) and IA2(2).

EXPIRATION OF CACHED AUTHENTICATORS MANAGING CONTENT OF PKI TRUST STORES GSA-APPROVED PRODUCTS AND SERVICES IN-PERSON OR TRUSTED EXTERNAL PARTY AUTHENTICATOR ISSUANCE PRESENTATION ATTACK DETECTION FOR BIOMETRIC AUTHENTICATORS PASSWORD MANAGERS

Authentication Feedback Cryptographic Module Authentication Identification and Authentication (Non-Organizational Users) ACCEPTANCE OF PIV CREDENTIALS FROM OTHER AGENCIES ACCEPTANCE OF EXTERNAL AUTHENTICATORS USE OF FICAM-APPROVED PRODUCTS USE OF DEFINED PROFILES

x x x x x

x x x x x

x x x x x

W: Incorporated into IA-8(2).

x

x

x

ACCEPTANCE OF PIV-I CREDENTIALS DISASSOCIABILITY

Service Identification and Authentication INFORMATION EXCHANGE

W: Incorporated into IA-9.

TRANSMISSION OF DECISIONS

W: Incorporated into IA-9.

Adaptive Authentication Re-authentication Identity Proofing

x

x x

x x

x x

x x x x

SUPERVISOR AUTHORIZATION IDENTITY EVIDENCE IDENTITY EVIDENCE VALIDATION AND VERIFICATION IN-PERSON VALIDATION AND VERIFICATION ADDRESS CONFIRMATION

x

ACCEPT EXTERNALLY-PROOFED IDENTITIES

PAGE 29

NIST SP 800-53B CONTROL BASELINES FOR INFORMATION SYSTEMS AND ORGANIZATIONS _________________________________________________________________________________________________

3.8 INCIDENT RESPONSE FAMILY Table 3-8 provides a summary of the controls and control enhancements assigned to the Incident Response Family. The controls are allocated to the low-impact, moderate-impact, and high-impact security control baselines and the privacy control baseline, as appropriate. A control or control enhancement that has been withdrawn from the control catalog is indicated by a “W” and an explanation of the control or control enhancement disposition in light gray text. TABLE 3-8: INCIDENT RESPONSE FAMILY

IR-1 IR-2 IR-2(1) IR-2(2) IR-2(3) IR-3 IR-3(1) IR-3(2) IR-3(3) IR-4 IR-4(1) IR-4(2) IR-4(3) IR-4(4) IR-4(5) IR-4(6) IR-4(7) IR-4(8) IR-4(9) IR-4(10) IR-4(11) IR-4(12) IR-4(13) IR-4(14) IR-4(15) IR-5 IR-5(1) IR-6 IR-6(1) IR-6(2) IR-6(3) IR-7 IR-7(1)

CHAPTER THREE

CONTROL NAME CONTROL ENHANCEMENT NAME

Policy and Procedures Incident Response Training

SECURITY CONTROL BASELINES

PRIVACY CONTROL BASELINE

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53B

CONTROL NUMBER

LOW

MOD

HIGH

x x

x x

x x

x x x x

x

x

x

x

x x

x x

SIMULATED EVENTS AUTOMATED TRAINING ENVIRONMENTS BREACH

Incident Response Testing

x x

AUTOMATED TESTING COORDINATION WITH RELATED PLANS CONTINUOUS IMPROVEMENT

Incident Handling

x

x

AUTOMATED INCIDENT HANDLING PROCESSES DYNAMIC RECONFIGURATION CONTINUITY OF OPERATIONS

x

INFORMATION CORRELATION AUTOMATIC DISABLING OF SYSTEM INSIDER THREATS INSIDER THREATS — INTRA-ORGANIZATION COORDINATION CORRELATION WITH EXTERNAL ORGANIZATIONS DYNAMIC RESPONSE CAPABILITY SUPPLY CHAIN COORDINATION

x

INTEGRATED INCIDENT RESPONSE TEAM MALICIOUS CODE AND FORENSIC ANALYSIS BEHAVIOR ANALYSIS SECURITY OPERATIONS CENTER PUBLIC RELATIONS AND REPUTATION REPAIR

Incident Monitoring AUTOMATED TRACKING, DATA COLLECTION, AND ANALYSIS Incident Reporting

x

x

x

x

x

x x

x x x x

x x x

x x x

AUTOMATED REPORTING VULNERABILITIES RELATED TO INCIDENTS SUPPLY CHAIN COORDINATION

Incident Response Assistance AUTOMATION SUPPORT FOR AVAILABILITY OF INFORMATION AND SUPPORT

x

x

PAGE 30

CONTROL NUMBER

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53B

IR-7(2) IR-8 IR-8(1) IR-9 IR-9(1) IR-9(2) IR-9(3) IR-9(4) IR-10

CHAPTER THREE

CONTROL NAME CONTROL ENHANCEMENT NAME

PRIVACY CONTROL BASELINE

NIST SP 800-53B CONTROL BASELINES FOR INFORMATION SYSTEMS AND ORGANIZATIONS _________________________________________________________________________________________________

SECURITY CONTROL BASELINES LOW

MOD

HIGH

x

x

x

COORDINATION WITH EXTERNAL PROVIDERS

Incident Response Plan BREACHES

x x

Information Spillage Response RESPONSIBLE PERSONNEL

W: Incorporated into IR-9.

TRAINING POST-SPILL OPERATIONS EXPOSURE TO UNAUTHORIZED PERSONNEL

Integrated Information Security Analysis Team

W: Moved to IR-4(11).

PAGE 31

NIST SP 800-53B CONTROL BASELINES FOR INFORMATION SYSTEMS AND ORGANIZATIONS _________________________________________________________________________________________________

3.9 MAINTENANCE FAMILY Table 3-9 provides a summary of the controls and control enhancements assigned to the Maintenance Family. The controls are allocated to the low-impact, moderate-impact, and highimpact security control baselines and the privacy control baseline, as appropriate. A control or control enhancement that has been withdrawn from the control catalog is indicated by a “W” and an explanation of the control or control enhancement disposition in light gray text.

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53B

CONTROL NUMBER

MA-1 MA-2 MA-2(1) MA-2(2) MA-3 MA-3(1) MA-3(2) MA-3(3) MA-3(4) MA-3(5) MA-3(6) MA-4 MA-4(1) MA-4(2) MA-4(3) MA-4(4) MA-4(5) MA-4(6) MA-4(7) MA-5 MA-5(1) MA-5(2) MA-5(3) MA-5(4) MA-5(5) MA-6 MA-6(1) MA-6(2) MA-6(3) MA-7

CHAPTER THREE

CONTROL NAME CONTROL ENHANCEMENT NAME

Policy and Procedures Controlled Maintenance RECORD CONTENT

PRIVACY CONTROL BASELINE

TABLE 3-9: MAINTENANCE FAMILY SECURITY CONTROL BASELINES LOW

MOD

HIGH

x x

x x

x x

W: Incorporated into MA-2.

x x x x

x x x x x

x

x

AUTOMATED MAINTENANCE ACTIVITIES

Maintenance Tools INSPECT TOOLS INSPECT MEDIA PREVENT UNAUTHORIZED REMOVAL RESTRICTED TOOL USE EXECUTION WITH PRIVILEGE SOFTWARE UPDATES AND PATCHES

Nonlocal Maintenance

x

LOGGING AND REVIEW DOCUMENT NONLOCAL MAINTENANCE

W: Incorporated into MA-1 and MA-4.

x

COMPARABLE SECURITY AND SANITIZATION AUTHENTICATION AND SEPARATION OF MAINTENANCE SESSIONS APPROVALS AND NOTIFICATIONS CRYPTOGRAPHIC PROTECTION DISCONNECT VERIFICATION

Maintenance Personnel

x

x

x x

x

x

INDIVIDUALS WITHOUT APPROPRIATE ACCESS SECURITY CLEARANCES FOR CLASSIFIED SYSTEMS CITIZENSHIP REQUIREMENTS FOR CLASSIFIED SYSTEMS FOREIGN NATIONALS NON-SYSTEM MAINTENANCE

Timely Maintenance PREVENTIVE MAINTENANCE PREDICTIVE MAINTENANCE AUTOMATED SUPPORT FOR PREDICTIVE MAINTENANCE

Field Maintenance

PAGE 32

NIST SP 800-53B CONTROL BASELINES FOR INFORMATION SYSTEMS AND ORGANIZATIONS _________________________________________________________________________________________________

3.10 MEDIA PROTECTION FAMILY Table 3-10 provides a summary of the controls and control enhancements assigned to the Media Protection Family. The controls are allocated to the low-impact, moderate-impact, and highimpact security control baselines and the privacy control baseline, as appropriate. A control or control enhancement that has been withdrawn from the control catalog is indicated by a “W” and an explanation of the control or control enhancement disposition in light gray text.

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53B

CONTROL NUMBER

MP-1 MP-2 MP-2(1) MP-2(2) MP-3 MP-4 MP-4(1) MP-4(2) MP-5 MP-5(1) MP-5(2) MP-5(3) MP-5(4) MP-6 MP-6(1) MP-6(2) MP-6(3) MP-6(4) MP-6(5) MP-6(6) MP-6(7) MP-6(8) MP-7 MP-7(1) MP-7(2) MP-8 MP-8(1) MP-8(2) MP-8(3) MP-8(4)

CHAPTER THREE

CONTROL NAME CONTROL ENHANCEMENT NAME

Policy and Procedures Media Access

PRIVACY CONTROL BASELINE

TABLE 3-10: MEDIA PROTECTION FAMILY

x

SECURITY CONTROL BASELINES LOW

MOD

HIGH

x x

x x

x x

AUTOMATED RESTRICTED ACCESS

W: Incorporated into MP-4(2).

CRYPTOGRAPHIC PROTECTION

W: Incorporated into SC-28(1).

Media Marking Media Storage CRYPTOGRAPHIC PROTECTION

x x

x x

W: Incorporated into SC-28(1).

AUTOMATED RESTRICTED ACCESS

Media Transport

x

PROTECTION OUTSIDE OF CONTROLLED AREAS

W: Incorporated into MP-5.

DOCUMENTATION OF ACTIVITIES

W: Incorporated into MP-5.

x

CUSTODIANS CRYPTOGRAPHIC PROTECTION

Media Sanitization REVIEW, APPROVE, TRACK, DOCUMENT, AND VERIFY

W: Incorporated into SC-28(1).

x

x

x

EQUIPMENT TESTING NONDESTRUCTIVE TECHNIQUES CONTROLLED UNCLASSIFIED INFORMATION

W: Incorporated into MP-6.

CLASSIFIED INFORMATION

W: Incorporated into MP-6.

MEDIA DESTRUCTION

W: Incorporated into MP-6.

x x x x

DUAL AUTHORIZATION REMOTE PURGING OR WIPING OF INFORMATION

Media Use PROHIBIT USE WITHOUT OWNER

x

x

x

W: Incorporated into MP-7.

PROHIBIT USE OF SANITIZATION-RESISTANT MEDIA

Media Downgrading DOCUMENTATION OF PROCESS EQUIPMENT TESTING CONTROLLED UNCLASSIFIED INFORMATION CLASSIFIED INFORMATION

PAGE 33

NIST SP 800-53B CONTROL BASELINES FOR INFORMATION SYSTEMS AND ORGANIZATIONS _________________________________________________________________________________________________

3.11 PHYSICAL AND ENVIRONMENTAL PROTECTION FAMILY Table 3-11 provides a summary of the controls and control enhancements assigned to the Physical and Environmental Protection Family. The controls are allocated to the low-impact, moderate-impact, and high-impact security control baselines and the privacy control baseline, as appropriate. A control or control enhancement that has been withdrawn from the control catalog is indicated by a “W” and an explanation of the control or control enhancement disposition in light gray text.

