Lexim011/Compliance huggingface dataset:
CCI-002448 (policy): Distribute asymmetric cryptographic keys using: NSA-approved key management technology and processes; prepositioned keying material; DoD-approved or DoD-issued Medium Assurance PKI certificates; DoD-approved or DoD-issued Medium Hardware Assurance PKI certificates and hardware security tokens that protect the user's private key; or certificates issued in accordance with organization-defined requirements.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-12 (3) NIST: NIST SP 800-53 Revision 5 (v5): SC-12 (3)
CCI-004898 (policy, technical): Defines requirements for certificates that are issued for producing, controlling, and distributing asymmetric cryptographic keys.
References: NIST: NIST SP 800-53 Revision 5 (v5): SC-12 (3)
CCI-004899 (policy, technical): Maintain physical control of cryptographic keys when store information is encrypted by external service providers.
References: NIST: NIST SP 800-53 Revision 5 (v5): SC-12 (6)
CCI-002449 (policy): Defines the cryptographic uses, and type of cryptography required for each use, to be implemented by the system.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-13 NIST: NIST SP 800-53 Revision 5 (v5): SC-13
CCI-004900 (technical): Determine the organization-defined cryptographic uses.
References: NIST: NIST SP 800-53 Revision 5 (v5): SC-13 a
CCI-002450 (technical): Implement organization-defined types of cryptography for each specified cryptography use.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-13 NIST: NIST SP 800-53 Revision 5 (v5): SC-13 b
CCI-001150 (technical): Prohibit remote activation of collaborative computing devices and applications, excluding the organization-defined exceptions where remote activation is to be allowed.
References: NIST: NIST SP 800-53 (v3): SC-15 a NIST: NIST SP 800-53 Revision 4 (v4): SC-15 a NIST: NIST SP 800-53 Revision 5 (v5): SC-15 a NIST: NIST SP 800-53A (v1): SC-15.1 (ii)
CCI-001151 (policy): Defines exceptions to the prohibition of collaborative computing devices where remote activation is to be allowed.
References: NIST: NIST SP 800-53 (v3): SC-15 a NIST: NIST SP 800-53 Revision 4 (v4): SC-15 a NIST: NIST SP 800-53 Revision 5 (v5): SC-15 a NIST: NIST SP 800-53A (v1): SC-15.1 (i)
CCI-001152 (technical): Provide an explicit indication of use to users physically present at collaborative computing devices.
References: NIST: NIST SP 800-53 (v3): SC-15 b NIST: NIST SP 800-53 Revision 4 (v4): SC-15 b NIST: NIST SP 800-53 Revision 5 (v5): SC-15 b NIST: NIST SP 800-53A (v1): SC-15.1 (iii)
CCI-001153 (technical): Provide physical or logical disconnect of collaborative computing devices in a manner that supports ease of use.
References: NIST: NIST SP 800-53 (v3): SC-15 (1) NIST: NIST SP 800-53 Revision 4 (v4): SC-15 (1) NIST: NIST SP 800-53 Revision 5 (v5): SC-15 (1) NIST: NIST SP 800-53A (v1): SC-15 (1).1
CCI-001155 (policy): Disable or remove collaborative computing devices and applications from organization-defined systems or system components in organization-defined secure work areas.
References: NIST: NIST SP 800-53 (v3): SC-15 (3) NIST: NIST SP 800-53 Revision 4 (v4): SC-15 (3) NIST: NIST SP 800-53 Revision 5 (v5): SC-15 (3) NIST: NIST SP 800-53A (v1): SC-15 (3).1 (ii)
CCI-001156 (policy): Defines secure work areas where collaborative computing devices and applications are to be disabled or removed.
References: NIST: NIST SP 800-53 (v3): SC-15 (3) NIST: NIST SP 800-53 Revision 4 (v4): SC-15 (3) NIST: NIST SP 800-53 Revision 5 (v5): SC-15 (3) NIST: NIST SP 800-53A (v1): SC-15 (3).1 (i)
CCI-002451 (policy): Defines the systems or system components from which collaborative computing devices and applications in organization-defined secure work areas are to be disabled or removed.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-15 (3) NIST: NIST SP 800-53 Revision 5 (v5): SC-15 (3)
CCI-002452 (policy): Defines the online meetings and teleconferences for which the system provides an explicit indication of current participants.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-15 (4) NIST: NIST SP 800-53 Revision 5 (v5): SC-15 (4)
CCI-002453 (technical): Provide an explicit indication of current participants in organization-defined online meetings and teleconferences.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-15 (4) NIST: NIST SP 800-53 Revision 5 (v5): SC-15 (4)
CCI-001157 (policy, technical): Associate organization-defined security attributes with information exchanged between systems.
