![](media/image1.png){width="2.0in" height="2.0in"}

[\[SYSTEM NAME\] (SYSTEM ACRONYM)]{.mark}

System Security Plan (SSP)

Version [\[#\]]{.mark}

[\[Month DD, YYYY\]]{.mark}

Prepared for:

United States Patent and Trademark Office

Office of Chief Information Officer

[\[Contract Number\]]{.mark}

FOR OFFICIAL USE ONLY

Record of Changes/Version History

  ------------------- -------- ---------- ------------- -------------------
  Change/Version      Date of  Sections   Description   Person Entering
  Number              Change   Changed                  Change

                                                        

                                                        

                                                        

                                                        

                                                        
  ------------------- -------- ---------- ------------- -------------------

Table of Contents

[1 System Identification 1](#system-identification)

[1.1 System Name/Title 1](#system-nametitle)

[1.2 Responsible Organization 1](#responsible-organization)

[1.3 Information Contacts 2](#information-contacts)

[1.4 Assignment of Security Responsibility
3](#assignment-of-security-responsibility)

[1.5 System Operational Status 5](#system-operational-status)

[1.6 System Description [\<Pull from System Boundary\>]{.mark}
5](#system-description-pull-from-system-boundary)

[1.6.1 System Purpose 6](#system-purpose)

[1.6.2 Capabilities 7](#capabilities)

[1.6.3 Information Flow 7](#information-flow)

[1.6.4 System Users 7](#system-users)

[1.6.5 Hardware Description 8](#hardware-description)

[1.6.6 Software Description 8](#software-description)

[1.6.7 Firmware Description 9](#firmware-description)

[1.6.8 Encryption/PKI 9](#encryptionpki)

[1.6.9 Network Topology 10](#network-topology)

[1.6.10 Network Configuration 10](#network-configuration)

[1.6.11 Network Connection Rules 10](#network-connection-rules)

[1.6.12 Accreditation Boundary 11](#accreditation-boundary)

[1.7 System Environment 11](#system-environment)

[1.8 System Interconnection/Information Sharing
11](#system-interconnectioninformation-sharing)

[1.8.1 Web Protocols 12](#web-protocols)

[1.8.2 Mobile Code 12](#mobile-code)

[1.8.3 Ports, Protocols and Services 13](#ports-protocols-and-services)

[1.9 General Description of Information Sensitivity
13](#general-description-of-information-sensitivity)

[1.9.1 Information Types 13](#information-types)

[1.9.2 Security Objectives Categorization (FIPS 199)
14](#security-objectives-categorization-fips-199)

[1.9.3 System Categorization 15](#system-categorization)

[1.10 E-Authentication Risk Assessment
15](#e-authentication-risk-assessment)

[1.11 Applicable Laws/ Regulations Affecting the System
16](#applicable-laws-regulations-affecting-the-system)

[2 Management Controls 18](#management-controls)

[2.1 Certification, Accreditation, and Security Assessments (CA)
18](#certification-accreditation-and-security-assessments-ca)

[2.1.1 Certification, Accreditation, Security Assessment Policies and
Procedures (CA-1)
18](#certification-accreditation-security-assessment-policies-and-procedures-ca-1)

[2.1.2 Security Assessments (CA-2) 19](#security-assessments-ca-2)

[2.1.3 Information System Connections (CA-3)
20](#information-system-connections-ca-3)

[2.1.4 Security Certification (CA-4) 20](#security-certification-ca-4)

[2.1.5 Plan of Action and Milestones (CA-5)
21](#plan-of-action-and-milestones-ca-5)

[2.1.6 Security Accreditation (CA-6) 21](#security-accreditation-ca-6)

[2.1.7 Continuous Monitoring (CA-7) 22](#continuous-monitoring-ca-7)

[2.2 Planning (PL) 23](#planning-pl)

[2.2.1 Security Planning Policy and Procedures (PL-1)
23](#security-planning-policy-and-procedures-pl-1)

[2.2.2 System Security Plan (PL-2) 24](#system-security-plan-pl-2)

[2.2.3 System Security Plan Update (PL-3)
24](#system-security-plan-update-pl-3)

[2.2.4 Rules of Behavior (PL-4) 25](#rules-of-behavior-pl-4)

[2.2.5 Privacy Impact Assessment (PL-5)
25](#privacy-impact-assessment-pl-5)

[2.2.6 Security-Related Activity Planning (PL-6)
25](#security-related-activity-planning-pl-6)

[2.3 Risk Assessment (RA) 26](#risk-assessment-ra)

[2.3.1 Risk Assessment Policy and Procedures (RA-1)
26](#risk-assessment-policy-and-procedures-ra-1)

[2.3.2 Security Categorization (RA-2) 26](#security-categorization-ra-2)

[2.3.3 Risk Assessment (RA-3) 27](#risk-assessment-ra-3)

[2.3.4 Risk Assessment Update (RA-4) 28](#risk-assessment-update-ra-4)

[2.3.5 Vulnerability Scanning (RA-5) 28](#vulnerability-scanning-ra-5)

[2.4 System and Services Acquisition (SA)
29](#system-and-services-acquisition-sa)

[[2.4.1]{.mark} [System and Services Acquisition Policy and Procedures
(SA-1)]{.mark}
29](#system-and-services-acquisition-policy-and-procedures-sa-1)

[2.4.2 Allocation of Resources (SA-2) 29](#allocation-of-resources-sa-2)

[2.4.3 Life Cycle Support (SA-3) 30](#life-cycle-support-sa-3)

[2.4.4 Acquisitions (SA-4) 30](#acquisitions-sa-4)

[2.4.5 Information System Documentation (SA-5)
31](#information-system-documentation-sa-5)

[2.4.6 Software Usage Restrictions (SA-6)
32](#software-usage-restrictions-sa-6)

[2.4.7 User Installed Software (SA-7) 32](#user-installed-software-sa-7)

[2.4.8 Security Engineering Principles (SA-8)
33](#security-engineering-principles-sa-8)

[2.4.9 External Information System Services (SA-9)
33](#external-information-system-services-sa-9)

[2.4.10 Developer Security Testing (SA-11)
34](#developer-security-testing-sa-11)

[3 Operational Controls 34](#operational-controls)

[3.1 Awareness and Training (AT) 35](#awareness-and-training-at)

[3.1.1 Security Awareness and Training Policy and Procedures (AT-1)
35](#security-awareness-and-training-policy-and-procedures-at-1)

[3.1.2 Security Awareness (AT-2) 35](#security-awareness-at-2)

[3.1.3 Security Training (AT-3) 36](#security-training-at-3)

[3.1.4 Security Training Records (AT-4)
36](#security-training-records-at-4)

[3.2 Configuration Management (CM) 37](#configuration-management-cm)

[3.2.1 Configuration Management Policy and Procedures (CM-1)
37](#configuration-management-policy-and-procedures-cm-1)

[3.2.2 Baseline Configuration (CM-2) 37](#baseline-configuration-cm-2)

[3.2.3 Configuration Change Control (CM-3)
38](#configuration-change-control-cm-3)

[3.2.4 Monitoring Configuration Changes (CM-4)
38](#monitoring-configuration-changes-cm-4)

[3.2.5 Access Restrictions for Change (CM-5)
39](#access-restrictions-for-change-cm-5)

[3.2.6 Configuration Settings (CM-6) 39](#configuration-settings-cm-6)

[3.2.7 Least Functionality (CM-7) 40](#least-functionality-cm-7)

[3.2.8 Information System Component Inventory (CM-8)
40](#information-system-component-inventory-cm-8)

[3.3 Contingency Planning (CP) 41](#contingency-planning-cp)

[3.3.1 Contingency Planning Policy and Procedures (CP-1)
41](#contingency-planning-policy-and-procedures-cp-1)

[3.3.2 Contingency Plan (CP-2) 41](#contingency-plan-cp-2)

[3.3.3 Contingency Training (CP-3) 42](#contingency-training-cp-3)

[3.3.4 Contingency Plan Testing and Exercises (CP-4)
42](#contingency-plan-testing-and-exercises-cp-4)

[3.3.5 Contingency Plan Update (CP-5) 43](#contingency-plan-update-cp-5)

[3.3.6 Alternate Storage Site (CP-6) 44](#alternate-storage-site-cp-6)

[3.3.7 Alternate Processing Site (CP-7)
44](#alternate-processing-site-cp-7)

[3.3.8 Telecommunications Services (CP-8)
45](#telecommunications-services-cp-8)

[3.3.9 Information System Backup (CP-9)
46](#information-system-backup-cp-9)

[3.3.10 Information System Recovery and Reconstitution (CP-10)
47](#information-system-recovery-and-reconstitution-cp-10)

[3.4 Incident Response (IR) 47](#incident-response-ir)

[3.4.1 Incident Response Policy and Procedures (IR-1)
47](#incident-response-policy-and-procedures-ir-1)

[3.4.2 Incident Response Training (IR-2)
48](#incident-response-training-ir-2)

[3.4.3 Incident Response Testing and Exercises (IR-3)
48](#incident-response-testing-and-exercises-ir-3)

[3.4.4 Incident Handling (IR-4) 49](#incident-handling-ir-4)

[3.4.5 Incident Monitoring (IR-5) 49](#incident-monitoring-ir-5)

[3.4.6 Incident Reporting (IR-6) 49](#incident-reporting-ir-6)

[3.4.7 Incident Response Assistance (IR-7)
50](#incident-response-assistance-ir-7)

[3.5 Maintenance (MA) 50](#maintenance-ma)

[3.5.1 System Maintenance Policy and Procedures (MA-1)
50](#system-maintenance-policy-and-procedures-ma-1)

[3.5.2 Controlled Maintenance (MA-2) 51](#controlled-maintenance-ma-2)

[3.5.3 Maintenance Tools (MA-3) 52](#maintenance-tools-ma-3)

[3.5.4 Remote Maintenance (MA-4) 52](#remote-maintenance-ma-4)

[3.5.5 Maintenance Personnel (MA-5) 53](#maintenance-personnel-ma-5)

[3.5.6 Timely Maintenance (MA-6) 54](#timely-maintenance-ma-6)

[3.6 Media Protection (MP) 54](#media-protection-mp)

[3.6.1 Media Protection Policy and Procedures (MP-1)
54](#media-protection-policy-and-procedures-mp-1)

[3.6.2 Media Access (MP-2) 54](#media-access-mp-2)

[3.6.3 Media Storage (MP-4) 55](#media-storage-mp-4)

[3.6.4 Media Transport (MP-5) 56](#media-transport-mp-5)

[3.6.5 Media Sanitization and Disposal (MP-6)
58](#media-sanitization-and-disposal-mp-6)

[3.7 Physical and Environmental Protection (PE)
58](#physical-and-environmental-protection-pe)

[3.7.1 Physical and Environmental Protection Policy and Procedures
(PE-1)
58](#physical-and-environmental-protection-policy-and-procedures-pe-1)

[3.7.2 Physical Access Authorizations (PE-2)
59](#physical-access-authorizations-pe-2)

[3.7.3 Physical Access Control (PE-3) 59](#physical-access-control-pe-3)

[3.7.4 Access Control for Display Medium (PE-5)
60](#access-control-for-display-medium-pe-5)

[3.7.5 Monitoring Physical Access (PE-6)
60](#monitoring-physical-access-pe-6)

[3.7.6 Visitor Control (PE-7) 61](#visitor-control-pe-7)

[3.7.7 Access Records (PE-8) 61](#access-records-pe-8)

[3.7.8 Power Equipment and Power Cabling (PE-9)
62](#power-equipment-and-power-cabling-pe-9)

[3.7.9 Emergency Shutoff (PE-10) 62](#emergency-shutoff-pe-10)

[3.7.10 Emergency Power (PE-11) 63](#emergency-power-pe-11)

[3.7.11 Emergency Lighting (PE-12) 63](#emergency-lighting-pe-12)

[3.7.12 Fire Protection (PE-13) 63](#fire-protection-pe-13)

[3.7.13 Temperature and Humidity Controls (PE-14)
64](#temperature-and-humidity-controls-pe-14)

[3.7.14 Water Damage Protection (PE-15)
64](#water-damage-protection-pe-15)

[3.7.15 Delivery and Removal (PE-16) 64](#delivery-and-removal-pe-16)

[3.7.16 Alternate Work Site (PE-17) 65](#alternate-work-site-pe-17)

[3.7.17 Location of Information System Components (PE-18)
65](#location-of-information-system-components-pe-18)

[3.8 Personnel Security (PS) 66](#personnel-security-ps)

[3.8.1 Personnel Security Policy and Procedures (PS-1)
66](#personnel-security-policy-and-procedures-ps-1)

[3.8.2 Position Categorization (PS-2) 66](#position-categorization-ps-2)

[3.8.3 Personnel Screening (PS-3) 67](#personnel-screening-ps-3)

[3.8.4 Personnel Termination (PS-4) 67](#personnel-termination-ps-4)

[3.8.5 Personnel Transfer (PS-5) 67](#personnel-transfer-ps-5)

[3.8.6 Access Agreements (PS-6) 68](#access-agreements-ps-6)

[3.8.7 Third-Party Personnel Security (PS-7)
68](#third-party-personnel-security-ps-7)

[3.8.8 Personnel Sanctions (PS-8) 69](#personnel-sanctions-ps-8)

[3.9 System and Information Integrity (SI)
69](#system-and-information-integrity-si)

[3.9.1 System and Information Integrity Policy and Procedures (SI-1)
69](#system-and-information-integrity-policy-and-procedures-si-1)

[3.9.2 Flaw Remediation (SI-2) 70](#flaw-remediation-si-2)

[3.9.3 Malicious Code Protection (SI-3)
70](#malicious-code-protection-si-3)

[3.9.4 Information System Monitoring Tools and Techniques (SI-4)
71](#information-system-monitoring-tools-and-techniques-si-4)

[3.9.5 Security Alerts and Advisories (SI-5)
72](#security-alerts-and-advisories-si-5)

[3.9.6 Spam Protection (SI-8) 73](#spam-protection-si-8)

[3.9.7 Information Input Restrictions (SI-9)
73](#information-input-restrictions-si-9)

[3.9.8 Information Accuracy, Completeness, Validity, and Authenticity
(SI-10)
73](#information-accuracy-completeness-validity-and-authenticity-si-10)

[3.9.9 Error Handling (SI-11) 74](#error-handling-si-11)

[3.9.10 Information Output Handling and Retention (SI-12)
74](#information-output-handling-and-retention-si-12)

[4 Technical Controls 75](#technical-controls)

[4.1 Access Control (AC) 75](#access-control-ac)

[4.1.1 Access Control Policy and Procedures (AC-1)
75](#access-control-policy-and-procedures-ac-1)

[4.1.2 Account Management (AC-2) 75](#account-management-ac-2)

[4.1.3 Access Enforcement (AC-3) 77](#access-enforcement-ac-3)

[4.1.4 Information Flow Enforcement (AC-4)
77](#information-flow-enforcement-ac-4)

[4.1.5 Separation of Duties (AC-5) 78](#separation-of-duties-ac-5)

[4.1.6 Least Privilege (AC-6) 79](#least-privilege-ac-6)

[4.1.7 Unsuccessful Login Attempts (AC-7)
79](#unsuccessful-login-attempts-ac-7)

[4.1.8 System Use Notification (AC-8) 79](#system-use-notification-ac-8)

[4.1.9 Session Lock (AC-11) 80](#session-lock-ac-11)

[4.1.10 Session Termination (AC-12) 81](#session-termination-ac-12)

[4.1.11 Supervision and Review -- Access Control (AC-13)
81](#supervision-and-review-access-control-ac-13)

[4.1.12 Permitted Actions without Identification or Authentication
(AC-14)
82](#permitted-actions-without-identification-or-authentication-ac-14)

[4.1.13 Remote Access (AC-17) 82](#remote-access-ac-17)

[4.1.14 Wireless Access Restrictions (AC-18)
83](#wireless-access-restrictions-ac-18)

[4.1.15 Access Control for Portable and Mobile Devices (AC-19)
84](#access-control-for-portable-and-mobile-devices-ac-19)

[4.1.16 Use of External Information Systems (AC-20)
85](#use-of-external-information-systems-ac-20)

[4.2 Audit and Accountability (AU) 86](#audit-and-accountability-au)

[4.2.1 Audit and Accountability Policy and Procedures (AU-1)
86](#audit-and-accountability-policy-and-procedures-au-1)

[4.2.2 Auditable Events (AU-2) 86](#auditable-events-au-2)

[4.2.3 Content of Audit Records (AU-3)
87](#content-of-audit-records-au-3)

[4.2.4 Audit Storage Capacity (AU-4) 88](#audit-storage-capacity-au-4)

[4.2.5 Response to Audit Processing Failures (AU-5)
88](#response-to-audit-processing-failures-au-5)

[4.2.6 Audit Monitoring, Analysis, and Reporting (AU-6)
88](#audit-monitoring-analysis-and-reporting-au-6)

[4.2.7 Audit Reduction and Report Generation (AU-7)
89](#audit-reduction-and-report-generation-au-7)

[4.2.8 Time Stamps (AU-8) 89](#time-stamps-au-8)

[4.2.9 Protection of Audit Information (AU-9)
90](#protection-of-audit-information-au-9)

[4.2.10 Audit Record Retention (AU-11)
90](#audit-record-retention-au-11)

[4.3 Identification and Authentication (IA)
91](#identification-and-authentication-ia)

[4.3.1 Identification and Authentication Policy and Procedures (IA-1)
91](#identification-and-authentication-policy-and-procedures-ia-1)

[4.3.2 User Identification and Authentication (IA-2)
91](#user-identification-and-authentication-ia-2)

[4.3.3 Device Identification and Authentication (IA-3)
93](#device-identification-and-authentication-ia-3)

[4.3.4 Identifier Management (IA-4) 93](#identifier-management-ia-4)

[4.3.5 Authenticator Management (IA-5)
93](#authenticator-management-ia-5)

[4.3.6 Authenticator Feedback (IA-6) 94](#authenticator-feedback-ia-6)

[4.3.7 Cryptographic Module Authentication (IA-7)
95](#cryptographic-module-authentication-ia-7)

[4.4 System and Communications Protection (SC)
95](#system-and-communications-protection-sc)

[4.4.1 System and Communications Protection Policy and Procedures (SC-1)
95](#system-and-communications-protection-policy-and-procedures-sc-1)

[4.4.2 Application Partitioning (SC-2)
96](#application-partitioning-sc-2)

[4.4.3 Information Remnance (SC-4) 96](#information-remnance-sc-4)

[4.4.4 Denial of Service Protection (SC-5)
96](#denial-of-service-protection-sc-5)

[4.4.5 Boundary Protection (SC-7) 97](#boundary-protection-sc-7)

[4.4.6 Transmission Integrity (SC-8) 99](#transmission-integrity-sc-8)

[4.4.7 Transmission Confidentiality (SC-9)
99](#transmission-confidentiality-sc-9)

[4.4.8 Network Disconnect (SC-10) 100](#network-disconnect-sc-10)

[4.4.9 Cryptographic Key Establishment and Management (SC-12)
100](#cryptographic-key-establishment-and-management-sc-12)

[4.4.10 Use of Cryptography (SC-13) 100](#use-of-cryptography-sc-13)

[4.4.11 Public Access Protections (SC-14)
101](#public-access-protections-sc-14)

[4.4.12 Collaborative Computing (SC-15)
101](#collaborative-computing-sc-15)

[4.4.13 Public Key Infrastructure Certificates (SC-17)
101](#public-key-infrastructure-certificates-sc-17)

[4.4.14 Mobile Code (SC-18) 102](#mobile-code-sc-18)

[4.4.15 Voice Over Internet Protocol (SC-19)
102](#voice-over-internet-protocol-sc-19)

[4.4.16 Secure Name/Address Resolution Service (Authoritative Source)
(SC-20)
103](#secure-nameaddress-resolution-service-authoritative-source-sc-20)

[4.4.17 Architecture and Provisioning for Name/Address Resolution
Service (SC-22)
103](#architecture-and-provisioning-for-nameaddress-resolution-service-sc-22)

[4.4.18 Session Authenticity (SC-23) 104](#session-authenticity-sc-23)

[5 Plan Approval 105](#system-security-plan-approval)

[Appendix A Acronyms A-1](#acronyms)

List of Tables

[Table 1‑1: System Name 1](#__RefHeading___Toc168748131)

[Table 1‑2: Responsible Organization for System Development and
Lifecycle Support 1](#__RefHeading___Toc168748132)

[Table 1‑3: Responsible Organization for Software Maintenance and Patch
Management 2](#__RefHeading___Toc168748133)

[Table 1‑4: System Owner 2](#__RefHeading___Toc168748134)

[Table 1‑5: Technical Information Point of Contact
3](#__RefHeading___Toc168748135)

[Table 1‑7: [\[SYSTEM ABBREVIATION\]]{.mark} Certification Agent
4](#__RefHeading___Toc168748137)

[Table 1‑8: [\[SYSTEM ABBREVIATION\]]{.mark} ITSO
4](#__RefHeading___Toc168748138)

[Table 1‑9: [\[SYSTEM ABBREVIATION\]]{.mark} ISSO
4](#__RefHeading___Toc168748139)

[Table 1‑10: Major Application Supported by [\[SYSTEM
ABBREVIATION\]]{.mark} 5](#__RefHeading___Toc168748140)

[Table 1‑11: Major Application Supported by [\[SYSTEM
ABBREVIATION\]]{.mark} 6](#__RefHeading___Toc168748141)

[Table 1‑12: Major Application Supported by [\[SYSTEM
ABBREVIATION\]]{.mark} 6](#__RefHeading___Toc168748142)

[Table 1‑13: Major Application Supported by [\[SYSTEM
ABBREVIATION\]]{.mark} 6](#__RefHeading___Toc168748143)

[Table 1‑14: System Hardware 7](#__RefHeading___Toc168748144)

[Table 1‑15: System Software 8](#__RefHeading___Toc168748145)

[Table 1‑16: System Firmware 9](#__RefHeading___Toc168748146)

[Table 1‑17: System Environment 11](#__RefHeading___Toc168748147)

[Table 1‑18: System Interconnections 12](#__RefHeading___Toc168748148)

[Table 1‑19: Ports, Protocols, and Services
13](#__RefHeading___Toc168748149)

[Table 1‑20: Information Type Processed by [\[SYSTEM
ABBREVIATION\]]{.mark} 15](#__RefHeading___Toc168748150)

[Table 1‑21: Information Type Processed by [\[SYSTEM
ABBREVIATION\]]{.mark} 16](#__RefHeading___Toc168748151)

[Table 1‑22: Information Type Processed by [\[SYSTEM
ABBREVIATION\]]{.mark} 16](#__RefHeading___Toc168748152)

[Table 1‑23: Security Impact 17](#__RefHeading___Toc168748153)

[Table 1‑24: Security Categorization 17](#__RefHeading___Toc168748154)

# System Identification

This System Security Plan (SSP) provides an overview of the security
requirements for [\[SYSTEM NAME\]]{.mark} (\[[SYSTEM
ABBREVIATION\]]{.mark}) and describes the controls in place or planned
for implementation to provide a level of security appropriate for the
information processed. Proper management of [\[Insert Agency
Name\]]{.mark} information technology systems is essential to ensure the
confidentiality, integrity and availability of the [\[SYSTEM
ABBREVIATION\]]{.mark} information.