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53B

CONTROL NUMBER

PE-1 PE-2 PE-2(1) PE-2(2) PE-2(3) PE-3 PE-3(1) PE-3(2) PE-3(3) PE-3(4) PE-3(5) PE-3(6) PE-3(7) PE-3(8) PE-4 PE-5 PE-5(1) PE-5(2) PE-5(3) PE-6 PE-6(1) PE-6(2) PE-6(3) PE-6(4) PE-7 PE-8 PE-8(1) PE-8(2) PE-8(3) PE-9 PE-9(1) PE-9(2)

CHAPTER THREE

CONTROL NAME CONTROL ENHANCEMENT NAME

PRIVACY CONTROL BASELINE

TABLE 3-11: PHYSICAL AND ENVIRONMENTAL PROTECTION FAMILY

Policy and Procedures Physical Access Authorizations

SECURITY CONTROL BASELINES LOW

MOD

HIGH

x x

x x

x x

x

x

x x

ACCESS BY POSITION AND ROLE TWO FORMS OF IDENTIFICATION RESTRICT UNESCORTED ACCESS

Physical Access Control SYSTEM ACCESS FACILITY AND SYSTEMS CONTINUOUS GUARDS LOCKABLE CASINGS TAMPER PROTECTION FACILITY PENETRATION TESTING

W: Incorporated into CA-8.

PHYSICAL BARRIERS ACCESS CONTROL VESTIBULES

Access Control for Transmission Access Control for Output Devices ACCESS TO OUTPUT BY AUTHORIZED INDIVIDUALS

x x

x x

W: Incorporated into PE-5.

LINK TO INDIVIDUAL IDENTITY MARKING OUTPUT DEVICES

W: Incorporated into PE-22.

Monitoring Physical Access

x

INTRUSION ALARMS AND SURVEILLANCE EQUIPMENT

x x

x x

AUTOMATED INTRUSION RECOGNITION AND RESPONSES VIDEO SURVEILLANCE

x

MONITORING PHYSICAL ACCESS TO SYSTEMS

Visitor Control Visitor Access Records

W: Incorporated into PE-2 and PE-3.

x

x

AUTOMATED RECORDS MAINTENANCE AND REVIEW PHYSICAL ACCESS RECORDS LIMIT PERSONALLY IDENTIFIABLE INFORMATION ELEMENTS

Power Equipment and Cabling

x x

W: Incorporated into PE-2.

x x

x

REDUNDANT CABLING AUTOMATIC VOLTAGE CONTROLS

PAGE 34

CONTROL NUMBER

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53B

PE-10 PE-10(1) PE-11 PE-11(1) PE-11(2) PE-12 PE-12(1) PE-13 PE-13(1) PE-13(2) PE-13(3) PE-13(4) PE-14 PE-14(1) PE-14(2) PE-15 PE-15(1) PE-16 PE-17 PE-18 PE-18(1) PE-19 PE-19(1) PE-20 PE-21 PE-22 PE-23

CHAPTER THREE

CONTROL NAME CONTROL ENHANCEMENT NAME

PRIVACY CONTROL BASELINE

NIST SP 800-53B CONTROL BASELINES FOR INFORMATION SYSTEMS AND ORGANIZATIONS _________________________________________________________________________________________________

SECURITY CONTROL BASELINES LOW

Emergency Shutoff ACCIDENTAL AND UNAUTHORIZED ACTIVATION

MOD

HIGH

x

x

W: Incorporated into PE-10.

Emergency Power

x

x x

x

x

x

x

x x

x x x

ALTERNATE POWER SUPPLY — MINIMAL OPERATIONAL CAPABILITY ALTERNATE POWER SUPPLY — SELF-CONTAINED

Emergency Lighting ESSENTIAL MISSIONS AND BUSINESS FUNCTIONS

Fire Protection DETECTION SYSTEMS — AUTOMATIC ACTIVATION AND NOTIFICATION SUPPRESSION SYSTEMS — AUTOMATIC ACTIVATION AND NOTIFICATION AUTOMATIC FIRE SUPPRESSION

W: Incorporated into PE-13(2).

INSPECTIONS

Environmental Controls

x

x

x

x

x

x

x x

x x x x x

AUTOMATIC CONTROLS MONITORING WITH ALARMS AND NOTIFICATIONS

Water Damage Protection AUTOMATION SUPPORT

Delivery and Removal Alternate Work Site Location of System Components FACILITY SITE

W: Moved to PE-23.

Information Leakage NATIONAL EMISSIONS POLICIES AND PROCEDURES

Asset Monitoring and Tracking Electromagnetic Pulse Protection Component Marking Facility Location

PAGE 35

NIST SP 800-53B CONTROL BASELINES FOR INFORMATION SYSTEMS AND ORGANIZATIONS _________________________________________________________________________________________________

3.12 PLANNING FAMILY Table 3-12 provides a summary of the controls and control enhancements assigned to the Planning Family. The controls are allocated to the low-impact, moderate-impact, and highimpact security control baselines and the privacy control baseline, as appropriate. A control or control enhancement that has been withdrawn from the control catalog is indicated by a “W” and an explanation of the control or control enhancement disposition in light gray text. TABLE 3-12: PLANNING FAMILY

PL-1 PL-2 PL-2(1) PL-2(2) PL-2(3) PL-3 PL-4 PL-4(1) PL-5 PL-6 PL-7 PL-8 PL-8(1) PL-8(2) PL-9 PL-10 PL-11

CHAPTER THREE

CONTROL NAME CONTROL ENHANCEMENT NAME

Policy and Procedures System Security and Privacy Plans

SECURITY CONTROL BASELINES

PRIVACY CONTROL BASELINE

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53B

CONTROL NUMBER

LOW

MOD

HIGH

x x

x x

x x

x x

CONCEPT OF OPERATIONS

W: Incorporated into PL-7.

FUNCTIONAL ARCHITECTURE

W: Incorporated into PL-8.

PLAN AND COORDINATE WITH OTHER ORGANIZATIONAL ENTITIES

W: Incorporated into PL-2.

System Security Plan Update Rules of Behavior SOCIAL MEDIA AND EXTERNAL SITE/APPLICATION USAGE RESTRICTIONS Privacy Impact Assessment Security-Related Activity Planning Concept of Operations Security and Privacy Architectures

W: Incorporated into PL-2.

x x

x x

x x

x x

W: Incorporated into RA-8. W: Incorporated into PL-2.

x

x

x

x x

x x

DEFENSE IN DEPTH SUPPLIER DIVERSITY

Central Management Baseline Selection Baseline Tailoring

x x x

PAGE 36

NIST SP 800-53B CONTROL BASELINES FOR INFORMATION SYSTEMS AND ORGANIZATIONS _________________________________________________________________________________________________

3.13 PROGRAM MANAGEMENT FAMILY Table 3-13 provides a summary of the controls and control enhancements assigned to the Program Management Family. These controls are implemented at the organization level and are not directed at individual information systems. The Program Management controls are designed to facilitate compliance with applicable federal laws, executive orders, directives, regulations, policies, and standards.

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53B

CONTROL NUMBER

PM-1 PM-2 PM-3 PM-4 PM-5 PM-5(1) PM-6 PM-7 PM-7(1) PM-8 PM-9 PM-10 PM-11 PM-12 PM-13 PM-14 PM-15 PM-16 PM-16(1) PM-17 PM-18 PM-19 PM-20 PM-20(1) PM-21 PM-22 PM-23 PM-24 PM-25 PM-26 PM-27

CHAPTER THREE

CONTROL NAME CONTROL ENHANCEMENT NAME

Information Security Program Plan Information Security Program Leadership Role Information Security and Privacy Resources Plan of Action and Milestones Process System Inventory INVENTORY OF PERSONALLY IDENTIFIABLE INFORMATION

Measures of Performance Enterprise Architecture

PRIVACY CONTROL BASELINE

TABLE 3-13: PROGRAM MANAGEMENT FAMILY SECURITY CONTROL BASELINES LOW

MOD

HIGH

x x x x x

OFFLOADING

Critical Infrastructure Plan Risk Management Strategy Authorization Process Mission and Business Process Definition Insider Threat Program Security and Privacy Workforce Testing, Training, and Monitoring Security and Privacy Groups and Associations Threat Awareness Program

x x x x x x

Deployed organization-wide. Supports information security program. Not associated with security control baselines. Independent of any system impact level.

AUTOMATED MEANS FOR SHARING THREAT INTELLIGENCE

Protecting Controlled Unclassified Information on External Systems Privacy Program Plan Privacy Program Leadership Role Dissemination of Privacy Program Information PRIVACY POLICIES ON WEBSITES, APPLICATIONS, AND DIGITAL SERVICES Accounting of Disclosures Personally Identifiable Information Quality Management Data Governance Body Data Integrity Board Minimization of Personally Identifiable Information Used in Testing, Training, and Research Complaint Management Privacy Reporting

x x x x x x x x x x x

PAGE 37

CONTROL NUMBER

PM-28 PM-29 PM-30 PM-30(1) PM-31 PM-32

CONTROL NAME CONTROL ENHANCEMENT NAME

Risk Framing Risk Management Program Leadership Roles Supply Chain Risk Management Strategy SUPPLIERS OF CRITICAL OR MISSION-ESSENTIAL ITEMS Continuous Monitoring Strategy Purposing

PRIVACY CONTROL BASELINE

NIST SP 800-53B CONTROL BASELINES FOR INFORMATION SYSTEMS AND ORGANIZATIONS _________________________________________________________________________________________________

SECURITY CONTROL BASELINES LOW

MOD

HIGH

x

x

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53B CHAPTER THREE

PAGE 38

NIST SP 800-53B CONTROL BASELINES FOR INFORMATION SYSTEMS AND ORGANIZATIONS _________________________________________________________________________________________________

3.14 PERSONNEL SECURITY FAMILY Table 3-14 provides a summary of the controls and control enhancements assigned to the Personnel Security Family. The controls are allocated to the low-impact, moderate-impact, and high-impact security control baselines and the privacy control baseline, as appropriate. A control or control enhancement that has been withdrawn from the control catalog is indicated by a “W” and an explanation of the control or control enhancement disposition in light gray text.

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53B

CONTROL NUMBER

PS-1 PS-2 PS-3 PS-3(1) PS-3(2) PS-3(3) PS-3(4) PS-4 PS-4(1) PS-4(2) PS-5 PS-6 PS-6(1) PS-6(2) PS-6(3) PS-7 PS-8 PS-9

CHAPTER THREE

CONTROL NAME CONTROL ENHANCEMENT NAME

PRIVACY CONTROL BASELINE

TABLE 3-14: PERSONNEL SECURITY FAMILY

Policy and Procedures Position Risk Designation Personnel Screening

SECURITY CONTROL BASELINES LOW

MOD

HIGH

x x x

x x x

x x x

x

x

x

x x

x x x

CLASSIFIED INFORMATION FORMAL INDOCTRINATION INFORMATION REQUIRING SPECIAL PROTECTION MEASURES CITIZENSHIP REQUIREMENTS

Personnel Termination POST-EMPLOYMENT REQUIREMENTS AUTOMATED ACTIONS

Personnel Transfer Access Agreements INFORMATION REQUIRING SPECIAL PROTECTION

x

x x

W: Incorporated into PS-3.

CLASSIFIED INFORMATION REQUIRING SPECIAL PROTECTION POST-EMPLOYMENT REQUIREMENTS

External Personnel Security Personnel Sanctions Position Descriptions

x x x

x x x

x x x

PAGE 39

NIST SP 800-53B CONTROL BASELINES FOR INFORMATION SYSTEMS AND ORGANIZATIONS _________________________________________________________________________________________________

3.15 PERSONALLY IDENTIFIABLE INFORMATION PROCESSING AND TRANSPARENCY FAMILY Table 3-15 provides a summary of the controls and control enhancements assigned to the Personally Identifiable Information Processing and Transparency Family. The controls are allocated to the privacy control baseline in accordance with the selection criteria defined in Section 2.2. A control or control enhancement that has been withdrawn from the control catalog is indicated by a “W” and an explanation of the control or control enhancement disposition in light gray text.