References: NIST: NIST SP 800-53 (v3): SC-16 NIST: NIST SP 800-53 Revision 4 (v4): SC-16 NIST: NIST SP 800-53 Revision 5 (v5): SC-16 NIST: NIST SP 800-53A (v1): SC-16.1
CCI-002454 (policy): Defines the security attributes to associate with the information being exchanged between systems and between system components.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-16 NIST: NIST SP 800-53 Revision 5 (v5): SC-16
CCI-002455 (technical): Associate organization-defined security attributes with information exchanged between system components.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-16 NIST: NIST SP 800-53 Revision 5 (v5): SC-16
CCI-004901 (technical): Associate organization-defined privacy attributes with information exchanged between systems.
References: NIST: NIST SP 800-53 Revision 5 (v5): SC-16
CCI-004902 (technical): Associate organization-defined privacy attributes with information exchanged between system components.
References: NIST: NIST SP 800-53 Revision 5 (v5): SC-16
CCI-004903 (policy): Defines the privacy attributes to associate with the information being exchanged between systems and between system components.
References: NIST: NIST SP 800-53 Revision 5 (v5): SC-16
CCI-001158 (technical): Verify the integrity of transmitted security attributes.
References: NIST: NIST SP 800-53 (v3): SC-16 (1) NIST: NIST SP 800-53 Revision 4 (v4): SC-16 (1) NIST: NIST SP 800-53 Revision 5 (v5): SC-16 (1) NIST: NIST SP 800-53A (v1): SC-16 (1).1
CCI-004904 (technical): Verify the integrity of transmitted privacy attributes.
References: NIST: NIST SP 800-53 Revision 5 (v5): SC-16 (1)
CCI-004905 (technical): Implement anti-spoofing mechanisms to prevent adversaries from falsifying the security attributes indicating the successful application of the security process.
References: NIST: NIST SP 800-53 Revision 5 (v5): SC-16 (2)
CCI-004906 (technical): Implement organization-defined mechanisms or techniques to bind security attributes to transmitted information.
References: NIST: NIST SP 800-53 Revision 5 (v5): SC-16 (3)
CCI-004907 (technical): Implement organization-defined mechanisms or techniques to bind privacy attributes to transmitted information.
References: NIST: NIST SP 800-53 Revision 5 (v5): SC-16 (3)
CCI-004908 (technical): Defines the mechanisms or techniques for binding security and privacy attributes to transmitted information.
References: NIST: NIST SP 800-53 Revision 5 (v5): SC-16 (3)
CCI-001159 (policy): Issue public key certificates under an organization-defined certificate policy or obtain public key certificates from an approved service provider.
References: NIST: NIST SP 800-53 (v3): SC-17 NIST: NIST SP 800-53 Revision 4 (v4): SC-17 NIST: NIST SP 800-53 Revision 5 (v5): SC-17 a NIST: NIST SP 800-53A (v1): SC-17.1
CCI-002456 (policy): Defines the certificate policy employed to issue public key certificates.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-17 NIST: NIST SP 800-53 Revision 5 (v5): SC-17 a
CCI-004909 (policy, technical): Include only approved trust anchors in trust stores or certificate stores managed by the organization.
References: NIST: NIST SP 800-53 Revision 5 (v5): SC-17 b
CCI-001160 (policy): Defines acceptable and unacceptable mobile code and mobile code technologies.
References: NIST: NIST SP 800-53 (v3): SC-18 a NIST: NIST SP 800-53 Revision 4 (v4): SC-18 a NIST: NIST SP 800-53 Revision 5 (v5): SC-18 a NIST: NIST SP 800-53A (v1): SC-18.1 (i)
CCI-001163 (policy): Authorize the use of mobile code within the system.
References: NIST: NIST SP 800-53 (v3): SC-18 c NIST: NIST SP 800-53 Revision 4 (v4): SC-18 c NIST: NIST SP 800-53 Revision 5 (v5): SC-18 b NIST: NIST SP 800-53A (v1): SC-18.1 (iii)
CCI-001164 (policy): Monitor the use of mobile code within the system.
References: NIST: NIST SP 800-53 (v3): SC-18 c NIST: NIST SP 800-53 Revision 4 (v4): SC-18 c NIST: NIST SP 800-53 Revision 5 (v5): SC-18 b NIST: NIST SP 800-53A (v1): SC-18.1 (iii)
CCI-001165 (policy): Control the use of mobile code within the system.
References: NIST: NIST SP 800-53 (v3): SC-18 c NIST: NIST SP 800-53 Revision 4 (v4): SC-18 c NIST: NIST SP 800-53 Revision 5 (v5): SC-18 b NIST: NIST SP 800-53A (v1): SC-18.1 (iii)
CCI-001166 (technical): Identify organization-defined unacceptable mobile code.
References: NIST: NIST SP 800-53 (v3): SC-18 (1) NIST: NIST SP 800-53 Revision 4 (v4): SC-18 (1) NIST: NIST SP 800-53 Revision 5 (v5): SC-18 (1) NIST: NIST SP 800-53A (v1): SC-18 (1).1 (i)
CCI-001662 (technical): Take organization-defined corrective action when organization-defined unacceptable mobile code is identified.