Before accreditation can be granted to any system, a series of documents
must be developed in accordance with the system development life cycle
(SDLC) in order to satisfy the minimum-security requirements mandated by
the *Federal Information Security Management Act of 2002* (FISMA) and
[\[Insert Agency Name\]]{.mark}. The SSP includes user responsibilities,
roles and limitations, and general security procedures for users and
security personnel, as well as management, operational, and technical
controls.

The security safeguards for the system shall meet the policy
requirements set forth in this SSP and its implementation manual and/or
regulation. All systems are subject to monitoring consistent with
applicable laws, regulations, agency policies, procedures and practices.

## System Name/Title

Table 1‑1: System Name

  ---------------------- ------------------------------------------------
  FISMA Identification:  

  System Name:           [\[SYSTEM NAME\]]{.mark}

  System Abbreviation:   [\[SYSTEM ABBREVIATION\]]{.mark}
  ---------------------- ------------------------------------------------

## Responsible Organization

The following agency/organization is identified as the organization
responsible for the system development of [\[SYSTEM
ABBREVIATION]{.mark}\]. They are the functional proponent or advocate
for the system or application and the activity responsible for
identifying the funding for system development, deployment and
maintenance throughout the system's lifecycle.

Table 1‑2: Responsible Organization for System Development and Lifecycle
Support

  ------------------------------ ----------------------------------------
  Federal Organization Name:     

  Sub-component/Department Name: 

  Address 1:                     

  Address 2:                     

  City:                          

  State:                         

  ZIP:                           

  POC Title:                     

  POC Name:                      

  POC Phone Number:              

  POC E-Mail Address:            
  ------------------------------ ----------------------------------------

The following agency/organization is responsible for the software
maintenance or patch management of this system/application.

Table 1‑3: Responsible Organization for Software Maintenance and Patch
Management

  ------------------------------ ----------------------------------------
  Federal Organization Name:     

  Sub-component/Department Name: 

  Address 1:                     

  Address 2:                     

  City:                          

  State:                         

  ZIP:                           

  POC Title:                     

  POC Name:                      

  POC Phone Number:              

  POC E-Mail Address:            
  ------------------------------ ----------------------------------------

## Information Contacts

The following individual is identified as the system owner or functional
proponent/advocate for this system or application.

Table 1‑4: System Owner

  ------------------------------ ----------------------------------------
  Federal Organization Name:     

  Sub-component/Department Name: 

  Address 1:                     

  Address 2:                     

  City:                          

  State:                         

  ZIP:                           

  POC Title:                     

  POC Name:                      

  POC Phone Number:              

  POC E-Mail Address:            
  ------------------------------ ----------------------------------------

The following is an additional point of contact for this system that has
in-depth knowledge of this system or application functions.

Table 1‑5: Technical Information Point of Contact

  ------------------------------ ----------------------------------------
  Federal Organization Name:     

  Sub-component/Department Name: 

  Address 1:                     

  Address 2:                     

  City:                          

  State:                         

  ZIP:                           

  POC Title:                     

  POC Name:                      

  POC Phone Number:              

  POC E-Mail Address:            
  ------------------------------ ----------------------------------------

## Assignment of Security Responsibility

The following individual has been identified in writing as the
Authorizing Official (AO) for this information system or application.

Table 1‑6: [\[SYSTEM ABBREVIATION\]]{.mark} AO

  ------------------------------ ----------------------------------------
  Federal Organization Name:     

  Sub-component/Department Name: 

  Address 1:                     

  Address 2:                     

  City:                          

  State:                         

  ZIP:                           

  POC Title:                     

  POC Name:                      

  POC Phone Number:              

  POC E-Mail Address:            
  ------------------------------ ----------------------------------------

The following individual has been identified in writing as the
Certification Agent (CA) for this information system or application.

Table 1‑7: [\[SYSTEM ABBREVIATION\]]{.mark} Certification Agent

  ------------------------------ ----------------------------------------
  Federal Organization Name:     

  Sub-component/Department Name: 

  Address 1:                     

  Address 2:                     

  City:                          

  State:                         

  ZIP:                           

  POC Title:                     

  POC Name:                      

  POC Phone Number:              

  POC E-Mail Address:            
  ------------------------------ ----------------------------------------

The following individual has been identified in writing as the
Information Technology Security Officer (ITSO) for this information
system or application.

Table 1‑8: [\[SYSTEM ABBREVIATION\]]{.mark} ITSO

  ------------------------------ ----------------------------------------
  Federal Organization Name:     

  Sub-component/Department Name: 

  Address 1:                     

  Address 2:                     

  City:                          

  State:                         

  ZIP:                           

  POC Title:                     

  POC Name:                      

  POC Phone Number:              

  POC E-Mail Address:            
  ------------------------------ ----------------------------------------

The following individual has been identified in writing as the
Information System Security Officer (ISSO) for this information system
or application.

Table 1‑9: [\[SYSTEM ABBREVIATION\]]{.mark} ISSO

  ------------------------------ ----------------------------------------
  Federal Organization Name:     

  Sub-component/Department Name: 

  Address 1:                     

  Address 2:                     

  City:                          

  State:                         

  ZIP:                           

  POC Title:                     

  POC Name:                      

  POC Phone Number:              

  POC E-Mail Address:            
  ------------------------------ ----------------------------------------

## System Operational Status

The system is in the following life cycle status:

\[ \] **Operational** -- the system is operating.

\[ \] **Under development** -- the system is being designed, developed
or implemented.

\[ \] **Undergoing a major modification** -- the system is undergoing a
major conversion or transition.

## System Description [\<Pull from System Boundary\>]{.mark}

[\<*Insert **System Description** from **System Boundary Definition**
document*\>]{.mark}

The following section provides a general description of the [\[SYSTEM
ABBREVIATION\]]{.mark}, and identifies the system's purpose,
capabilities, users, and information data flow; discusses the hardware,
software and firmware implemented in support of [\[SYSTEM
ABBREVIATION\]]{.mark}.

### System Purpose

The purpose of this system is to [\[enter verbiage here\]]{.mark}.

The following tables identify the components supported by the system or
network.

Table 1‑10: Component Supported by [\[SYSTEM ABBREVIATION\]]{.mark}

  ----------------------------- -----------------------------------------
  Application Name:             

  Function:                     
  ----------------------------- -----------------------------------------

Table 1‑11: Component Supported by [\[SYSTEM ABBREVIATION\]]{.mark}

  ----------------------------- -----------------------------------------
  Application Name:             

  Function:                     
  ----------------------------- -----------------------------------------

Table 1‑12: Component Supported by [\[SYSTEM ABBREVIATION\]]{.mark}

  ----------------------------- -----------------------------------------
  Application Name:             

  Function:                     
  ----------------------------- -----------------------------------------

Table 1‑13: Component Supported by [\[SYSTEM ABBREVIATION\]]{.mark}

  ----------------------------- -----------------------------------------
  Application Name:             

  Function:                     
  ----------------------------- -----------------------------------------

###  {#section .unnumbered}

### Capabilities

-   [Describe the system's operating characteristics and operational
    capabilities.]{.mark}

-   [Identify any characteristics of the system that might influence the
    level of effort required for the Certification and Accreditation
    (C&A) process]{.mark}

### Information Flow

-   [Describe the processing flow of the application from system input
    to system output.]{.mark}

-   [Describe the system's internal interfaces and data flows, including
    the types of data and the general methods for data
    transmission.]{.mark}

-   [Describe the specific transmission media or interfaces to other
    systems. The description must include diagrams or text to explain
    the flow of critical information from one component to
    another.]{.mark}

-   [Describe the information inputs and outputs to the system. Include
    both electronic information and media.]{.mark}

### System Users

-   [Identify the class of individuals who use and support the
    information system (i.e., users, system administrators, network
    administrators, etc).]{.mark}

-   [Include their organizational affiliations, access rights,
    privileges, and citizenship, if applicable.]{.mark}

### Hardware Description

-   [Describe the target hardware and its function.]{.mark}

-   [Complete the table, or include an equipment list as an attachment.
    If an equipment list is attached reference the equipment list in the
    text block area.]{.mark}

-   [Identify the hardware that is on the Validated Products List (VPL)
    (<http://niap.nist.gov/cc-scheme/index.html>) or Evaluated Product
    List (EPL) (<http://www.radium.ncsc.mil/tpep/epl/>).]{.mark}

-   [If the development effort involves a change of existing hardware,
    identify the specific hardware components being changed.]{.mark}

[Error: Reference source not found]{.mark} lists the principal hardware
components for [\[SYSTEM ABBREVIATION\]]{.mark}.

Table 1‑14: System Hardware

  -----------------------------------------------------------------------
  System Component        Device Name             Hardware/Operating
                                                  System
  ----------------------- ----------------------- -----------------------
                                                  

                                                  

                                                  

                                                  

                                                  
  -----------------------------------------------------------------------

### Software Description

-   [Describe the operating system(s), database management system(s),
    and software applications and how they will be used.]{.mark}

-   [Complete the table, or include a software list as an attachment. If
    a software list is attached, reference the software list in the text
    block area.]{.mark}

-   [Include any security software protecting the system and
    information.]{.mark}

-   [Identify whether the software is Commercial off-the-Shelf (COTS),
    Government off-the-Shelf (GOTS), or custom-built software.]{.mark}

-   [Identify the software that is on the Validated Products List (VPL)
    (<http://niap.nist.gov/cc-scheme/index.html>) or Evaluated Product
    List (EPL) (<http://www.radium.ncsc.mil/tpep/epl/>).]{.mark}

-   [Include manufacturer-supplied software, other COTS, and all
    program-generated application software.]{.mark}

[Error: Reference source not found]{.mark} lists the principal software
components for [\[SYSTEM ABBREVIATION\]]{.mark}.

Table 1‑15: System Software

  -----------------------------------------------------------------------
  System Component                    Software Components
  ----------------------------------- -----------------------------------
                                      

                                      

                                      

                                      

                                      
  -----------------------------------------------------------------------

### Firmware Description

-   [Identify the firmware (software embedded in a hardware device) that
    allows reading and executing of the software, but not writing or
    modifying it. For example, firmware includes programmable read-only
    memory (PROM) and enhanced PROM (EPROM) devices.]{.mark}

-   [Examples of firmware include Cisco's Internetwork Operating Systems
    (IOSs), PCMCIA (Personal Computer Memory Card International
    Association) PC Cards, personal digital assistants (PDAs), Wireless
    Cards.]{.mark}

-   [State whether the firmware is a standard commercial product,
    unique, or on the VPL or EPL.]{.mark}

[Error: Reference source not found]{.mark} lists the principal firmware
components for [\[SYSTEM ABBREVIATION\]]{.mark}.

Table 1‑16: System Firmware

  -----------------------------------------------------------------------
  Hardware Device         Firmware                Remarks
  ----------------------- ----------------------- -----------------------
                                                  

                                                  

                                                  

                                                  

                                                  
  -----------------------------------------------------------------------

### Encryption/PKI

-   [Describe the encryption techniques used for information processing,
    transmission, and storage.]{.mark}

-   [Include public key infrastructures, certificate authorities, and
    certificate practice statements.]{.mark}

### Network Topology

[\[SYSTEM ABBREVIATION\]]{.mark} implements the following physical
network topology:

\[ \] **Bus Topology**

\[ \] **Mesh Topology**

\[ \] **Ring Topology**

\[ \] **Star Topology**

\[ \] **Tree Topology**

\[ \] **Hybrid Topology** -- [explain]{.mark}

\[ \] **Other** -- [explain]{.mark}

### Network Configuration

The following architectural drawings of [\[SYSTEM ABBREVIATION\]]{.mark}
provide a visual depiction of the major hardware components that
constitute \[[SYSTEM ABBREVIATION\]]{.mark}.

-   [Insert system drawing(s) that provide a visual indication of how
    the hardware comments are interconnected. This drawing should be at
    a level which gives the reader an understanding of data flow through
    the system or network. The drawing should not be a complex
    engineering drawing. The objective is to give the reader an
    understanding of data flow only. Drawings should identify the
    placement of firewalls, routers, processors, storage devices, and so
    on.]{.mark}

-   [Include the drawing in the SSP or attach it. If the drawing is to
    be an attachment to the SSP, reference the drawing and indicate that
    it is an attachment to this document.]{.mark}

-   [Describe the significant features of the communications layout,
    including a high-level diagram of the communications links and
    encryption techniques connecting the components of the system,
    associated data communications, and networks.]{.mark}

### Network Connection Rules

-   [Identify any network connection rules for communicating with
    external information systems (i.e., Internet).]{.mark}

### Accreditation Boundary

-   [Describe the boundary of the system. The description must include
    diagrams or text to clearly delineate which components are to be
    evaluated as part of the C&A task and which are not
    included.]{.mark}

-   [All included components must be described in the hardware/software
    description and described in the network configuration
    section.]{.mark}

-   [Elements outside the accreditation boundary must be included in the
    section on external interfaces.]{.mark}

## System Environment

-   [Provide a general description of the technical system. Include any
    environmental or technical factors that raise special security
    concerns (dial-up lines, open network, etc.).]{.mark}

-   [Describe the primary computing platform(s) used and a description
    of the principal system components, including hardware, software,
    and communications resources.]{.mark}

-   [Include any security software protecting the system and
    information.]{.mark}

[Error: Reference source not found]{.mark} lists the principal system
components that constitute the environment for [\[SYSTEM
ABBREVIATION\]]{.mark}.

Table 1‑17: System Environment

  ----------------------- ----------------------- -----------------------
  System Component        Asset Name              IP Address

                                                  

                                                  
  ----------------------- ----------------------- -----------------------

[]{.mark}

## System Interconnection/Information Sharing

-   [List of interconnected systems (including Internet) and unique
    FISMA system identifiers, if one has been assigned. If FISMA
    identifier has not been assigned place an N/A in the space provided
    for the FISMA identifier.]{.mark}

-   [Name of system(s) and organization owning the other
    system(s).]{.mark}

-   [Type of interconnection (TCP/IP, Dial, SNA, etc.).]{.mark}

-   [If connected to an external system not covered by a security plan,
    provide a short discussion of any security concerns that need to be
    considered for protection after the table.]{.mark}

-   [It is required that written authorization (Memorandums of
    Understanding \[MOUs\], Memorandums of Agreement \[MOAs\]) be
    obtained prior to connection with other systems and/or sharing
    sensitive data/information. It should detail the rules of behavior
    that must be maintained by the interconnecting systems. A
    description of these rules must be included with the security plan
    or discussed in this section.]{.mark}

-   [Short discussion of major concerns or considerations in determining
    interconnection.]{.mark}

-   [Name and title of authorizing management official(s).]{.mark}

-   [Date of authorization.]{.mark}

-   [System of Record, if applicable (Privacy Act data).]{.mark}

-   [Sensitivity level of each system.]{.mark}

-   [Interaction among systems.]{.mark}

-   [Security concerns and Rules of Behavior of the other systems that
    must be considered in the protection of this system.]{.mark}

[Error: Reference source not found]{.mark} lists the system
interconnections associated with [\[SYSTEM ABBREVIATION\]]{.mark}.

Table 1‑18: System Interconnections

  -------- -------------- -------- ----------- -------- ---------- -------- -------------
  AIS Name Organization   System   Agreement   Date     FIPS 199   C&A      Authorizing
                          Type     (ISA/MOU)            Category   Status   Official (AO)

                                                                            

                                                                            
  -------- -------------- -------- ----------- -------- ---------- -------- -------------

[]{.mark}

### Web Protocols

-   [Describe any use of web protocols.]{.mark}

-   [Describe any use of collaborative computing mechanisms.]{.mark}

### Mobile Code

Describe any use of mobile code (Java, JavaScript, and ActiveX) by the
application.

### Ports, Protocols and Services

-   [Identify the ports, protocols, and services used by the
    system.]{.mark}

-   [In the "Keyword" column, enter the description for the port or
    protocol, such as FTP, FTP-Data, or SMTP.]{.mark}

-   [In the "Decimal" column, enter the decimal port number and indicate
    if it is tcp or udp, such as 22/tcp, 22/udp, 25/tcp, or
    25/udp.]{.mark}

-   [In the "Description" column, provide a description of the port or
    service, such as File Transfer \[Default Data\], File Transfer
    \[Control\], or Simple Mail Transfer.]{.mark}

-   [In the "Used By" column, identify the system or application that
    uses the identified port, protocol, or service.]{.mark}

-   [Add additional rows as required to document all ports, protocols,
    and services used by the system.]{.mark}

[Error: Reference source not found]{.mark} lists the Ports, Protocols,
and Services enabled in this system or application.

Table 1‑19: Ports, Protocols, and Services

  ----------------- ----------------- ----------------- -----------------
  Keyword           Decimal           Description       Used by

                                                        

                                                        

                                                        

                                                        

                                                        
  ----------------- ----------------- ----------------- -----------------

## General Description of Information Sensitivity

The purpose of this section is to review the system's requirements
against the need for availability, integrity, and confidentiality. By
performing this analysis, the value of the system can be determined. The
value is one of the first major factors in risk management[.]{.mark}

### Information Types

The following tables identify the information types that are input,
stored, processed, and/or output from \[[SYSTEM ABBREVIATION\]]{.mark}.
The selection of the information types is based on guidance provided by
*NIST SP 800-60, Guide for Mapping Types of Information and Information
Systems to Security Categories*, *OMB Federal Enterprise Architecture
Program Management Office Business Reference Model 2.0*, and *FIPS Pub
199, Standards for Security Categorization of Federal Information and
Information Systems*.

*[The tables also identify the security impact levels for
confidentiality, integrity, and availability for each of the information
types expressed as low, moderate, or high. The security impact levels
are based on the potential impact definitions for each of the security
objectives (i.e., confidentiality, integrity, and availability)
discussed in NIST SP 800-60 and FIPS Pub 199]{.mark}*

*[\<PULL from FIPS 199 Security Categorization Workbook\>.]{.mark}*

Table 1‑20: Information Type Processed by [\[SYSTEM
ABBREVIATION\]]{.mark}

  ------------- ----------------- ----------- -------------- ---------------------------
  Information   Security                                     Rationale for Selecting
  Type Name     Objective                                    Security Categorization
                                                             Levels

                Confidentiality   Integrity   Availability   

  Info Type 1                                                \<[Provide a detailed
                                                             rationale]{.mark}\>

  Info Type 2                                                
  ------------- ----------------- ----------- -------------- ---------------------------

### Security Objectives Categorization (FIPS 199)

Based on the information provided in Section Error: Reference source not
found, Information Types, for [\[SYSTEM ABBREVIATION\]]{.mark} the
security impact level for each of the three security objectives of
confidentiality, integrity, and availability are identified in Error:
Reference source not found.