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53B

CONTROL NUMBER

PT-1 PT-2 PT-2(1) PT-2(2) PT-3 PT-3(1) PT-3(2) PT-4 PT-4(1) PT-4(2) PT-4(3) PT-5 PT-5(1) PT-5(2) PT-6 PT-6(1) PT-6(2) PT-7 PT-7(1) PT-7(2) PT-8

CHAPTER THREE

CONTROL NAME CONTROL ENHANCEMENT NAME

Policy and Procedures Authority to Process Personally Identifiable Information

PRIVACY CONTROL BASELINE

TABLE 3-15: PERSONALLY IDENTIFIABLE INFORMATION PROCESSING AND TRANSPARENCY FAMILY SECURITY CONTROL BASELINES LOW

MOD

HIGH

x x

DATA TAGGING AUTOMATION

Personally Identifiable Information Processing Purposes

x

DATA TAGGING AUTOMATION

Consent

x

TAILORED CONSENT JUST-IN-TIME CONSENT REVOCATION

Privacy Notice JUST-IN-TIME NOTICE

x

PRIVACY ACT STATEMENTS

x x x x x x x x

System of Records Notice ROUTINE USES EXEMPTION RULES

Specific Categories of Personally Identifiable Information SOCIAL SECURITY NUMBERS FIRST AMENDMENT INFORMATION

Computer Matching Requirements

Personally Identifiable Information Processing and Transparency controls are not allocated to the security control baselines. Privacy baseline controls are selected based on the selection criteria defined in Section 2.2.

PAGE 40

NIST SP 800-53B CONTROL BASELINES FOR INFORMATION SYSTEMS AND ORGANIZATIONS _________________________________________________________________________________________________

3.16 RISK ASSESSMENT FAMILY Table 3-16 provides a summary of the controls and control enhancements assigned to the Risk Assessment Family. The controls are allocated to the low-impact, moderate-impact, and highimpact security control baselines and the privacy control baseline, as appropriate. A control or control enhancement that has been withdrawn from the control catalog is indicated by a “W” and an explanation of the control or control enhancement disposition in light gray text.

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53B

CONTROL NUMBER

RA-1 RA-2 RA-2(1) RA-3 RA-3(1) RA-3(2) RA-3(3) RA-3(4) RA-4 RA-5 RA-5(1) RA-5(2) RA-5(3) RA-5(4) RA-5(5) RA-5(6) RA-5(7) RA-5(8) RA-5(9) RA-5(10) RA-5(11) RA-6 RA-7 RA-8 RA-9 RA-10

CHAPTER THREE

CONTROL NAME CONTROL ENHANCEMENT NAME

Policy and Procedures Security Categorization IMPACT-LEVEL PRIORITIZATION Risk Assessment

PRIVACY CONTROL BASELINE

TABLE 3-16: RISK ASSESSMENT FAMILY SECURITY CONTROL BASELINES LOW

MOD

HIGH

x

x x

x x

x x

x

x x

x x

x x

SUPPLY CHAIN RISK ASSESSMENT USE OF ALL-SOURCE INTELLIGENCE DYNAMIC THREAT AWARENESS PREDICTIVE CYBER ANALYTICS

Risk Assessment Update Vulnerability Monitoring and Scanning

W: Incorporated into RA-3.

UPDATE TOOL CAPABILITY

W: Incorporated into RA-5.

x x

UPDATE VULNERABILITIES TO BE SCANNED

x

x

x

x

x

x x

BREADTH AND DEPTH OF COVERAGE DISCOVERABLE INFORMATION PRIVILEGED ACCESS AUTOMATED TREND ANALYSES AUTOMATED DETECTION AND NOTIFICATION OF UNAUTHORIZED COMPONENTS

W: Incorporated into CM-8.

REVIEW HISTORIC AUDIT LOGS PENETRATION TESTING AND ANALYSES

W: Incorporated into CA-8.

CORRELATE SCANNING INFORMATION PUBLIC DISCLOSURE PROGRAM

Technical Surveillance Countermeasures Survey Risk Response Privacy Impact Assessments Criticality Analysis Threat Hunting

x x

x

x

x

x

x

x

x

x

PAGE 41

NIST SP 800-53B CONTROL BASELINES FOR INFORMATION SYSTEMS AND ORGANIZATIONS _________________________________________________________________________________________________

3.17 SYSTEM AND SERVICES ACQUISITION FAMILY Table 3-17 provides a summary of the controls and control enhancements assigned to the System and Services Acquisition Family. The controls are allocated to the low-impact, moderateimpact, and high-impact security control baselines and the privacy control baseline, as appropriate. A control or control enhancement that has been withdrawn from the control catalog is indicated by a “W” and an explanation of the control or control enhancement disposition in light gray text. TABLE 3-17: SYSTEM AND SERVICES ACQUISITION FAMILY

SA-1 SA-2 SA-3 SA-3(1) SA-3(2) SA-3(3) SA-4 SA-4(1) SA-4(2) SA-4(3) SA-4(4) SA-4(5) SA-4(6) SA-4(7) SA-4(8) SA-4(9) SA-4(10) SA-4(11) SA-4(12) SA-5 SA-5(1) SA-5(2) SA-5(3) SA-5(4) SA-5(5) SA-6 SA-7 SA-8 SA-8(1) SA-8(2) SA-8(3) SA-8(4)

CHAPTER THREE

CONTROL NAME CONTROL ENHANCEMENT NAME

Policy and Procedures Allocation of Resources System Development Life Cycle

SECURITY CONTROL BASELINES

PRIVACY CONTROL BASELINE

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53B

CONTROL NUMBER

LOW

MOD

HIGH

x x x

x x x

x x x

x x x

x

x

x x x

x x x

MANAGE PREPRODUCTION ENVIRONMENT USE OF LIVE OR OPERATIONAL DATA TECHNOLOGY REFRESH

Acquisition Process FUNCTIONAL PROPERTIES OF CONTROLS DESIGN AND IMPLEMENTATION INFORMATION FOR CONTROLS DEVELOPMENT METHODS, TECHNIQUES, AND PRACTICES ASSIGNMENT OF COMPONENTS TO SYSTEMS

W: Incorporated into CM-8(9).

SYSTEM, COMPONENT, AND SERVICE CONFIGURATIONS

x

USE OF INFORMATION ASSURANCE PRODUCTS NIAP-APPROVED PROTECTION PROFILES CONTINUOUS MONITORING PLAN FOR CONTROLS FUNCTIONS, PORTS, PROTOCOLS, AND SERVICES IN USE USE OF APPROVED PIV PRODUCTS

x

x x

x x

x

x

x

SYSTEM OF RECORDS DATA OWNERSHIP

System Documentation FUNCTIONAL PROPERTIES OF SECURITY CONTROLS

W: Incorporated into SA-4(1).

SECURITY-RELEVANT EXTERNAL SYSTEM INTERFACES

W: Incorporated into SA-4(2).

HIGH-LEVEL DESIGN

W: Incorporated into SA-4(2).

LOW-LEVEL DESIGN

W: Incorporated into SA-4(2).

SOURCE CODE

W: Incorporated into SA-4(2).

Software Usage Restrictions User-Installed Software Security and Privacy Engineering Principles

W: Incorporated into CM-10 and SI-7. W: Incorporated into CM-11 and SI-7.

x

x

x

CLEAR ABSTRACTIONS LEAST COMMON MECHANISM MODULARITY AND LAYERING PARTIALLY ORDERED DEPENDENCIES

PAGE 42

NIST SP 800-53B CONTROL BASELINES FOR INFORMATION SYSTEMS AND ORGANIZATIONS _________________________________________________________________________________________________

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53B

SA-8(5) SA-8(6) SA-8(7) SA-8(8) SA-8(9) SA-8(10) SA-8(11) SA-8(12) SA-8(13) SA-8(14) SA-8(15) SA-8(16) SA-8(17) SA-8(18) SA-8(19) SA-8(20) SA-8(21) SA-8(22) SA-8(23) SA-8(24) SA-8(25) SA-8(26) SA-8(27) SA-8(28) SA-8(29) SA-8(30) SA-8(31) SA-8(32) SA-8(33) SA-9 SA-9(1) SA-9(2) SA-9(3) SA-9(4) SA-9(5) SA-9(6) SA-9(7) SA-9(8) SA-10 SA-10(1) SA-10(2) SA-10(3)

CHAPTER THREE

CONTROL NAME CONTROL ENHANCEMENT NAME

SECURITY CONTROL BASELINES

PRIVACY CONTROL BASELINE

CONTROL NUMBER

LOW

MOD

HIGH

x x

x

x

x

x

x

x

x

EFFICIENTLY MEDIATED ACCESS MINIMIZED SHARING REDUCED COMPLEXITY SECURE EVOLVABILITY TRUSTED COMPONENTS HIERARCHICAL TRUST INVERSE MODIFICATION THRESHOLD HIERARCHICAL PROTECTION MINIMIZED SECURITY ELEMENTS LEAST PRIVILEGE PREDICATE PERMISSION SELF-RELIANT TRUSTWORTHINESS SECURE DISTRIBUTED COMPOSITION TRUSTED COMMUNICATIONS CHANNELS CONTINUOUS PROTECTION SECURE METADATA MANAGEMENT SELF-ANALYSIS ACCOUNTABILITY AND TRACEABILITY SECURE DEFAULTS SECURE FAILURE AND RECOVERY ECONOMIC SECURITY PERFORMANCE SECURITY HUMAN FACTORED SECURITY ACCEPTABLE SECURITY REPEATABLE AND DOCUMENTED PROCEDURES PROCEDURAL RIGOR SECURE SYSTEM MODIFICATION SUFFICIENT DOCUMENTATION MINIMIZATION

External System Services RISK ASSESSMENTS AND ORGANIZATIONAL APPROVALS IDENTIFICATION OF FUNCTIONS, PORTS, PROTOCOLS, AND SERVICES ESTABLISH AND MAINTAIN TRUST RELATIONSHIP WITH PROVIDERS CONSISTENT INTERESTS OF CONSUMERS AND PROVIDERS PROCESSING, STORAGE, AND SERVICE LOCATION ORGANIZATION-CONTROLLED CRYPTOGRAPHIC KEYS ORGANIZATION-CONTROLLED INTEGRITY CHECKING PROCESSING AND STORAGE LOCATION — U.S. JURISDICTION

Developer Configuration Management SOFTWARE AND FIRMWARE INTEGRITY VERIFICATION ALTERNATIVE CONFIGURATION MANAGEMENT PROCESSES HARDWARE INTEGRITY VERIFICATION

PAGE 43

CONTROL NUMBER

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53B

SA-10(4) SA-10(5) SA-10(6) SA-10(7) SA-11 SA-11(1) SA-11(2) SA-11(3) SA-11(4) SA-11(5) SA-11(6) SA-11(7) SA-11(8) SA-11(9) SA-12 SA-12(1) SA-12(2) SA-12(3) SA-12(4) SA-12(5) SA-12(6) SA-12(7) SA-12(8) SA-12(9) SA-12(10) SA-12(11) SA-12(12) SA-12(13) SA-12(14) SA-12(15) SA-13 SA-14 SA-14(1) SA-15 SA-15(1) SA-15(2) SA-15(3) SA-15(4) SA-15(5) SA-15(6) SA-15(7) SA-15(8)

CHAPTER THREE

CONTROL NAME CONTROL ENHANCEMENT NAME

PRIVACY CONTROL BASELINE

NIST SP 800-53B CONTROL BASELINES FOR INFORMATION SYSTEMS AND ORGANIZATIONS _________________________________________________________________________________________________

SECURITY CONTROL BASELINES LOW

MOD

HIGH

x

x

TRUSTED GENERATION MAPPING INTEGRITY FOR VERSION CONTROL TRUSTED DISTRIBUTION SECURITY AND PRIVACY REPRESENTATIVES

Developer Testing and Evaluation

x

STATIC CODE ANALYSIS THREAT MODELING AND VULNERABILITY ANALYSES INDEPENDENT VERIFICATION OF ASSESSMENT PLANS AND EVIDENCE MANUAL CODE REVIEWS PENETRATION TESTING ATTACK SURFACE REVIEWS VERIFY SCOPE OF TESTING AND EVALUATION DYNAMIC CODE ANALYSIS INTERACTIVE APPLICATION SECURITY TESTING

Supply Chain Protection ACQUISITION STRATEGIES, TOOLS, AND METHODS

W: Moved to SR Family.

SUPPLIER REVIEWS

W: Moved to SR-6.

TRUSTED SHIPPING AND WAREHOUSING

W: Incorporated into SR-3.

DIVERSITY OF SUPPLIERS

W: Moved to SR-3(1).

LIMITATION OF HARM

W: Moved to SR-3(2).

MINIMIZING PROCUREMENT TIME

W: Incorporated into SR-5(1).

ASSESSMENTS PRIOR TO SELECTION / ACCEPTANCE / UPDATE

W: Moved to SR-5(2).

