Lexim011/Compliance huggingface dataset:
CCI-001070 (policy): The organization defines a frequency for employing automated mechanisms to detect the presence of unauthorized software on organizational information systems and notify designated organizational officials.
References: NIST: NIST SP 800-53 (v3): RA-5 (7) NIST: NIST SP 800-53A (v1): RA-5 (7).1 (i)
CCI-001072 (policy): The organization employs an independent penetration agent or penetration team to conduct a vulnerability analysis on the information system.
References: NIST: NIST SP 800-53 (v3): RA-5 (9) (a) NIST: NIST SP 800-53A (v1): RA-5 (9).1
CCI-001073 (policy): The organization employs an independent penetration agent or penetration team to perform penetration testing on the information system based on the vulnerability analysis to determine the exploitability of identified vulnerabilities.
References: NIST: NIST SP 800-53 (v3): RA-5 (9) (b) NIST: NIST SP 800-53A (v1): RA-5 (9).1
CCI-001074 (policy): The organization develops a system and communications protection policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.
References: NIST: NIST SP 800-53 (v3): SC-1 a NIST: NIST SP 800-53 Revision 4 (v4): SC-1 a 1 NIST: NIST SP 800-53A (v1): SC-1.1 (i) (ii)
CCI-001078 (policy): The organization develops system and communications protection procedures to facilitate the implementation of the system and communications protection policy and associated system and communications protection controls.
References: NIST: NIST SP 800-53 (v3): SC-1 b NIST: NIST SP 800-53 Revision 4 (v4): SC-1 a 2 NIST: NIST SP 800-53A (v1): SC-1.1 (iv) (v)
CCI-001087 (technical): The organization implements an information system isolation boundary to minimize the number of nonsecurity functions included within the boundary containing security functions.
References: NIST: NIST SP 800-53 (v3): SC-3 (3) NIST: NIST SP 800-53A (v1): SC-3 (3).1
CCI-001088 (policy): The organization implements security functions as largely independent modules that avoid unnecessary interactions between modules.
References: NIST: NIST SP 800-53 (v3): SC-3 (4) NIST: NIST SP 800-53A (v1): SC-3 (4).1
CCI-001091 (technical): The information system does not share resources that are used to interface with systems operating at different security levels.
References: NIST: NIST SP 800-53 (v3): SC-4 (1) NIST: NIST SP 800-53A (v1): SC-4 (1).1
CCI-001092 (technical): The information system protects against or limits the effects of the organization-defined or referenced types of denial of service attacks.
References: NIST: NIST SP 800-53 (v3): SC-5 NIST: NIST SP 800-53A (v1): SC-5.1 (ii)
CCI-001096 (technical): The information system limits the use of resources by priority.
References: NIST: NIST SP 800-53 (v3): SC-6 NIST: NIST SP 800-53A (v1): SC-6.1
CCI-001099 (policy): The organization physically allocates publicly accessible information system components to separate subnetworks with separate physical network interfaces.
References: NIST: NIST SP 800-53 (v3): SC-7 (1) NIST: NIST SP 800-53A (v1): SC-7 (1).1
CCI-001100 (technical): The information system prevents public access into the organization's internal networks except as appropriately mediated by managed interfaces employing boundary protection devices.
References: NIST: NIST SP 800-53 (v3): SC-7 (2) NIST: NIST SP 800-53A (v1): SC-7 (2).1 (ii)
CCI-001104 (policy): The organization employs security controls as needed to protect the confidentiality and integrity of the information being transmitted.
References: NIST: NIST SP 800-53 (v3): SC-7 (4) (c) NIST: NIST SP 800-53A (v1): SC-7 (4).1 (iv)
CCI-001110 (policy): The organization prevents the unauthorized release of information outside of the information system boundary or any unauthorized communication through the information system boundary when there is an operational failure of the boundary protection mechanisms.
References: NIST: NIST SP 800-53 (v3): SC-7 (6) NIST: NIST SP 800-53A (v1): SC-7 (6).1 (i) (ii)
CCI-001111 (technical): The information system prevents remote devices that have established a non-remote connection with the system from communicating outside of that communications path with resources in external networks.
References: NIST: NIST SP 800-53 (v3): SC-7 (7) NIST: NIST SP 800-53A (v1): SC-7 (7).1
CCI-001115 (technical): The information system, at managed interfaces, denies network traffic and audits internal users (or malicious code) posing a threat to external information systems.
References: NIST: NIST SP 800-53 (v3): SC-7 (9) NIST: NIST SP 800-53A (v1): SC-7 (9).1 (i) (ii)
CCI-001117 (technical): The information system checks incoming communications to ensure the communications are coming from an authorized source and routed to an authorized destination.
References: NIST: NIST SP 800-53 (v3): SC-7 (11) NIST: NIST SP 800-53A (v1): SC-7 (11).1
CCI-001118 (technical): The information system implements host-based boundary protection mechanisms for servers, workstations, and mobile devices.
References: NIST: NIST SP 800-53 (v3): SC-7 (12) NIST: NIST SP 800-53A (v1): SC-7 (12).1
CCI-001122 (policy): The organization defines the managed interfaces where boundary protections against unauthorized physical connections are to be implemented.
References: NIST: NIST SP 800-53 (v3): SC-7 (14) NIST: NIST SP 800-53 Revision 4 (v4): SC-7 (14) NIST: NIST SP 800-53A (v1): SC-7 (14).1 (i)
CCI-001127 (technical): The information system protects the integrity of transmitted information.
References: NIST: NIST SP 800-53 (v3): SC-8 NIST: NIST SP 800-53A (v1): SC-8.1
CCI-001128 (technical): The organization employs cryptographic mechanisms to recognize changes to information during transmission unless otherwise protected by alternative physical measures.
References: NIST: NIST SP 800-53 (v3): SC-8 (1) NIST: NIST SP 800-53A (v1): SC-8 (1).1
CCI-001129 (technical): The information system maintains the integrity of information during aggregation, packaging, and transformation in preparation for transmission.
References: NIST: NIST SP 800-53 (v3): SC-8 (2) NIST: NIST SP 800-53A (v1): SC-8 (2).1
CCI-001130 (technical): The information system protects the confidentiality of transmitted information.