Table 1‑21: Security Impact

  -------------------------------- --------------------------------------
  Security Objective               Security Impact Level

  Confidentiality                  low/Moderate/High

  Integrity                        low/Moderate/High

  Availability                     low/Moderate/High
  -------------------------------- --------------------------------------

### System Categorization

Using the security controls for Confidentiality, Integrity and
Availability from *NIST 800-53, Recommended Security Controls for
Federal Information Systems*, in conjunction with [\[Agency\]]{.mark}
Policy. The [\[SYSTEM ABBREVIATION\]]{.mark} has been categorized as a
[\[Low/Moderate/High\]]{.mark} risk system.

Table 1‑22: Security Categorization

  ---------------------------------------------- ------------------------
  [\[SYSTEM ABBREVIATION\]]{.mark} Security      low/Moderate/High
  Categorization                                 

  ---------------------------------------------- ------------------------

Using this categorization, in conjunction with the risk assessment and
any unique security requirements, [\[Agency\]]{.mark} has established
the security controls for this system, as detailed in this SSP.

## E-Authentication Risk Assessment

The e-Authentication Guidance for Federal Agencies, the Office of
Management and Budget (OMB) memorandum M-04-04, "e-Authentication
Guidance for Federal Agencies," established the requirement that
agencies conduct an e-Authentication risk assessment on those systems
that remotely authenticate users over a network for purposes of
e-government and commerce.

[\[Use the following for applications requiring
e-Authentication:\]]{.mark}

[\[Insert Application Acronym]{.mark}\] has been identified as an
application that requires an e-Authentication risk assessment in
accordance with OMB Memo 04-04. [\[Insert Application Acronym\]]{.mark}
is operating under Assurance Level [\[Insert Assurance Level\].]{.mark}

**[Or]{.mark}**

[\[Use the following for applications NOT requiring
e-Authentication:\]]{.mark}

[\[Insert Application Acronym\]]{.mark} has been determined to be a
Federal System that does not require e-Authentication security controls
to be implemented due to the nature of the transactions processed on the
system.

## Applicable Laws/ Regulations Affecting the System

Following are the laws and regulations that affect the system:

-   *5 United States Code (U.S.C.) 552, Freedom of Information Act,
    1967*

-   *5 U.S.C. 552a, Privacy Act, 1974*

-   *18 U.S.C. 1030 (a) (3), Fraud and related activity in connection
    with computers*

-   *38 U.S.C. 218, Security and law enforcement on property under the
    jurisdiction of the Administration*

-   *38 U.S.C. 3301, Confidential Nature of Claims*

-   *Office of Management and Budget (OMB) Circular A-130, Appendix III,
    Security of Federal Automated Information Systems*

-   *Federal Information Processing Standards (FIPS) 199, Standards for
    Security Categorization of Federal Information and Information
    Systems*

-   *FIPS 200, Minimum Security Requirements for Federal Information and
    Information Systems*

-   *National Institute of Standards and Technology (NIST) Special
    Publication (SP) 800-18, Guide for Developing System Security Plans*

-   *NIST SP 800-27, Draft, Rev A, Engineering Principles for
    Information Technology Security (A Baseline for Achieving Security)*

-   *NIST SP 800-30, Draft, Rev A, Risk Management Guide for Information
    Technology Systems*

-   *NIST SP 800-34, Contingency Planning Guide for Information
    Technology Systems*

-   *NIST SP 800-37, Guide for the Security Certification and
    Accreditation of Federal Information Systems*

-   *NIST SP 800-42, Guideline on Network Security Testing*

-   *NIST SP 800-53, Recommended Security Controls for Federal
    Information Systems*

-   *NIST SP 800-53A, Draft, Techniques and Procedures for Verifying the
    Effectiveness of Security Controls in Federal Information Systems*

-   *NIST SP 800-60, Guide for Mapping Types of Information and
    Information Systems to Security Categories*

-   *NIST SP 800-61, Computer Security Incident Handling Guide*

-   *NIST SP 800-64, Security Considerations in the Information System
    Development Life Cycle*

-   *Public Law (PL) 99-474, The Computer Fraud and Abuse Act of 1986*

-   *PL 93-502 -- Freedom of Information Act 1974*

-   *Homeland Security Presidential Directive (HSPD-7), Critical
    Infrastructure Identification, Prioritization, and Protection*

-   *Federal Information Security Management Act of 2002*

[**Note**: Include more if applicable; include USPTO Security
Policy/Handbook, etc.]{.mark}

# Management Controls

The Management security controls[^1] section of this SSP identifies the
management safeguards and countermeasures in-place or planned for
[\[SYSTEM NAME\]]{.mark}. Management Controls are those safeguards and
countermeasures that focus on the management of risk and the management
of the information security system. They are actions that are performed
primarily to support information system security management decisions.

## Certification, Accreditation, and Security Assessments (CA)

### Certification, Accreditation, Security Assessment Policies and Procedures (CA-1)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The organization develops, disseminates, and periodically
reviews/updates: (i) formal, documented, security assessment and
certification and accreditation policies that address purpose, scope,
roles, responsibilities, management commitment, coordination among
organizational entities, and compliance; and (ii) formal, documented
procedures to facilitate the implementation of the security assessment
and certification and accreditation policies and associated assessment,
certification, and accreditation controls.*

*Supplemental Guidance: The security assessment and certification and
accreditation policies and procedures are consistent with applicable
laws, Executive Orders, directives, policies, regulations, standards,
and guidance. The security assessment and certification and
accreditation policies can be included as part of the general
information security policy for the organization. Security assessment
and certification and accreditation procedures can be developed for the
security program in general, and for a particular information system,
when required. The organization defines what constitutes a significant
change to the information system to achieve consistent security
reaccreditations. NIST Special Publication 800-53A provides guidance on
security control assessments. NIST Special Publication 800-37 provides
guidance on security certification and accreditation. NIST Special
Publication 800-12 provides guidance on security policies and
procedures.*

*Control Enhancements: None.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Security Assessments (CA-2)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The organization conducts an assessment of the security
controls in the information system \[Assignment: organization-defined
frequency, at least annually\] to determine the extent to which the
controls are implemented correctly, operating as intended, and producing
the desired outcome with respect to meeting the security requirements
for the system.*

*Supplemental Guidance: This control is intended to support the FISMA
requirement that the management, operational, and technical controls in
each information system contained in the inventory of major information
systems be assessed with a frequency depending on risk, but no less than
annually. The FISMA requirement for (at least) annual security control
assessments should not be interpreted by organizations as adding
additional assessment requirements to those requirements already in
place in the security certification and accreditation process. To
satisfy the annual FISMA assessment requirement, organizations can draw
upon the security control assessment results from any of the following
sources, including but not limited to: (i) security certifications
conducted as part of an information system accreditation or
reaccreditation process (see CA-4); (ii) continuous monitoring
activities (see CA-7); or (iii) testing and evaluation of the
information system as part of the ongoing system development life cycle
process (provided that the testing and evaluation results are current
and relevant to the determination of security control effectiveness).
Existing security assessment results are reused to the extent that they
are still valid and are supplemented with additional assessments as
needed. Reuse of assessment information is critical in achieving a
broad-based, cost-effective, and fully integrated security program
capable of producing the needed evidence to determine the actual
security status of the information system.*

*OMB does not require an annual assessment of all security controls
employed in an organizational information system. In accordance with OMB
policy, organizations must annually assess a subset of the security
controls based on: (i) the FIPS 199 security categorization of the
information system; (ii) the specific security controls selected and
employed by the organization to protect the information system; and
(iii) the level of assurance (or confidence) that the organization must
have in determining the effectiveness of the security controls in the
information system. It is expected that the organization will assess all
of the security controls in the information system during the three-year
accreditation cycle. The organization can use the current year's
assessment results obtained during security certification to meet the
annual FISMA assessment requirement (see CA-4). NIST SP 800-53A provides
guidance on security control assessments to include reuse of existing
assessment results. Related security controls: CA-4, CA-6, CA-7, SA-11.*

*Control Enhancements: None.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Information System Connections (CA-3)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The organization authorizes all connections from the
information system to other information systems outside of the
accreditation boundary through the use of system connection agreements
and monitors/controls the system connections on an ongoing basis.*

*Supplemental Guidance: Since FIPS 199 security categorizations apply to
individual information systems, the organization carefully considers the
risks that may be introduced when systems are connected to other
information systems with different security requirements and security
controls, both within the organization and external to the organization.
Risk considerations also include information systems sharing the same
networks. NIST SP 800-47 provides guidance on connecting information
systems. Related security controls: SC-7, SA-9.*

*Control Enhancements: None.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Security Certification (CA-4)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The organization conducts an assessment of the security
controls in the information system to determine the extent to which the
controls are implemented correctly, operating as intended, and producing
the desired outcome with respect to meeting the security requirements
for the system.*

*Supplemental Guidance: A security certification is conducted by the
organization in support of the OMB Circular A-130, Appendix III
requirement for accrediting the information system. The security
certification is a key factor in all security accreditation (i.e.,
authorization) decisions and is integrated into and spans the system
development life cycle. The organization assesses all security controls
in an information system during the initial security accreditation.
Subsequent to the initial accreditation and in accordance with OMB
policy, the organization assesses a subset of the controls annually
during continuous monitoring (see CA-7). The organization can use the
current year's assessment results obtained during security certification
to meet the annual FISMA assessment requirement (see CA-2). NIST SP
800-53A provides guidance on security control assessments. NIST SP
800-37 provides guidance on security certification and accreditation.
Related security controls: CA-2, CA-6, SA-11.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

*Control Enhancements:*

*(1) The organization employs an independent certification agent or
certification team to conduct an assessment of the security controls in
the information system.*

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Plan of Action and Milestones (CA-5)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The organization develops and updates \[Assignment:
organization-defined frequency\], a plan of action and milestones for
the information system that documents the organization's planned,
implemented, and evaluated remedial actions to correct deficiencies
noted during the assessment of the security controls and to reduce or
eliminate known vulnerabilities in the system.*

*Supplemental Guidance: The plan of action and milestones is a key
document in the security accreditation package developed for the
authorizing official and is subject to federal reporting requirements
established by OMB. The plan of action and milestones updates are based
on the findings from security control assessments, security impact
analyses, and continuous monitoring activities. OMB FISMA reporting
guidance contains instructions regarding organizational plans of action
and milestones. NIST SP 800-37 provides guidance on the security
certification and accreditation of information systems. NIST SP 800-30
provides guidance on risk mitigation.*

*Control Enhancements: None.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Security Accreditation (CA-6)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The organization authorizes (i.e., accredits) the information
system for processing before operations and updates the authorization
\[Assignment: organization-defined frequency, at least every three
years\] or when there is a significant change to the system. A senior
organizational official signs and approves the security accreditation.*

*Supplemental Guidance: OMB Circular A-130, Appendix III, establishes
policy for security accreditations of federal information systems. The
organization assesses the security controls employed within the
information system before and in support of the security accreditation.
Security assessments conducted in support of security accreditations are
called security certifications. The security accreditation of an
information system is not a static process. Through the employment of a
comprehensive continuous monitoring process (the fourth and final phase
of the certification and accreditation process), the critical
information contained in the accreditation package (i.e., the system
security plan, the security assessment report, and the plan of action
and milestones) is updated on an ongoing basis providing the authorizing
official and the information system owner with an up-to-date status of
the security state of the information system. To reduce the
administrative burden of the three-year reaccreditation process, the
authorizing official uses the results of the ongoing continuous
monitoring process to the maximum extent possible as the basis for
rendering a reaccreditation decision. NIST SP 800-37 provides guidance
on the security certification and accreditation of information systems.
Related security controls: CA-2, CA-4, CA-7.*

*Control Enhancements: None.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Continuous Monitoring (CA-7)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The organization monitors the security controls in the
information system on an ongoing basis.*

*Supplemental Guidance: Continuous monitoring activities include
configuration management and control of information system components,
security impact analyses of changes to the system, ongoing assessment of
security controls, and status reporting. The organization assesses all
security controls in an information system during the initial security
accreditation. Subsequent to the initial accreditation and in accordance
with OMB policy, the organization assesses a subset of the controls
annually during continuous monitoring. The selection of an appropriate
subset of security controls is based on: (i) the FIPS 199 security
categorization of the information system; (ii) the specific security
controls selected and employed by the organization to protect the
information system; and (iii) the level of assurance (or grounds for
confidence) that the organization must have in determining the
effectiveness of the security controls in the information system. The
organization establishes the selection criteria and subsequently selects
a subset of the security controls employed within the information system
for assessment. The organization also establishes the schedule for
control monitoring to ensure adequate coverage is achieved. Those
security controls that are volatile or critical to protecting the
information system are assessed at least annually. All other controls
are assessed at least once during the information system's three-year
accreditation cycle. The organization can use the current year's
assessment results obtained during continuous monitoring to meet the
annual FISMA assessment requirement (see CA-2).*

*This control is closely related to and mutually supportive of the
activities required in monitoring configuration changes to the
information system. An effective continuous monitoring program results
in ongoing updates to the information system security plan, the security
assessment report, and the plan of action and milestones---the three
principle documents in the security accreditation package. A rigorous
and well executed continuous monitoring process significantly reduces
the level of effort required for the reaccreditation of the information
system. NIST Special Publication 800-37 provides guidance on the
continuous monitoring process. NIST Special Publication 800-53A provides
guidance on the assessment of security controls. Related security
controls: CA-2, CA-4, CA-5, CA-6, CM-4.*

*Control Enhancements: None.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

## Planning (PL)

### Security Planning Policy and Procedures (PL-1)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The organization develops, disseminates, and periodically
reviews/updates: (i) a formal, documented, security planning policy that
addresses purpose, scope, roles, responsibilities, management
commitment, coordination among organizational entities, and compliance;
and (ii) formal, documented procedures to facilitate the implementation
of the security planning policy and associated security planning
controls.*

*Supplemental Guidance: The security planning policy and procedures are
consistent with applicable laws, Executive Orders, directives, policies,
regulations, standards, and guidance. The security planning policy
addresses the overall policy requirements for confidentiality,
integrity, and availability and can be included as part of the general
information security policy for the organization. Security planning
procedures can be developed for the security program in general, and for
a particular information system, when required. NIST Special Publication
800-18 provides guidance on security planning. NIST Special Publication
800-12 provides guidance on security policies and procedures.*

*Control Enhancements: None*.

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### System Security Plan (PL-2)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The organization develops and implements a security plan for
the information system that provides an overview of the security
requirements for the system and a description of the security controls
in place or planned for meeting those requirements. Designated officials
within the organization review and approve the plan.*

*Supplemental Guidance: The security plan is aligned with the
organization's information system architecture and information security
architecture. NIST SP 800-18 provides guidance on security planning.*

*Control Enhancements: None.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### System Security Plan Update (PL-3)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The organization reviews the security plan for the information
system \[Assignment: organization-defined frequency, at least annually\]
and revises the plan to address system/organizational changes or
problems identified during plan implementation or security control
assessments.*

*Supplemental Guidance: Significant changes are defined in advance by
the organization and identified in the configuration management process.
NIST SP 800-18 provides guidance on security plan updates.*

*Control Enhancements: None.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Rules of Behavior (PL-4)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The organization establishes and makes readily available to
all information system users a set of rules that describes their
responsibilities and expected behavior with regard to information and
information system usage. The organization receives signed
acknowledgement from users indicating that they have read, understand,
and agree to abide by the rules of behavior, before authorizing access
to the information system and its resident information.*

*Supplemental Guidance: Electronic signatures are acceptable for use in
acknowledging rules of behavior unless specifically prohibited by
organizational policy. NIST Special Publication 800-18 provides guidance
on preparing rules of behavior.*

*Control Enhancements: None.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Privacy Impact Assessment (PL-5)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The organization conducts a privacy impact assessment on the
information system in accordance with OMB policy.*

*Supplemental Guidance: OMB Memorandum 03-22 provides guidance for
implementing the privacy provisions of the E-Government Act of 2002.
Only those information systems identified and/or covered by OMB policy
are required to have privacy impact assessments. NIST SP 800-53 provides
tailoring guidance for security control baselines to ensure that the
employment of specific security controls is consistent with applicable
federal laws, directives, policies, regulations, standards, and
guidance.*

*Control Enhancements: None.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Security-Related Activity Planning (PL-6)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The organization plans and coordinates security-related
activities affecting the information system before conducting such
activities in order to reduce the impact on organizational operations
(i.e., mission, functions, image and reputation), organization assets
and individuals.*

*Supplemental Guidance: Routine security-related activities include, but
are not limited to, security assessments, audits, system hardware and
software maintenance, security certifications, and testing/exercises.
Organizational advance planning and coordination includes both emergency
and non-emergency (i.e., routine) situations.*

*Control Enhancements: None.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

## Risk Assessment (RA)

### Risk Assessment Policy and Procedures (RA-1)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

[]{.mark}

*Control: The organization develops, disseminates, and periodically
reviews/updates: (i) a formal, documented risk assessment policy that
addresses purpose, scope, roles, responsibilities, management
commitment, coordination among organizational entities, and compliance;
and (ii) formal, documented procedures to facilitate the implementation
of the risk assessment policy and associated risk assessment controls.*

*Supplemental Guidance: The risk assessment policy and procedures are
consistent with applicable laws, Executive Orders, directives, policies,
regulations, standards, and guidance. The risk assessment policy can be
included as part of the general information security policy for the
organization. Risk assessment procedures can be developed for the
security program in general, and for a particular information system,
when required. NIST Special Publications 800-30 provides guidance on the
assessment of risk. NIST Special Publication 800-12 provides guidance on
security policies and procedures.*

*Control Enhancements: None.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Security Categorization (RA-2)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The organization categorizes the information system and the
information processed, stored, or transmitted by the system in
accordance with applicable federal laws, Executive Orders, directives,
policies, regulations, standards, and guidance and documents the results
(including supporting rationale) in the system security plan. Designated
senior-level officials within the organization review and approve the
security categorizations.*

*Supplemental Guidance: The applicable federal policy for security
categorization of nonnational security information and information
systems is FIPS 199. The organization conducts FIPS 199 security
categorizations as an organization-wide activity with the involvement of
the chief information officer, senior agency information security
officer, information system owners, and information owners. The
organization also considers potential impacts to other organizations
and, in accordance with the USA PATRIOT Act of 2001 and Homeland
Security Presidential Directives, potential national-level impacts in
categorizing the information system. As part of a defense-in-depth
protection strategy, the organization considers partitioning
higher-impact information systems into separate physical domains (or
environments) and restricting or prohibiting network access in
accordance with an organizational assessment of risk. NIST SP 800-60
provides guidance on determining the security categories of the
information types resident on the information system. Related security
controls: MP-4, SC-7.*

*Control Enhancements: None.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Risk Assessment (RA-3)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The organization conducts assessments of the risk and
magnitude of harm that could result from the unauthorized access, use,
disclosure, disruption, modification, or destruction of information and
information systems that support the operations and assets of the agency
(including information and information systems managed/operated by
external parties).*

*Supplemental Guidance: Risk assessments take into account
vulnerabilities, threat sources, and security controls planned or in
place to determine the resulting level of residual risk posed to
organizational operations, organizational assets, or individuals based
on the operation of the information system. The organization also
considers potential impacts to other organizations and, in accordance
with the USA PATRIOT Act and Homeland Security Presidential Directives,
potential national-level impacts in categorizing the information system.
Risk assessments also take into account risk posed to organizational
operations, organizational assets, or individuals from external parties
(e.g., service providers, contractors operating information systems on
behalf of the organization, individuals accessing organizational
information systems, outsourcing entities). In accordance with OMB
policy and related E-authentication initiatives, authentication of
public users accessing federal information systems may also be required
to protect nonpublic or privacy-related information. As such,
organizational assessments of risk also address public access to federal
information systems. The General Services Administration provides tools
supporting that portion of the risk assessment dealing with public
access to federal information systems. NIST SP 800-30 provides guidance
on conducting risk assessments including threat, vulnerability, and
impact assessments.*

*Control Enhancements: None.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Risk Assessment Update (RA-4)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The organization updates the risk assessment \[Assignment:
organization-defined frequency\] or whenever there are significant
changes to the information system, the facilities where the system
resides, or other conditions that may impact the security or
accreditation status of the system.*

*Supplemental Guidance: The organization develops and documents specific
criteria for what is considered significant change to the information
system. NIST SP 800-30 provides guidance on conducting risk assessment
updates.*

*Control Enhancements: None.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Vulnerability Scanning (RA-5)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The organization scans for vulnerabilities in the information
system \[Assignment: organization-defined frequency\] or when
significant new vulnerabilities potentially affecting the system are
identified and reported.*

*Supplemental Guidance: Vulnerability scanning is conducted using
appropriate scanning tools and techniques. The organization trains
selected personnel in the use and maintenance of vulnerability scanning
tools and techniques. Vulnerability scans are scheduled and/or random in
accordance with organizational policy and assessment of risk. The
information obtained from the vulnerability scanning process is freely
shared with appropriate personnel throughout the organization to help
eliminate similar vulnerabilities in other information systems.
Vulnerability analysis for custom software and applications may require
additional, more specialized approaches (e.g., vulnerability scanning
tools for applications, source code reviews, static analysis of source
code). NIST Special Publication 800-42 provides guidance on network
security testing. NIST Special Publication 800-40 (Version 2) provides
guidance on patch and vulnerability management.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

## System and Services Acquisition (SA)

### [System and Services Acquisition Policy and Procedures (SA-1)]{.mark} 

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The organization develops, disseminates, and periodically
reviews/updates: (i) a formal, documented, system and services
acquisition policy that includes information security considerations and
that addresses purpose, scope, roles, responsibilities, management
commitment, coordination among organizational entities, and compliance;
and (ii) formal, documented procedures to facilitate the implementation
of the system and services acquisition policy and associated system and
services acquisition controls.*

*Supplemental Guidance: The system and services acquisition policy and
procedures are consistent with applicable laws, Executive Orders,
directives, policies, regulations, standards, and guidance. The system
and services acquisition policy can be included as part of the general
information security policy for the organization. System and services
acquisition procedures can be developed for the security program in
general, and for a particular information system, when required. NIST
Special Publication 800-12 provides guidance on security policies and
procedures.*

*Control Enhancements: None.*

**Implementation**: [As applicable, describe how the control is
implemented within the system]{.mark}

### Allocation of Resources (SA-2)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The organization determines, documents, and allocates as part
of its capital planning and investment control process, the resources
required to adequately protect the information system.*

*Supplemental Guidance: The organization includes the determination of
security requirements for the information system in mission/business
case planning and establishes a discrete line item for information
system security in the organization's programming and budgeting
documentation. NIST Special Publication 800-65 provides guidance on
integrating security into the capital planning and investment control
process.*

*Control Enhancements: None.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Life Cycle Support (SA-3)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The organization manages the information system using a system
development life cycle methodology that includes information security
considerations.*

*Supplemental Guidance: NIST Special Publication 800-64 provides
guidance on security considerations in the system development life
cycle.*

*Control Enhancements: None*.