References: NIST: NIST SP 800-53 (v3): SC-18 (1) NIST: NIST SP 800-53 Revision 4 (v4): SC-18 (1) NIST: NIST SP 800-53 Revision 5 (v5): SC-18 (1) NIST: NIST SP 800-53A (v1): SC-18 (1).1 (ii)
CCI-002457 (policy): Defines the corrective actions to be taken when organization-defined unacceptable mobile code is identified.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-18 (1) NIST: NIST SP 800-53 Revision 5 (v5): SC-18 (1)
CCI-002458 (policy): Defines what constitutes unacceptable mobile code by using corrective actions.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-18 (1) NIST: NIST SP 800-53 Revision 5 (v5): SC-18 (1)
CCI-001167 (policy): Verify that the development of mobile code to be deployed in information systems meets organization-defined mobile code requirements.
References: NIST: NIST SP 800-53 (v3): SC-18 (2) NIST: NIST SP 800-53 Revision 4 (v4): SC-18 (2) NIST: NIST SP 800-53 Revision 5 (v5): SC-18 (2) NIST: NIST SP 800-53A (v1): SC-18 (2).1 (ii)
CCI-001168 (policy): Defines mobile code requirements for the acquisition, development, and use of mobile code.
References: NIST: NIST SP 800-53 (v3): SC-18 (2) NIST: NIST SP 800-53 Revision 4 (v4): SC-18 (2) NIST: NIST SP 800-53 Revision 5 (v5): SC-18 (2) NIST: NIST SP 800-53A (v1): SC-18 (2).1 (i)
CCI-001687 (policy): Verify that the use of mobile code deployed in system meets organization-defined mobile code requirements.
References: NIST: NIST SP 800-53 (v3): SC-18 (2) NIST: NIST SP 800-53 Revision 4 (v4): SC-18 (2) NIST: NIST SP 800-53 Revision 5 (v5): SC-18 (2) NIST: NIST SP 800-53A (v1): SC-18 (2).1 (ii)
CCI-001688 (policy): Verify the acquisition of mobile code deployed in the system meets organization-defined mobile code requirements.
References: NIST: NIST SP 800-53 (v3): SC-18 (2) NIST: NIST SP 800-53 Revision 4 (v4): SC-18 (2) NIST: NIST SP 800-53 Revision 5 (v5): SC-18 (2) NIST: NIST SP 800-53A (v1): SC-18 (2).1 (ii)
CCI-001169 (technical): Prevent the download of organization-defined unacceptable mobile code.
References: NIST: NIST SP 800-53 (v3): SC-18 (3) NIST: NIST SP 800-53 Revision 4 (v4): SC-18 (3) NIST: NIST SP 800-53 Revision 5 (v5): SC-18 (3) NIST: NIST SP 800-53A (v1): SC-18 (3).1
CCI-001695 (technical): Prevent the execution of organization-defined unacceptable mobile code.
References: NIST: NIST SP 800-53 (v3): SC-18 (3) NIST: NIST SP 800-53 Revision 4 (v4): SC-18 (3) NIST: NIST SP 800-53 Revision 5 (v5): SC-18 (3) NIST: NIST SP 800-53A (v1): SC-18 (3).1
CCI-002459 (policy): Defines the unacceptable mobile code to prevent download and execution.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-18 (3) NIST: NIST SP 800-53 Revision 5 (v5): SC-18 (3)
CCI-001170 (technical): Prevents the automatic execution of mobile code in organization-defined software applications.
References: NIST: NIST SP 800-53 (v3): SC-18 (4) NIST: NIST SP 800-53 Revision 4 (v4): SC-18 (4) NIST: NIST SP 800-53 Revision 5 (v5): SC-18 (4) NIST: NIST SP 800-53A (v1): SC-18 (4).1 (iii) (iv)
CCI-001171 (policy): Defines software applications in which automatic mobile code execution is to be prohibited.
References: NIST: NIST SP 800-53 (v3): SC-18 (4) NIST: NIST SP 800-53 Revision 4 (v4): SC-18 (4) NIST: NIST SP 800-53 Revision 5 (v5): SC-18 (4) NIST: NIST SP 800-53A (v1): SC-18 (4).1 (i)
CCI-001172 (policy): Defines actions to be enforced before executing mobile code.