References: NIST: NIST SP 800-53 (v3): SC-9 NIST: NIST SP 800-53A (v1): SC-9.1
CCI-001131 (technical): The organization employs cryptographic mechanisms to prevent unauthorized disclosure of information during transmission unless otherwise protected by alternative physical measures.
References: NIST: NIST SP 800-53 (v3): SC-9 (1) NIST: NIST SP 800-53A (v1): SC-9 (1).1
CCI-001132 (technical): The information system maintains the confidentiality of information during aggregation, packaging, and transformation in preparation for transmission.
References: NIST: NIST SP 800-53 (v3): SC-9 (2) NIST: NIST SP 800-53A (v1): SC-9 (2).1
CCI-001136 (policy): The organization defines security functions include information system authentication and reauthentication.
References: NIST: NIST SP 800-53 (v3): SC-11 NIST: NIST SP 800-53A (v1): SC-11.1 (ii)
CCI-001137 (policy): The organization establishes cryptographic keys for required cryptography employed within the information system.
References: NIST: NIST SP 800-53 (v3): SC-12 NIST: NIST SP 800-53A (v1): SC-12.1
CCI-001138 (policy): The organization manages cryptographic keys for required cryptography employed within the information system.
References: NIST: NIST SP 800-53 (v3): SC-12 NIST: NIST SP 800-53A (v1): SC-12.1
CCI-001140 (technical): The organization produces, controls, and distributes symmetric cryptographic keys using NIST-approved or NSA-approved key management technology and processes.
References: NIST: NIST SP 800-53 (v3): SC-12 (2) NIST: NIST SP 800-53A (v1): SC-12 (2).1
CCI-001141 (technical): The organization produces, controls, and distributes symmetric and asymmetric cryptographic keys using NSA-approved key management technology and processes.
References: NIST: NIST SP 800-53 (v3): SC-12 (3) NIST: NIST SP 800-53A (v1): SC-12 (3).1
CCI-001142 (technical): The organization produces, controls, and distributes asymmetric cryptographic keys using approved PKI Class 3 certificates or prepositioned keying material.
References: NIST: NIST SP 800-53 (v3): SC-12 (4) NIST: NIST SP 800-53A (v1): SC-12 (4).1
CCI-001143 (technical): The organization produces, controls, and distributes asymmetric cryptographic keys using approved PKI Class 3 or Class 4 certificates and hardware security tokens that protect the user's private key.
References: NIST: NIST SP 800-53 (v3): SC-12 (5) NIST: NIST SP 800-53A (v1): SC-12 (5).1
CCI-001144 (technical): The information system implements required cryptographic protections using cryptographic modules that comply with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.
References: NIST: NIST SP 800-53 (v3): SC-13 NIST: NIST SP 800-53A (v1): SC-13.1
CCI-001145 (technical): The organization employs, at a minimum, FIPS-validated cryptography to protect unclassified information.
References: NIST: NIST SP 800-53 (v3): SC-13 (1) NIST: NIST SP 800-53A (v1): SC-13 (1).1
CCI-001146 (technical): The organization employs NSA-approved cryptography to protect classified information.
References: NIST: NIST SP 800-53 (v3): SC-13 (2) NIST: NIST SP 800-53A (v1): SC013 (2(.1
CCI-001147 (technical): The organization employs, at a minimum, FIPS-validated cryptography to protect information when such information must be separated from individuals who have the necessary clearances yet lack the necessary access approvals.
References: NIST: NIST SP 800-53 (v3): SC-13 (3) NIST: NIST SP 800-53A (v1): SC-13 (3).1
CCI-001148 (technical): The organization employs FIPS-validated or NSA-approved cryptography to implement digital signatures.
References: NIST: NIST SP 800-53 (v3): AU-10 (5) NIST: NIST SP 800-53 (v3): SC-13 (4) NIST: NIST SP 800-53A (v1): AU-10 (5).1 (ii) NIST: NIST SP 800-53A (v1): SC-13 (4).1
CCI-001149 (technical): The information system protects the integrity and availability of publicly available information and applications.
References: NIST: NIST SP 800-53 (v3): SC-14 NIST: NIST SP 800-53A (v1): SC-14.1
CCI-001154 (technical): The information system or supporting environment blocks both inbound and outbound traffic between instant messaging clients that are independently configured by end users and external service providers.
References: NIST: NIST SP 800-53 (v3): SC-15 (2) NIST: NIST SP 800-53A (v1): SC-15 (2).1
CCI-001161 (policy): The organization establishes usage restrictions for acceptable mobile code and mobile code technologies.
References: NIST: NIST SP 800-53 (v3): SC-18 b NIST: NIST SP 800-53 Revision 4 (v4): SC-18 b NIST: NIST SP 800-53A (v1): SC-18.1 (ii)
CCI-001162 (policy): The organization establishes implementation guidance for acceptable mobile code and mobile code technologies.
References: NIST: NIST SP 800-53 (v3): SC-18 b NIST: NIST SP 800-53 Revision 4 (v4): SC-18 b NIST: NIST SP 800-53A (v1): SC-18.1 (ii)
CCI-001173 (policy): The organization establishes usage restrictions for Voice over Internet Protocol (VoIP) technologies based on the potential to cause damage to the information system if used maliciously.
References: NIST: NIST SP 800-53 (v3): SC-19 a NIST: NIST SP 800-53 Revision 4 (v4): SC-19 a NIST: NIST SP 800-53A (v1): SC-19.1 (i)
CCI-001174 (policy): The organization establishes implementation guidance for Voice over Internet Protocol (VoIP) technologies based on the potential to cause damage to the information system if used maliciously.
References: NIST: NIST SP 800-53 (v3): SC-19 a NIST: NIST SP 800-53 Revision 4 (v4): SC-19 a NIST: NIST SP 800-53A (v1): SC-19.1 (i)
CCI-001175 (policy): The organization authorizes the use of VoIP within the information system.
References: NIST: NIST SP 800-53 (v3): SC-19 b NIST: NIST SP 800-53 Revision 4 (v4): SC-19 b NIST: NIST SP 800-53A (v1): SC-19.1 (ii)
CCI-001176 (policy): The organization monitors the use of VoIP within the information system.
References: NIST: NIST SP 800-53 (v3): SC-19 b NIST: NIST SP 800-53 Revision 4 (v4): SC-19 b NIST: NIST SP 800-53A (v1): SC-19.1 (ii)
CCI-001177 (policy): The organization controls the use of VoIP within the information system.