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Acquisitions (SA-4)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The organization includes security requirements and/or
security specifications, either explicitly or by reference, in
information system acquisition contracts based on an assessment of risk
and in accordance with applicable laws, Executive Orders, directives,
policies, regulations, and standards.*

*Supplemental Guidance:*

*Solicitation Documents*

*The solicitation documents (e.g., Requests for Proposals) for
information systems and services include, either explicitly or by
reference, security requirements that describe: (i) required security
capabilities (security needs and, as necessary, specific security
controls and other specific FISMA requirements); (ii) required design
and development processes; (iii) required test and evaluation
procedures; and (iv) required documentation. The requirements in the
solicitation documents permit updating security controls as new
threats/vulnerabilities are identified and as new technologies are
implemented. NIST Special Publication 800-36 provides guidance on the
selection of information security products. NIST Special Publication
800-35 provides guidance on information technology security services.
NIST Special Publication 800-64 provides guidance on security
considerations in the system development life cycle.*

*Information System Documentation*

*The solicitation documents include requirements for appropriate
information system documentation. The documentation addresses user and
systems administrator guidance and information regarding the
implementation of the security controls in the information system. The
level of detail required in the documentation is based on the FIPS 199
security category for the information system.*

*Use of Tested, Evaluated, and Validated Products*

*NIST Special Publication 800-23 provides guidance on the acquisition
and use of tested/evaluated information technology products.*

*Configuration Settings and Implementation Guidance*

*The information system required documentation includes security
configuration settings and security implementation guidance. OMB FISMA
reporting instructions provide guidance on configuration requirements
for federal information systems. NIST Special Publication 800-70
provides guidance on configuration settings for information technology
products.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

*Control Enhancements:*

*(1) The organization requires in solicitation documents that
appropriate documentation be provided describing the functional
properties of the security controls employed within the information
system with sufficient detail to permit analysis and testing of the
controls.*

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Information System Documentation (SA-5)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The organization obtains, protects as required, and makes
available to authorized personnel, adequate documentation for the
information system.*

*Supplemental Guidance: Documentation includes administrator and user
guides with information on: (i) configuring, installing, and operating
the information system; and (ii) effectively using the system's security
features. When adequate information system documentation is either
unavailable or non existent (e.g., due to the age of the system or lack
of support from the vendor/manufacturer), the organization documents
attempts to obtain such documentation and provides compensating security
controls, if needed*.

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

*Control Enhancements:*

*(1) The organization includes, in addition to administrator and user
guides, documentation, if available from the vendor/manufacturer,
describing the functional properties of the security controls employed
within the information system with sufficient detail to permit analysis
and testing of the controls.*

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Software Usage Restrictions (SA-6)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The organization complies with software usage restrictions.*

*Supplemental Guidance: Software and associated documentation are used
in accordance with contract agreements and copyright laws. For software
and associated documentation protected by quantity licenses, the
organization employs tracking systems to control copying and
distribution. The organization controls and documents the use of
publicly accessible peer-to-peer file sharing technology to ensure that
this capability is not used for the unauthorized distribution, display,
performance, or reproduction of copyrighted work.*

*Control Enhancements: None.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### User Installed Software (SA-7)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The organization enforces explicit rules governing the
installation of software by users.*

*Supplemental Guidance: If provided the necessary privileges, users have
the ability to install software. The organization identifies what types
of software installations are permitted (e.g., updates and security
patches to existing software) and what types of installations are
prohibited (e.g., software that is free only for personal, not
government use, and software whose pedigree with regard to being
potentially malicious is unknown or suspect).*

*Control Enhancements: None.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Security Engineering Principles (SA-8)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The organization designs and implements the information system
using security engineering principles.*

*Supplemental Guidance: NIST Special Publication 800-27 provides
guidance on engineering principles for information system security. The
application of security engineering principles is primarily targeted at
new development information systems or systems undergoing major upgrades
and is integrated into the system development life cycle. For legacy
information systems, the organization applies security engineering
principles to system upgrades and modifications, to the extent feasible,
given the current state of the hardware, software, and firmware
components within the system.*

*Control Enhancements: None.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### External Information System Services (SA-9)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The organization: (i) requires that providers of external
information system services employ adequate security controls in
accordance with applicable laws, Executive Orders, directives, policies,
regulations, standards, guidance, and established service-level
agreements; and (ii) monitors security control compliance.*

*Supplemental Guidance: An external information system service is a
service that is implemented outside of the accreditation boundary of the
organizational information system (i.e., a service that is used by, but
not a part of, the organizational information system). Relationships
with external service providers are established in a variety of ways,
for example, through joint ventures, business partnerships, outsourcing
arrangements (i.e., through contracts, interagency agreements, lines of
business arrangements), licensing agreements, and/or supply chain
exchanges. Ultimately, the responsibility for adequately mitigating
risks to the organization's operations and assets, and to individuals,
arising from the use of external information system services remains
with the authorizing official. Authorizing officials must require that
an appropriate chain of trust be established with external service
providers when dealing with the many issues associated with information
system security. For services external to the organization, a chain of
trust requires that the organization establish and retain a level of
confidence that each participating service provider in the potentially
complex consumer-provider relationship provides adequate protection for
the services rendered to the organization. Where a sufficient level of
trust cannot be established in the external services and/or service
providers, the organization employs compensating security controls or
accepts the greater degree of risk to its operations and assets, or to
individuals. The external information system services documentation
includes government, service provider, and end user security roles and
responsibilities, and any service-level agreements. Service-level
agreements define the expectations of performance for each required
security control, describe measurable outcomes, and identify remedies
and response requirements for any identified instance of non-compliance.
NIST SP 800-35 provides guidance on information technology security
services. NIST SP 800-64 provides guidance on the security
considerations in the system development life cycle.*

*Control Enhancements: None.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Developer Security Testing (SA-11)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The organization requires that information system developers
create a security test and evaluation plan, implement the plan, and
document the results.*

*Supplemental Guidance: Developmental security test results are used to
the greatest extent feasible after verification of the results and
recognizing that these results are impacted whenever there have been
security relevant modifications to the information system subsequent to
developer testing. Test results may be used in support of the security
certification and accreditation process for the delivered information
system. Related security controls: CA-2, CA-4.*

*Control Enhancements: None.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

# Operational Controls

The Operational security controls section of this SSP identifies the
operational safeguards and countermeasures in-place or planned for
[\[SYSTEM NAME\]]{.mark}. Operational Controls are those safeguards and
countermeasures that are primarily implemented and executed by people as
opposed to systems and technology.

## Awareness and Training (AT)

### Security Awareness and Training Policy and Procedures (AT-1)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

Control: The organization develops, disseminates, and periodically
reviews/updates: (i) a formal, documented, security awareness and
training policy that addresses purpose, scope, roles, responsibilities,
management commitment, coordination among organizational entities, and
compliance; and (ii) formal, documented procedures to facilitate the
implementation of the security awareness and training policy and
associated security awareness and training controls.

*Supplemental Guidance: The security awareness and training policy and
procedures are consistent with applicable laws, Executive Orders,
directives, policies, regulations, standards, and guidance. The security
awareness and training policy can be included as part of the general
information security policy for the organization. Security awareness and
training procedures can be developed for the security program in
general, and for a particular information system, when required. NIST
Special Publications 800-16 and 800-50 provide guidance on security
awareness and training. NIST Special Publication 800-12 provides
guidance on security policies and procedures.*

*Control Enhancements: None.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Security Awareness (AT-2)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

Control: The organization provides basic security awareness training to
all information system users (including managers and senior executives)
before authorizing access to the system, when required by system
changes, and \[Assignment: organization-defined frequency, at least
annually\] thereafter.

*Supplemental Guidance: The organization determines the appropriate
content of security awareness training based on the specific
requirements of the organization and the information systems to which
personnel have authorized access. The organization's security awareness
program is consistent with the requirements contained in C.F.R. Part 5
Subpart C (5 C.F.R 930.301) and with the guidance in NIST Special
Publication 800-50.*

*Control Enhancements: None.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Security Training (AT-3)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

Control: The organization identifies personnel that have significant
information system security roles and responsibilities during the system
development life cycle, documents those roles and responsibilities, and
provides appropriate information system security training: (i) before
authorizing access to the system or performing assigned duties; (ii)
when required by system changes; and (iii) \[Assignment:
organization-defined frequency\] thereafter.

*Supplemental Guidance: The organization determines the appropriate
content of security training based on the specific requirements of the
organization and the information systems to which personnel have
authorized access. In addition, the organization provides system
managers, system and network administrators, and other personnel having
access to system-level software, adequate technical training to perform
their assigned duties. The organization's security training program is
consistent with the requirements contained in C.F.R. Part 5 Subpart C (5
C.F.R 930.301) and with the guidance in NIST Special Publication
800-50.*

*Control Enhancements: None.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Security Training Records (AT-4)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

Control: The organization documents and monitors individual information
system security training activities including basic security awareness
training and specific information system security training.

*Supplemental Guidance: None.*

*Control Enhancements: None.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

## Configuration Management (CM)

### Configuration Management Policy and Procedures (CM-1)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The organization develops, disseminates, and periodically
reviews/updates: (i) a formal, documented, configuration management
policy that addresses purpose, scope, roles, responsibilities,
management commitment, coordination among organizational entities, and
compliance; and (ii) formal, documented procedures to facilitate the
implementation of the configuration management policy and associated
configuration management controls.*

*Supplemental Guidance: The configuration management policy and
procedures are consistent with applicable laws, Executive Orders,
directives, policies, regulations, standards, and guidance. The
configuration management policy can be included as part of the general
information security policy for the organization. Configuration
management procedures can be developed for the security program in
general, and for a particular information system, when required. NIST
Special Publication 800-12 provides guidance on security policies and
procedures.*

*Control Enhancements: None.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Baseline Configuration (CM-2)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The organization develops, documents, and maintains a current
baseline configuration of the information system.*

*Supplemental Guidance: This control establishes a baseline
configuration for the information system. The baseline configuration
provides information about a particular component's makeup (e.g., the
standard software load for a workstation or notebook computer including
updated patch information) and the component's logical placement within
the information system architecture. The baseline configuration also
provides the organization with a well-defined and documented
specification to which the information system is built and deviations,
if required, are documented in support of mission needs/objectives. The
baseline configuration of the information system is consistent with the
Federal Enterprise Architecture. Related security controls: CM-6, CM-8.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

*Control Enhancements:*

*(1) The organization updates the baseline configuration of the
information system as an integral part of information system component
installations.*

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Configuration Change Control (CM-3)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The organization authorizes, documents, and controls changes
to the information system.*

*Supplemental Guidance: The organization manages configuration changes
to the information system using an organizationally approved process
(e.g., a chartered Configuration Control Board). Configuration change
control involves the systematic proposal, justification, implementation,
test/evaluation, review, and disposition of changes to the information
system, including upgrades and modifications. Configuration change
control includes changes to the configuration settings for information
technology products (e.g., operating systems, firewalls, routers). The
organization includes emergency changes in the configuration change
control process, including changes resulting from the remediation of
flaws. The approvals to implement a change to the information system
include successful results from the security analysis of the change. The
organization audits activities associated with configuration changes to
the information system. Related security controls: CM-4, CM-6, SI-2.*

*Control Enhancements: None.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Monitoring Configuration Changes (CM-4)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The organization monitors changes to the information system
conducting security impact analyses to determine the effects of the
changes.*

*Supplemental Guidance: Prior to change implementation, and as part of
the change approval process, the organization analyzes changes to the
information system for potential security impacts. After the information
system is changed (including upgrades and modifications), the
organization checks the security features to verify that the features
are still functioning properly. The organization audits activities
associated with configuration changes to the information system.
Monitoring configuration changes and conducting security impact analyses
are important elements with regard to the ongoing assessment of security
controls in the information system. Related security control: CA-7.*

*Control Enhancements: None.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Access Restrictions for Change (CM-5)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The organization: (i) approves individual access privileges
and enforces physical and logical access restrictions associated with
changes to the information system; and (ii) generates, retains, and
reviews records reflecting all such changes.*

*Supplemental Guidance: Planned or unplanned changes to the hardware,
software, and/or firmware components of the information system can have
significant effects on the overall security of the system. Accordingly,
only qualified and authorized individuals obtain access to information
system components for purposes of initiating changes, including
upgrades, and modifications.*

*Control Enhancements: None.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Configuration Settings (CM-6)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The organization: (i) establishes mandatory configuration
settings for information technology products employed within the
information system; (ii) configures the security settings of information
technology products to the most restrictive mode consistent with
operational requirements; (iii) documents the configuration settings;
and (iv) enforces the configuration settings in all components of the
information system.*

*Supplemental Guidance: Configuration settings are the configurable
parameters of the information technology products that compose the
information system. Organizations monitor and control changes to the
configuration settings in accordance with organizational policies and
procedures. OMB FISMA reporting instructions provide guidance on
configuration requirements for federal information systems. NIST Special
Publication 800-70 provides guidance on producing and using
configuration settings for information technology products employed in
organizational information systems. Related security controls: CM-2,
CM-3, SI-4.*

*Control Enhancements: None.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Least Functionality (CM-7)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The organization configures the information system to provide
only essential capabilities and specifically prohibits and/or restricts
the use of the following functions, ports, protocols, and/or services:
\[Assignment: organization-defined list of prohibited and/or restricted
functions, ports, protocols, and/or services\].*

*Supplemental Guidance: Information systems are capable of providing a
wide variety of functions and services. Some of the functions and
services, provided by default, may not be necessary to support essential
organizational operations (e.g., key missions, functions). Additionally,
it is sometimes convenient to provide multiple services from a single
component of an information system, but doing so increases risk over
limiting the services provided by any one component. Where feasible, the
organization limits component functionality to a single function per
device (e.g., email server or web server, not both). The functions and
services provided by information systems, or individual components of
information systems, are carefully reviewed to determine which functions
and services are candidates for elimination (e.g., Voice Over Internet
Protocol, Instant Messaging, File Transfer Protocol, Hyper Text Transfer
Protocol, file sharing).*

*Control Enhancements: None.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Information System Component Inventory (CM-8)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The organization develops, documents, and maintains a current
inventory of the components of the information system and relevant
ownership information.*

*Supplemental Guidance: The organization determines the appropriate
level of granularity for the information system components included in
the inventory that are subject to management control (i.e., tracking,
and reporting). The inventory of information system components includes
any information determined to be necessary by the organization to
achieve effective property accountability (e.g., manufacturer, model
number, serial number, software license information, system/component
owner). The component inventory is consistent with the accreditation
boundary of the information system. Related security controls: CM-2,
CM-6.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

*Control Enhancements:*

*(1) The organization updates the inventory of information system
components as an integral part of component installations.*

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

## Contingency Planning (CP)

### Contingency Planning Policy and Procedures (CP-1)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The organization develops, disseminates, and periodically
reviews/updates: (i) a formal, documented, contingency planning policy
that addresses purpose, scope, roles, responsibilities, management
commitment, coordination among organizational entities, and compliance;
and (ii) formal, documented procedures to facilitate the implementation
of the contingency planning policy and associated contingency planning
controls.*

*Supplemental Guidance: The contingency planning policy and procedures
are consistent with applicable federal laws, directives, policies,
regulations, standards, and guidance. The contingency planning policy
can be included as part of the general information security policy for
the organization. Contingency planning procedures can be developed for
the security program in general, and for a particular information
system, when required. NIST SP 800-34 provides guidance on contingency
planning. NIST SP 800-12 provides guidance on security policies and
procedures.*

*Control Enhancements: None.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Contingency Plan (CP-2)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The organization develops and implements a contingency plan
for the information system addressing contingency roles,
responsibilities, assigned individuals with contact information, and
activities associated with restoring the system after a disruption or
failure. Designated officials within the organization review and approve
the contingency plan and distribute copies of the plan to key
contingency personnel.*

*Supplemental Guidance: None.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

*Control Enhancements:*

*(1) The organization coordinates contingency plan development with
organizational elements responsible for related plans.*

*Enhancement Supplemental Guidance: Examples of related plans include
Business Continuity Plan, Disaster Recovery Plan, Continuity of
Operations Plan, Business Recovery Plan, Incident Response Plan, and
Emergency Action Plan.*

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Contingency Training (CP-3)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The organization trains personnel in their contingency roles
and responsibilities with respect to the information system and provides
refresher training \[Assignment: organization-defined frequency, at
least annually\].*

*Supplemental Guidance: None.*

*Control Enhancements: None.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Contingency Plan Testing and Exercises (CP-4)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The organization: (i) tests and/or exercises the contingency
plan for the information system \[Assignment: organization-defined
frequency, at least annually\] using \[Assignment: organization-defined
tests and/or exercises\] to determine the plan's effectiveness and the
organization's readiness to execute the plan; and (ii) reviews the
contingency plan test/exercise results and initiates corrective
actions.*

*Supplemental Guidance: There are several methods for testing and/or
exercising contingency plans to identify potential weaknesses (e.g.,
full-scale contingency plan testing, functional/tabletop exercises). The
depth and rigor of contingency plan testing and/or exercises increases
with the FIPS 199 impact level of the information system. Contingency
plan testing and/or exercises also include a determination of the
effects on organizational operations and assets (e.g., reduction in
mission capability) and individuals arising due to contingency
operations in accordance with the plan. NIST SP 800-84 provides guidance
on test, training, and exercise programs for information technology
plans and capabilities.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

*Control Enhancements:*

*(1) The organization coordinates contingency plan testing and/or
exercises with organizational elements responsible for related plans.*

*Enhancement Supplemental Guidance: Examples of related plans include
Business Continuity Plan, Disaster Recovery Plan, Continuity of
Operations Plan, Business Recovery Plan, Incident Response Plan, and
Emergency Action Plan.*

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Contingency Plan Update (CP-5)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The organization reviews the contingency plan for the
information system \[Assignment: organization-defined frequency, at
least annually\] and revises the plan to address system/organizational
changes or problems encountered during plan implementation, execution,
or testing.*

*Supplemental Guidance: Organizational changes include changes in
mission, functions, or business processes supported by the information
system. The organization communicates changes to appropriate
organizational elements responsible for related plans (e.g., Business
Continuity Plan, Disaster Recovery Plan, Continuity of Operations Plan,
Business Recovery Plan, Incident Response Plan, Emergency Action Plan).*