USE OF ALL-SOURCE INTELLIGENCE

W: Incorporated into RA-3(2).

OPERATIONS SECURITY

W: Moved to SR-7.

VALIDATE AS GENUINE AND NOT ALTERED

W: Moved to SR-4(3).

PENETRATION TESTING / ANALYSIS OF ELEMENTS, PROCESSES, AND ACTORS

W: Moved to SR-6(1).

INTER-ORGANIZATIONAL AGREEMENTS

W: Moved to SR-8.

CRITICAL INFORMATION SYSTEM COMPONENTS

W: Incorporated into MA-6 and RA-9.

IDENTITY AND TRACEABILITY

W: Moved to SR-4(1) and SR-4(2).

PROCESSES TO ADDRESS WEAKNESSES OR DEFICIENCIES

W: Incorporated into SR-3.

Trustworthiness Criticality Analysis

W: Incorporated into SA-8.

CRITICAL COMPONENTS WITH NO VIABLE ALTERNATIVE SOURCING

W: Incorporated into SA-20.

Development Process, Standards, and Tools

W: Moved to SR-5.

W: Incorporated into RA-9.

x

x

x

x

QUALITY METRICS SECURITY AND PRIVACY TRACKING TOOLS CRITICALITY ANALYSIS THREAT MODELING AND VULNERABILITY ANALYSIS

W: Incorporated into SA-11(2).

ATTACK SURFACE REDUCTION CONTINUOUS IMPROVEMENT AUTOMATED VULNERABILITY ANALYSIS REUSE OF THREAT AND VULNERABILITY INFORMATION

PAGE 44

CONTROL NUMBER

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53B

SA-15(9) SA-15(10) SA-15(11) SA-15(12) SA-16 SA-17 SA-17(1) SA-17(2) SA-17(3) SA-17(4) SA-17(5) SA-17(6) SA-17(7) SA-17(8) SA-17(9) SA-18 SA-18(1) SA-18(2) SA-19 SA-19(1) SA-19(2) SA-19(3) SA-19(4) SA-20 SA-21 SA-21(1) SA-22 SA-22(1) SA-23

CHAPTER THREE

CONTROL NAME CONTROL ENHANCEMENT NAME

USE OF LIVE DATA

PRIVACY CONTROL BASELINE

NIST SP 800-53B CONTROL BASELINES FOR INFORMATION SYSTEMS AND ORGANIZATIONS _________________________________________________________________________________________________

SECURITY CONTROL BASELINES LOW

MOD

HIGH

W: Incorporated into SA-3(2).

INCIDENT RESPONSE PLAN ARCHIVE SYSTEM OR COMPONENT MINIMIZE PERSONALLY IDENTIFIABLE INFORMATION

Developer-Provided Training Developer Security and Privacy Architecture and Design

x x

FORMAL POLICY MODEL SECURITY-RELEVANT COMPONENTS FORMAL CORRESPONDENCE INFORMAL CORRESPONDENCE CONCEPTUALLY SIMPLE DESIGN STRUCTURE FOR TESTING STRUCTURE FOR LEAST PRIVILEGE ORCHESTRATION DESIGN DIVERSITY

Tamper Resistance and Detection

W: Moved to SR-9.

MULTIPLE PHASES OF SYSTEM DEVELOPMENT LIFE CYCLE

W: Moved to SR-9(1).

INSPECTION OF SYSTEMS OR COMPONENTS

W: Moved to SR-10.

Component Authenticity ANTI-COUNTERFEIT TRAINING

W: Moved to SR-11.

CONFIGURATION CONTROL FOR COMPONENT SERVICE AND REPAIR

W: Moved to SR-11(2).

COMPONENT DISPOSAL

W: Moved to SR-12.

ANTI-COUNTERFEIT SCANNING

W: Moved to SR-11(3).

W: Moved to SR-11(1).

Customized Development of Critical Components Developer Screening VALIDATION OF SCREENING

Unsupported System Components ALTERNATIVE SOURCES FOR CONTINUED SUPPORT

x W: Incorporated into SA-21.

x

x

x

W: Incorporated into SA-22.

Specialization

PAGE 45

NIST SP 800-53B CONTROL BASELINES FOR INFORMATION SYSTEMS AND ORGANIZATIONS _________________________________________________________________________________________________

3.18 SYSTEM AND COMMUNICATIONS PROTECTION FAMILY Table 3-18 provides a summary of the controls and control enhancements assigned to the System and Communications Protection Family. The controls are allocated to the low-impact, moderate-impact, and high-impact security control baselines and the privacy control baseline, as appropriate. A control or control enhancement that has been withdrawn from the control catalog is indicated by a “W” and an explanation of the control or control enhancement disposition in light gray text.

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53B

CONTROL NUMBER

SC-1 SC-2 SC-2(1) SC-2(2) SC-3 SC-3(1) SC-3(2) SC-3(3) SC-3(4) SC-3(5) SC-4 SC-4(1) SC-4(2) SC-5 SC-5(1) SC-5(2) SC-5(3) SC-6 SC-7 SC-7(1) SC-7(2) SC-7(3) SC-7(4) SC-7(5) SC-7(6) SC-7(7) SC-7(8) SC-7(9) SC-7(10) SC-7(11) SC-7(12) SC-7(13)

CHAPTER THREE

CONTROL NAME CONTROL ENHANCEMENT NAME

Policy and Procedures Separation of System and User Functionality INTERFACES FOR NON-PRIVILEGED USERS

PRIVACY CONTROL BASELINE

TABLE 3-18: SYSTEM AND COMMUNICATIONS PROTECTION FAMILY SECURITY CONTROL BASELINES LOW

MOD

HIGH

x

x x

x x

DISASSOCIABILITY

Security Function Isolation

x

HARDWARE SEPARATION ACCESS AND FLOW CONTROL FUNCTIONS MINIMIZE NONSECURITY FUNCTIONALITY MODULE COUPLING AND COHESIVENESS LAYERED STRUCTURES

Information in Shared System Resources SECURITY LEVELS

x

x

W: Incorporated into SC-4.

MULTILEVEL OR PERIODS PROCESSING

Denial-of-Service Protection

x

x

x

x

x

x

RESTRICT ABILITY TO ATTACK OTHER SYSTEMS CAPACITY, BANDWIDTH, AND REDUNDANCY DETECTION AND MONITORING

Resource Availability Boundary Protection PHYSICALLY SEPARATED SUBNETWORKS

W: Incorporated into SC-7.

PUBLIC ACCESS

W: Incorporated into SC-7.

ACCESS POINTS EXTERNAL TELECOMMUNICATIONS SERVICES DENY BY DEFAULT — ALLOW BY EXCEPTION RESPONSE TO RECOGNIZED FAILURES SPLIT TUNNELING FOR REMOTE DEVICES ROUTE TRAFFIC TO AUTHENTICATED PROXY SERVERS

x x x

x x x

W: Incorporated into SC-7(18).

x x

x x

RESTRICT THREATENING OUTGOING COMMUNICATIONS TRAFFIC PREVENT EXFILTRATION RESTRICT INCOMING COMMUNICATIONS TRAFFIC HOST-BASED PROTECTION ISOLATION OF SECURITY TOOLS, MECHANISMS, AND SUPPORT COMPONENTS

PAGE 46

CONTROL NUMBER

CONTROL NAME CONTROL ENHANCEMENT NAME

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53B

SC-7(14) SC-7(15) SC-7(16) SC-7(17) SC-7(18) SC-7(19) SC-7(20) SC-7(21) SC-7(22) SC-7(23) SC-7(24) SC-7(25) SC-7(26) SC-7(27) SC-7(28) SC-7(29) SC-8 SC-8(1) SC-8(2) SC-8(3) SC-8(4) SC-8(5) SC-9 SC-10 SC-11 SC-11(1) SC-12 SC-12(1) SC-12(2) SC-12(3) SC-12(4) SC-12(5) SC-12(6) SC-13 SC-13(1) SC-13(2) SC-13(3) SC-13(4) SC-14

PROTECT AGAINST UNAUTHORIZED PHYSICAL CONNECTIONS

SC-15 SC-15(1) SC-15(2)

Collaborative Computing Devices and Applications

CHAPTER THREE

PRIVACY CONTROL BASELINE

NIST SP 800-53B CONTROL BASELINES FOR INFORMATION SYSTEMS AND ORGANIZATIONS _________________________________________________________________________________________________

SECURITY CONTROL BASELINES LOW

MOD

HIGH

NETWORKED PRIVILEGED ACCESSES PREVENT DISCOVERY OF SYSTEM COMPONENTS AUTOMATED ENFORCEMENT OF PROTOCOL FORMATS

x

FAIL SECURE BLOCK COMMUNICATION FROM NON-ORGANIZATIONALLY CONFIGURED HOSTS DYNAMIC ISOLATION AND SEGREGATION

x

ISOLATION OF SYSTEM COMPONENTS SEPARATE SUBNETS FOR CONNECTING TO DIFFERENT SECURITY DOMAINS DISABLE SENDER FEEDBACK ON PROTOCOL VALIDATION FAILURE PERSONALLY IDENTIFIABLE INFORMATION

x

UNCLASSIFIED NATIONAL SECURITY SYSTEM CONNECTIONS CLASSIFIED NATIONAL SECURITY SYSTEM CONNECTIONS UNCLASSIFIED NON-NATIONAL SECURITY SYSTEM CONNECTIONS CONNECTIONS TO PUBLIC NETWORKS SEPARATE SUBNETS TO ISOLATE FUNCTIONS

Transmission Confidentiality and Integrity

x x

CRYPTOGRAPHIC PROTECTION

x x

PRE- AND POST-TRANSMISSION HANDLING CRYPTOGRAPHIC PROTECTION FOR MESSAGE EXTERNALS CONCEAL OR RANDOMIZE COMMUNICATIONS PROTECTED DISTRIBUTION SYSTEM

Transmission Confidentiality Network Disconnect Trusted Path

W: Incorporated into SC-8.

x

x

x

x x

IRREFUTABLE COMMUNICATIONS PATH

Cryptographic Key Establishment and Management

x

AVAILABILITY SYMMETRIC KEYS ASYMMETRIC KEYS PKI CERTIFICATES

W: Incorporated into SC-12(3).

PKI CERTIFICATES / HARDWARE TOKENS

W: Incorporated into SC-12(3).

PHYSICAL CONTROL OF KEYS

Cryptographic Protection FIPS-VALIDATED CRYPTOGRAPHY NSA-APPROVED CRYPTOGRAPHY

W: Incorporated into SC-13.

INDIVIDUALS WITHOUT FORMAL ACCESS APPROVALS

W: Incorporated into SC-13.

DIGITAL SIGNATURES

W: Incorporated into SC-13.

Public Access Protections

W: Incorporated into AC-2, AC-3, AC5, SI-3, SI-4, SI-5, SI-7, and SI-10.

x

x

x

W: Incorporated into SC-13.

x

x

x

PHYSICAL OR LOGICAL DISCONNECT BLOCKING INBOUND AND OUTBOUND COMMUNICATIONS TRAFFIC

W: Incorporated into SC-7.

PAGE 47

CONTROL NUMBER

CONTROL NAME CONTROL ENHANCEMENT NAME

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53B

SC-15(3) SC-15(4) SC-16 SC-16(1) SC-16(2) SC-16(3) SC-17 SC-18 SC-18(1) SC-18(2) SC-18(3) SC-18(4) SC-18(5) SC-19

DISABLING AND REMOVAL IN SECURE WORK AREAS

SC-20

Secure Name/Address Resolution Service (Authoritative Source)

SC-20(1) SC-20(2) SC-21

CHILD SUBSPACES

SC-21(1) SC-22

DATA ORIGIN AND INTEGRITY

SC-23 SC-23(1) SC-23(2) SC-23(3) SC-23(4) SC-23(5) SC-24 SC-25 SC-26 SC-26(1) SC-27 SC-28 SC-28(1) SC-28(2) SC-28(3) SC-29 SC-29(1) SC-30 SC-30(1)

CHAPTER THREE

PRIVACY CONTROL BASELINE

NIST SP 800-53B CONTROL BASELINES FOR INFORMATION SYSTEMS AND ORGANIZATIONS _________________________________________________________________________________________________

SECURITY CONTROL BASELINES LOW

MOD

HIGH

x x

x x

EXPLICITLY INDICATE CURRENT PARTICIPANTS

Transmission of Security and Privacy Attributes INTEGRITY VERIFICATION ANTI-SPOOFING MECHANISMS CRYPTOGRAPHIC BINDING

Public Key Infrastructure Certificates Mobile Code IDENTIFY UNACCEPTABLE CODE AND TAKE CORRECTIVE ACTIONS ACQUISITION, DEVELOPMENT, AND USE PREVENT DOWNLOADING AND EXECUTION PREVENT AUTOMATIC EXECUTION ALLOW EXECUTION ONLY IN CONFINED ENVIRONMENTS

Voice over Internet Protocol

W: Technology-specific; addressed as any other technology or protocol.

x

x

x

W: Incorporated into SC-20.