References: NIST: NIST SP 800-53 (v3): SC-19 b NIST: NIST SP 800-53 Revision 4 (v4): SC-19 b NIST: NIST SP 800-53A (v1): SC-19.1 (ii)
CCI-001180 (technical): The information system performs data origin authentication and data integrity verification on the name/address resolution responses the system receives from authoritative sources when requested by client systems.
References: NIST: NIST SP 800-53 (v3): SC-21 NIST: NIST SP 800-53A (v1): SC-21.1
CCI-001181 (technical): The information system performs data origin authentication and data integrity verification on all resolution responses received whether or not local client systems explicitly request this service.
References: NIST: NIST SP 800-53 (v3): SC-21 (1) NIST: NIST SP 800-53A (v1): SC-21 (1).1
CCI-001186 (technical): The information system provides a readily observable logout capability whenever authentication is used to gain access to web pages.
References: NIST: NIST SP 800-53 (v3): SC-23 (2) NIST: NIST SP 800-53A (v1): SC-23 (2).1
CCI-001187 (technical): The information system generates a unique session identifier for each session.
References: NIST: NIST SP 800-53 (v3): SC-23 (3) NIST: NIST SP 800-53A (v1): SC-23 (3).1 (i)
CCI-001200 (technical): The organization employs cryptographic mechanisms to prevent unauthorized disclosure of information at rest unless otherwise protected by alternative physical measures.
References: NIST: NIST SP 800-53 (v3): SC-28 (1) NIST: NIST SP 800-53A (v1): SC-28 (1).1 (i)
CCI-001202 (policy): The organization employs virtualization techniques to present information system components as other types of components, or components with differing configurations.
References: NIST: NIST SP 800-53 (v3): SC-30 NIST: NIST SP 800-53A (v1): SC-30.1
CCI-001205 (policy): The organization employs randomness in the implementation of the virtualization techniques.
References: NIST: NIST SP 800-53 (v3): SC-30 (2) NIST: NIST SP 800-53A (v1): SC-30 (2).1
CCI-001206 (policy): The organization requires that information system developers/integrators perform a covert channel analysis to identify those aspects of system communication that are potential avenues for covert storage and timing channels.
References: NIST: NIST SP 800-53 (v3): SC-31 NIST: NIST SP 800-53A (v1): SC-31.1
CCI-001208 (policy): The organization partitions the information system into components residing in separate physical domains (or environments) as deemed necessary.
References: NIST: NIST SP 800-53 (v3): SC-32 NIST: NIST SP 800-53A (v1): SC-32.1
CCI-001209 (technical): The information system protects the integrity of information during the processes of data aggregation, packaging, and transformation in preparation for transmission.
References: NIST: NIST SP 800-53 (v3): SC-33 NIST: NIST SP 800-53A (v1): SC-33.1
CCI-001231 (policy): The organization centrally manages the flaw remediation process.
References: NIST: NIST SP 800-53 (v3): SI-2 (1) NIST: NIST SP 800-53 Revision 4 (v4): SI-2 (1) NIST: NIST SP 800-53A (v1): SI-2 (1).1
CCI-001232 (technical): The organization installs software updates automatically.
References: NIST: NIST SP 800-53 (v3): SI-2 (1) NIST: NIST SP 800-53A (v1): SI-2 (1).1
CCI-001233 (technical): The organization employs automated mechanisms on an organization-defined frequency to determine the state of information system components with regard to flaw remediation.
References: NIST: NIST SP 800-53 (v3): SI-2 (2) NIST: NIST SP 800-53 Revision 4 (v4): SI-2 (2) NIST: NIST SP 800-53A (v1): SI-2 (2).1 (ii)
CCI-001234 (policy): The organization defines a frequency for employing automated mechanisms to determine the state of information system components with regard to flaw remediation.
References: NIST: NIST SP 800-53 (v3): SI-2 (2) NIST: NIST SP 800-53 Revision 4 (v4): SI-2 (2) NIST: NIST SP 800-53A (v1): SI-2 (2).1 (i)
CCI-001237 (technical): The organization employs automated patch management tools to facilitate flaw remediation to organization-defined information system components.
References: NIST: NIST SP 800-53 (v3): SI-2 (4) NIST: NIST SP 800-53A (v1): SI-2 (4).1 (ii)
CCI-001238 (policy): The organization defines information system components for which automated patch management tools are to be employed to facilitate flaw remediation.
References: NIST: NIST SP 800-53 (v3): SI-2 (4) NIST: NIST SP 800-53A (v1): SI-2 (4).1 (i)
CCI-001239 (technical): The organization employs malicious code protection mechanisms at information system entry and exit points to detect and eradicate malicious code transported by electronic mail, electronic mail attachments, web accesses, removable media, or other common means or inserted through the exploitation of information system vulnerabilities.
References: NIST: NIST SP 800-53 (v3): SI-3 a NIST: NIST SP 800-53A (v1): SI-3.1 (i)
CCI-001240 (technical): The organization updates malicious code protection mechanisms whenever new releases are available in accordance with organizational configuration management policy and procedures.
References: NIST: NIST SP 800-53 (v3): SI-3 b NIST: NIST SP 800-53 Revision 4 (v4): SI-3 b NIST: NIST SP 800-53A (v1): SI-3.1 (iii)
CCI-001242 (technical): The organization configures malicious code protection mechanisms to perform real-time scans of files from external sources at endpoints as the files are downloaded, opened, or executed in accordance with organizational security policy.
References: NIST: NIST SP 800-53 (v3): SI-3 c NIST: NIST SP 800-53 Revision 4 (v4): SI-3 c 1 NIST: NIST SP 800-53A (v1): SI-3.1 (vi)
CCI-001246 (policy): The organization centrally manages malicious code protection mechanisms.
References: NIST: NIST SP 800-53 (v3): SI-3 (1) NIST: NIST SP 800-53 Revision 4 (v4): SI-3 (1) NIST: NIST SP 800-53A (v1): SI-3 (1).1
CCI-001247 (technical): The information system automatically updates malicious code protection mechanisms.