References: NIST: NIST SP 800-53 (v3): SC-18 (4) NIST: NIST SP 800-53 Revision 4 (v4): SC-18 (4) NIST: NIST SP 800-53 Revision 5 (v5): SC-18 (4) NIST: NIST SP 800-53A (v1): SC-18 (4).1 (ii)
CCI-002460 (technical): Enforce organization-defined actions prior to executing mobile code.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-18 (4) NIST: NIST SP 800-53 Revision 5 (v5): SC-18 (4)
CCI-002461 (policy): Allow execution of permitted mobile code only in confined virtual machine environments.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-18 (5) NIST: NIST SP 800-53 Revision 5 (v5): SC-18 (5)
CCI-001178 (technical): Provide additional data origin authentication artifacts along with the authoritative name resolution data the system returns in response to external name/address resolution queries.
References: NIST: NIST SP 800-53 (v3): SC-20 NIST: NIST SP 800-53 Revision 4 (v4): SC-20 a NIST: NIST SP 800-53 Revision 5 (v5): SC-20 a NIST: NIST SP 800-53A (v1): SC-20.1
CCI-002462 (technical): Provide additional data integrity verification artifacts along with the authoritative name resolution data the system returns in response to external name/address resolution queries.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-20 a NIST: NIST SP 800-53 Revision 5 (v5): SC-20 a
CCI-001179 (technical): Provides the means to indicate the security status of child zones, when operating as part of a distributed, hierarchical namespace.
References: NIST: NIST SP 800-53 (v3): SC-20 (1) NIST: NIST SP 800-53 Revision 4 (v4): SC-20 b NIST: NIST SP 800-53 Revision 5 (v5): SC-20 b NIST: NIST SP 800-53A (v1): SC-20 (1).1 (i)
CCI-001663 (technical): Provide the means to enable verification of a chain of trust among parent and child domains (if the child supports secure resolution services), when operating as part of a distributed, hierarchical namespace.
References: NIST: NIST SP 800-53 (v3): SC-20 (1) NIST: NIST SP 800-53 Revision 4 (v4): SC-20 b NIST: NIST SP 800-53 Revision 5 (v5): SC-20 b NIST: NIST SP 800-53A (v1): SC-20 (1).1 (ii)
CCI-002463 (technical): Provide data origin artifacts for internal name/address resolution queries.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-20 (2) NIST: NIST SP 800-53 Revision 5 (v5): SC-20 (2)
CCI-002464 (technical): Provide data integrity protection artifacts for internal name/address resolution queries.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-20 (2) NIST: NIST SP 800-53 Revision 5 (v5): SC-20 (2)
CCI-002465 (technical): Request data origin authentication verification on the name/address resolution responses the system receives from authoritative sources.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-21 NIST: NIST SP 800-53 Revision 5 (v5): SC-21
CCI-002466 (technical): Request data integrity verification on the name/address resolution responses the system receives from authoritative sources.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-21 NIST: NIST SP 800-53 Revision 5 (v5): SC-21
CCI-002467 (technical): Perform data integrity verification on the name/address resolution responses the system receives from authoritative sources.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-21 NIST: NIST SP 800-53 Revision 5 (v5): SC-21
CCI-002468 (technical): Perform data origin verification authentication on the name/address resolution responses the system receives from authoritative sources.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-21 NIST: NIST SP 800-53 Revision 5 (v5): SC-21
CCI-001182 (policy): Ensure the systems that collectively provide name/address resolution service for an organization are fault-tolerant.
References: NIST: NIST SP 800-53 (v3): SC-22 NIST: NIST SP 800-53 Revision 4 (v4): SC-22 NIST: NIST SP 800-53 Revision 5 (v5): SC-22 NIST: NIST SP 800-53A (v1): SC-22.1 (i)
CCI-001183 (policy): Ensure the systems that collectively provide name/address resolution service for an organization implement internal/external role separation.
References: NIST: NIST SP 800-53 (v3): SC-22 NIST: NIST SP 800-53 Revision 4 (v4): SC-22 NIST: NIST SP 800-53 Revision 5 (v5): SC-22 NIST: NIST SP 800-53A (v1): SC-22.1 (ii)
CCI-001184 (technical): Protect the authenticity of communications sessions.
References: NIST: NIST SP 800-53 (v3): SC-23 NIST: NIST SP 800-53 Revision 4 (v4): SC-23 NIST: NIST SP 800-53 Revision 5 (v5): SC-23 NIST: NIST SP 800-53A (v1): SC-23.1
CCI-001185 (technical): Invalidate session identifiers upon user logout or other session termination.
References: NIST: NIST SP 800-53 (v3): SC-23 (1) NIST: NIST SP 800-53 Revision 4 (v4): SC-23 (1) NIST: NIST SP 800-53 Revision 5 (v5): SC-23 (1) NIST: NIST SP 800-53A (v1): SC-23 (1).1
CCI-001188 (technical): Generate a unique session identifier for each session with organization-defined randomness requirements.
References: NIST: NIST SP 800-53 (v3): SC-23 (4) NIST: NIST SP 800-53 Revision 4 (v4): SC-23 (3) NIST: NIST SP 800-53 Revision 5 (v5): SC-23 (3) NIST: NIST SP 800-53A (v1): SC-23 (4).1 (ii)
CCI-001189 (policy): Defines randomness requirements for generating unique session identifiers.