DATA ORIGIN AND INTEGRITY

Secure Name/Address Resolution Service (Recursive or Caching Resolver) Architecture and Provisioning for Name/Address Resolution Service Session Authenticity

x

x

x

W: Incorporated into SC-21.

x

x

x

x

x

INVALIDATE SESSION IDENTIFIERS AT LOGOUT USER-INITIATED LOGOUTS AND MESSAGE DISPLAYS

W: Incorporated into AC-12(1).

UNIQUE SYSTEM-GENERATED SESSION IDENTIFIERS UNIQUE SESSION IDENTIFIERS WITH RANDOMIZATION

W: Incorporated into SC-23(3).

ALLOWED CERTIFICATE AUTHORITIES

Fail in Known State Thin Nodes Decoys DETECTION OF MALICIOUS CODE

Platform-Independent Applications Protection of Information at Rest CRYPTOGRAPHIC PROTECTION

x

W: Incorporated into SC-35.

x x

x x

OFFLINE STORAGE CRYPTOGRAPHIC KEYS

Heterogeneity VIRTUALIZATION TECHNIQUES

Concealment and Misdirection VIRTUALIZATION TECHNIQUES

W: Incorporated into SC-29(1).

PAGE 48

CONTROL NUMBER

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53B

SC-30(2) SC-30(3) SC-30(4) SC-30(5) SC-31 SC-31(1) SC-31(2) SC-31(3) SC-32 SC-32(1) SC-33 SC-34 SC-34(1) SC-34(2) SC-34(3) SC-35 SC-36 SC-36(1) SC-36(2) SC-37 SC-37(1) SC-38 SC-39 SC-39(1) SC-39(2) SC-40 SC-40(1) SC-40(2) SC-40(3) SC-40(4) SC-41 SC-42 SC-42(1) SC-42(2) SC-42(3) SC-42(4) SC-42(5) SC-43 SC-44 SC-45 SC-45(1) SC-45(2)

CHAPTER THREE

CONTROL NAME CONTROL ENHANCEMENT NAME

PRIVACY CONTROL BASELINE

NIST SP 800-53B CONTROL BASELINES FOR INFORMATION SYSTEMS AND ORGANIZATIONS _________________________________________________________________________________________________

SECURITY CONTROL BASELINES LOW

MOD

HIGH

RANDOMNESS CHANGE PROCESSING AND STORAGE LOCATIONS MISLEADING INFORMATION CONCEALMENT OF SYSTEM COMPONENTS

Covert Channel Analysis TEST COVERT CHANNELS FOR EXPLOITABILITY MAXIMUM BANDWIDTH MEASURE BANDWIDTH IN OPERATIONAL ENVIRONMENTS

System Partitioning SEPARATE PHYSICAL DOMAINS FOR PRIVILEGED FUNCTIONS

Transmission Preparation Integrity Non-Modifiable Executable Programs

W: Incorporated into SC-8.

NO WRITABLE STORAGE INTEGRITY PROTECTION AND READ-ONLY MEDIA HARDWARE-BASED PROTECTION

W: Moved to SC-51.

External Malicious Code Identification Distributed Processing and Storage POLLING TECHNIQUES SYNCHRONIZATION

Out-of-Band Channels ENSURE DELIVERY AND TRANSMISSION

Operations Security Process Isolation

x

x

x

HARDWARE SEPARATION SEPARATE EXECUTION DOMAIN PER THREAD

Wireless Link Protection ELECTROMAGNETIC INTERFERENCE REDUCE DETECTION POTENTIAL IMITATIVE OR MANIPULATIVE COMMUNICATIONS DECEPTION SIGNAL PARAMETER IDENTIFICATION

Port and I/O Device Access Sensor Capability and Data REPORTING TO AUTHORIZED INDIVIDUALS OR ROLES AUTHORIZED USE PROHIBIT USE OF DEVICES

W: Incorporated into SC-42.

NOTICE OF COLLECTION COLLECTION MINIMIZATION

Usage Restrictions Detonation Chambers System Time Synchronization SYNCHRONIZATION WITH AUTHORITATIVE TIME SOURCE SECONDARY AUTHORITATIVE TIME SOURCE

PAGE 49

CONTROL NUMBER

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53B

SC-46 SC-47 SC-48 SC-48(1) SC-49 SC-50 SC-51

CHAPTER THREE

CONTROL NAME CONTROL ENHANCEMENT NAME

PRIVACY CONTROL BASELINE

NIST SP 800-53B CONTROL BASELINES FOR INFORMATION SYSTEMS AND ORGANIZATIONS _________________________________________________________________________________________________

SECURITY CONTROL BASELINES LOW

MOD

HIGH

Cross Domain Policy Enforcement Alternate Communications Paths Sensor Relocation DYNAMIC RELOCATION OF SENSORS OR MONITORING CAPABILITIES

Hardware-Enforced Separation and Policy Enforcement Software-Enforced Separation and Policy Enforcement Hardware-Based Protection

PAGE 50

NIST SP 800-53B CONTROL BASELINES FOR INFORMATION SYSTEMS AND ORGANIZATIONS _________________________________________________________________________________________________

3.19 SYSTEM AND INFORMATION INTEGRITY FAMILY Table 3-19 provides a summary of the controls and control enhancements assigned to the System and Information Integrity Family. The controls are allocated to the low-impact, moderate-impact, and high-impact security control baselines and the privacy control baseline, as appropriate. A control or control enhancement that has been withdrawn from the control catalog is indicated by a “W” and an explanation of the control or control enhancement disposition in light gray text.

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53B

CONTROL NUMBER

SI-1 SI-2 SI-2(1) SI-2(2) SI-2(3) SI-2(4) SI-2(5) SI-2(6) SI-3 SI-3(1) SI-3(2) SI-3(3) SI-3(4) SI-3(5) SI-3(6) SI-3(7) SI-3(8) SI-3(9) SI-3(10) SI-4 SI-4(1) SI-4(2) SI-4(3) SI-4(4) SI-4(5) SI-4(6) SI-4(7) SI-4(8) SI-4(9) SI-4(10) SI-4(11) SI-4(12)

CHAPTER THREE

CONTROL NAME CONTROL ENHANCEMENT NAME

Policy and Procedures Flaw Remediation CENTRAL MANAGEMENT

PRIVACY CONTROL BASELINE

TABLE 3-19: SYSTEM AND INFORMATION INTEGRITY FAMILY

x

SECURITY CONTROL BASELINES LOW

MOD

HIGH

x x

x x

x x

W: Incorporated into PL-9.

AUTOMATED FLAW REMEDIATION STATUS

x

x

x

x

TIME TO REMEDIATE FLAWS AND BENCHMARKS FOR CORRECTIVE ACTIONS AUTOMATED PATCH MANAGEMENT TOOLS AUTOMATIC SOFTWARE AND FIRMWARE UPDATES REMOVAL OF PREVIOUS VERSIONS OF SOFTWARE AND FIRMWARE

Malicious Code Protection

x

CENTRAL MANAGEMENT

W: Incorporated into PL-9.

AUTOMATIC UPDATES

W: Incorporated into SI-3.

NON-PRIVILEGED USERS

W: Incorporated into AC-6(10).

UPDATES ONLY BY PRIVILEGED USERS PORTABLE STORAGE DEVICES

W: Incorporated into MP-7.

TESTING AND VERIFICATION NONSIGNATURE-BASED DETECTION

W: Incorporated into SI-3.

DETECT UNAUTHORIZED COMMANDS AUTHENTICATE REMOTE COMMANDS

W: Moved to AC-17(10).

MALICIOUS CODE ANALYSIS

System Monitoring SYSTEM-WIDE INTRUSION DETECTION SYSTEM AUTOMATED TOOLS AND MECHANISMS FOR REAL-TIME ANALYSIS

x

x

x

x

x

x x

x x

AUTOMATED TOOL AND MECHANISM INTEGRATION INBOUND AND OUTBOUND COMMUNICATIONS TRAFFIC SYSTEM-GENERATED ALERTS RESTRICT NON-PRIVILEGED USERS

W: Incorporated into AC-6(10).

AUTOMATED RESPONSE TO SUSPICIOUS EVENTS PROTECTION OF MONITORING INFORMATION

W: Incorporated into SI-4.

TESTING OF MONITORING TOOLS AND MECHANISMS VISIBILITY OF ENCRYPTED COMMUNICATIONS

x

ANALYZE COMMUNICATIONS TRAFFIC ANOMALIES AUTOMATED ORGANIZATION-GENERATED ALERTS

x

PAGE 51

CONTROL NUMBER

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53B

SI-4(13) SI-4(14) SI-4(15) SI-4(16) SI-4(17) SI-4(18) SI-4(19) SI-4(20) SI-4(21) SI-4(22) SI-4(23) SI-4(24) SI-4(25) SI-5 SI-5(1) SI-6 SI-6(1) SI-6(2) SI-6(3) SI-7 SI-7(1) SI-7(2) SI-7(3) SI-7(4) SI-7(5) SI-7(6) SI-7(7) SI-7(8) SI-7(9) SI-7(10) SI-7(11) SI-7(12) SI-7(13) SI-7(14) SI-7(15) SI-7(16) SI-7(17) SI-8 SI-8(1) SI-8(2) SI-8(3) SI-9

CHAPTER THREE

CONTROL NAME CONTROL ENHANCEMENT NAME

PRIVACY CONTROL BASELINE

NIST SP 800-53B CONTROL BASELINES FOR INFORMATION SYSTEMS AND ORGANIZATIONS _________________________________________________________________________________________________

SECURITY CONTROL BASELINES LOW

MOD

HIGH

ANALYZE TRAFFIC AND EVENT PATTERNS

x

WIRELESS INTRUSION DETECTION WIRELESS TO WIRELINE COMMUNICATIONS CORRELATE MONITORING INFORMATION INTEGRATED SITUATIONAL AWARENESS ANALYZE TRAFFIC AND COVERT EXFILTRATION RISK FOR INDIVIDUALS

x

PRIVILEGED USERS PROBATIONARY PERIODS

x

UNAUTHORIZED NETWORK SERVICES HOST-BASED DEVICES INDICATORS OF COMPROMISE OPTIMIZE NETWORK TRAFFIC ANALYSIS

Security Alerts, Advisories, and Directives

x

x

AUTOMATED ALERTS AND ADVISORIES

Security and Privacy Function Verification NOTIFICATION OF FAILED SECURITY TESTS

x x x

W: Incorporated into SI-6.

AUTOMATION SUPPORT FOR DISTRIBUTED TESTING REPORT VERIFICATION RESULTS

Software, Firmware, and Information Integrity

x x

INTEGRITY CHECKS AUTOMATED NOTIFICATIONS OF INTEGRITY VIOLATIONS

x x x

CENTRALLY MANAGED INTEGRITY TOOLS TAMPER-EVIDENT PACKAGING

W: Incorporated into SR-9.

x

AUTOMATED RESPONSE TO INTEGRITY VIOLATIONS CRYPTOGRAPHIC PROTECTION

x

INTEGRATION OF DETECTION AND RESPONSE

x

AUDITING CAPABILITY FOR SIGNIFICANT EVENTS VERIFY BOOT PROCESS PROTECTION OF BOOT FIRMWARE CONFINED ENVIRONMENTS WITH LIMITED PRIVILEGES

W: Moved to CM-7(6).

INTEGRITY VERIFICATION CODE EXECUTION IN PROTECTED ENVIRONMENTS

W: Moved to CM-7(7).