References: NIST: NIST SP 800-53 (v3): SI-3 (2) NIST: NIST SP 800-53 Revision 4 (v4): SI-3 (2) NIST: NIST SP 800-53A (v1): SI-3 (2).1
CCI-001248 (technical): The information system prevents non-privileged users from circumventing malicious code protection capabilities.
References: NIST: NIST SP 800-53 (v3): SI-3 (3) NIST: NIST SP 800-53A (v1): SI-3 (3).1
CCI-001250 (technical): The organization does not allow users to introduce removable media into the information system.
References: NIST: NIST SP 800-53 (v3): SI-3 (5) NIST: NIST SP 800-53A (v1): SI-3 (5).1
CCI-001252 (policy): The organization monitors events on the information system in accordance with organization-defined monitoring objectives and detects information system attacks.
References: NIST: NIST SP 800-53 (v3): SI-4 a NIST: NIST SP 800-53A (v1): SI-4.1 (ii)
CCI-001254 (policy): The organization identifies unauthorized use of the information system.
References: NIST: NIST SP 800-53 (v3): SI-4 b NIST: NIST SP 800-53A (v1): SI-4.1 (iii)
CCI-001259 (technical): The organization interconnects and configures individual intrusion detection tools into a systemwide intrusion detection system using common protocols.
References: NIST: NIST SP 800-53 (v3): SI-4 (1) NIST: NIST SP 800-53A (v1): SI-4 (1).1
CCI-001261 (policy): The organization employs automated tools to integrate intrusion detection tools into access control and flow control mechanisms for rapid response to attacks by enabling reconfiguration of these mechanisms in support of attack isolation and elimination.
References: NIST: NIST SP 800-53 (v3): SI-4 (3) NIST: NIST SP 800-53A (v1): SI-4 (3).1
CCI-001262 (technical): The information system monitors inbound and outbound communications for unusual or unauthorized activities or conditions.
References: NIST: NIST SP 800-53 (v3): SI-4 (4) NIST: NIST SP 800-53A (v1): SI-4
CCI-001263 (technical): The information system provides near real-time alerts when any of the organization-defined list of compromise or potential compromise indicators occurs.
References: NIST: NIST SP 800-53 (v3): SI-4 (5) NIST: NIST SP 800-53A (v1): SI-4 (5).1 (ii)
CCI-001265 (technical): The information system prevents non-privileged users from circumventing intrusion detection and prevention capabilities.
References: NIST: NIST SP 800-53 (v3): SI-4 (6) NIST: NIST SP 800-53A (v1): SI-4 (6).1
CCI-001269 (technical): The organization protects information obtained from intrusion monitoring tools from unauthorized access, modification, and deletion.
References: NIST: NIST SP 800-53 (v3): SI-4 (8) NIST: NIST SP 800-53A (v1): SI-4 (8).1
CCI-001272 (technical): The organization makes provisions so encrypted traffic is visible to information system monitoring tools.
References: NIST: NIST SP 800-53 (v3): SI-4 (10) NIST: NIST SP 800-53A (v1): SI-4 (10).1
CCI-001278 (policy): The organization uses the traffic/event profiles in tuning system monitoring devices to reduce the number of false positives to an organization-defined measure of false positives and the number of false negatives to an organization-defined measure of false negatives.
References: NIST: NIST SP 800-53 (v3): SI-4 (13) (c) NIST: NIST SP 800-53A (v1): SI-4 (13).1 (iv)
CCI-001279 (policy): The organization defines the respective measurements to which the organization must tune system monitoring devices to reduce the number of false positives.
References: NIST: NIST SP 800-53 (v3): SI-4 (13) (c) NIST: NIST SP 800-53A (v1): SI-4 (13).1 (iii)
CCI-001280 (policy): The organization defines the respective measurements to which the organization must tune system monitoring devices to reduce the number of false negatives.
References: NIST: NIST SP 800-53 (v3): SI-4 (13) (c) NIST: NIST SP 800-53A (v1): SI-4 (13).1 (iii)
CCI-001281 (policy): The organization employs a wireless intrusion detection system.
References: NIST: NIST SP 800-53 (v3): SI-4 (14) NIST: NIST SP 800-53A (v1): SI-4 (14).1 (i)
CCI-001291 (technical): The information system verifies the correct operation of security functions in accordance with organization-defined conditions and in accordance with organization-defined frequency (if periodic verification).
References: NIST: NIST SP 800-53 (v3): SI-6 NIST: NIST SP 800-53A (v1): SI-6.1 (iv)
CCI-001292 (policy): The organization defines the appropriate conditions, including the system transitional states if applicable, for verifying the correct operation of security functions.
References: NIST: NIST SP 800-53 (v3): SI-6 NIST: NIST SP 800-53A (v1): SI-6.1 (i)
CCI-001293 (policy): The organization defines the information system responses and alternative action(s) to anomalies discovered during security function verification.
References: NIST: NIST SP 800-53 (v3): SI-6 NIST: NIST SP 800-53A (v1): SI-6.1 (iii)
CCI-001297 (technical): The information system detects unauthorized changes to software and information.
References: NIST: NIST SP 800-53 (v3): SI-7 NIST: NIST SP 800-53A (v1): SI-7.1
CCI-001298 (policy): The organization reassesses the integrity of software and information by performing, on an organization-defined frequency, integrity scans of the information system.
References: NIST: NIST SP 800-53 (v3): SI-7 (1) NIST: NIST SP 800-53A (v1): SI-7 (1).1 (ii)
CCI-001299 (policy): The organization defines the frequency of integrity scans to be performed on the information system.
References: NIST: NIST SP 800-53 (v3): SI-7 (1) NIST: NIST SP 800-53A (v1): SI-7 (1).1 (i)
CCI-001302 (policy): The organization requires use of tamper-evident packaging for organization-defined information system components during organization-defined conditions.
References: NIST: NIST SP 800-53 (v3): SI-7 (4) NIST: NIST SP 800-53A (v1): SI-7 (4).1 (iii)
CCI-001303 (policy): The organization defines information system components that require tamper-evident packaging.
References: NIST: NIST SP 800-53 (v3): SI-7 (4) NIST: NIST SP 800-53A (v1): SI-7 (4).1 (i)
CCI-001304 (policy): The organization defines conditions (i.e., transportation from vendor to operational site, during operation, both) under which tamper-evident packaging must be used for organization-defined information system components.