*Control Enhancements: None.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Alternate Storage Site (CP-6)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The organization identifies an alternate storage site and
initiates necessary agreements to permit the storage of information
system backup information.*

*Supplemental Guidance: The frequency of information system backups and
the transfer rate of backup information to the alternate storage site
(if so designated) are consistent with the organization's recovery time
objectives and recovery point objectives.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

*Control Enhancements:*

*(1) The organization identifies an alternate storage site that is
geographically separated from the primary storage site so as not to be
susceptible to the same hazards.*

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

*(3) The organization identifies potential accessibility problems to the
alternate storage site in the event of an area-wide disruption or
disaster and outlines explicit mitigation actions.*

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Alternate Processing Site (CP-7)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The organization identifies an alternate processing site and
initiates necessary agreements to permit the resumption of information
system operations for critical mission/business functions within
\[Assignment: organization-defined time period\] when the primary
processing capabilities are unavailable.*

*Supplemental Guidance: Equipment and supplies required to resume
operations within the organization-defined time period are either
available at the alternate site or contracts are in place to support
delivery to the site. Timeframes to resume information system operations
are consistent with organization-established recovery time objectives.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

*Control Enhancements:*

*(1) The organization identifies an alternate processing site that is
geographically separated from the primary processing site so as not to
be susceptible to the same hazards.*

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

*(2) The organization identifies potential accessibility problems to the
alternate processing site in the event of an area-wide disruption or
disaster and outlines explicit mitigation actions.*

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

*(3) The organization develops alternate processing site agreements that
contain priority-of-service provisions in accordance with the
organization's availability requirements.*

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Telecommunications Services (CP-8)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The organization identifies primary and alternate
telecommunications services to support the information system and
initiates necessary agreements to permit the resumption of system
operations for critical mission/business functions within \[Assignment:
organization-defined time period\] when the primary telecommunications
capabilities are unavailable.*

*Supplemental Guidance: In the event that the primary and/or alternate
telecommunications services are provided by a common carrier, the
organization requests Telecommunications Service Priority (TSP) for all
telecommunications services used for national security emergency
preparedness (see [http://tsp.ncs.gov](http://tsp.ncs.gov/) for a full
explanation of the TSP program).*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

*Control Enhancements:*

*(1) The organization develops primary and alternate telecommunications
service agreements that contain priority-of-service provisions in
accordance with the organization's availability requirements.*

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

*(2) The organization obtains alternate telecommunications services that
do not share a single point of failure with primary telecommunications
services.*

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Information System Backup (CP-9)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The organization conducts backups of user-level and
system-level information (including system state information) contained
in the information system \[Assignment: organization-defined frequency\]
and protects backup information at the storage location.*

*Supplemental Guidance: The frequency of information system backups and
the transfer rate of backup information to alternate storage sites (if
so designated) are consistent with the organization's recovery time
objectives and recovery point objectives. While integrity and
availability are the primary concerns for system backup information,
protecting backup information from unauthorized disclosure is also an
important consideration depending on the type of information residing on
the backup media and the FIPS 199 impact level. An organizational
assessment of risk guides the use of encryption for backup information.
The protection of system backup information while in transit is beyond
the scope of this control. Related security controls: MP-4, MP-5.*

*Control Enhancements:*

*(1) The organization tests backup information \[Assignment:
organization-defined frequency\] to verify media reliability and
information integrity.*

*(4) The organization protects system backup information from
unauthorized modification.*

*Enhancement Supplemental Guidance: The organization employs appropriate
mechanisms (e.g., digital signatures, cryptographic hashes) to protect
the integrity of information system backups. Protecting the
confidentiality of system backup information is beyond the scope of this
control. Related security controls: MP-4, MP-5.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Information System Recovery and Reconstitution (CP-10)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The organization employs mechanisms with supporting procedures
to allow the information system to be recovered and reconstituted to a
known secure state after a disruption or failure.*

*Supplemental Guidance: Information system recovery and reconstitution
to a known secure state means that all system parameters (either default
or organization-established) are set to secure values, security-critical
patches are reinstalled, security-related configuration settings are
reestablished, system documentation and operating procedures are
available, application and system software is reinstalled and configured
with secure settings, information from the most recent, known secure
backups is loaded, and the system is fully tested.*

*Control Enhancements: None.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

## Incident Response (IR)

### Incident Response Policy and Procedures (IR-1)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The organization develops, disseminates, and periodically
reviews/updates: (i) a formal, documented, incident response policy that
addresses purpose, scope, roles, responsibilities, management
commitment, coordination among organizational entities, and compliance;
and (ii) formal, documented procedures to facilitate the implementation
of the incident response policy and associated incident response
controls.*

*Supplemental Guidance: The incident response policy and procedures are
consistent with applicable laws, Executive Orders, directives, policies,
regulations, standards, and guidance. The incident response policy can
be included as part of the general information security policy for the
organization. Incident response procedures can be developed for the
security program in general, and for a particular information system,
when required. NIST Special Publication 800-12 provides guidance on
security policies and procedures. NIST Special Publication 800-61
provides guidance on incident handling and reporting. NIST Special
Publication 800-83 provides guidance on malware incident handling and
prevention.*

*Control Enhancements: None.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Incident Response Training (IR-2)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The organization trains personnel in their incident response
roles and responsibilities with respect to the information system and
provides refresher training \[Assignment: organization-defined
frequency, at least annually\].*

*Supplemental Guidance: None.*

*Control Enhancements: None.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Incident Response Testing and Exercises (IR-3)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The organization tests and/or exercises the incident response
capability for the information system \[Assignment: organization-defined
frequency, at least annually\] using \[Assignment: organization-defined
tests and/or exercises\] to determine the incident response
effectiveness and documents the results.*

*Supplemental Guidance: NIST Special Publication 800-84 provides
guidance on test, training, and exercise programs for information
technology plans and capabilities.*

*Control Enhancement: None.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Incident Handling (IR-4)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The organization implements an incident handling capability
for security incidents that includes preparation, detection and
analysis, containment, eradication, and recovery.*

*Supplemental Guidance: Incident-related information can be obtained
from a variety of sources including, but not limited to, audit
monitoring, network monitoring, physical access monitoring, and
user/administrator reports. The organization incorporates the lessons
learned from ongoing incident handling activities into the incident
response procedures and implements the procedures accordingly. Related
security controls: AU-6, PE-6.*

*Control Enhancements:*

*(1) The organization employs automated mechanisms to support the
incident handling process.*

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Incident Monitoring (IR-5)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The organization tracks and documents information system
security incidents on an ongoing basis.*

*Supplemental Guidance: None.*

*Control Enhancements: None.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Incident Reporting (IR-6)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The organization promptly reports incident information to
appropriate authorities.*

*Supplemental Guidance: The types of incident information reported, the
content and timeliness of the reports, and the list of designated
reporting authorities or organizations are consistent with applicable
laws, Executive Orders, directives, policies, regulations, standards,
and guidance. Organizational officials report cyber security incidents
to the United States Computer Emergency Readiness Team (US-CERT) at
http://www.us-cert.gov within the specified timeframe designated in the
US-CERT Concept of Operations for Federal Cyber Security Incident
Handling. In addition to incident information, weaknesses and
vulnerabilities in the information system are reported to appropriate
organizational officials in a timely manner to prevent security
incidents. NIST Special Publication 800-61 provides guidance on incident
reporting.*

*Control Enhancements:*

*(1) The organization employs automated mechanisms to assist in the
reporting of security incidents.*

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Incident Response Assistance (IR-7)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The organization provides an incident response support
resource that offers advice and assistance to users of the information
system for the handling and reporting of security incidents. The support
resource is an integral part of the organization's incident response
capability.*

*Supplemental Guidance: Possible implementations of incident response
support resources in an organization include a help desk or an
assistance group and access to forensics services, when required.*

*Control Enhancements:*

*(1) The organization employs automated mechanisms to increase the
availability of incident response-related information and support.*

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

## Maintenance (MA)

### System Maintenance Policy and Procedures (MA-1)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The organization develops, disseminates, and periodically
reviews/updates: (i) a formal, documented, information system
maintenance policy that addresses purpose, scope, roles,
responsibilities, management commitment, coordination among
organizational entities, and compliance; and (ii) formal, documented
procedures to facilitate the implementation of the information system
maintenance policy and associated system maintenance controls.*

*Supplemental Guidance: The information system maintenance policy and
procedures are consistent with applicable laws, Executive Orders,
directives, policies, regulations, standards, and guidance. The
information system maintenance policy can be included as part of the
general information security policy for the organization. System
maintenance procedures can be developed for the security program in
general, and for a particular information system, when required. NIST
Special Publication 800-12 provides guidance on security policies and
procedures.*

*Control Enhancements: None.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Controlled Maintenance (MA-2)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

[]{.mark}

*Control: The organization schedules, performs, documents, and reviews
records of routine preventative and regular maintenance (including
repairs) on the components of the information system in accordance with
manufacturer or vendor specifications and/or organizational
requirements.*

*Supplemental Guidance: All maintenance activities to include routine,
scheduled maintenance and repairs are controlled; whether performed on
site or remotely and whether the equipment is serviced on site or
removed to another location. Organizational officials approve the
removal of the information system or information system components from
the facility when repairs are necessary. If the information system or
component of the system requires off-site repair, the organization
removes all information from associated media using approved procedures.
After maintenance is performed on the information system, the
organization checks all potentially impacted security controls to verify
that the controls are still functioning properly.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

*Control Enhancements:*

*(1) The organization maintains maintenance records for the information
system that include: (i) the date and time of maintenance; (ii) name of
the individual performing the maintenance; (iii) name of escort, if
necessary; (iv) a description of the maintenance performed; and (v) a
list of equipment removed or replaced (including identification numbers,
if applicable).*

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Maintenance Tools (MA-3)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The organization approves, controls, and monitors the use of
information system maintenance tools and maintains the tools on an
ongoing basis.*

*Supplemental Guidance: The intent of this control is to address
hardware and software brought into the information system specifically
for diagnostic/repair actions (e.g., a hardware or software packet
sniffer that is introduced for the purpose of a particular maintenance
activity). Hardware and/or software components that may support
information system maintenance, yet are a part of the system (e.g., the
software implementing "ping," "ls," "ipconfig," or the hardware and
software implementing the monitoring port of an Ethernet switch) are not
covered by this control.*

*Control Enhancement: None.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Remote Maintenance (MA-4)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The organization authorizes, monitors, and controls any
remotely executed maintenance and diagnostic activities, if employed.*

*Supplemental Guidance: Remote maintenance and diagnostic activities are
conducted by individuals communicating through an external,
non-organization-controlled network (e.g., the Internet). The use of
remote maintenance and diagnostic tools is consistent with
organizational policy and documented in the security plan for the
information system. The organization maintains records for all remote
maintenance and diagnostic activities. Other techniques and/or controls
to consider for improving the security of remote maintenance include:
(i) encryption and decryption of communications; (ii) strong
identification and authentication techniques, such as Level 3 or 4
tokens as described in NIST Special Publication 800-63; and (iii) remote
disconnect verification. When remote maintenance is completed, the
organization (or information system in certain cases) terminates all
sessions and remote connections invoked in the performance of that
activity. If password-based authentication is used to accomplish remote
maintenance, the organization changes the passwords following each
remote maintenance service. NIST Special Publication 800-88 provides
guidance on media sanitization. The National Security Agency provides a
listing of approved media sanitization products at
http://www.nsa.gov/ia/government/mdg.cfm. Related security controls:
IA-2, MP-6.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

*Control Enhancements:*

*(1) The organization audits all remote maintenance and diagnostic
sessions and appropriate organizational personnel review the maintenance
records of the remote sessions.*

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

*(2) The organization addresses the installation and use of remote
maintenance and diagnostic links in the security plan for the
information system.*

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Maintenance Personnel (MA-5)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The organization allows only authorized personnel to perform
maintenance on the information system.*

*Supplemental Guidance: Maintenance personnel (whether performing
maintenance locally or remotely) have appropriate access authorizations
to the information system when maintenance activities allow access to
organizational information or could result in a future compromise of
confidentiality, integrity, or availability. When maintenance personnel
do not have needed access authorizations, organizational personnel with
appropriate access authorizations supervise maintenance personnel during
the performance of maintenance activities on the information system.*

*Control Enhancements: None.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Timely Maintenance (MA-6)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The organization obtains maintenance support and spare parts
for \[Assignment: organization-defined list of key information system
components\] within \[Assignment: organization-defined time period\] of
failure.*

*Supplemental Guidance: None.*

*Control Enhancements: None.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

## Media Protection (MP)

### Media Protection Policy and Procedures (MP-1)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

Control: The organization develops, disseminates, and periodically
reviews/updates: (i) a formal, documented, media protection policy that
addresses purpose, scope, roles, responsibilities, management
commitment, coordination among organizational entities, and compliance;
and (ii) formal, documented procedures to facilitate the implementation
of the media protection policy and associated media protection controls.

*Supplemental Guidance: The media protection policy and procedures are
consistent with applicable laws, Executive Orders, directives, policies,
regulations, standards, and guidance. The media protection policy can be
included as part of the general information security policy for the
organization. Media protection procedures can be developed for the
security program in general, and for a particular information system,
when required. NIST Special Publication 800-12 provides guidance on
security policies and procedures.*

*Control Enhancements: None.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Media Access (MP-2)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The organization restricts access to information system media
to authorized individuals.*

*Supplemental Guidance: Information system media includes both digital
media (e.g., diskettes, magnetic tapes, external/removable hard drives,
flash/thumb drives, compact disks, digital video disks) and non-digital
media (e.g., paper, microfilm). This control also applies to portable
and mobile computing and communications devices with information storage
capability (e.g., notebook computers, personal digital assistants,
cellular telephones).*

*An organizational assessment of risk guides the selection of media and
associated information contained on that media requiring restricted
access. Organizations document in policy and procedures, the media
requiring restricted access, individuals authorized to access the media,
and the specific measures taken to restrict access. The rigor with which
this control is applied is commensurate with the FIPS 199 security
categorization of the information contained on the media. For example,
fewer protection measures are needed for media containing information
determined by the organization to be in the public domain, to be
publicly releasable, or to have limited or no adverse impact on the
organization or individuals if accessed by other than authorized
personnel. In these situations, it is assumed that the physical access
controls where the media resides provide adequate protection.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

*Control Enhancements:*

*(1) The organization employs automated mechanisms to restrict access to
media storage areas and to audit access attempts and access granted.*

*Enhancement Supplemental Guidance: This control enhancement is
primarily applicable to designated media storage areas within an
organization where a significant volume of media is stored and is not
intended to apply to every location where some media is stored (e.g., in
individual offices).*

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Media Storage (MP-4)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The organization physically controls and securely stores
information system media within controlled areas.*

*Supplemental Guidance: Information system media includes both digital
media (e.g., diskettes, magnetic tapes, external/removable hard drives,
flash/thumb drives, compact disks, digital video disks) and non-digital
media (e.g., paper, microfilm). A controlled area is any area or space
for which the organization has confidence that the physical and
procedural protections provided are sufficient to meet the requirements
established for protecting the information and/or information system.
This control applies to portable and mobile computing and communications
devices with information storage capability (e.g., notebook computers,
personal digital assistants, cellular telephones). Telephone systems are
also considered information systems and may have the capability to store
information on internal media (e.g., on voicemail systems). Since
telephone systems do not have, in most cases, the identification,
authentication, and access control mechanisms typically employed in
other information systems, organizational personnel exercise extreme
caution in the types of information stored on telephone voicemail
systems.*

*An organizational assessment of risk guides the selection of media and
associated information contained on that media requiring physical
protection. Organizations document in policy and procedures, the media
requiring physical protection and the specific measures taken to afford
such protection. The rigor with which this control is applied is
commensurate with the FIPS 199 security categorization of the
information contained on the media. For example, fewer protection
measures are needed for media containing information determined by the
organization to be in the public domain, to be publicly releasable, or
to have limited or no adverse impact on the organization or individuals
if accessed by other than authorized personnel. In these situations, it
is assumed that the physical access controls to the facility where the
media resides provide adequate protection. The organization protects
information system media identified by the organization until the media
are destroyed or sanitized using approved equipment, techniques, and
procedures.*

*As part of a defense-in-depth protection strategy, the organization
considers routinely encrypting information at rest on selected secondary
storage devices. FIPS 199 security categorization guides the selection
of appropriate candidates for secondary storage encryption. The
organization implements effective cryptographic key management in
support of secondary storage encryption and provides protections to
maintain the availability of the information in the event of the loss of
cryptographic keys by users. NIST Special Publications 800-56 and 800-57
provide guidance on cryptographic key establishment and cryptographic
key management. Related security controls: CP-9, RA-2.*

*Control Enhancements: None.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Media Transport (MP-5)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The organization protects and controls information system
media during transport outside of controlled areas and restricts the
activities associated with transport of such media to authorized
personnel.*

*Supplemental Guidance: Information system media includes both digital
media (e.g., diskettes, tapes, removable hard drives, flash/thumb
drives, compact disks, digital video disks) and non-digital media (e.g.,
paper, microfilm). A controlled area is any area or space for which the
organization has confidence that the physical and procedural protections
provided are sufficient to meet the requirements established for
protecting the information and/or information system. This control also
applies to portable and mobile computing and communications devices with
information storage capability (e.g., notebook computers, personal
digital assistants, cellular telephones) that are transported outside of
controlled areas. Telephone systems are also considered information
systems and may have the capability to store information on internal
media (e.g., on voicemail systems). Since telephone systems do not have,
in most cases, the identification, authentication, and access control
mechanisms typically employed in other information systems,
organizational personnel exercise extreme caution in the types of
information stored on telephone voicemail systems that are transported
outside of controlled areas. An organizational assessment of risk guides
the selection of media and associated information contained on that
media requiring protection during transport. Organizations document in
policy and procedures, the media requiring protection during transport
and the specific measures taken to protect such transported media. The
rigor with which this control is applied is commensurate with the FIPS
199 security categorization of the information contained on the media.
An organizational assessment of risk also guides the selection and use
of appropriate storage containers for transporting non-digital media.
Authorized transport and courier personnel may include individuals from
outside the organization (e.g., U.S. Postal Service or a commercial
transport or delivery service).*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

*Control Enhancements:*

*(1) The organization protects digital and non-digital media during
transport outside of controlled areas using \[Assignment:
organization-defined security measures, e.g., locked container,
cryptography\].*

*Enhancement Supplemental Guidance: Physical and technical security
measures for the protection of digital and non-digital media are
approved by the organization, commensurate with the FIPS 199 security
categorization of the information residing on the media, and consistent
with applicable federal laws, directives, policies, regulations,
standards, and guidance. Cryptographic mechanisms can provide
confidentiality and/or integrity protections depending upon the
mechanisms used.*

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

*(2) The organization documents, where appropriate, activities
associated with the transport of information system media using
\[Assignment: organization-defined system of records\].*

*Enhancement Supplemental Guidance: Organizations establish
documentation requirements for activities associated with the transport
of information system media in accordance with the organizational
assessment of risk*

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Media Sanitization and Disposal (MP-6)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The organization sanitizes information system media, both
digital and non-digital, prior to disposal or release for reuse.*

*Supplemental Guidance: Sanitization is the process used to remove
information from information system media such that there is reasonable
assurance, in proportion to the confidentiality of the information, that
the information cannot be retrieved or reconstructed. Sanitization
techniques, including clearing, purging, and destroying media
information, prevent the disclosure of organizational information to
unauthorized individuals when such media is reused or disposed. The
organization uses its discretion on sanitization techniques and
procedures for media containing information deemed to be in the public
domain or publicly releasable, or deemed to have no adverse impact on
the organization or individuals if released for reuse or disposed. NIST
Special Publication 800-88 provides guidance on media sanitization. The
National Security Agency also provides media sanitization guidance and
maintains a listing of approved sanitization products at
<http://www.nsa.gov/ia/government/mdg.cfm>.*

*Control Enhancements: None.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

## Physical and Environmental Protection (PE)

### Physical and Environmental Protection Policy and Procedures (PE-1)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

Control: The organization develops, disseminates, and periodically
reviews/updates: (i) a formal, documented, physical and environmental
protection policy that addresses purpose, scope, roles,
responsibilities, management commitment, coordination among
organizational entities, and compliance; and (ii) formal, documented
procedures to facilitate the implementation of the physical and
environmental protection policy and associated physical and
environmental protection controls.