References: NIST: NIST SP 800-53 (v3): SC-23 (4) NIST: NIST SP 800-53 Revision 4 (v4): SC-23 (3) NIST: NIST SP 800-53 Revision 5 (v5): SC-23 (3) NIST: NIST SP 800-53A (v1): SC-23 (4).1 (i)
CCI-001664 (technical): Recognize only session identifiers that are system-generated.
References: NIST: NIST SP 800-53 (v3): SC-23 (3) NIST: NIST SP 800-53 Revision 4 (v4): SC-23 (3) NIST: NIST SP 800-53 Revision 5 (v5): SC-23 (3) NIST: NIST SP 800-53A (v1): SC-23 (3).1 (ii)
CCI-002469 (policy): Defines the certificate authorities allowed to be used for verification of the establishment of protected sessions.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-23 (5) NIST: NIST SP 800-53 Revision 5 (v5): SC-23 (5)
CCI-002470 (technical): Only allow the use of organization-defined certificate authorities for verification of the establishment of protected sessions.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-23 (5) NIST: NIST SP 800-53 Revision 5 (v5): SC-23 (5)
CCI-001190 (technical): Fail to an organization-defined known-system state for the following failures on the indicated components while preserving organization-defined system state information in failure.
References: NIST: NIST SP 800-53 (v3): SC-24 NIST: NIST SP 800-53 Revision 4 (v4): SC-24 NIST: NIST SP 800-53 Revision 5 (v5): SC-24 NIST: NIST SP 800-53A (v1): SC-24.1 (iv)
CCI-001191 (policy): Defines the known system state the system should fail to in the event of an organization-defined system failure.
References: NIST: NIST SP 800-53 (v3): SC-24 NIST: NIST SP 800-53 Revision 4 (v4): SC-24 NIST: NIST SP 800-53 Revision 5 (v5): SC-24 NIST: NIST SP 800-53A (v1): SC-24.1 (i)
CCI-001192 (policy): Defines types of system failures for which should fail to an organization-defined known system state.
References: NIST: NIST SP 800-53 (v3): SC-24 NIST: NIST SP 800-53 Revision 4 (v4): SC-24 NIST: NIST SP 800-53 Revision 5 (v5): SC-24 NIST: NIST SP 800-53A (v1): SC-24.1 (ii)
CCI-001193 (policy): Defines system state information that should be preserved in the event of a system failure.
References: NIST: NIST SP 800-53 (v3): SC-24 NIST: NIST SP 800-53 Revision 4 (v4): SC-24 NIST: NIST SP 800-53 Revision 5 (v5): SC-24 NIST: NIST SP 800-53A (v1): SC-24.1 (iii)
CCI-001665 (technical): Preserve organization-defined system state information in the event of a system failure.
References: NIST: NIST SP 800-53 (v3): SC-24 NIST: NIST SP 800-53 Revision 4 (v4): SC-24 NIST: NIST SP 800-53 Revision 5 (v5): SC-24 NIST: NIST SP 800-53A (v1): SC-24.1 (v)
CCI-001194 (policy): Employ minimal functionality and information storage on organization-defined information system components.
References: NIST: NIST SP 800-53 (v3): SC-25 NIST: NIST SP 800-53 Revision 4 (v4): SC-25 NIST: NIST SP 800-53 Revision 5 (v5): SC-25 NIST: NIST SP 800-53A (v1): SC-25.1
CCI-002471 (policy): Defines the system components, with minimal functionality and information storage, to be employed.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-25 NIST: NIST SP 800-53 Revision 5 (v5): SC-25
CCI-001195 (policy): Include components within organizational systems specifically designed to be the target of malicious attacks for detecting, deflecting, and analyzing such attacks.
References: NIST: NIST SP 800-53 (v3): SC-26 NIST: NIST SP 800-53 Revision 4 (v4): SC-26 NIST: NIST SP 800-53 Revision 5 (v5): SC-26 NIST: NIST SP 800-53A (v1): SC-26.1
CCI-001197 (policy): Include within organizational systems organization-defined platform-independent applications.
References: NIST: NIST SP 800-53 (v3): SC-27 NIST: NIST SP 800-53 Revision 4 (v4): SC-27 NIST: NIST SP 800-53 Revision 5 (v5): SC-27 NIST: NIST SP 800-53A (v1): SC-27.1 (ii)
CCI-001198 (policy): Defines applications that are platform independent.
References: NIST: NIST SP 800-53 (v3): SC-27 NIST: NIST SP 800-53 Revision 4 (v4): SC-27 NIST: NIST SP 800-53 Revision 5 (v5): SC-27 NIST: NIST SP 800-53A (v1): SC-27.1 (i)
CCI-001199 (technical): Protects the confidentiality and/or integrity of organization-defined information at rest.