References: NIST: NIST SP 800-53 (v3): SI-7 (4) NIST: NIST SP 800-53A (v1): SI-7 (4).1 (ii)
CCI-001305 (technical): The organization employs spam protection mechanisms at information system entry and exit points to detect and take action on unsolicited messages transported by electronic mail, electronic mail attachments, web accesses, removable media, or other common means.
References: NIST: NIST SP 800-53 (v3): SI-8 a NIST: NIST SP 800-53A (v1): SI-8.1 (i)
CCI-001306 (policy): The organization updates spam protection mechanisms when new releases are available in accordance with organizational configuration management policy and procedures.
References: NIST: NIST SP 800-53 (v3): SI-8 b NIST: NIST SP 800-53 Revision 4 (v4): SI-8 b NIST: NIST SP 800-53A (v1): SI-8.1 (iii)
CCI-001307 (policy): The organization centrally manages spam protection mechanisms.
References: NIST: NIST SP 800-53 (v3): SI-8 (1) NIST: NIST SP 800-53 Revision 4 (v4): SI-8 (1) NIST: NIST SP 800-53A (v1): SI-8 (1).1
CCI-001309 (policy): The organization restricts the capability to input information to the information system to authorized personnel.
References: NIST: NIST SP 800-53 (v3): SI-9 NIST: NIST SP 800-53A (v1): SI-9.1
CCI-001311 (technical): The information system identifies potentially security-relevant error conditions.
References: NIST: NIST SP 800-53 (v3): SI-11 a NIST: NIST SP 800-53A (v1): SI-11.1 (i)
CCI-001313 (policy): The organization defines sensitive or potentially harmful information that should not be contained in error logs and administrative messages.
References: NIST: NIST SP 800-53 (v3): SI-11 b NIST: NIST SP 800-53A (v1): SI-11.1 (ii)
CCI-001316 (policy): The organization protects the information system from harm by considering mean time to failure rates for an organization-defined list of information system components in specific environments of operation.
References: NIST: NIST SP 800-53 (v3): SI-13 a NIST: NIST SP 800-53A (v1): SI-13.1 (ii)
CCI-001317 (policy): The organization defines a list of information system components for which mean time to failure rates should be considered to protect the information system from harm.
References: NIST: NIST SP 800-53 (v3): SI-13 a NIST: NIST SP 800-53A (v1): SI-13.1 (i)
CCI-001324 (policy): The organization defines the minimum frequency at which the organization manually initiates a transfer between active and standby information system components if the mean time to failure (MTTF) exceeds the organization-defined time period.
References: NIST: NIST SP 800-53 (v3): SI-13 (3) NIST: NIST SP 800-53 Revision 4 (v4): SI-13 (3) NIST: NIST SP 800-53A (v1): SI-13 (3).1 (i)
CCI-001325 (policy): The organization defines a time period that the mean time to failure (MTTF) must exceed before the organization manually initiates a transfer between active and standby information system components.
References: NIST: NIST SP 800-53 (v3): SI-13 (3) NIST: NIST SP 800-53 Revision 4 (v4): SI-13 (3) NIST: NIST SP 800-53A (v1): SI-13 (3).1 (ii)
CCI-001338 (technical): The information system associates the identity of the information producer with the information.
References: NIST: NIST SP 800-53 (v3): AU-10 (1) NIST: NIST SP 800-53A (v1): AU-10 (1).1
CCI-001339 (technical): The information system validates the binding of the information producer's identity to the information.
References: NIST: NIST SP 800-53 (v3): AU-10 (2) NIST: NIST SP 800-53A (v1): AU-10 (2).1
CCI-001342 (technical): The organization employs either FIPS-validated or NSA-approved cryptography to implement digital signatures.
References: NIST: NIST SP 800-53 (v3): AU-10 (5) NIST: NIST SP 800-53A (v1): AU-10 (5).1
CCI-001343 (technical): The information system invokes a system shutdown in the event of an audit failure, unless an alternative audit capability exists.
References: NIST: NIST SP 800-53 (v3): AU-5 (4) NIST: NIST SP 800-53A (v1): AU-5 (4).1
CCI-001344 (policy): The organization specifies the permitted actions for each authorized information system process, role, and/or user in the audit and accountability policy.
References: NIST: NIST SP 800-53 (v3): AU-6 (7) NIST: NIST SP 800-53A (v1): AU-6 (7).1
CCI-001345 (technical): The organization employs automated mechanisms to alert security personnel of any organization-defined inappropriate or unusual activities with security implications.
References: NIST: NIST SP 800-53 (v3): AU-6 (8) NIST: NIST SP 800-53A (v1): AU-6 (8).1 (ii)
CCI-001346 (policy): The organization defines a list of inappropriate or unusual activities with security implications that are to result in alerts to security personnel.
References: NIST: NIST SP 800-53 (v3): AU-6 (8) NIST: NIST SP 800-53A (v1): AU-6 (8).1 (i)
CCI-001347 (policy): The organization performs, in a physically dedicated information system, full-text analysis of privileged functions executed.
References: NIST: NIST SP 800-53 (v3): AU-6 (9) NIST: NIST SP 800-53A (v1): AU-6 (9).1
CCI-001352 (technical): The organization protects the audit records of non-local accesses to privileged accounts and the execution of privileged functions.
References: NIST: NIST SP 800-53 (v3): AU-9 (4) (b) NIST: NIST SP 800-53A (v1): AU-9 (4).1 (ii)
CCI-001354 (policy): The organization manages information system accounts by deactivating temporary accounts that are no longer required.
References: NIST: NIST SP 800-53 (v3): AC-2 h NIST: NIST SP 800-53A (v1): AC-2.1 (i)
CCI-001355 (policy): The organization manages information system accounts by deactivating accounts of terminated or transferred users.
References: NIST: NIST SP 800-53 (v3): AC-2 h NIST: NIST SP 800-53A (v1): AC-2.1 (i)
CCI-001356 (technical): The organization monitors for atypical usage of information system accounts.
References: NIST: NIST SP 800-53 (v3): AC-2 (5) (c) NIST: NIST SP 800-53A (v1): AC-2 (5).1 (iv)
CCI-001357 (policy): The organization reports atypical usage to designated organizational officials.