*Supplemental Guidance: The physical and environmental protection policy
and procedures are consistent with applicable laws, Executive Orders,
directives, policies, regulations, standards, and guidance. The physical
and environmental protection policy can be included as part of the
general information security policy for the organization. Physical and
environmental protection procedures can be developed for the security
program in general, and for a particular information system, when
required. NIST Special Publication 800-12 provides guidance on security
policies and procedures.*

*Control Enhancements: None.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Physical Access Authorizations (PE-2)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The organization develops and keeps current a list of
personnel with authorized access to the facility where the information
system resides (except for those areas within the facility officially
designated as publicly accessible) and issues appropriate authorization
credentials. Designated officials within the organization review and
approve the access list and authorization credentials \[Assignment:
organization-defined frequency, at least annually\].*

*Supplemental Guidance: Appropriate authorization credentials include,
for example, badges, identification cards, and smart cards. The
organization promptly removes from the access list personnel no longer
requiring access to the facility where the information system resides.*

*Control Enhancements: None.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Physical Access Control (PE-3)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The organization controls all physical access points
(including designated entry/exit points) to the facility where the
information system resides (except for those areas within the facility
officially designated as publicly accessible) and verifies individual
access authorizations before granting access to the facility. The
organization controls access to areas officially designated as publicly
accessible, as appropriate, in accordance with the organization's
assessment of risk.*

*Supplemental Guidance: The organization uses physical access devices
(e.g., keys, locks, combinations, card readers) and/or guards to control
entry to facilities containing information systems. The organization
secures keys, combinations, and other access devices and inventories
those devices regularly. The organization changes combinations and keys:
(i) periodically; and (ii) when keys are lost, combinations are
compromised, or individuals are transferred or terminated. Workstations
and associated peripherals connected to (and part of) an organizational
information system may be located in areas designated as publicly
accessible with access to such devices being appropriately controlled.
Where federal Personal Identity Verification (PIV) credential is used as
an identification token and token-based access control is employed, the
access control system conforms to the requirements of FIPS 201 and NIST
Special Publication 800-73. If the token-based access control function
employs cryptographic verification, the access control system conforms
to the requirements of NIST Special Publication 800-78. If the
token-based access control function employs biometric verification, the
access control system conforms to the requirements of NIST Special
Publication 800-76.*

*Control Enhancements: None.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Access Control for Display Medium (PE-5)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The organization controls physical access to information
system devices that display information to prevent unauthorized
individuals from observing the display output.*

*Control Enhancements: None.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Monitoring Physical Access (PE-6)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The organization monitors physical access to the information
system to detect and respond to physical security incidents.*

*Supplemental Guidance: The organization reviews physical access logs
periodically and investigates apparent security violations or suspicious
physical access activities. Response to detected physical security
incidents is part of the organization's incident response capability.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

*Control Enhancements:*

*(1) The organization monitors real-time physical intrusion alarms and
surveillance equipment.*

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Visitor Control (PE-7)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The organization controls physical access to the information
system by authenticating visitors before authorizing access to the
facility where the information system resides other than areas
designated as publicly accessible.*

*Supplemental Guidance: Government contractors and others with permanent
authorization credentials are not considered visitors. Personal Identity
Verification (PIV) credentials for federal employees and contractors
conform to FIPS 201, and the issuing organizations for the PIV
credentials are accredited in accordance with the provisions of NIST
Special Publication 800-79.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

*Control Enhancements:*

*(!) The organization escorts visitors and monitors visitor activity,
when required.*

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Access Records (PE-8)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

[]{.mark}

*Control: The organization maintains visitor access records to the
facility where the information system resides (except for those areas
within the facility officially designated as publicly accessible) that
includes: (i) name and organization of the person visiting; (ii)
signature of the visitor; (iii) form of identification; (iv) date of
access; (v) time of entry and departure; (vi) purpose of visit; and
(vii) name and organization of person visited. Designated officials
within the organization review the visitor access records \[Assignment:
organization-defined frequency\].*

*Supplemental Guidance: None.*

*Control Enhancements: None*

**Implementation**: [As applicable, describe how the control is
implemented within the system]{.mark}.

### Power Equipment and Power Cabling (PE-9)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

Control: The organization protects power equipment and power cabling for
the information system from damage and destruction.

*Supplemental Guidance: None.*

*Control Enhancements: None.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Emergency Shutoff (PE-10)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The organization provides, for specific locations within a
facility containing concentrations of information system resources, the
capability of shutting off power to any information system component
that may be malfunctioning or threatened without endangering personnel
by requiring them to approach the equipment.*

*Supplemental Guidance: Facilities containing concentrations of
information system resources may include, for example, data centers,
server rooms, and mainframe rooms.*

*Control Enhancements: None.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

###  Emergency Power (PE-11)

*Control: The organization provides a short-term uninterruptible power
supply to facilitate an orderly shutdown of the information system in
the event of a primary power source loss.*

*Supplemental Guidance: None.*

*Control Enhancements: None.*

###  Emergency Lighting (PE-12)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The organization employs and maintains automatic emergency
lighting that activates in the event of a power outage or disruption and
that covers emergency exits and evacuation routes.*

*Supplemental Guidance: None.*

*Control Enhancements: None.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

###  Fire Protection (PE-13)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The organization employs and maintains fire suppression and
detection devices/systems that can be activated in the event of a fire.*

*Supplemental Guidance: Fire suppression and detection devices/systems
include, but are not limited to, sprinkler systems, handheld fire
extinguishers, fixed fire hoses, and smoke detectors.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

*Control Enhancements:*

*(1) The organization employs fire detection devices/systems that
activate automatically and notify the organization and emergency
responders in the event of a fire.*

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

*(2) The organization employs fire suppression devices/systems that
provide automatic notification of any activation to the organization and
emergency responders.*

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

*(3) The organization employs an automatic fire suppression capability
in facilities that are not staffed on a continuous basis.*

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Temperature and Humidity Controls (PE-14)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The organization regularly maintains, within acceptable
levels, and monitors the temperature and humidity within the facility
where the information system resides.*

*Supplemental Guidance: None.*

*Control Enhancements: None.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Water Damage Protection (PE-15)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The organization protects the information system from water
damage resulting from broken plumbing lines or other sources of water
leakage by providing master shutoff valves that are accessible, working
properly, and known to key personnel.*

*Supplemental Guidance: None.*

*Control Enhancements: None.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Delivery and Removal (PE-16)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The organization authorizes and controls information
system-related items entering and exiting the facility and maintains
appropriate records of those items.*

*Supplemental Guidance: The organization controls delivery areas and, if
possible, isolates the areas from the information system and media
libraries to avoid unauthorized physical access.*

*Control Enhancements: None.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Alternate Work Site (PE-17)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The organization employs appropriate management, operational,
and technical information system security controls at alternate work
sites.*

*Supplemental Guidance: The organization provides a means for employees
to communicate with information system security staff in case of
security problems. NIST SP 800-46 provides guidance on security in
telecommuting and broadband communications.*

*Control Enhancements: None.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Location of Information System Components (PE-18)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The organization positions information system components
within the facility to minimize potential damage from physical and
environmental hazards and to minimize the opportunity for unauthorized
access.*

*Supplemental Guidance: Physical and environmental hazards include, for
example, flooding, fire, tornados, earthquakes, hurricanes, acts of
terrorism, vandalism, electrical interference, and electromagnetic
radiation. Whenever possible, the organization also considers the
location or site of the facility with regard to physical and
environmental hazards.*

*Control Enhancements: None.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

## Personnel Security (PS)

### Personnel Security Policy and Procedures (PS-1)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The organization develops, disseminates, and periodically
reviews/updates: (i) a formal, documented, personnel security policy
that addresses purpose, scope, roles, responsibilities, management
commitment, coordination among organizational entities, and compliance;
and (ii) formal, documented procedures to facilitate the implementation
of the personnel security policy and associated personnel security
controls.*

*Supplemental Guidance: The personnel security policy and procedures are
consistent with applicable laws, Executive Orders, directives, policies,
regulations, standards, and guidance. The personnel security policy can
be included as part of the general information security policy for the
organization. Personnel security procedures can be developed for the
security program in general, and for a particular information system,
when required. NIST Special Publication 800-12 provides guidance on
security policies and procedures.*

*Control Enhancements: None.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Position Categorization (PS-2)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

Control: The organization assigns a risk designation to all positions
and establishes screening criteria for individuals filling those
positions. The organization reviews and revises position risk
designations \[Assignment: organization-defined frequency\].

*Supplemental Guidance: Position risk designations are consistent with 5
CFR 731.106(a) and Office of Personnel Management policy and guidance.*

*Control Enhancements: None.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Personnel Screening (PS-3)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

Control: The organization screens individuals requiring access to
organizational information and information systems before authorizing
access.

*Supplemental Guidance: Screening is consistent with: (i) 5 CFR 731.106;
(ii) Office of Personnel Management policy, regulations, and guidance;
(iii) organizational policy, regulations, and guidance; (iv) FIPS 201
and Special Publications 800-73, 800-76, and 800-78; and (v) the
criteria established for the risk designation of the assigned position.*

*Control Enhancements: None*.

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

###  Personnel Termination (PS-4)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

Control: The organization, upon termination of individual employment,
terminates information system access, conducts exit interviews,
retrieves all organizational information system-related property, and
provides appropriate personnel with access to official records created
by the terminated employee that are stored on organizational information
systems.

*Supplemental Guidance: Information system-related property includes,
for example, keys, identification cards, and building passes. Timely
execution of this control is particularly essential for employees or
contractors terminated for cause.*

*Control Enhancements: None.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Personnel Transfer (PS-5)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

[]{.mark}

*Control: The organization reviews information systems/facilities access
authorizations when personnel are reassigned or transferred to other
positions within the organization and initiates appropriate actions.*

*Supplemental Guidance: Appropriate actions that may be required
include: (i) returning old and issuing new keys, identification cards,
building passes; (ii) closing old accounts and establishing new
accounts; (iii) changing system access authorizations; and (iv)
providing for access to official records created or controlled by the
employee at the old work location and in the old accounts.*

*Control Enhancements: None.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

###  Access Agreements (PS-6)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

Control: The organization completes appropriate signed access agreements
for individuals requiring access to organizational information and
information systems before authorizing access and reviews/updates the
agreements \[Assignment: organization-defined frequency\].

*Supplemental Guidance: Access agreements include, for example,
nondisclosure agreements, acceptable use agreements, rules of behavior,
and conflict-of-interest agreements. Electronic signatures are
acceptable for use in acknowledging access agreements unless
specifically prohibited by organizational policy.*

*Control Enhancements: None.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

###  Third-Party Personnel Security (PS-7)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

Control: The organization establishes personnel security requirements
including security roles and responsibilities for third-party providers
and monitors provider compliance.

*Supplemental Guidance: Third-party providers include, for example,
service bureaus, contractors, and other organizations providing
information system development, information technology services,
outsourced applications, and network and security management. The
organization explicitly includes personnel security requirements in
acquisition-related documents. NIST Special Publication 800-35 provides
guidance on information technology security services.*

*Control Enhancements: None.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

###  Personnel Sanctions (PS-8)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The organization employs a formal sanctions process for
personnel failing to comply with established information security
policies and procedures.*

*Supplemental Guidance: The sanctions process is consistent with
applicable federal laws, directives, policies, regulations, standards,
and guidance. The sanctions process can be included as part of the
general personnel policies and procedures for the organization.*

*Control Enhancements: None.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

## System and Information Integrity (SI)

### System and Information Integrity Policy and Procedures (SI-1)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The organization develops, disseminates, and periodically
reviews/updates: (i) a formal, documented, system and information
integrity policy that addresses purpose, scope, roles, responsibilities,
management commitment, coordination among organizational entities, and
compliance; and (ii) formal, documented procedures to facilitate the
implementation of the system and information integrity policy and
associated system and information integrity controls.*

*Supplemental Guidance: The system and information integrity policy and
procedures are consistent with applicable laws, Executive Orders,
directives, policies, regulations, standards, and guidance. The system
and information integrity policy can be included as part of the general
information security policy for the organization. System and information
integrity procedures can be developed for the security program in
general, and for a particular information system, when required. NIST
Special Publication 800-12 provides guidance on security policies and
procedures.*

*Control Enhancements: None.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Flaw Remediation (SI-2)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The organization identifies, reports, and corrects information
system flaws.*

*Supplemental Guidance: The organization identifies information systems
containing software affected by recently announced software flaws (and
potential vulnerabilities resulting from those flaws). The organization
(or the software developer/vendor in the case of software developed and
maintained by a vendor/contractor) promptly installs newly released
security relevant patches, service packs, and hot fixes, and tests
patches, service packs, and hot fixes for effectiveness and potential
side effects on the organization's information systems before
installation. Flaws discovered during security assessments, continuous
monitoring, incident response activities, or information system error
handling are also addressed expeditiously. Flaw remediation is
incorporated into configuration management as an emergency change. NIST
SP 800-40, provides guidance on security patch installation and patch
management. Related security controls: CA-2, CA-4, CA-7, CM-3, IR-4,
SI-11.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

*Control Enhancements:*

*(2) The organization employs automated mechanisms to periodically and
upon demand determine the state of information system components with
regard to flaw remediation.*

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Malicious Code Protection (SI-3)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The information system implements malicious code protection.*

*Supplemental Guidance: The organization employs malicious code
protection mechanisms at critical information system entry and exit
points (e.g., firewalls, electronic mail servers, web servers, proxy
servers, remote-access servers) and at workstations, servers, or mobile
computing devices on the network. The organization uses the malicious
code protection mechanisms to detect and eradicate malicious code (e.g.,
viruses, worms, Trojan horses, spyware) transported: (i) by electronic
mail, electronic mail attachments, Internet accesses, removable media
(e.g., USB devices, diskettes or compact disks), or other common means;
or (ii) by exploiting information system vulnerabilities. The
organization updates malicious code protection mechanisms (including the
latest virus definitions) whenever new releases are available in
accordance with organizational configuration management policy and
procedures. The organization considers using malicious code protection
software products from multiple vendors (e.g., using one vendor for
boundary devices and servers and another vendor for workstations). The
organization also considers the receipt of false positives during
malicious code detection and eradication and the resulting potential
impact on the availability of the information system. NIST Special
Publication 800-83 provides guidance on implementing malicious code
protection.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

*Control Enhancements:*

*(1) The organization centrally manages malicious code protection
mechanisms.*

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

*(2) The information system automatically updates malicious code
protection mechanisms.*

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Information System Monitoring Tools and Techniques (SI-4)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The organization employs tools and techniques to monitor
events on the information system, detect attacks, and provide
identification of unauthorized use of the system.*

*Supplemental Guidance: Information system monitoring capability is
achieved through a variety of tools and techniques (e.g., intrusion
detection systems, intrusion prevention systems, malicious code
protection software, audit record monitoring software, network
monitoring software). Monitoring devices are strategically deployed
within the information system (e.g., at selected perimeter locations,
near server farms supporting critical applications) to collect essential
information. Monitoring devices are also deployed at ad hoc locations
within the system to track specific transactions. Additionally, these
devices are used to track the impact of security changes to the
information system. The granularity of the information collected is
determined by the organization based upon its monitoring objectives and
the capability of the information system to support such activities.
Organizations consult appropriate legal counsel with regard to all
information system monitoring activities. Organizations heighten the
level of information system monitoring activity whenever there is an
indication of increased risk to organizational operations,
organizational assets, or individuals based on law enforcement
information, intelligence information, or other credible sources of
information. NIST Special Publication 800-61 provides guidance on
detecting attacks through various types of security technologies. NIST
Special Publication 800-83 provides guidance on detecting malware-based
attacks through malicious code protection software. NIST Special
Publication 800-92 provides guidance on monitoring and analyzing
computer security event logs. NIST Special Publication 800-94 provides
guidance on intrusion detection and prevention. Related security
control: AC-8.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

*Control Enhancements:*

*(4) The information system monitors inbound and outbound communications
for unusual or unauthorized activities or conditions.*

*Enhancement Supplemental Guidance: Unusual/unauthorized activities or
conditions include, for example, the presence of malicious code, the
unauthorized export of information, or signaling to an external
information system.*

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Security Alerts and Advisories (SI-5)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The organization receives information system security
alerts/advisories on a regular basis, issues alerts/advisories to
appropriate personnel, and takes appropriate actions in response.*

*Supplemental Guidance: The organization documents the types of actions
to be taken in response to security alerts/advisories. The organization
also maintains contact with special interest groups (e.g., information
security forums) that: (i) facilitate sharing of security-related
information (e.g., threats, vulnerabilities, and latest security
technologies); (ii) provide access to advice from security
professionals; and (iii) improve knowledge of security best practices.
NIST Special Publication 800-40 provides guidance on monitoring and
distributing security alerts and advisories.*

*Control Enhancements: None.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Spam Protection (SI-8)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The information system implements spam protection.*

*Supplemental Guidance: The organization employs spam protection
mechanisms at critical information system entry points (e.g., firewalls,
electronic mail servers, remote-access servers) and at workstations,
servers, or mobile computing devices on the network. The organization
uses the spam protection mechanisms to detect and take appropriate
action on unsolicited messages transported by electronic mail,
electronic mail attachments, Internet accesses, or other common means.
Consideration is given to using spam protection software products from
multiple vendors (e.g., using one vendor for boundary devices and
servers and another vendor for workstations). NIST Special Publication
800-45 provides guidance on electronic mail security.*

*Control Enhancements: None.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Information Input Restrictions (SI-9)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The organization restricts the capability to input information
to the information system to authorized personnel.*

*Supplemental Guidance: Restrictions on personnel authorized to input
information to the information system may extend beyond the typical
access controls employed by the system and include limitations based on
specific operational/project responsibilities.*

*Control Enhancements: None.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Information Accuracy, Completeness, Validity, and Authenticity (SI-10)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The information system checks information for accuracy,
completeness, validity, and authenticity.*

*Supplemental Guidance: Checks for accuracy, completeness, validity, and
authenticity of information are accomplished as close to the point of
origin as possible. Rules for checking the valid syntax of information
system inputs (e.g., character set, length, numerical range, acceptable
values) are in place to verify that inputs match specified definitions
for format and content. Inputs passed to interpreters are prescreened to
prevent the content from being unintentionally interpreted as commands.
The extent to which the information system is able to check the
accuracy, completeness, validity, and authenticity of information is
guided by organizational policy and operational requirements.*

*Control Enhancements: None.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Error Handling (SI-11)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The information system identifies and handles error conditions
in an expeditious manner without providing information that could be
exploited by adversaries.*

*Supplemental Guidance: The structure and content of error messages are
carefully considered by the organization. Error messages are revealed
only to authorized personnel. Error messages generated by the
information system provide timely and useful information without
revealing potentially harmful information that could be used by
adversaries. Sensitive information (e.g., account numbers, social
security numbers, and credit card numbers) are not listed in error logs
or associated administrative messages. The extent to which the
information system is able to identify and handle error conditions is
guided by organizational policy and operational requirements.*

*Control Enhancements: None.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Information Output Handling and Retention (SI-12)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The organization handles and retains output from the
information system in accordance with applicable laws, Executive Orders,
directives, policies, regulations, standards, and operational
requirements.*

*Control Enhancements: None.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

# Technical Controls

The Technical security controls section of this SSP identifies the
technical safeguards and countermeasures in-place or planned for
[\[SYSTEM NAME\]]{.mark}. Technical Controls are those safeguards and
countermeasures that are primarily implemented and executed by the
information system through mechanisms contained in the hardware,
software, or firmware components of the system.

## Access Control (AC)

### Access Control Policy and Procedures (AC-1)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

[Control]{.underline}: The organization develops, disseminates, and
periodically reviews/updates: (i) a formal, documented, access control
policy that addresses purpose, scope, roles, responsibilities,
management commitment, coordination among organizational entities, and
compliance; and (ii) formal, documented procedures to facilitate the
implementation of the access control policy and associated access
controls.