BINARY OR MACHINE EXECUTABLE CODE

W: Moved to CM-7(8).

x

CODE AUTHENTICATION TIME LIMIT ON PROCESS EXECUTION WITHOUT SUPERVISION RUNTIME APPLICATION SELF-PROTECTION

Spam Protection CENTRAL MANAGEMENT AUTOMATIC UPDATES

x

x

W: Incorporated into PL-9.

x

x

CONTINUOUS LEARNING CAPABILITY

Information Input Restrictions

W: Incorporated into AC-2, AC-3, AC5, and AC-6.

PAGE 52

CONTROL NUMBER

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53B

SI-10 SI-10(1) SI-10(2) SI-10(3) SI-10(4) SI-10(5) SI-10(6) SI-11 SI-12 SI-12(1) SI-12(2)

CONTROL NAME CONTROL ENHANCEMENT NAME

PRIVACY CONTROL BASELINE

NIST SP 800-53B CONTROL BASELINES FOR INFORMATION SYSTEMS AND ORGANIZATIONS _________________________________________________________________________________________________

SECURITY CONTROL BASELINES LOW

Information Input Validation

MOD

HIGH

x

x

x x

x x

MANUAL OVERRIDE CAPABILITY REVIEW AND RESOLVE ERRORS PREDICTABLE BEHAVIOR TIMING INTERACTIONS RESTRICT INPUTS TO TRUSTED SOURCES AND APPROVED FORMATS INJECTION PREVENTION

Error Handling Information Management and Retention LIMIT PERSONALLY IDENTIFIABLE INFORMATION ELEMENTS MINIMIZE PERSONALLY IDENTIFIABLE INFORMATION IN TESTING, TRAINING,

x x x

x

AND RESEARCH

SI-12(3) SI-13 SI-13(1) SI-13(2) SI-13(3) SI-13(4) SI-13(5) SI-14 SI-14(1) SI-14(2) SI-14(3) SI-15 SI-16 SI-17 SI-18 SI-18(1) SI-18(2) SI-18(3) SI-18(4) SI-18(5) SI-19 SI-19(1) SI-19(2) SI-19(3) SI-19(4)

INFORMATION DISPOSAL

x

Predictable Failure Prevention TRANSFERRING COMPONENT RESPONSIBILITIES TIME LIMIT ON PROCESS EXECUTION WITHOUT SUPERVISION

W: Incorporated into SI-7(16).

MANUAL TRANSFER BETWEEN COMPONENTS STANDBY COMPONENT INSTALLATION AND NOTIFICATION FAILOVER CAPABILITY

Non-Persistence REFRESH FROM TRUSTED SOURCES NON-PERSISTENT INFORMATION NON-PERSISTENT CONNECTIVITY

Information Output Filtering Memory Protection Fail-Safe Procedures Personally Identifiable Information Quality Operations

x

x

x

AUTOMATION SUPPORT DATA TAGS COLLECTION INDIVIDUAL REQUESTS

x

NOTICE OF CORRECTION OR DELETION

De-identification

x

COLLECTION ARCHIVING RELEASE REMOVAL, MASKING, ENCRYPTION, HASHING, OR REPLACEMENT OF DIRECT IDENTIFIERS

SI-19(5) SI-19(6) SI-19(7) SI-19(8) SI-20

CHAPTER THREE

STATISTICAL DISCLOSURE CONTROL DIFFERENTIAL PRIVACY VALIDATED ALGORITHMS AND SOFTWARE MOTIVATED INTRUDER

Tainting

PAGE 53

CONTROL NUMBER

SI-21 SI-22 SI-23

CONTROL NAME CONTROL ENHANCEMENT NAME

PRIVACY CONTROL BASELINE

NIST SP 800-53B CONTROL BASELINES FOR INFORMATION SYSTEMS AND ORGANIZATIONS _________________________________________________________________________________________________

SECURITY CONTROL BASELINES LOW

MOD

HIGH

Information Refresh Information Diversity Information Fragmentation

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53B CHAPTER THREE

PAGE 54

NIST SP 800-53B CONTROL BASELINES FOR INFORMATION SYSTEMS AND ORGANIZATIONS _________________________________________________________________________________________________

3.20 SUPPLY CHAIN RISK MANAGEMENT FAMILY Table 3-20 provides a summary of the controls and control enhancements assigned to the Supply Chain Risk Management Family. The controls are allocated to the low-impact, moderateimpact, and high-impact security control baselines and the privacy control baseline, as appropriate. A control or control enhancement that has been withdrawn from the control catalog is indicated by a “W” and an explanation of the control or control enhancement disposition in light gray text.

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53B

CONTROL NUMBER

SR-1 SR-2 SR-2(1) SR-3 SR-3(1) SR-3(2) SR-3(3) SR-4 SR-4(1) SR-4(2) SR-4(3) SR-4(4) SR-5 SR-5(1) SR-5(2) SR-6 SR-6(1) SR-7 SR-8 SR-9 SR-9(1) SR-10 SR-11 SR-11(1) SR-11(2) SR-11(3) SR-12

CHAPTER THREE

CONTROL NAME CONTROL ENHANCEMENT NAME

Policy and Procedures Supply Chain Risk Management Plan ESTABLISH SCRM TEAM

Supply Chain Controls and Processes

PRIVACY CONTROL BASELINE

TABLE 3-20: SUPPLY CHAIN RISK MANAGEMENT FAMILY SECURITY CONTROL BASELINES LOW

MOD

HIGH

x x x x

x x x x

x x x x

x

x

x

x

x

x

x

x x x x

x x x x

x x x x x x x

x

x

x

DIVERSE SUPPLY BASE LIMITATION OF HARM SUB-TIER FLOW DOWN

Provenance IDENTITY TRACK AND TRACE VALIDATE AS GENUINE AND NOT ALTERED SUPPLY CHAIN INTEGRITY — PEDIGREE

Acquisition Strategies, Tools, and Methods ADEQUATE SUPPLY ASSESSMENTS PRIOR TO SELECTION, ACCEPTANCE, MODIFICATION, OR UPDATE

Supplier Assessments and Reviews TESTING AND ANALYSIS

Supply Chain Operations Security Notification Agreements Tamper Resistance and Detection MULTIPLE STAGES OF SYSTEM DEVELOPMENT LIFE CYCLE

Inspection of Systems or Components Component Authenticity ANTI-COUNTERFEIT TRAINING CONFIGURATION CONTROL FOR COMPONENT SERVICE AND REPAIR ANTI-COUNTERFEIT SCANNING

COMPONENT DISPOSAL

PAGE 55

NIST SP 800-53B CONTROL BASELINES FOR INFORMATION SYSTEMS AND ORGANIZATIONS _________________________________________________________________________________________________

REFERENCES LAWS, POLICIES, INSTRUCTIONS, STANDARDS, GUIDELINES, AND INTERNAL REPORTS LAWS

[FISMA]

Federal Information Security Modernization Act (P.L. 113-283), December 2014. https://www.congress.gov/113/plaws/publ283/PLAW-113publ283.pdf

[FOIA96] This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53B

Freedom of Information Act (FOIA), 5 U.S.C. § 552, As Amended By Public Law No. 104-231, 110 Stat. 3048, Electronic Freedom of Information Act Amendments of 1996. https://www.govinfo.gov/content/pkg/PLAW-104publ231/pdf/PLAW104publ231.pdf

[PRIVACT]

Privacy Act (P.L. 93-579), December 1974.

https://www.govinfo.gov/content/pkg/STATUTE-88/pdf/STATUTE-88-Pg1896.pdf [44 USC 3552]

Title 44 U.S. Code, Sec. 3552, Definitions. 2017 ed.

https://www.govinfo.gov/app/details/USCODE-2017-title44/USCODE-2017-title44chap35-subchapII-sec3552 POLICIES AND INSTRUCTIONS

[CNSSI 1253]

Committee on National Security Systems Instruction No. 1253, Security Categorization and Control Selection for National Security Systems, March 2014. https://www.cnss.gov/CNSS/issuances/Instructions.cfm

[CNSSP 22]

Committee on National Security Systems Policy No. 22, Cybersecurity Risk Management Policy, August 2016. https://www.cnss.gov/CNSS/issuances/Policies.cfm

[DODI 8510.01]

Department of Defense Instruction 8510.01, Risk Management Framework (RMF) for DoD Information Technology (IT), March 2014.

https://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodi/851001p.pdf ?ver=2019-02-26-101520-300 [OMB A-130]

Office of Management and Budget Memorandum Circular A-130, Managing Information as a Strategic Resource, July 2016. https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/circulars/A130/a13 0revised.pdf STANDARDS, GUIDELINES, AND INTERNAL REPORTS

[FIPS 199]

National Institute of Standards and Technology (2004) Standards for Security Categorization of Federal Information and Information Systems. (U.S. Department of Commerce, Washington, D.C.), Federal Information Processing Standards Publication (FIPS) 199. https://doi.org/10.6028/NIST.FIPS.199

REFERENCES

PAGE 56

NIST SP 800-53B CONTROL BASELINES FOR INFORMATION SYSTEMS AND ORGANIZATIONS _________________________________________________________________________________________________

[FIPS 200]

National Institute of Standards and Technology (2006) Minimum Security Requirements for Federal Information and Information Systems. (U.S. Department of Commerce, Washington, D.C.), Federal Information Processing Standards Publication (FIPS) 200. https://doi.org/10.6028/NIST.FIPS.200

[SP 800-18]

Swanson MA, Hash J, Bowen P (2006) Guide for Developing Security Plans for Federal Information Systems. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-18, Rev. 1. https://doi.org/10.6028/NIST.SP.800-18r1

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53B

[SP 800-30]

Joint Task Force Transformation Initiative (2012) Guide for Conducting Risk Assessments. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-30, Rev. 1. https://doi.org/10.6028/NIST.SP.800-30r1

[SP 800-37]

Joint Task Force (2018) Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-37, Rev. 2. https://doi.org/10.6028/NIST.SP.800-37r2

[SP 800-39]

Joint Task Force Transformation Initiative (2011) Managing Information Security Risk: Organization, Mission, and Information System View. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-39. https://doi.org/10.6028/NIST.SP.800-39

[SP 800-53]

Joint Task Force (2020) Security and Privacy Controls for Information Systems and Organizations. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-53, Rev. 5. https://doi.org/10.6028/NIST.SP.800-53r5

[SP 800-59]

Barker W (2003) Guideline for Identifying an Information System as a National Security System. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-59. https://doi.org/10.6028/NIST.SP.800-59

[SP 800-60-1]

Stine KM, Kissel RL, Barker WC, Fahlsing J, Gulick J (2008) Guide for Mapping Types of Information and Information Systems to Security Categories. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-60, Vol. 1, Rev. 1. https://doi.org/10.6028/NIST.SP.800-60v1r1

[SP 800-60-2]

Stine KM, Kissel RL, Barker WC, Lee A, Fahlsing J (2008) Guide for Mapping Types of Information and Information Systems to Security Categories: Appendices. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-60, Vol. 2, Rev. 1. https://doi.org/10.6028/NIST.SP.800-60v2r1

REFERENCES

PAGE 57

NIST SP 800-53B CONTROL BASELINES FOR INFORMATION SYSTEMS AND ORGANIZATIONS _________________________________________________________________________________________________

[SP 800-82]

Stouffer K, Lightman S, Pillitteri V, Abrams M, Hahn, A (2015) Guide to Industrial Control System (ICS) Security. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-82, Rev. 2. https://doi.org/10.6028/NIST.SP.800-82r2

[IR 8011 v1]

Dempsey KL, Eavy P, Moore G (2017) Automation Support for Security Control Assessments: Volume 1: Overview. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Interagency or Internal (NISTIR) 8011, Volume 1. https://doi.org/10.6028/NIST.IR.8011-1

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53B

[IR 8062]

Brooks S, Garcia M, Lefkovitz N, Lightman S, Nadeau E (2017) An Introduction to Privacy Engineering and Risk Management in Federal Systems. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Interagency or Internal Report (NISTIR) 8062. https://doi.org/10.6028/NIST.IR.8062

MISCELLANEOUS PUBLICATIONS AND WEBSITES

[DSB 2017]

Department of Defense, Defense Science Board (2017) Task Force on Cyber Deterrence (Office of the Under Secretary of Defense for Acquisition, Technology, and Logistics, Washington, DC). https://apps.dtic.mil/dtic/tr/fulltext/u2/1028516.pdf

[NIST CSRC]

National Institute of Standards and Technology (2020) Computer Security Resource Center (CSRC). https://csrc.nist.gov

[SCOR]

National Institute of Standards and Technology (2020) Security Control Overlay Repository (SCOR). https://csrc.nist.gov/projects/risk-management/scor

REFERENCES

PAGE 58

NIST SP 800-53B CONTROL BASELINES FOR INFORMATION SYSTEMS AND ORGANIZATIONS _________________________________________________________________________________________________

APPENDIX A

GLOSSARY COMMON TERMS AND DEFINITIONS

A

ppendix A provides definitions for terminology used in NIST SP 800-53B. Sources for terms used in this publication are cited as applicable. Where no citation is noted, the source of the definition is SP 800-53B.