References: NIST: NIST SP 800-53 (v3): AC-2 (5) (d) NIST: NIST SP 800-53A (v1): AC-2 (5).1 (v)
CCI-001359 (policy): The organization tracks privileged role assignments.
References: NIST: NIST SP 800-53 (v3): AC-2 (7) (b) NIST: NIST SP 800-53A (v1): AC-2 (7).1 (ii)
CCI-001362 (technical): The information system enforces a Discretionary Access Control (DAC) policy that allows users to specify and control sharing by named individuals or groups of individuals, or by both.
References: NIST: NIST SP 800-53 (v3): AC-3 (4) NIST: NIST SP 800-53A (v1): AC-3 (4).1
CCI-001363 (policy): The organization establishes a Discretionary Access Control (DAC) policy that allows users to specify and control sharing by named individuals or groups of individuals, or by both.
References: NIST: NIST SP 800-53 (v3): AC-3 (4) (a) NIST: NIST SP 800-53A (v1): AC-3 (4).1
CCI-001366 (policy): The organization defines user information to be encrypted or stored off-line in a secure location.
References: NIST: NIST SP 800-53 (v3): AC-3 (6) NIST: NIST SP 800-53A (v1): AC-3 (6).1 (i)
CCI-001367 (policy): The organization defines system information to be encrypted or stored off-line in a secure location.
References: NIST: NIST SP 800-53 (v3): AC-3 (6) NIST: NIST SP 800-53A (v1): AC-3 (6).1 (i)
CCI-001376 (technical): The information system uniquely identifies source domains for information transfer.
References: NIST: NIST SP 800-53 (v3): AC-4 (17) (a) NIST: NIST SP 800-53A (v1): AC-4 (17).1 (i)
CCI-001377 (technical): The information system uniquely authenticates source domains for information transfer.
References: NIST: NIST SP 800-53 (v3): AC-4 (17) (a) NIST: NIST SP 800-53A (v1): AC-4 (17).1 (ii)
CCI-001380 (policy): The organization documents separation of duties of individuals.
References: NIST: NIST SP 800-53 (v3): AC-5 b NIST: NIST SP 800-53 Revision 4 (v4): AC-5 b NIST: NIST SP 800-53A (v1): AC-5.1 (ii)
CCI-001382 (policy): The organization defines the number of consecutive, unsuccessful login attempts to the mobile device.
References: NIST: NIST SP 800-53 (v3): AC-7 (2) NIST: NIST SP 800-53A (v1): AC-7 (2).1 (i)
CCI-001383 (technical): The information system provides additional protection for mobile devices accessed via login by purging information from the device after an organization-defined number of consecutive, unsuccessful login attempts to the mobile device.
References: NIST: NIST SP 800-53 (v3): AC-7 (2) NIST: NIST SP 800-53A (v1): AC-7 (2).1 (i)
CCI-001396 (policy): The organization defines security attributes for which the information system supports and maintains the bindings for information in storage.
References: NIST: NIST SP 800-53 (v3): AC-16 NIST: NIST SP 800-53A (v1): AC-16.1 (i)
CCI-001397 (policy): The organization defines security attributes for which the information system supports and maintains the bindings for information in process.
References: NIST: NIST SP 800-53 (v3): AC-16 NIST: NIST SP 800-53A (v1): AC-16.1 (i)
CCI-001398 (policy): The organization defines security attributes for which the information system supports and maintains the bindings for information in transmission.
References: NIST: NIST SP 800-53 (v3): AC-16 NIST: NIST SP 800-53A (v1): AC-16.1 (i)
CCI-001399 (technical): The information system supports and maintains the binding of organization-defined security attributes to information in storage.
References: NIST: NIST SP 800-53 (v3): AC-16 NIST: NIST SP 800-53A (v1): AC-16.1 (ii)
CCI-001400 (technical): The information system supports and maintains the binding of organization-defined security attributes to information in process.
References: NIST: NIST SP 800-53 (v3): AC-16 NIST: NIST SP 800-53A (v1): AC-16.1 (ii)
CCI-001401 (technical): The information system supports and maintains the binding of organization-defined security attributes to information in transmission.
References: NIST: NIST SP 800-53 (v3): AC-16 NIST: NIST SP 800-53A (v1): AC-16.1 (ii)
CCI-001402 (policy): The organization monitors for unauthorized remote access to the information system.
References: NIST: NIST SP 800-53 (v3): AC-17 c NIST: NIST SP 800-53A (v1): AC-17.1 (iii)
CCI-001409 (policy): The organization defines nondiscretionary access control policies to be enforced over the organization-defined set of users and resources, where the rule set for each policy specifies access control information employed by the policy rule set (e.g., position, nationality, age, project, time of day) and required relationships among the access control information to permit access.
References: NIST: NIST SP 800-53 (v3): AC-3 (3) NIST: NIST SP 800-53A (v1): AC-3 (3).1 (ii)
CCI-001410 (policy): The organization defines the set of users and resources over which the information system is to enforce nondiscretionary access control policies.
References: NIST: NIST SP 800-53 (v3): AC-3 (3) NIST: NIST SP 800-53A (v1): AC-3 (3).1 (i)
CCI-001412 (policy): The organization encrypts or stores off-line, in a secure location, organization-defined user information.
References: NIST: NIST SP 800-53 (v3): AC-3 (6) NIST: NIST SP 800-53A (v1): AC-3 (6).1 (ii)
CCI-001413 (policy): The organization encrypts or stores off-line, in a secure location, organization-defined system information.
References: NIST: NIST SP 800-53 (v3): AC-3 (6) NIST: NIST SP 800-53A (v1): AC-3 (6).1 (ii)
CCI-001416 (policy): The organization defines one-way information flows to be enforced by the information system.
References: NIST: NIST SP 800-53 (v3): AC-4 (7) NIST: NIST SP 800-53 Revision 4 (v4): AC-4 (7) NIST: NIST SP 800-53A (v1): AC-4 (7).1 (i)
CCI-001418 (policy): The organization defines security policy filters for which the information system enforces the use of human review.
References: NIST: NIST SP 800-53 (v3): AC-4 (9) NIST: NIST SP 800-53A (v1): AC-4 (9).1 (i)
CCI-001421 (policy): The organization limits authorization to super user accounts on the information system to designated system administration personnel.