*[Supplemental Guidance]{.underline}: The access control policy and
procedures are consistent with applicable laws, Executive Orders,
directives, policies, regulations, standards, and guidance. The access
control policy can be included as part of the general information
security policy for the organization. Access control procedures can be
developed for the security program in general, and for a particular
information system, when required. NIST Special Publication 800-12
provides guidance on security policies and procedures.*

*Control Enhancements: None.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Account Management (AC-2)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The organization manages information system accounts,
including establishing, activating, modifying, reviewing, disabling, and
removing accounts. The organization reviews information system accounts
\[Assignment: organization-defined frequency, at least annually\].*

*Supplemental Guidance: Account management includes the identification
of account types (i.e., individual, group, and system), establishment of
conditions for group membership, and assignment of associated
authorizations. The organization identifies authorized users of the
information system and specifies access rights/privileges. The
organization grants access to the information system based on: (i) a
valid need-to-know/need-to-share that is determined by assigned official
duties and satisfying all personnel security criteria; and (ii) intended
system usage. The organization requires proper identification for
requests to establish information system accounts and approves all such
requests. The organization specifically authorizes and monitors the use
of guest/anonymous accounts and removes, disables, or otherwise secures
unnecessary accounts. Account managers are notified when information
system users are terminated or transferred and associated accounts are
removed, disabled, or otherwise secured. Account managers are also
notified when users' information system usage or
need-to-know/need-to-share changes.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

*Control Enhancements:*

*(1) The organization employs automated mechanisms to support the
management of information system accounts.*

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

*(2) The information system automatically terminates temporary and
emergency accounts after \[Assignment: organization-defined time period
for each type of account\].*

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

*(3) The information system automatically disables inactive accounts
after \[Assignment: organization-defined time period\].*

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

*(4) The organization employs automated mechanisms to audit account
creation, modification, disabling, and termination actions and to
notify, as required, appropriate individuals.*

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Access Enforcement (AC-3)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The information system enforces assigned authorizations for
controlling access to the system in accordance with applicable policy.*

*Supplemental Guidance: Access control policies (e.g., identity-based
policies, role-based policies, rule-based policies) and associated
access enforcement mechanisms (e.g., access control lists, access
control matrices, cryptography) are employed by organizations to control
access between users (or processes acting on behalf of users) and
objects (e.g., devices, files, records, processes, programs, domains) in
the information system. In addition to controlling access at the
information system level, access enforcement mechanisms are employed at
the application level, when necessary, to provide increased information
security for the organization. Consideration is given to the
implementation of a controlled, audited, and manual override of
automated mechanisms in the event of emergencies or other serious
events. If encryption of stored information is employed as an access
enforcement mechanism, the cryptography used is FIPS 140-2 (as amended)
compliant. Related security control: SC-13.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

*Control Enhancements:*

*(1) The information system restricts access to privileged functions
(deployed in hardware, software, and firmware) and security-relevant
information to explicitly authorized personnel.*

*Enhancement Supplemental Guidance: Explicitly authorized personnel
include, for example, security administrators, system and network
administrators, and other privileged users. Privileged users are
individuals who have access to system control, monitoring, or
administration functions (e.g., system administrators, information
system security officers, maintainers, system programmers).*

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Information Flow Enforcement (AC-4)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The information system enforces assigned authorizations for
controlling the flow of information within the system and between
interconnected systems in accordance with applicable policy.*

*Supplemental Guidance: Information flow control regulates where
information is allowed to travel within an information system and
between information systems (as opposed to who is allowed to access the
information) and without explicit regard to subsequent accesses to that
information. A few, of many, generalized examples of possible
restrictions that are better expressed as flow control than access
control are: keeping export controlled information from being
transmitted in the clear to the Internet, blocking outside traffic that
claims to be from within the organization, and not passing any web
requests to the Internet that are not from the internal web proxy.
Information flow control policies and enforcement mechanisms are
commonly employed by organizations to control the flow of information
between designated sources and destinations (e.g., networks,
individuals, devices) within information systems and between
interconnected systems. Flow control is based on the characteristics of
the information and/or the information path. Specific examples of flow
control enforcement can be found in boundary protection devices (e.g.,
proxies, gateways, guards, encrypted tunnels, firewalls, and routers)
that employ rule sets or establish configuration settings that restrict
information system services or provide a packet filtering capability.
Related security control: SC-7.*

*Control Enhancements: None.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Separation of Duties (AC-5)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The information system enforces separation of duties through
assigned access authorizations.*

*Supplemental Guidance: The organization establishes appropriate
divisions of responsibility and separates duties as needed to eliminate
conflicts of interest in the responsibilities and duties of individuals.
There is access control software on the information system that prevents
users from having all of the necessary authority or information access
to perform fraudulent activity without collusion. Examples of separation
of duties include: (i) mission functions and distinct information system
support functions are divided among different individuals/roles; (ii)
different individuals perform information system support functions
(e.g., system management, systems programming, quality
assurance/testing, configuration management, and network security); and
(iii) security personnel who administer access control functions do not
administer audit functions.*

*Control Enhancements: None.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Least Privilege (AC-6)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The information system enforces the most restrictive set of
rights/privileges or accesses needed by users (or processes acting on
behalf of users) for the performance of specified tasks.*

*Supplemental Guidance: The organization employs the concept of least
privilege for specific duties and information systems (including
specific ports, protocols, and services) in accordance with risk
assessments as necessary to adequately mitigate risk to organizational
operations, organizational assets, and individuals.*

*Control Enhancements: None.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Unsuccessful Login Attempts (AC-7)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The information system enforces a limit of \[Assignment:
organization-defined number\] consecutive invalid access attempts by a
user during a \[Assignment: organization-defined time period\] time
period. The information system automatically \[Selection: locks the
account/node for an \[Assignment: organization-defined time period\],
delays next login prompt according to \[Assignment: organization-defined
delay algorithm\] when the maximum number of unsuccessful attempts is
exceeded.*

*Supplemental Guidance: Due to the potential for denial of service,
automatic lockouts initiated by the information system are usually
temporary and automatically release after a predetermined time period
established by the organization.*

*Control Enhancements: None.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### System Use Notification (AC-8)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

Control: The information system displays an approved, system use
notification message before granting system access informing potential
users: (i) that the user is accessing a U.S. Government information
system; (ii) that system usage may be monitored, recorded, and subject
to audit; (iii) that unauthorized use of the system is prohibited and
subject to criminal and civil penalties; and (iv) that use of the system
indicates consent to monitoring and recording. The system use
notification message provides appropriate privacy and security notices
(based on associated privacy and security policies or summaries) and
remains on the screen until the user takes explicit actions to log on to
the information system.

*Supplemental Guidance: Privacy and security policies are consistent
with applicable laws, Executive Orders, directives, policies,
regulations, standards, and guidance. System use notification messages
can be implemented in the form of warning banners displayed when
individuals log in to the information system. For publicly accessible
systems: (i) the system use information is available and when
appropriate, is displayed before granting access; (ii) any references to
monitoring, recording, or auditing are in keeping with privacy
accommodations for such systems that generally prohibit those
activities; and (iii) the notice given to public users of the
information system includes a description of the authorized uses of the
system.*

*Control Enhancements: None.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Session Lock (AC-11)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The information system prevents further access to the system
by initiating a session lock after \[Assignment: organization-defined
time period\] of inactivity, and the session lock remains in effect
until the user reestablishes access using appropriate identification and
authentication procedures.*

*Supplemental Guidance: Users can directly initiate session lock
mechanisms. A session lock is not a substitute for logging out of the
information system. Organization-defined time periods of inactivity
comply with federal policy; for example, in accordance with OMB
Memorandum 06-16, the organization-defined time period is no greater
than thirty minutes for remote access and portable devices.*

*Control Enhancements: None.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Session Termination (AC-12)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The information system automatically terminates a remote
session after \[Assignment: organization-defined time period\] of
inactivity.*

*Supplemental Guidance: A remote session is initiated whenever an
organizational information system is accessed by a user (or an
information system) communicating through an external,
non-organization-controlled network (e.g., the Internet).*

*Control Enhancements: None.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Supervision and Review -- Access Control (AC-13)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

Control: The organization supervises and reviews the activities of users
with respect to the enforcement and usage of information system access
controls.

*Supplemental Guidance: The organization reviews audit records (e.g.,
user activity logs) for inappropriate activities in accordance with
organizational procedures. The organization investigates any unusual
information system-related activities and periodically reviews changes
to access authorizations. The organization reviews more frequently the
activities of users with significant information system roles and
responsibilities. The extent of the audit record reviews is based on the
FIPS 199 impact level of the information system. For example, for
low-impact systems, it is not intended that security logs be reviewed
frequently for every workstation, but rather at central points such as a
web proxy or email servers and when specific circumstances warrant
review of other audit records. NIST Special Publication 800-92 provides
guidance on computer security log management.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

*Control Enhancements:*

*(1) The organization employs automated mechanisms to facilitate the
review of user activities.*

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Permitted Actions without Identification or Authentication (AC-14)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

Control: The organization identifies and documents specific user actions
that can be performed on the information system without identification
or authentication.

*Supplemental Guidance: The organization allows limited user activity
without identification and authentication for public websites or other
publicly available information systems (e.g., individuals accessing a
federal information system at http://www.firstgov.gov). Related security
control: IA-2.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

*Control Enhancements:*

*(1) The organization permits actions to be performed without
identification and authentication only to the extent necessary to
accomplish mission objectives.*

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

###  Remote Access (AC-17)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The organization authorizes, monitors, and controls all
methods of remote access to the information system.*

*Supplemental Guidance: Remote access is any access to an organizational
information system by a user (or an information system) communicating
through an external, non-organization-controlled network (e.g., the
Internet). Examples of remote access methods include dial-up, broadband,
and wireless. Remote access controls are applicable to information
systems other than public web servers or systems specifically designed
for public access. The organization restricts access achieved through
dial-up connections (e.g., limiting dial-up access based upon source of
request) or protects against unauthorized connections or subversion of
authorized connections (e.g., using virtual private network technology).
NIST SP 800-63 provides guidance on remote electronic authentication. If
the federal Personal Identity Verification (PIV) credential is used as
an identification token where cryptographic token-based access control
is employed, the access control system conforms to the requirements of
FIPS 201 and NIST SP 800-73 and 800-78. NIST SP 800-77 provides guidance
on IPsec-based virtual private networks. Related security control:
IA-2.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

*Control Enhancements:*

*(1) The organization employs automated mechanisms to facilitate the
monitoring and control of remote access methods.*

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

*(2) The organization uses cryptography to protect the confidentiality
and integrity of remote access sessions.*

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

*(3) The organization controls all remote accesses through a limited
number of managed access control points.*

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

*(4) The organization permits remote access for privileged functions
only for compelling operational needs and documents the rationale for
such access in the security plan for the information system.*

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Wireless Access Restrictions (AC-18)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The organization: (i) establishes usage restrictions and
implementation guidance for wireless technologies; and (ii) authorizes,
monitors, controls wireless access to the information system.*

*Supplemental Guidance: NIST SP 800-48 and 800-97 provide guidance on
wireless network security. NIST SP 800-94 provides guidance on wireless
intrusion detection and prevention.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

*Control Enhancements:*

*(1) The organization uses authentication and encryption to protect
wireless access to the information system.*

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Access Control for Portable and Mobile Devices (AC-19)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The organization: (i) establishes usage restrictions and
implementation guidance for organization-controlled portable and mobile
devices; and (ii) authorizes, monitors, and controls device access to
organizational information systems.*

*Supplemental Guidance: Portable and mobile devices (e.g., notebook
computers, personal digital assistants, cellular telephones, and other
computing and communications devices with network connectivity and the
capability of periodically operating in different physical locations)
are only allowed access to organizational information systems in
accordance with organizational security policies and procedures.
Security policies and procedures include device identification and
authentication, implementation of mandatory protective software (e.g.,
malicious code detection, firewall), configuration management, scanning
devices for malicious code, updating virus protection software, scanning
for critical software updates and patches, conducting primary operating
system (and possibly other resident software) integrity checks, and
disabling unnecessary hardware (e.g., wireless, infrared). Protecting
information residing on portable and mobile devices (e.g., employing
cryptographic mechanisms to provide confidentiality and integrity
protections during storage and while in transit when outside of
controlled areas) is covered in the media protection family. Related
security controls: MP-4, MP-5.*

*Control Enhancements: None.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Use of External Information Systems (AC-20)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The organization establishes terms and conditions for
authorized individuals to: (i) access the information system from an
external information system; and (ii) process, store, and/or transmit
organization-controlled information using an external information
system.*

*Supplemental Guidance: External information systems are information
systems or components of information systems that are outside of the
accreditation boundary established by the organization and for which the
organization typically has no direct control over the application of
required security controls or the assessment of security control
effectiveness. External information systems include, but are not limited
to, personally owned information systems (e.g., computers, cellular
telephones, or personal digital assistants); privately owned computing
and communications devices resident in commercial or public facilities
(e.g., hotels, convention centers, or airports); information systems
owned or controlled by nonfederal governmental organizations; and
federal information systems that are not owned by, operated by, or under
the direct control of the organization.*

*Authorized individuals include organizational personnel, contractors,
or any other individuals with authorized access to the organizational
information system. This control does not apply to the use of external
information systems to access organizational information systems and
information that are intended for public access (e.g., individuals
accessing federal information through public interfaces to
organizational information systems). The organization establishes terms
and conditions for the use of external information systems in accordance
with organizational security policies and procedures. The terms and
conditions address as a minimum; (i) the types of applications that can
be accessed on the organizational information system from the external
information system; and (ii) the maximum FIPS 199 security category of
information that can be processed, stored, and transmitted on the
external information system.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

*Control Enhancements:*

*(1) The organization prohibits authorized individuals from using an
external information system to access the information system or to
process, store, or transmit organization-controlled information except
in situations where the organization: (i) can verify the employment of
required security controls on the external system as specified in the
organization's information security policy and system security plan; or
(ii) has approved information system connection or processing agreements
with the organizational entity hosting the external information system.*

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

## Audit and Accountability (AU)

### Audit and Accountability Policy and Procedures (AU-1)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

Control: The organization develops, disseminates, and periodically
reviews/updates: (i) a formal, documented, audit and accountability
policy that addresses purpose, scope, roles, responsibilities,
management commitment, coordination among organizational entities, and
compliance; and (ii) formal, documented procedures to facilitate the
implementation of the audit and accountability policy and associated
audit and accountability controls.

*Supplemental Guidance: The audit and accountability policy and
procedures are consistent with applicable laws, Executive Orders,
directives, policies, regulations, standards, and guidance. The audit
and accountability policy can be included as part of the general
information security policy for the organization. Audit and
accountability procedures can be developed for the security program in
general, and for a particular information system, when required. NIST
Special Publication 800-12 provides guidance on security policies and
procedures.*

*Control Enhancements: None.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Auditable Events (AU-2)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The information system generates audit records for the
following events: \[Assignment: organization-defined auditable
events\].*

*Supplemental Guidance: The purpose of this control is to identify
important events which need to be audited as significant and relevant to
the security of the information system. The organization specifies which
information system components carry out auditing activities. Auditing
activity can affect information system performance. Therefore, the
organization decides, based upon a risk assessment, which events require
auditing on a continuous basis and which events require auditing in
response to specific situations. Audit records can be generated at
various levels of abstraction, including at the packet level as
information traverse the network. Selecting the right level of
abstraction for audit record generation is a critical aspect of an audit
capability and can facilitate the identification of root causes to
problems. Additionally, the security audit function is coordinated with
the network health and status monitoring function to enhance the mutual
support between the two functions by the selection of information to be
recorded by each function. The checklists and configuration guides at
<http://csrc.nist.gov/pcig/cig.html> provide recommended lists of
auditable events. The organization defines auditable events that are
adequate to support after-the-fact investigations of security incidents.
NIST SP 800-92 provides guidance on computer security log management.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

*Control Enhancements:*

*(3) The organization periodically reviews and updates the list of
organization-defined auditable events.*

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Content of Audit Records (AU-3)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

Control: The information system produces audit records that contain
sufficient information to establish what events occurred, the sources of
the events, and the outcomes of the events.

*Supplemental Guidance: Audit record content includes, for most audit
records: (i) date and time of the event; (ii) the component of the
information system (e.g., software component, hardware component) where
the event occurred; (iii) type of event; (iv) user/subject identity; and
(v) the outcome (success or failure) of the event. NIST Special
Publication 800-92 provides guidance on computer security log
management.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

*Control Enhancements:*

*(1) The information system provides the capability to include
additional, more detailed information in the audit records for audit
events identified by type, location, or subject.*

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Audit Storage Capacity (AU-4)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

Control: The organization allocates sufficient audit record storage
capacity and configures auditing to reduce the likelihood of such
capacity being exceeded.

*Supplemental Guidance: The organization provides sufficient audit
storage capacity, taking into account the auditing to be performed and
the online audit processing requirements. Related security controls:
AU-2, AU-5, AU-6, AU-7, SI-4.*

*Control Enhancements: None.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Response to Audit Processing Failures (AU-5)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The information system alerts appropriate organizational
officials in the event of an audit processing failure and takes the
following additional actions: \[Assignment: organization-defined actions
to be taken (e.g., shut down information system, overwrite oldest audit
records, stop generating audit records)\].*

*Supplemental Guidance: Audit processing failures include, for example,
software/hardware errors, failures in the audit capturing mechanisms,
and audit storage capacity being reached or exceeded. Related security
control: AU-4.*

*Control Enhancements: None.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Audit Monitoring, Analysis, and Reporting (AU-6)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

Control: The organization regularly reviews/analyzes information system
audit records for indications of inappropriate or unusual activity,
investigates suspicious activity or suspected violations, reports
findings to appropriate officials, and takes necessary actions.

*Supplemental Guidance: Organizations increase the level of audit
monitoring and analysis activity within the information system whenever
there is an indication of increased risk to organizational operations,
organizational assets, or individuals based on law enforcement
information, intelligence information, or other credible sources of
information.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

*Control Enhancements:*

*(2) The organization employs automated mechanisms to alert security
personnel of the following inappropriate or unusual activities with
security implications: \[Assignment: organization-defined list of
inappropriate or unusual activities that are to result in alerts\].*

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Audit Reduction and Report Generation (AU-7)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The information system provides an audit reduction and report
generation capability.*

*Supplemental Guidance: Audit reduction, review, and reporting tools
support after-the-fact investigations of security incidents without
altering original audit records.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

*Control Enhancements:*

*(1) The information system provides the capability to automatically
process audit records for events of interest based upon selectable,
event criteria.*

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Time Stamps (AU-8)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The information system provides time stamps for use in audit
record generation.*

*Supplemental Guidance: Time stamps (including date and time) of audit
records are generated using internal system clocks.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

*Control Enhancements:*

*(1) The organization synchronizes internal information system clocks
\[Assignment: organization-defined frequency\].*

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Protection of Audit Information (AU-9)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

Control: The information system protects audit information and audit
tools from unauthorized access, modification, and deletion.

*Supplemental Guidance: Audit information includes all information
(e.g., audit records, audit settings, and audit reports) needed to
successfully audit information system activity.*

*Control Enhancements: None.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Audit Record Retention (AU-11)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

Control: The organization retains audit records for \[Assignment:
organization-defined time period\] to provide support for after-the-fact
investigations of security incidents and to meet regulatory and
organizational information retention requirements.

*Supplemental Guidance: The organization retains audit records until it
is determined that they are no longer needed for administrative, legal,
audit, or other operational purposes. This includes, for example,
retention and availability of audit records relative to Freedom of
Information Act (FOIA) requests, subpoena, and law enforcement actions.
Standard categorizations of audit records relative to such types of
actions and standard response processes for each type of action are
developed and disseminated. NIST Special Publication 800-61 provides
guidance on computer security incident handling and audit record
retention.*

*Control Enhancements: None.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

## Identification and Authentication (IA)

### Identification and Authentication Policy and Procedures (IA-1)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The organization develops, disseminates, and periodically
reviews/updates: (i) a formal, documented, identification and
authentication policy that addresses purpose, scope, roles,
responsibilities, management commitment, coordination among
organizational entities, and compliance; and (ii) formal, documented
procedures to facilitate the implementation of the identification and
authentication policy and associated identification and authentication
controls.*

*Supplemental Guidance: The identification and authentication policy and
procedures are consistent with: (i) FIPS 201 and NIST SP 800-73, 800-76,
and 800-78; and (ii) other applicable federal laws, directives,
policies, regulations, standards, and guidance. The identification and
authentication policy can be included as part of the general information
security policy for the organization. Identification and authentication
procedures can be developed for the security program in general, and for
a particular information system, when required. NIST SP 800-12 provides
guidance on security policies and procedures. NIST SP 800-63 provides
guidance on remote electronic authentication.*

*Control Enhancements: None.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### User Identification and Authentication (IA-2)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The information system uniquely identifies and authenticates
users (or processes acting on behalf of users).*

*Supplemental Guidance: Users are uniquely identified and authenticated
for all accesses other than those accesses explicitly identified and
documented by the organization in accordance security control AC-14.
Authentication of user identities is accomplished through the use of
passwords, tokens, biometrics, or in the case of multifactor
authentication, some combination thereof. NIST SP 800-63 provides
guidance on remote electronic authentication including strength of
authentication mechanisms. For purposes of this control, the guidance
provided in NIST SP 800-63 is applied to both local and remote access to
information systems. Remote access is any access to an organizational
information system by a user (or an information system) communicating
through an external, non-organization-controlled network (e.g., the
Internet). Local access is any access to an organizational information
system by a user (or an information system) communicating through an
internal organization-controlled network (e.g., local area network) or
directly to a device without the use of a network. Unless a more
stringent control enhancement is specified, authentication for both
local and remote information system access is NIST SP 800-63 level 1
compliant. FIPS 201 and NIST SP 800-73, 800-76, and 800-78 specify a
personal identity verification (PIV) credential for use in the unique
identification and authentication of federal employees and contractors.
In addition to identifying and authenticating users at the information
system level (i.e., at system logon), identification and authentication
mechanisms are employed at the application level, when necessary, to
provide increased information security for the organization.*

*In accordance with OMB policy and E-Authentication E-Government
initiative, authentication of public users accessing federal information
systems may also be required to protect nonpublic or privacy-related
information. The e-authentication risk assessment conducted in
accordance with OMB Memorandum 04-04 is used in determining the NIST SP
800-63 compliance requirements for such accesses with regard to the IA-2
control and its enhancements. Scalability, practicality, and security
issues are simultaneously considered in balancing the need to ensure
ease of use for public access to such information and information
systems with the need to protect organizational operations,
organizational assets, and individuals. Related security controls:
AC-14, AC-17.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

*Control Enhancements:*

*(1) The information system employs multifactor authentication for
remote system access that is NIST SP 800-63 \[Selection:
organization-defined level 3, level 3 using a hardware authentication
device, or level 4\] compliant.*

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Device Identification and Authentication (IA-3)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The information system identifies and authenticates specific
devices before establishing a connection.*

*Supplemental Guidance: The information system typically uses either
shared known information (e.g., Media Access Control (MAC) or
Transmission Control Protocol/Internet Protocol (TCP/IP) addresses) or
an organizational authentication solution (e.g., IEEE 802.1x and
Extensible Authentication Protocol (EAP) or a Radius server with
EAP-Transport Layer Security (TLS) authentication) to identify and
authenticate devices on local and/or wide area networks. The required
strength of the device authentication mechanism is determined by the
FIPS 199 security categorization of the information system with higher
impact levels requiring stronger authentication.*

*Control Enhancements: None.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Identifier Management (IA-4)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

Control: The organization manages user identifiers by: (i) uniquely
identifying each user; (ii) verifying the identity of each user; (iii)
receiving authorization to issue a user identifier from an appropriate
organization official; (iv) issuing the user identifier to the intended
party; (v) disabling the user identifier after \[Assignment:
organization-defined time period\] of inactivity; and (vi) archiving
user identifiers.