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53B

agency

Any executive agency or department, military department, Federal Government corporation, Federal Governmentcontrolled corporation, or other establishment in the Executive Branch of the Federal Government, or any independent regulatory agency. See executive agency.

assignment operation

A control parameter that allows an organization to assign a specific, organization-defined value to the control or control enhancement (e.g., assigning a list of roles to be notified or a value for the frequency of testing). See organization-defined control parameters and selection operation.

assurance

Grounds for justified confidence that a [security or privacy] claim has been or will be achieved.

[OMB A-130]

Note 1: Assurance is typically obtained relative to a set of specific claims. The scope and focus of such claims may vary (e.g., security claims, safety claims), and the claims themselves may be interrelated. Note 2: Assurance is obtained through techniques and methods that generate credible evidence to substantiate claims.

authorizing official

A senior Federal official or executive with the authority to authorize (i.e., assume responsibility for) the operation of an information system or the use of a designated set of common controls at an acceptable level of risk to agency operations (including mission, functions, image, or reputation), agency assets, individuals, other organizations, and the Nation.

availability

Ensuring timely and reliable access to and use of information.

capability

A combination of mutually reinforcing security and/or privacy controls implemented by technical means, physical means, and procedural means. Such controls are typically selected to achieve a common information security- or privacy-related purpose.

common control

A security or privacy control that is inherited by multiple information systems or programs.

common control provider

An organizational official responsible for the development, implementation, assessment, and monitoring of common controls (i.e., security or privacy controls inheritable by systems).

[OMB A-130]

[FISMA]

[OMB A-130] [SP 800-37]

APPENDIX A

PAGE 59

NIST SP 800-53B CONTROL BASELINES FOR INFORMATION SYSTEMS AND ORGANIZATIONS _________________________________________________________________________________________________

compensating controls

The security and privacy controls employed in lieu of the controls in the baselines described in NIST Special Publication 800-53B that provide equivalent or comparable protection for a system or organization.

confidentiality

Preserving authorized restrictions on information access and disclosure, including means for protecting personal privacy and proprietary information.

control baseline

The set of security and privacy controls defined for a low-impact, moderate-impact, or high-impact system or selected based on the privacy selection criteria that provide a starting point for the tailoring process.

control enhancement

Augmentation of a security or privacy control to build in additional but related functionality to the control, increase the strength of the control, or add assurance to the control.

control inheritance

A situation in which a system or application receives protection from security or privacy controls (or portions of controls) that are developed, implemented, assessed, authorized, and monitored by entities other than those responsible for the system or application; entities either internal or external to the organization where the system or application resides. See common control.

environment of operation

The physical surroundings in which an information system processes, stores, and transmits information.

high-impact system

A system in which at least one security objective (i.e., confidentiality, integrity, or availability) is assigned a FIPS Publication 199 potential impact value of high.

hybrid control

A security or privacy control that is implemented for an information system, in part as a common control and in part as a system-specific control.

impact

The effect on organizational operations, organizational assets, individuals, other organizations, or the Nation (including the national security interests of the United States) of a loss of confidentiality, integrity, or availability of information or a system.

impact value

The assessed worst-case potential impact that could result from a compromise of the confidentiality, integrity, or availability of information expressed as a value of low, moderate, or high.

information

Any communication or representation of knowledge such as facts, data, or opinions in any medium or form, including textual, numerical, graphic, cartographic, narrative, electronic, or audiovisual forms.

[FISMA]

[FIPS 200, Adapted]

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53B

[OMB A-130] [FIPS 200]

[OMB A-130]

[FIPS 199]

[OMB A-130]

APPENDIX A

PAGE 60

NIST SP 800-53B CONTROL BASELINES FOR INFORMATION SYSTEMS AND ORGANIZATIONS _________________________________________________________________________________________________

information security

The protection of information and systems from unauthorized access, use, disclosure, disruption, modification, or destruction in order to provide confidentiality, integrity, and availability.

information system

A discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information.

integrity

Guarding against improper information modification or destruction, and includes ensuring information non-repudiation and authenticity.

low-impact system

A system in which all three security objectives (i.e., confidentiality, integrity, and availability) are assigned a FIPS Publication 199 potential impact value of low.

moderate-impact system

A system in which at least one security objective (i.e., confidentiality, integrity, or availability) is assigned a FIPS Publication 199 potential impact value of moderate and no security objective is assigned a potential impact value of high.

national security system

Any system (including any telecommunications system) used or operated by an agency or by a contractor of an agency, or other organization on behalf of an agency—(i) the function, operation, or use of which involves intelligence activities; involves cryptologic activities related to national security; involves command and control of military forces; involves equipment that is an integral part of a weapon or weapons system; or is critical to the direct fulfillment of military or intelligence missions (excluding a system that is to be used for routine administrative and business applications, for example, payroll, finance, logistics, and personnel management applications); or (ii) is protected at all times by procedures established for information that have been specifically authorized under criteria established by an Executive Order or an Act of Congress to be kept classified in the interest of national defense or foreign policy.

organization

An entity of any size, complexity, or positioning within an organizational structure, including federal agencies, private enterprises, academic institutions, state, local, or tribal governments, or as appropriate, any of their operational elements.

organization-defined control parameter

The variable part of a control or control enhancement that is instantiated by an organization during the tailoring process by either assigning an organization-defined value or selecting a value from a predefined list provided as part of the control or control enhancement. See assignment operation and selection operation.

[OMB A-130]

[OMB A-130]

[FISMA]

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53B

[FIPS 200]

[FIPS 200]

[OMB A-130]

[FIPS 200, Adapted]

APPENDIX A

PAGE 61

NIST SP 800-53B CONTROL BASELINES FOR INFORMATION SYSTEMS AND ORGANIZATIONS _________________________________________________________________________________________________

overlay

A specification of security or privacy controls, control enhancements, supplemental guidance, and other supporting information employed during the tailoring process, that is intended to complement (and further refine) security control baselines. The overlay specification may be more stringent or less stringent than the original security control baseline specification and can be applied to multiple information systems. See tailoring.

personally identifiable information

Information that can be used to distinguish or trace an individual’s identity, either alone or when combined with other information that is linked or linkable to a specific individual.

potential impact

The loss of confidentiality, integrity, or availability could be expected to have a limited adverse effect (FIPS Publication 199 low), a serious adverse effect (FIPS Publication 199 moderate), or a severe or catastrophic adverse effect (FIPS Publication 199 high) on organizational operations, organizational assets, or individuals.

privacy control

The administrative, technical, and physical safeguards employed within an agency to ensure compliance with applicable privacy requirements and manage privacy risks.

privacy impact assessment

An analysis of how information is handled to ensure handling conforms to applicable legal, regulatory, and policy requirements regarding privacy; to determine the risks and effects of creating, collecting, using, processing, storing, maintaining, disseminating, disclosing, and disposing of information in identifiable form in an electronic information system; and to examine and evaluate protections and alternate processes for handling information to mitigate potential privacy concerns. A privacy impact assessment is both an analysis and a formal document detailing the process and the outcome of the analysis.

privacy plan

A formal document that details the privacy controls selected for an information system or environment of operation that are in place or planned for meeting applicable privacy requirements and managing privacy risks, details how the controls have been implemented, and describes the methodologies and metrics that will be used to assess the controls.

privacy program plan

A formal document that provides an overview of an agency’s privacy program, including a description of the structure of the privacy program, the resources dedicated to the privacy program, the role of the Senior Agency Official for Privacy and other privacy officials and staff, the strategic goals and objectives of the privacy program, and the program management controls and common controls in place or planned for meeting applicable privacy requirements and managing privacy risks.

[OMB A-130]

[OMB A-130]

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53B

[FIPS 199]

[OMB A-130]

[OMB A-130]

[OMB A-130]

[OMB A-130]

APPENDIX A

PAGE 62

NIST SP 800-53B CONTROL BASELINES FOR INFORMATION SYSTEMS AND ORGANIZATIONS _________________________________________________________________________________________________

processing

Operation or set of operations performed upon PII that can include but is not limited to the collection, retention, logging, generation, transformation, use, disclosure, transfer, and disposal of PII.

risk

A measure of the extent to which an entity is threatened by a potential circumstance or event, and typically is a function of: (i) the adverse impact, or magnitude of harm, that would arise if the circumstance or event occurs; and (ii) the likelihood of occurrence.

risk assessment

The process of identifying risks to organizational operations (including mission, functions, image, reputation), organizational assets, individuals, other organizations, and the Nation, resulting from the operation of a system. Part of risk management, incorporates threat and vulnerability analyses and analyses of privacy problems arising from information processing and considers mitigations provided by security and privacy controls planned or in place. Synonymous with risk analysis.

risk management

The program and supporting processes to manage risk to agency operations (including mission, functions, image, reputation), agency assets, individuals, other organizations, and the Nation, and includes: establishing the context for risk-related activities, assessing risk, responding to risk once determined, and monitoring risk over time.

scoping considerations

A part of tailoring guidance providing organizations with specific considerations on the applicability and implementation of security and privacy controls in the control baselines. Considerations include policy or regulatory, technology, physical infrastructure, system component allocation, public access, scalability, common control, operational or environmental, and security objective.

security category

The characterization of information or an information system based on an assessment of the potential impact that a loss of confidentiality, integrity, or availability of such information or information system would have on agency operations, agency assets, individuals, other organizations, and the Nation.

security control

The safeguards or countermeasures prescribed for an information system or an organization to protect the confidentiality, integrity, and availability of the system and its information.

security control baseline

The set of minimum security controls defined for a low-impact, moderate-impact, or high-impact information system.

[IR 8062]

[OMB A-130]

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53B

[SP 800-39]

[OMB A-130]

[OMB A-130]

[OMB A-130]

[OMB A-130]

APPENDIX A

PAGE 63

NIST SP 800-53B CONTROL BASELINES FOR INFORMATION SYSTEMS AND ORGANIZATIONS _________________________________________________________________________________________________

security functionality

The security-related features, functions, mechanisms, services, procedures, and architectures implemented within organizational information systems or the environments in which those systems operate.

security functions

The hardware, software, or firmware of the system responsible for enforcing the system security policy and supporting the isolation of code and data on which the protection is based.

security objective

Confidentiality, integrity, or availability.

security plan

Formal document that provides an overview of the security requirements for an information system or an information security program and describes the security controls in place or planned for meeting those requirements. The system security plan describes the system components that are included within the system, the environment in which the system operates, how the security requirements are implemented, and the relationships with or connections to other systems. See system security plan.

security requirement

A requirement levied on an information system or an organization that is derived from applicable laws, executive orders, directives, regulations, policies, standards, procedures, or mission/business needs to ensure the confidentiality, integrity, and availability of information that is being processed, stored, or transmitted.

[FIPS 199]

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53B

[FIPS 200, Adapted]

Note: Security requirements can be used in a variety of contexts from highlevel policy-related activities to low-level implementation-related activities in system development and engineering disciplines.

selection operation

A control parameter that allows an organization to select a value from a list of predefined values provided as part of the control or control enhancement (e.g., selecting to either restrict an action or prohibit an action). See assignment operation and organization-defined control parameter.

senior agency official for privacy

The senior official, designated by the head of each agency, who has agency-wide responsibility for privacy, including implementation of privacy protections; compliance with Federal laws, regulations, and policies relating to privacy; management of privacy risks at the agency; and a central policy-making role in the agency’s development and evaluation of legislative, regulatory, and other policy proposals.

system owner (or program manager)

Official responsible for the procurement, development, integration, modification, operation, and maintenance of a system.