References: NIST: NIST SP 800-53 (v3): AC-6 (5) NIST: NIST SP 800-53A (v1): AC-6 (5).1
CCI-001426 (technical): The information system maintains the binding of security attributes to information with sufficient assurance that the information--attribute association can be used as the basis for automated policy actions.
References: NIST: NIST SP 800-53 (v3): AC-16 (3) NIST: NIST SP 800-53A (v1): AC-16 (3).1
CCI-001427 (technical): The information system allows authorized users to associate security attributes with information.
References: NIST: NIST SP 800-53 (v3): AC-16 (4) NIST: NIST SP 800-53A (v1): AC-16 (4).1 (ii)
CCI-001431 (policy): The organization defines a frequency for monitoring for unauthorized remote connections to the information system.
References: NIST: NIST SP 800-53 (v3): AC-17 (5) NIST: NIST SP 800-53A (v1): AC-17 (5).1 (i)
CCI-001432 (policy): The organization takes appropriate action if an unauthorized remote connection to the information system is discovered.
References: NIST: NIST SP 800-53 (v3): AC-17 (5) NIST: NIST SP 800-53A (v1): AC-17 (5).1 (iv)
CCI-001433 (policy): The organization defines a list of security functions and security-relevant information that for remote access sessions have organization-defined security measures employed and are audited.
References: NIST: NIST SP 800-53 (v3): AC-17 (7) NIST: NIST SP 800-53A (v1): AC-17 (7).1 (i)
CCI-001434 (policy): The organization defines additional security measures to be employed when an organization-defined list of security functions and security-relevant information is accessed remotely.
References: NIST: NIST SP 800-53 (v3): AC-17 (7) NIST: NIST SP 800-53A (v1): AC-17 (7).1 (ii)
CCI-001435 (policy): The organization defines networking protocols within the information system deemed to be nonsecure.
References: NIST: NIST SP 800-53 (v3): AC-17 (8) NIST: NIST SP 800-53A (v1): AC-17 (8).1 (i)
CCI-001436 (technical): The organization disables organization-defined networking protocols within the information system deemed to be nonsecure except for explicitly identified components in support of specific operational requirements.
References: NIST: NIST SP 800-53 (v3): AC-17 (8) NIST: NIST SP 800-53A (v1): AC-17 (8).1 (ii)
CCI-001437 (policy): The organization documents the rationale for the execution of privileged commands and access to security-relevant information in the security plan for the information system.
References: NIST: NIST SP 800-53 (v3): AC-17 (4) NIST: NIST SP 800-53A (v1): AC-17 (4).1 (ii)
CCI-001438 (policy): The organization establishes usage restrictions for wireless access.
References: NIST: NIST SP 800-53 (v3): AC-18 a NIST: NIST SP 800-53 Revision 4 (v4): AC-18 a NIST: NIST SP 800-53A (v1): AC-18.1 (i)
CCI-001440 (policy): The organization monitors for unauthorized wireless access to the information system.
References: NIST: NIST SP 800-53 (v3): AC-18 b NIST: NIST SP 800-53A (v1): AC-18.1 (ii)
CCI-001442 (policy): The organization enforces requirements for wireless connections to the information system.
References: NIST: NIST SP 800-53 (v3): AC-18 d NIST: NIST SP 800-53A (v1): AC-18.1 (iv)
CCI-001445 (policy): The organization monitors for unauthorized wireless connections to the information system on an organization-defined frequency.
References: NIST: NIST SP 800-53 (v3): AC-18 (2) NIST: NIST SP 800-53A (v1): AC-18 (2).1 (ii)
CCI-001446 (policy): The organization scans for unauthorized wireless access points on an organization-defined frequency.
References: NIST: NIST SP 800-53 (v3): AC-18 (2) NIST: NIST SP 800-53A (v1): AC-18 (2).1 (ii)
CCI-001447 (policy): The organization defines a frequency of monitoring for unauthorized wireless connections to information system, including scans for unauthorized wireless access points.
References: NIST: NIST SP 800-53 (v3): AC-18 (2) NIST: NIST SP 800-53A (v1): AC-18 (2).1 (i)
CCI-001448 (policy): The organization takes appropriate action if an unauthorized wireless connection is discovered.
References: NIST: NIST SP 800-53 (v3): AC-18 (2) NIST: NIST SP 800-53A (v1): AC-18 (2).1 (iv)
CCI-001450 (policy): The organization does not allow users to independently configure wireless networking capabilities.
References: NIST: NIST SP 800-53 (v3): AC-18 (4) NIST: NIST SP 800-53A (v1): AC-18 (4).1
CCI-001452 (technical): The information system enforces the organization-defined time period during which the limit of consecutive invalid access attempts by a user is counted.
References: NIST: NIST SP 800-53 (v3): AC-7 a NIST: NIST SP 800-53A (v1): AC-7.1 (ii)
CCI-001454 (technical): The organization ensures that remote sessions for accessing an organization-defined list of security functions and security-relevant information are audited.
References: NIST: NIST SP 800-53 (v3): AC-17 (7) NIST: NIST SP 800-53A (v1): AC-17 (7).1 (iv)
CCI-001455 (policy): The organization explicitly identifies components needed in support of specific operational requirements.
References: NIST: NIST SP 800-53 (v3): AC-17 (8) NIST: NIST SP 800-53A (v1): AC-17 (8).1 (ii)
CCI-001456 (policy): The organization defines locations that the organization deems to be of significant risk in accordance with organizational policies and procedures.
References: NIST: NIST SP 800-53 (v3): AC-19 f NIST: NIST SP 800-53A (v1): AC-19.1 (vi)
CCI-001457 (policy): The organization defines inspection and preventative measures to be applied on mobile devices returning from locations that the organization deems to be of significant risk in accordance with organizational policies and procedures.
References: NIST: NIST SP 800-53 (v3): AC-19 g NIST: NIST SP 800-53A (v1): AC-19.1 (vii)
CCI-001462 (technical): The information system provides the capability for authorized users to capture/record and log content related to a user session.
References: NIST: NIST SP 800-53 (v3): AU-14 a NIST: NIST SP 800-53 Revision 4 (v4): AU-14 (2) NIST: NIST SP 800-53A (v1): AU-14.1 (i)
CCI-001463 (technical): The information system provides the capability to remotely view/hear all content related to an established user session in real time.