References: NIST: NIST SP 800-53 (v3): SC-28 NIST: NIST SP 800-53 Revision 4 (v4): SC-28 NIST: NIST SP 800-53 Revision 5 (v5): SC-28 NIST: NIST SP 800-53A (v1): SC-28.1
CCI-002472 (policy): Defines the information at rest that is to be protected.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-28 NIST: NIST SP 800-53 Revision 5 (v5): SC-28
CCI-002473 (policy): Defines the information at rest for which cryptographic mechanisms will be implemented.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-28 (1) NIST: NIST SP 800-53 Revision 5 (v5): SC-28 (1)
CCI-002474 (policy): Defines the system components which require the implementation of cryptographic mechanisms to prevent unauthorized disclosure and modification of organization-defined information at rest.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-28 (1) NIST: NIST SP 800-53 Revision 5 (v5): SC-28 (1)
CCI-002475 (technical): Implement cryptographic mechanisms to prevent unauthorized modification of organization-defined information when at rest on organization-defined system components.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-28 (1) NIST: NIST SP 800-53 Revision 5 (v5): SC-28 (1)
CCI-002476 (technical): Implement cryptographic mechanisms to prevent unauthorized disclosure of organization-defined information at rest on organization-defined system components.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-28 (1) NIST: NIST SP 800-53 Revision 5 (v5): SC-28 (1)
CCI-002477 (policy): Defines the information to be removed from online storage and stored in an offline secure location.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-28 (2) NIST: NIST SP 800-53 Revision 5 (v5): SC-28 (2)
CCI-002478 (policy): Remove organization-defined information from online storage.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-28 (2) NIST: NIST SP 800-53 Revision 5 (v5): SC-28 (2)
CCI-002479 (policy): Store organization-defined information in an offline secure location.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-28 (2) NIST: NIST SP 800-53 Revision 5 (v5): SC-28 (2)
CCI-004910 (policy, technical): Provide protected storage for cryptographic keys with organization-defined safeguards and/or hardware protected key store.
References: NIST: NIST SP 800-53 Revision 5 (v5): SC-28 (3)
CCI-004911 (policy): Defines the safeguards for providing protected storage for cryptographic keys.
References: NIST: NIST SP 800-53 Revision 5 (v5): SC-28 (3)
CCI-001201 (policy): Employ a diverse set of information technologies for organization-defined system components in the implementation of the system.
References: NIST: NIST SP 800-53 (v3): SC-29 NIST: NIST SP 800-53 Revision 4 (v4): SC-29 NIST: NIST SP 800-53 Revision 5 (v5): SC-29 NIST: NIST SP 800-53A (v1): SC-29.1
CCI-002480 (policy): Defines the system components for which a diverse set of information technologies are to be employed.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-29 NIST: NIST SP 800-53 Revision 5 (v5): SC-29
CCI-001203 (policy): Employ virtualization techniques to support the deployment of a diversity of operating systems that are changed on an organization-defined frequency.
References: NIST: NIST SP 800-53 (v3): SC-30 (1) NIST: NIST SP 800-53 Revision 4 (v4): SC-29 (1) NIST: NIST SP 800-53 Revision 5 (v5): SC-29 (1) NIST: NIST SP 800-53A (v1): SC-30 (1).1 (ii)
CCI-001204 (policy): Defines the frequency of changes to operating systems and applications to support a diversity of deployments.
References: NIST: NIST SP 800-53 (v3): SC-30 (1) NIST: NIST SP 800-53 Revision 4 (v4): SC-29 (1) NIST: NIST SP 800-53 Revision 5 (v5): SC-29 (1) NIST: NIST SP 800-53A (v1): SC-30 (1).1 (i)
CCI-002481 (policy): Employ virtualization techniques to support the deployment of a diversity of applications that are changed per organization-defined frequency.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-29 (1) NIST: NIST SP 800-53 Revision 5 (v5): SC-29 (1)
CCI-002482 (policy): Defines the concealment and misdirection techniques employed for organization-defined systems to confuse and mislead adversaries.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-30 NIST: NIST SP 800-53 Revision 5 (v5): SC-30
CCI-002483 (policy): Defines the systems for which organization-defined concealment and misdirection techniques are to be employed.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-30 NIST: NIST SP 800-53 Revision 5 (v5): SC-30
CCI-002484 (policy): Defines the time periods at which to employ organization-defined concealment and misdirection techniques on organization-defined systems.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-30 NIST: NIST SP 800-53 Revision 5 (v5): SC-30
CCI-002485 (policy): Employ organization-defined concealment and misdirection techniques for organization-defined information systems at organization-defined time periods to confuse and mislead adversaries.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-30 NIST: NIST SP 800-53 Revision 5 (v5): SC-30
CCI-002486 (policy): Defines the techniques to be employed to introduce randomness into organizational operations and assets.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-30 (2) NIST: NIST SP 800-53 Revision 5 (v5): SC-30 (2)
CCI-002487 (policy): Employ organization-defined techniques to introduce randomness into organizational operations.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-30 (2) NIST: NIST SP 800-53 Revision 5 (v5): SC-30 (2)