[OMB A-130]

APPENDIX A

PAGE 64

NIST SP 800-53B CONTROL BASELINES FOR INFORMATION SYSTEMS AND ORGANIZATIONS _________________________________________________________________________________________________

system security plan

See security plan.

system-specific control

A security or privacy control for an information system that is implemented at the system level and is not inherited by any other information system.

tailored control baseline

A set of controls resulting from the application of tailoring guidance to a control baseline. See tailoring.

tailoring

The process by which security and privacy control baselines are modified by identifying and designating common controls, applying scoping considerations on the applicability and implementation of baseline controls, selecting compensating controls, assigning specific values to organization-defined control parameters, supplementing baselines with additional controls or control enhancements, and providing additional specification information for control implementation.

APPENDIX A

PAGE 65

[OMB A-130]

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53B

NIST SP 800-53B CONTROL BASELINES FOR INFORMATION SYSTEMS AND ORGANIZATIONS _________________________________________________________________________________________________

APPENDIX B

ACRONYMS COMMON ABBREVIATIONS

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53B

CIO

Chief Information Officer

CISO

Chief Information Security Officer

CNSS

Committee on National Security Systems

CNSSI

Committee on National Security Systems Instruction

CNSSP

Committee on National Security Systems Policy

CSRC

Computer Security Resource Center

DoD

Department of Defense

DoDI

Department of Defense Instruction

FIPS

Federal Information Processing Standards

FISMA

Federal Information Security Modernization Act

FOIA

Freedom of Information Act

IT

Information Technology

ITL

Information Technology Laboratory

JTF

Joint Task Force

MOD

Moderate

NIST

National Institute of Standards and Technology

OIRA

Office of Information and Regulatory Affairs

O/S

Organization or Information System

OMB

Office of Management and Budget

PII

Personally Identifiable Information

RMF

Risk Management Framework

SAOP

Senior Agency Official for Privacy

SCOR

Security Control Overlay Repository

SP

Special Publication

APPENDIX B

PAGE 66

NIST SP 800-53B CONTROL BASELINES FOR INFORMATION SYSTEMS AND ORGANIZATIONS _________________________________________________________________________________________________

APPENDIX C

OVERLAYS ADDITIONAL CUSTOMIZATION OPTIONS FOR CONTROL BASELINES

I This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53B

n certain situations, it may be beneficial for organizations to apply the tailoring guidance to develop a set of controls for particular communities of interest or to address specialized requirements, technologies implemented, or unique missions or environments of operation. An organization may decide to establish a set of controls for specific applications or use cases, such as cloud-based services that could be applied to organizations procuring or implementing such services; industrial control systems generating or transmitting electric power or controlling environmental systems within facilities; systems processing, storing, or transmitting classified information; or systems controlling the safety of transportation systems. In these examples, overlays can be developed for each particular sector, technology area, unique circumstance, or environment and promulgated to large communities of interest—thus achieving standardized security and privacy capabilities, consistent control implementation, and cost-effective security and privacy solutions.

To address the need for specialized sets of controls for communities of interest, systems, and organizations, the concept of overlay is introduced. An overlay may be a fully specified set of controls, control enhancements, and other supporting information (e.g., parameter values) that is derived from the application of tailoring guidance to control baselines 38 39 or it may be derived independently of control baselines. 40 Overlays are developed to apply to multiple systems within a community of interest and complement and further refine control baselines by: •

Providing an opportunity for the community of interest to add, modify, or eliminate controls

•

Providing control applicability and interpretations for specific technologies, computing paradigms, environments of operation, types of systems, types of missions/operations, operating modes, industry sectors, and statutory/regulatory requirements

•

Establishing parameter values for assignment and selection operations in controls and control enhancements that are agreeable to communities of interest

Organizations use the overlay concept when there is divergence from the basic assumptions used to create the initial control baselines or when specific controls are needed to protect a particular technology or address a particular threat. Overlays may require tailoring as described in Chapter Three to help ensure that control implementations accurately reflect security and privacy requirements for each system, system component, and operational environment to which the overlay is applied. The overlay concept is applicable to groups of like technologies,

38 [SP 800-82] provides an example of an overlay that includes a fully specified set of controls for industrial control

systems. Alternatively, overlays can include a specific set of relevant controls that address a particular community need and complement control baselines. 39 Control baselines can include the federal baselines in Chapter Three; baselines developed by state, local, or tribal governments; or baselines developed by private sector organizations (e.g., manufacturers, consortia, trade associations, industry, and critical infrastructure sectors). 40 Overlays that are baseline independent often address very specific circumstances (e.g., protecting classified information), situations, and/or conditions.

APPENDIX C

PAGE 67

NIST SP 800-53B CONTROL BASELINES FOR INFORMATION SYSTEMS AND ORGANIZATIONS _________________________________________________________________________________________________

systems, or communities of interest (i.e., the overlay concept is not appropriate for an individual system since the tailoring process is used to adapt control baselines for individual systems). The full range of tailoring activities can be employed by organizations to provide a structured approach for developing overlays that support the areas described above. Overlays provide an opportunity to build consensus across communities of interest and develop security and privacy plans for systems and organizations that have broad-based support for specific circumstances, situations, or conditions. Categories of overlays that may be useful include:

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53B

•

Communities of interest, industry sectors, coalitions, or partnerships, such as healthcare, law enforcement, intelligence, finance, manufacturing, transportation, energy, and allied collaboration or sharing

•

Information technologies and computing paradigms, such as virtualized systems, cloud, mobile, smart grid, and cross-domain solutions

•

Environments of operation, such as space, tactical, or sea

•

Types of systems and operating modes, such as industrial or process control systems, weapons systems, single-user systems, stand-alone systems, and IoT devices and sensors

•

Types of missions or operations, such as counterterrorism, first responders, research, development, test, and evaluation

•

Types of threats, such as advanced persistent threats or insider threats

•

Statutory or regulatory requirements, such as the Foreign Intelligence Surveillance Act, Health Insurance Portability and Accountability Act, FISMA, and Privacy Act

Overlays provide uniformity and efficiency of control selection by presenting tailoring options developed by security and privacy experts and other subject matter experts to system owners responsible for implementing and maintaining such systems. There are many options that can be used to construct overlays, depending on the specificity desired by the overlay developers. Some overlays may be very specific with respect to the hardware, firmware, and software that form the key components of the targeted system types and the environments in which the systems operate. Other overlays may be more abstract in order to be applicable to a larger class of systems that may be deployed in different operational environments.

PUBLICATION OF OVERLAYS Overlays can be published independently in a variety of venues and publications, including OMB policies, CNSS Instructions, NIST Special Publications, industry standards, and sector-specific guidance. The Security Control Overlay Repository (SCOR) provides stakeholders with a platform for voluntarily sharing security control overlays. To learn more about the repository, including instructions on how to submit an overlay, and to obtain a list of published overlays, see [SCOR].

APPENDIX C

PAGE 68

NIST SP 800-53B CONTROL BASELINES FOR INFORMATION SYSTEMS AND ORGANIZATIONS _________________________________________________________________________________________________

Organizations may use the following outline when developing overlays. 41 The outline is provided as an example only. Organizations may use any format based on specific organizational needs and the type of overlay being developed. The level of detail included in the overlay is at the discretion of the organization or community of interest initiating the overlay but should be of sufficient breadth and depth to provide an appropriate justification and rationale for the overlay, including any risk-based decisions made during the overlay development process. The example overlay outline includes the following sections:

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53B

•

Identification

•

Overlay characteristics

•

Applicability

•

Overlay summary

•

Overlay control specifications

•

Tailoring considerations

•

Terms and definitions

•

Additional information or instructions

Identification Organizations identify the overlay by providing a unique name for the overlay, a version number and date, the version of [SP 800-53] used to create the overlay, other documentation used to create the overlay, author or authoring group and point of contact, and type of organizational approval received. Organizations define how long the overlay is to be in effect and any events that may trigger an update to the overlay other than changes to [SP 800-53] or organizationspecific guidance. If there are no unique events that can trigger an update for the overlay, the identification section provides that notation.

Overlay Characteristics Organizations describe the characteristics that define the intended use of the overlay in order to help potential users select the most appropriate overlay for their mission or business functions, including: •

A description of the physical environment where the systems, system components, or technologies targeted by the overlay will be used or operate (e.g., inside a guarded building within the continental United States, in an unmanned space vehicle, while traveling for business to a foreign country that is known for attempting to gain access to sensitive or classified information, or in a mobile vehicle that is in close proximity to hostile entities)

•

The type(s) of information that will be processed, stored, or transmitted by the systems, system components, or technologies targeted by the overlay (e.g., personal identity and authentication information; financial management information; facilities, fleet, and

41 While organizations are encouraged to use the overlay concept, the development of widely divergent overlays on the same topic may prove to be counterproductive. The overlay concept is most effective when communities of interest work together to create consensus-based overlays that are not duplicative.

APPENDIX C

PAGE 69

NIST SP 800-53B CONTROL BASELINES FOR INFORMATION SYSTEMS AND ORGANIZATIONS _________________________________________________________________________________________________

equipment management information; defense and national security information; system development information) •

The functionality within the targeted systems, system components, or technologies or the types of systems (e.g., stand-alone systems, industrial or process control systems, or crossdomain systems)

•

Other characteristics related to the overlay that are intended to protect organizational mission or business functions, systems, information, or individuals from a specific set of threats that may not be addressed by the assumptions described in Section 2.3.

Applicability This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53B

Organizations provide criteria to help users of the overlay in determining whether the overlay applies to a particular system, system component, technology, or environment of operation. Typical formats may include a list of questions or a decision tree based on the description of the characteristics of the overlay target (including associated applications) and its environment of operation at the level of specificity appropriate to the overlay.

Overlay Summary Organizations provide a brief summary of the characteristics of the overlay. The summary may include the controls and control enhancements that are affected by the overlay; an indication of which controls and control enhancements are selected or not selected based on the specific characteristics and assumptions in the overlay, the tailoring guidance provided in Section 2.4, or any organization-specific guidance; the selected controls and control enhancements, including parameter values; and references to applicable laws, executive orders, directives, instructions, regulations, policies, or standards.

Overlay Control Specifications Organizations provide a comprehensive expression of the controls and control enhancements in the overlay as part of the tailoring process. This may include the justification for selecting or not selecting a specific control or control enhancement; modifications to the control discussion section that address the characteristics of the overlay and the environments in which the overlay is intended to be used; unique parameter values for control selection or assignment operations; specific statutory or regulatory requirements (above and beyond FISMA) that are met by a control or control enhancement; recommendations for compensating controls, as appropriate; and guidance that extends the capability of the control or control enhancement by specifying additional functionality, altering the strength of mechanism, or adding or limiting implementation options.

Tailoring Considerations Organizations provide information to system owners and authorizing officials to consider during the tailoring process when determining the set of controls and control enhancements applicable to their specific systems, system components, or technologies. This is especially important for overlays that are used in an environment of operation different from the one assumed by the control baselines in Chapter Three. In addition, organizations can provide guidance on the use of multiple overlays applied to a control baseline and address any potential conflicts that may arise between the controls in the baselines and overlay specifications.

APPENDIX C

PAGE 70

NIST SP 800-53B CONTROL BASELINES FOR INFORMATION SYSTEMS AND ORGANIZATIONS _________________________________________________________________________________________________

Terms and Definitions Organizations provide any terms and associated definitions that are unique and relevant to the overlay. If there are no unique terms or definitions for the overlay, that is stated in this section. Additional Information or Instructions Organizations provide any additional information or instructions relevant to the overlay not covered in the previous sections.

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-53B APPENDIX C

PAGE 71

Related documents

• 7 U.S.C. § 4505 — Certification of organizations#560607
• NIST SP 800-53Ar5: Assessing Security and Privacy Controls in Information Systems and Organizations#3013
• NIST SP 800-205: Attribute Considerations for Access Control Systems#2954
• NIST SP 800-176: Computer Security Division 2014 Annual Report#2927
• NIST SP 800-170: Computer Security Division 2013 Annual Report#2918