References: NIST: NIST SP 800-53 (v3): AU-14 b NIST: NIST SP 800-53A (v1): AU-14.1 (ii)
CCI-001465 (policy): The organization establishes terms and conditions, consistent with any trust relationships established with other organizations owning, operating, and/or maintaining external information systems, allowing authorized individuals to store organization-controlled information using the external information systems.
References: NIST: NIST SP 800-53 (v3): AC-20 b NIST: NIST SP 800-53A (v1): AC-20.1
CCI-001466 (policy): The organization establishes terms and conditions, consistent with any trust relationships established with other organizations owning, operating, and/or maintaining external information systems, allowing authorized individuals to transmit organization-controlled information using the external information systems.
References: NIST: NIST SP 800-53 (v3): AC-20 b NIST: NIST SP 800-53A (v1): AC-20.1
CCI-001467 (policy): The organization prohibits authorized individuals from using an external information system to process organization-controlled information except in situations where the organization can verify the implementation of required security controls on the external system as specified in the organization's information security policy and security plan.
References: NIST: NIST SP 800-53 (v3): AC-20 (1) (a) NIST: NIST SP 800-53A (v1): AC-20 (1).1
CCI-001468 (policy): The organization prohibits authorized individuals from using an external information system to store organization-controlled information except in situations where the organization can verify the implementation of required security controls on the external system as specified in the organization's information security policy and security plan.
References: NIST: NIST SP 800-53 (v3): AC-20 (1) (a) NIST: NIST SP 800-53A (v1): AC-20 (1).1
CCI-001469 (policy): The organization prohibits authorized individuals from using an external information system to transmit organization-controlled information except in situations where the organization can verify the implementation of required security controls on the external system as specified in the organization's information security policy and security plan.
References: NIST: NIST SP 800-53 (v3): AC-20 (1) (a) NIST: NIST SP 800-53A (v1): AC-20 (1).1
CCI-001479 (policy): The organization provides refresher security awareness training to all information system users (including managers, senior executives, and contractors) in accordance with the organization-defined frequency.
References: NIST: NIST SP 800-53 (v3): AT-2 NIST: NIST SP 800-53 Revision 4 (v4): AT-2 c NIST: NIST SP 800-53A (v1): AT-2.1 (iii)
CCI-001480 (policy): The organization defines the frequency for providing refresher security awareness training to all information system users (including managers, senior executives, and contractors).
References: NIST: NIST SP 800-53 (v3): AT-2 NIST: NIST SP 800-53 Revision 4 (v4): AT-2 NIST: NIST SP 800-53A (v1): AT-2.1 (ii)
CCI-001486 (policy): The organization defines a frequency for reviewing and updating the list of organization-defined auditable events.
References: NIST: NIST SP 800-53 (v3): AU-2 (3) NIST: NIST SP 800-53 Revision 4 (v4): AU-2 (3) NIST: NIST SP 800-53A (v1): AU-2 (3).1 (i)
CCI-001489 (policy): The organization defines information system components for which generated audit records are centrally managed by the organization.
References: NIST: NIST SP 800-53 (v3): AU-3 (2) NIST: NIST SP 800-53A (v1): AU-3 (2).1 (i)
CCI-001492 (policy): The organization defines an authoritative time source for the synchronization of internal information system clocks.
References: NIST: NIST SP 800-53 (v3): AU-8 (1) NIST: NIST SP 800-53 Revision 4 (v4): AU-8 (1) (a) NIST: NIST SP 800-53A (v1): AU-8 (1).1 (ii)
CCI-001500 (technical): The information system automatically implements organization-defined safeguards and countermeasures if security functions (or mechanisms) are changed inappropriately.
References: NIST: NIST SP 800-53 (v3): CM-5 (7) NIST: NIST SP 800-53A (v1): CM-5 (7).1 (ii)
CCI-001501 (policy): The organization defines safeguards and countermeasures to be employed by the information system if security functions (or mechanisms) are changed inappropriately.
References: NIST: NIST SP 800-53 (v3): CM-5 (7) NIST: NIST SP 800-53A (v1): CM-5 (7).1 (i)
CCI-001502 (policy): The organization monitors changes to the configuration settings in accordance with organizational policies and procedures.
References: NIST: NIST SP 800-53 (v3): CM-6 d NIST: NIST SP 800-53 Revision 4 (v4): CM-6 d NIST: NIST SP 800-53A (v1): CM-6.1 (vi)
CCI-001503 (policy): The organization controls changes to the configuration settings in accordance with organizational policies and procedures.
References: NIST: NIST SP 800-53 (v3): CM-6 d NIST: NIST SP 800-53 Revision 4 (v4): CM-6 d NIST: NIST SP 800-53A (v1): CM-6.1 (vi)
CCI-001531 (policy): The organization ensures that individuals requiring access to organizational information and information systems sign appropriate access agreements prior to being granted access.
References: NIST: NIST SP 800-53 (v3): PS-6 a NIST: NIST SP 800-53 Revision 4 (v4): PS-6 c 1 NIST: NIST SP 800-53A (v1): PS-6.1 (i) (ii)
CCI-001534 (policy): The organization ensures that access to information with special protection measures is granted only to individuals who have a valid access authorization that is demonstrated by assigned official government duties.
References: NIST: NIST SP 800-53 (v3): PS-6 (1) (a) NIST: NIST SP 800-53A (v1): PS-6 (1).1
CCI-001535 (policy): The organization ensures that access to information with special protection measures is granted only to individuals who satisfy associated personnel security criteria.
References: NIST: NIST SP 800-53 (v3): PS-6 (1) (b) NIST: NIST SP 800-53A (v1): PS-6 (1).1
CCI-001542 (policy): The organization employs a formal sanctions process for individuals failing to comply with established information security policies and procedures.
References: NIST: NIST SP 800-53 (v3): PS-8 NIST: NIST SP 800-53 Revision 4 (v4): PS-8 a NIST: NIST SP 800-53A (v1): PS-8.1
CCI-001543 (policy): The organization disseminates the most recent information security program plan to appropriate entities in the organization that includes roles, responsibilities, management commitment, coordination among organizational entities, and compliance.
References: NIST: NIST SP 800-53 (v3): PM-1 a NIST: NIST SP 800-53A (v1): PM-1.1 (v)