*Supplemental Guidance: Identifier management is not applicable to
shared information system accounts (e.g., guest and anonymous accounts).
FIPS 201 and Special Publications 800-73, 800-76, and 800-78 specify a
personal identity verification (PIV) credential for use in the unique
identification and authentication of federal employees and contractors.*

*Control Enhancements: None.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Authenticator Management (IA-5)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The organization manages information system authenticators by:
(i) defining initial authenticator content; (ii) establishing
administrative procedures for initial authenticator distribution, for
lost/compromised, or damaged authenticators, and for revoking
authenticators; (iii) changing default authenticators upon information
system installation; and (iv) changing/refreshing authenticators
periodically.*

*Supplemental Guidance: Information system authenticators include, for
example, tokens, PKI certificates, biometrics, passwords, and key cards.
Users take reasonable measures to safeguard authenticators including
maintaining possession of their individual authenticators, not loaning
or sharing authenticators with others, and reporting lost or compromised
authenticators immediately. For password-based authentication, the
information system: (i) protects passwords from unauthorized disclosure
and modification when stored and transmitted; (ii) prohibits passwords
from being displayed when entered; (iii) enforces password minimum and
maximum lifetime restrictions; and (iv) prohibits password reuse for a
specified number of generations. For PKI-based authentication, the
information system: (i) validates certificates by constructing a
certification path to an accepted trust anchor; (ii) establishes user
control of the corresponding private key; and (iii) maps the
authenticated identity to the user account. In accordance with OMB
policy and related E-authentication initiatives, authentication of
public users accessing federal information systems (and associated
authenticator management) may also be required to protect nonpublic or
privacy-related information. FIPS 201 and Special Publications 800-73,
800-76, and 800-78 specify a personal identity verification (PIV)
credential for use in the unique identification and authentication of
federal employees and contractors. NIST Special Publication 800-63
provides guidance on remote electronic authentication.*

*Control Enhancements: None.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Authenticator Feedback (IA-6)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

Control: The information system obscures feedback of authentication
information during the authentication process to protect the information
from possible exploitation/use by unauthorized individuals.

*Supplemental Guidance: The feedback from the information system does
not provide information that would allow an unauthorized user to
compromise the authentication mechanism. Displaying asterisks when a
user types in a password is an example of obscuring feedback of
authentication information.*

*Control Enhancements: None.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Cryptographic Module Authentication (IA-7)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

Control: The information system employs authentication methods that meet
the requirements of applicable laws, Executive Orders, directives,
policies, regulations, standards, and guidance for authentication to a
cryptographic module.

*Supplemental Guidance: The applicable federal standard for
authentication to a cryptographic module is FIPS 140-2 (as amended).
Validation certificates issued by the NIST Cryptographic Module
Validation Program (including FIPS 140-1, FIPS 140-2, and future
amendments) remain in effect, and the modules remain available for
continued use and purchase until a validation certificate is
specifically revoked. Additional information on the use of validated
cryptography is available at http://csrc.nist.gov/cryptval.*

*Control Enhancements: None.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

## System and Communications Protection (SC)

### System and Communications Protection Policy and Procedures (SC-1)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The organization develops, disseminates, and periodically
reviews/updates: (i) a formal, documented, system and communications
protection policy that addresses purpose, scope, roles,
responsibilities, management commitment, coordination among
organizational entities, and compliance; and (ii) formal, documented
procedures to facilitate the implementation of the system and
communications protection policy and associated system and
communications protection controls.*

*Supplemental Guidance: The system and communications protection policy
and procedures are consistent with applicable laws, Executive Orders,
directives, policies, regulations, standards, and guidance. The system
and communications protection policy can be included as part of the
general information security policy for the organization. System and
communications protection procedures can be developed for the security
program in general, and for a particular information system, when
required. NIST Special Publication 800-12 provides guidance on security
policies and procedures.*

*Control Enhancements: None.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Application Partitioning (SC-2)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The information system separates user functionality (including
user interface services) from information system management
functionality.*

*Supplemental Guidance: The information system physically or logically
separates user interface services (e.g., public web pages) from
information storage and management services (e.g., database management).
Separation may be accomplished through the use of different computers,
different central processing units, different instances of the operating
system, different network addresses, combinations of these methods, or
other methods as appropriate.*

*Control Enhancements: None.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Information Remnance (SC-4)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The information system prevents unauthorized and unintended
information transfer via shared system resources.*

*Supplemental Guidance: Control of information system remnance,
sometimes referred to as object reuse, or data remnance, prevents
information, including encrypted representations of information,
produced by the actions of a prior user/role (or the actions of a
process acting on behalf of a prior user/role) from being available to
any current user/role (or current process) that obtains access to a
shared system resource (e.g., registers, main memory, secondary storage)
after that resource has been released back to the information system.*

*Control Enhancements: None.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Denial of Service Protection (SC-5)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The information system protects against or limits the effects
of the following types of denial of service attacks: \[Assignment:
organization-defined list of types of denial of service attacks or
reference to source for current list\].*

*Supplemental Guidance: A variety of technologies exist to limit, or in
some cases, eliminate the effects of denial of service attacks. For
example, boundary protection devices can filter certain types of packets
to protect devices on an organization's internal network from being
directly affected by denial of service attacks. Information systems that
are publicly accessible can be protected by employing increased capacity
and bandwidth combined with service redundancy.*

*Control Enhancements: None.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Boundary Protection (SC-7)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

Control: The information system monitors and controls communications at
the external boundary of the information system and at key internal
boundaries within the system.

*Supplemental Guidance: Any connections to the Internet, or other
external networks or information systems, occur through managed
interfaces consisting of appropriate boundary protection devices (e.g.,
proxies, gateways, routers, firewalls, guards, encrypted tunnels)
arranged in an effective architecture (e.g., routers protecting
firewalls and application gateways residing on a protected subnetwork
commonly referred to as a demilitarized zone or DMZ). Information system
boundary protections at any designated alternate processing sites
provide the same levels of protection as that of the primary site.*

*As part of a defense-in-depth protection strategy, the organization
considers partitioning higher-impact information systems into separate
physical domains (or environments) and applying the concepts of managed
interfaces described above to restrict or prohibit network access in
accordance with an organizational assessment of risk. FIPS 199 security
categorization guides the selection of appropriate candidates for domain
partitioning.*

*The organization carefully considers the intrinsically shared nature of
commercial telecommunications services in the implementation of security
controls associated with the use of such services. Commercial
telecommunications services are commonly based on network components and
consolidated management systems shared by all attached commercial
customers, and may include third party provided access lines and other
service elements. Consequently, such interconnecting transmission
services may represent sources of increased risk despite contract
security provisions. Therefore, when this situation occurs, the
organization either implements appropriate compensating security
controls or explicitly accepts the additional risk. NIST Special
Publication 800-77 provides guidance on virtual private networks.
Related security controls: MP-4, RA-2.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

*Control Enhancements:*

*(1) The organization physically allocates publicly accessible
information system components to separate subnetworks with separate,
physical network interfaces.*

*Enhancement Supplemental Guidance: Publicly accessible information
system components include, for example, public web servers.*

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

*(2) The organization prevents public access into the organization's
internal networks except as appropriately mediated.*

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

*(3) The organization limits the number of access points to the
information system to allow for better monitoring of inbound and
outbound network traffic.*

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

*(4) The organization implements a managed interface (boundary
protection devices in an effective security architecture) with any
external telecommunication service, implementing controls appropriate to
the required protection of the confidentiality and integrity of the
information being transmitted.*

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

*(5) The information system denies network traffic by default and allows
network traffic by exception (i.e., deny all, permit by exception).*

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Transmission Integrity (SC-8)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The information system protects the integrity of transmitted
information.*

*Supplemental Guidance: If the organization is relying on a commercial
service provider for transmission services as a commodity item rather
than a fully dedicated service, it may be more difficult to obtain the
necessary assurances regarding the implementation of needed security
controls for transmission integrity. When it is infeasible or
impractical to obtain the necessary security controls and assurances of
control effectiveness through appropriate contracting vehicles, the
organization either implements appropriate compensating security
controls or explicitly accepts the additional risk. NIST Special
Publication 800-52 provides guidance on protecting transmission
integrity using Transport Layer Security (TLS). NIST Special Publication
800-77 provides guidance on protecting transmission integrity using
IPsec. NIST Special Publication 800-81 provides guidance on Domain Name
System (DNS) message authentication and integrity verification. NSTISSI
No. 7003 contains guidance on the use of Protective Distribution
Systems.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Transmission Confidentiality (SC-9)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The information system protects the confidentiality of
transmitted information.*

*Supplemental Guidance: If the organization is relying on a commercial
service provider for transmission services as a commodity item rather
than a fully dedicated service, it may be more difficult to obtain the
necessary assurances regarding the implementation of needed security
controls for transmission confidentiality. When it is infeasible or
impractical to obtain the necessary security controls and assurances of
control effectiveness through appropriate contracting vehicles, the
organization either implements appropriate compensating security
controls or explicitly accepts the additional risk. NIST Special
Publication 800-52 provides guidance on protecting transmission
confidentiality using Transport Layer Security (TLS). NIST Special
Publication 800-77 provides guidance on protecting transmission
confidentiality using IPsec. NSTISSI No. 7003 contains guidance on the
use of Protective Distribution Systems. Related security control:
AC-17.*

*Control Enhancements:None.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Network Disconnect (SC-10)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The information system terminates a network connection at the
end of a session or after \[Assignment: organization-defined time
period\] of inactivity.*

*Supplemental Guidance: The organization applies this control within the
context of risk management that considers specific mission or
operational requirements.*

*Control Enhancements: None.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Cryptographic Key Establishment and Management (SC-12)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

Control: When cryptography is required and employed within the
information system, the organization establishes and manages
cryptographic keys using automated mechanisms with supporting procedures
or manual procedures.

*Supplemental Guidance: NIST Special Publication 800-56 provides
guidance on cryptographic key establishment. NIST Special Publication
800-57 provides guidance on cryptographic key management.*

*Control Enhancements: None.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Use of Cryptography (SC-13)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: For information requiring cryptographic protection, the
information system implements cryptographic mechanisms that comply with
applicable federal laws, Executive Orders, directives, policies,
regulations, standards, and guidance.*

*Supplemental Guidance: The applicable federal standard for employing
cryptography in nonnational security information systems is FIPS 140-2
(as amended). Validation certificates issued by the NIST Cryptographic
Module Validation Program (including FIPS 140-1, FIPS 140-2, and future
amendments) remain in effect and the modules remain available for
continued use and purchase until a validation certificate is
specifically revoked. NIST SP 800-56 and 800-57 provide guidance on
cryptographic key establishment and cryptographic key management.
Additional information on the use of validated cryptography is available
at <http://csrc.nist.gov/cryptval>.*

*Control Enhancements: None.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Public Access Protections (SC-14)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The information system protects the integrity and availability
of publicly available information and applications.*

*Supplemental Guidance: None.*

*Control Enhancements: None.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Collaborative Computing (SC-15)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The information system prohibits remote activation of
collaborative computing mechanisms and provides an explicit indication
of use to the local users.*

*Supplemental Guidance: Collaborative computing mechanisms include, for
example, video and audio conferencing capabilities. Explicit indication
of use includes, for example, signals to local users when cameras and/or
microphones are activated.*

*Control Enhancements: None.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Public Key Infrastructure Certificates (SC-17)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The organization issues public key certificates under an
appropriate certificate policy or obtains public key certificates under
an appropriate certificate policy from an approved service provider.*

*Supplemental Guidance: For user certificates, each agency either
establishes an agency certification authority cross-certified with the
Federal Bridge Certification Authority at medium assurance or higher or
uses certificates from an approved, shared service provider, as required
by OMB Memorandum 05-24. NIST SP 800-32 provides guidance on public key
technology. NIST SP 800-63 provides guidance on remote electronic
authentication.*

*Control Enhancements: None.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Mobile Code (SC-18)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The organization: (i) establishes usage restrictions and
implementation guidance for mobile code technologies based on the
potential to cause damage to the information system if used maliciously;
and (ii) authorizes, monitors, and controls the use of mobile code
within the information system.*

*Supplemental Guidance: Mobile code technologies include, for example,
Java, JavaScript, ActiveX, PDF, Postscript, Shockwave movies, Flash
animations, and VBScript. Usage restrictions and implementation guidance
apply to both the selection and use of mobile code installed on
organizational servers and mobile code downloaded and executed on
individual workstations. Control procedures prevent the development,
acquisition, or introduction of unacceptable mobile code within the
information system. NIST SP 800-28 provides guidance on active content
and mobile code.*

*Control Enhancements: None.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Voice Over Internet Protocol (SC-19)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The organization: (i) establishes usage restrictions and
implementation guidance for Voice over Internet Protocol (VoIP)
technologies based on the potential to cause damage to the information
system if used maliciously; and (ii) authorizes, monitors, and controls
the use of VoIP within the information system.*

*Supplemental Guidance: NIST SP 800-58 provides guidance on security
considerations for VoIP technologies employed in information systems.*

*Control Enhancements: None.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Secure Name/Address Resolution Service (Authoritative Source) (SC-20)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The information system that provides name/address resolution
service provides additional data origin and integrity artifacts along
with the authoritative data it returns in response to resolution
queries.*

*Supplemental Guidance: This control enables remote clients to obtain
origin authentication and integrity verification assurances for the
name/address resolution information obtained through the service. A
domain name system (DNS) server is an example of an information system
that provides name/address resolution service; digital signatures and
cryptographic keys are examples of additional artifacts; and DNS
resource records are examples of authoritative data. NIST SP 800-81
provides guidance on secure domain name system deployment.*

*Control Enhancements: None.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Architecture and Provisioning for Name/Address Resolution Service (SC-22)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The information systems that collectively provide name/address
resolution service for an organization are fault tolerant and implement
role separation.*

*Supplemental Guidance: A domain name system (DNS) server is an example
of an information system that provides name/address resolution service.
To eliminate single points of failure and to enhance redundancy, there
are typically at least two authoritative domain name system (DNS)
servers, one configured as primary and the other as secondary.
Additionally, the two servers are commonly located in two different
network subnets and geographically separated (i.e., not located in the
same physical facility). If organizational information technology
resources are divided into those resources belonging to internal
networks and those resources belonging to external networks,
authoritative DNS servers with two roles (internal and external) are
established. The DNS server with the internal role provides name/address
resolution information pertaining to both internal and external
information technology resources while the DNS server with the external
role only provides name/address resolution information pertaining to
external information technology resources. The list of clients who can
access the authoritative DNS server of a particular role is also
specified. NIST SP 800-81 provides guidance on secure DNS deployment.*

*Control Enhancements: None.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

### Session Authenticity (SC-23)

**Implementation Status**: [In Place / Not In Place / Planned / Not
Applicable -- if Not in Place or Planned then add, Risk = (Low,
Moderate, High)]{.mark}

*Control: The information system provides mechanisms to protect the
authenticity of communications sessions.*

*Supplemental Guidance: This control focuses on communications
protection at the session, versus packet, level. The intent of this
control is to implement session-level protection where needed (e.g., in
service-oriented architectures providing web-based services). NIST SP
800-52 provides guidance on the use of transport layer security (TLS)
mechanisms. NIST SP 800-77 provides guidance on the deployment of IPsec
virtual private networks (VPNs) and other methods of protecting
communications sessions. NIST SP 800-95 provides guidance on secure web
services.*

*Control Enhancements: None.*

**Implementation**: [As applicable, describe how the control is
implemented within the system.]{.mark}

#  {#section-1 .unnumbered}

# SYSTEM SECURITY Plan Approval {#system-security-plan-approval .unnumbered}

We have reviewed the system security plan for [\[SYSTEM NAME\]]{.mark}
and have made the determination that the security requirements and
security controls selected for this system are in fact adequate to
satisfy the security objectives of confidentiality, integrity, and
availability based on the identified security impact level for [\[SYSTEM
NAME\]]{.mark}.

[\[Insert Name\],]{.mark} System Owner Date

[\[Insert Name\],]{.mark} Certifying Official Date

[\[Insert Name\],]{.mark} Authorizing Official Date

[]{.mark}

[\[Add additional signature blocks as needed\]]{.mark}

##### Acronyms

  -----------------------------------------------------------------------
  Acronym    Definition
  ---------- ------------------------------------------------------------
  AIS        Automated Information System

  AC         Access Control

  ACL        Access Control Lists

  ADP        Automated Data Processing

  AO         Authorizing Official

  AT         Awareness and Training

  AU         Audit and Accountability

  C&A        Certification and Accreditation

  CDS        Classification Dispute System

  CM         Configuration Management

  COTS       Commercial-off-the-Shelf

  CP         Contingency Planning

  DCID       Director of Central Intelligence Directives

  DoC        Department of Commerce

  DoD        Department of Defense

  DoS        Denial of Service

  DISA       Defense Information Systems Agency

  FIPS       Federal Information Processing Standard

  FISCAM     Federal Information Systems Control Audit Manual

  FISMA      Federal Information Systems Management Act

  FRAP       Facilitated Risk Assessment Plan

  GAO        Government Accountability Office

  GISRA      Government Information Security Review Act

  GPL        General Public License

  GSS        General Support System

  HLA        High-Level Architecture

  IA         Information Assurance

  IA         Identification and Authentication

  IP         Internet Protocol

  IPA        Internet Purchasing Application System

  IPD        Initial Public Draft

  IR         Incident Response

  IRM        Information Resources Management

  IS         Information System

  ISS        Internet Security Scanner™

  IT         Information Technology

  ITSPD      Information Technology Security Policy Division

  LAN        Local Area Network

  LCM        Lifecycle Management

  MA         Maintenance

  NIACAP     National Information Assurance Certification and
             Accreditation Process

  NIST       National Institute of Standards and Technology

  NOD        Network Operation Division

  NT         New Technology (Microsoft Windows NT™)

  NTFS       New Technology File System (Microsoft Windows NT/2000/XP™)

  MA         Major Application

  OACS       Office Automation Correspondence System

  OCIO       Office of the Chief Information Officer

  OIG        Office of Inspector General

  OMB        Office of Management and Budgeting

  OS         Operating System

  OSP        Operational Support Plans

  PE         Physical and Environment Protection

  PL         Planning

  PTONet     PTO Network

  PS         Personnel Security

  RA         Risk Assessment

  RAM        Revenue Accounting and Management

  RDBMS      Relation Data Base Management System

  RTM        Requirements Traceability Matrix

  SA         System Administrator

  SA         System and Services Acquisition

  SAP        Security Controls Assessment Plan

  SBU        Sensitive but Unclassified

  SC         System and Communications Protection

  SCA        Security Controls Assessment

  SDD        System Design Documents

  SDM        Systems Developer Manager

  SI         System and Information Integrity

  SMM        System Maintenance Manager

  SO         System Owner

  SPAD       System Product Assurance Division

  SRR        Security Readiness Review

  SSP        System Security Plan

  ST&E       Security Test and Evaluation

  STIG       Security Technical Implementation Guide

  USPTO      United States Patent and Trademark Office
  -----------------------------------------------------------------------

[^1]: All security controls (management, operational, technical) and
    descriptions are based on NIST SP 800-53, Rev.1, December 2006.