CCI-002488 (policy): Employ organization-defined techniques to introduce randomness into organizational assets.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-30 (2) NIST: NIST SP 800-53 Revision 5 (v5): SC-30 (2)
CCI-002489 (policy): Defines the processing and/or storage locations to be changed at random intervals or at an organization-defined frequency.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-30 (3) NIST: NIST SP 800-53 Revision 5 (v5): SC-30 (3)
CCI-002490 (policy): Defines the frequency at which the location of organization-defined processing and/or storage changes.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-30 (3) NIST: NIST SP 800-53 Revision 5 (v5): SC-30 (3)
CCI-002492 (policy): Change the location of organization-defined processing and/or storage at an organization-defined time frequency or at random time intervals.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-30 (3) NIST: NIST SP 800-53 Revision 5 (v5): SC-30 (3)
CCI-002493 (policy): Defines the system components in which it will employ realistic but misleading information regarding its security state or posture.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-30 (4) NIST: NIST SP 800-53 Revision 5 (v5): SC-30 (4)
CCI-002494 (policy): Employ realistic, but misleading, information in organization-defined system components about its security state or posture.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-30 (4) NIST: NIST SP 800-53 Revision 5 (v5): SC-30 (4)
CCI-002495 (policy): Defines the techniques to be employed to hide or conceal organization-defined system components.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-30 (5) NIST: NIST SP 800-53 Revision 5 (v5): SC-30 (5)
CCI-002496 (policy): Defines the system components to be hidden or concealed.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-30 (5) NIST: NIST SP 800-53 Revision 5 (v5): SC-30 (5)
CCI-002497 (policy): Employ organization-defined techniques to hide or conceal organization-defined system components.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-30 (5) NIST: NIST SP 800-53 Revision 5 (v5): SC-30 (5)
CCI-002498 (policy): Perform a covert channel analysis to identify those aspects of communications within the system that are potential avenues for covert storage and/or timing channels.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-31 a NIST: NIST SP 800-53 Revision 5 (v5): SC-31 a
CCI-002499 (policy): Estimate the maximum bandwidth of the covert storage and timing channels.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-31 b NIST: NIST SP 800-53 Revision 5 (v5): SC-31 b
CCI-001207 (policy): Test a subset of the identified covert channels to determine which channels are exploitable.
References: NIST: NIST SP 800-53 (v3): SC-31 (1) NIST: NIST SP 800-53 Revision 4 (v4): SC-31 (1) NIST: NIST SP 800-53 Revision 5 (v5): SC-31 (1) NIST: NIST SP 800-53A (v1): SC-31 (1).1
CCI-002500 (policy): Defines the maximum bandwidth values to which covert storage and/or timing channels are to be reduced.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-31 (2) NIST: NIST SP 800-53 Revision 5 (v5): SC-31 (2)
CCI-002501 (policy): Reduce the maximum bandwidth for identified covert storage and/or timing channels to organization-defined values.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-31 (2) NIST: NIST SP 800-53 Revision 5 (v5): SC-31 (2)
CCI-002502 (policy): Defines the subset of identified covert channels in the operational environment of the system that are to have the bandwidth measured.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-31 (3) NIST: NIST SP 800-53 Revision 5 (v5): SC-31 (3)
CCI-002503 (policy): Measure the bandwidth of an organization-defined subset of identified covert channels in the operational environment of the information system.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-31 (3) NIST: NIST SP 800-53 Revision 5 (v5): SC-31 (3)
CCI-002504 (policy): Defines the system components into which the system is partitioned.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-32 NIST: NIST SP 800-53 Revision 5 (v5): SC-32
CCI-002505 (policy): Defines the circumstances under which the system components are to be physically or logically separated to support partitioning.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-32 NIST: NIST SP 800-53 Revision 5 (v5): SC-32
CCI-002506 (policy): Partitions the system into organization-defined system components residing in separate physical or logical domains or environments based on organization-defined circumstances for physical or logical separation of components.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-32 NIST: NIST SP 800-53 Revision 5 (v5): SC-32
CCI-004912 (policy, technical): Partition privileged functions into separate physical domains.
References: NIST: NIST SP 800-53 Revision 5 (v5): SC-32 (1)
CCI-001212 (policy): Defines system components on which the operating environment and organization-defined applications are loaded and executed from hardware-enforced, read-only media.
References: NIST: NIST SP 800-53 (v3): SC-34 NIST: NIST SP 800-53 Revision 4 (v4): SC-34 NIST: NIST SP 800-53 Revision 5 (v5): SC-34 NIST: NIST SP 800-53A (v1): SC-34.1 (ii)
CCI-001210 (technical): For organization-defined system components, load and execute the operating environment from hardware-enforced, read-only media.
References: NIST: NIST SP 800-53 (v3): SC-34 a NIST: NIST SP 800-53 Revision 4 (v4): SC-34 a NIST: NIST SP 800-53 Revision 5 (v5): SC-34 a NIST: NIST SP 800-53A (v1): SC-34.1 (iii)
CCI-001211 (technical): For organization-defined system components, load and execute organization-defined applications from hardware-enforced, read-only media.
References: NIST: NIST SP 800-53 (v3): SC-34 b NIST: NIST SP 800-53 Revision 4 (v4): SC-34 b NIST: NIST SP 800-53 Revision 5 (v5): SC-34 b NIST: NIST SP 800-53A (v1): SC-34.1 (iii)
CCI-001213 (policy): Defines applications that will be loaded and executed from hardware-enforced, read-only media.
References: NIST: NIST SP 800-53 (v3): SC-34 b NIST: NIST SP 800-53 Revision 4 (v4): SC-34 b NIST: NIST SP 800-53 Revision 5 (v5): SC-34 b NIST: NIST SP 800-53A (v1): SC-34.1 (i)
CCI-001214 (policy): Employ organization-defined system components with no writeable storage that is persistent across component restart or power on/off.
References: NIST: NIST SP 800-53 (v3): SC-34 (1) NIST: NIST SP 800-53 Revision 4 (v4): SC-34 (1) NIST: NIST SP 800-53 Revision 5 (v5): SC-34 (1) NIST: NIST SP 800-53A (v1): SC-34 (1).1 (ii)
CCI-001215 (policy): Defines the system components to be employed with no writeable storage.
References: NIST: NIST SP 800-53 (v3): SC-34 (1) NIST: NIST SP 800-53 Revision 4 (v4): SC-34 (1) NIST: NIST SP 800-53 Revision 5 (v5): SC-34 (1) NIST: NIST SP 800-53A (v1): SC-34 (1).1 (i)
CCI-001216 (policy): Protect the integrity of information prior to storage on read-only media.
References: NIST: NIST SP 800-53 (v3): SC-34 (2) NIST: NIST SP 800-53 Revision 4 (v4): SC-34 (2) NIST: NIST SP 800-53 Revision 5 (v5): SC-34 (2) NIST: NIST SP 800-53A (v1): SC-34 (2).1
CCI-002507 (policy): Control read-only media after information has been recorded onto the media.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-34 (2) NIST: NIST SP 800-53 Revision 5 (v5): SC-34 (2)
CCI-001196 (policy): Include system components that proactively seek to identify network-based malicious code or malicious websites.
References: NIST: NIST SP 800-53 (v3): SC-26 (1) NIST: NIST SP 800-53 Revision 4 (v4): SC-35 NIST: NIST SP 800-53 Revision 5 (v5): SC-35 NIST: NIST SP 800-53A (v1): SC-26 (1).1
CCI-002513 (policy): Defines the processing that is to be distributed across multiple physical locations or logical domains.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-36 NIST: NIST SP 800-53 Revision 5 (v5): SC-36
CCI-002514 (policy): Defines the storage components that is to be distributed across multiple physical locations or logical domains.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-36 NIST: NIST SP 800-53 Revision 5 (v5): SC-36
CCI-002515 (policy): Distributes organization-defined processing across multiple physical locations or logical domains.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-36 NIST: NIST SP 800-53 Revision 5 (v5): SC-36
CCI-002516 (policy): Distributes organization-defined storage components across multiple physical locations or logical domains.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-36 NIST: NIST SP 800-53 Revision 5 (v5): SC-36
CCI-002517 (policy): Defines the distributed processing components that are to be polled to identify potential faults, errors, or compromises.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-36 (1) NIST: NIST SP 800-53 Revision 5 (v5): SC-36 (1) (a)
CCI-002518 (policy): Defines the distributed storage components that are to be polled to identify potential faults, errors, or compromises.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-36 (1) NIST: NIST SP 800-53 Revision 5 (v5): SC-36 (1) (a)
CCI-002519 (policy): Employ polling techniques to identify potential faults, errors, or compromises to organization-defined distributed processing components.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-36 (1) NIST: NIST SP 800-53 Revision 5 (v5): SC-36 (1) (a)
CCI-002520 (policy): Employ polling techniques to identify potential faults, errors, or compromises to organization-defined distributed storage components.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-36 (1) NIST: NIST SP 800-53 Revision 5 (v5): SC-36 (1) (a)
CCI-004913 (policy): Takes organization-defined actions in response to identified faults, errors, or compromises.
References: NIST: NIST SP 800-53 Revision 5 (v5): SC-36 (1) (b)
CCI-004914 (policy): Defines actions to take in response to identified faults, errors, or compromises.
References: NIST: NIST SP 800-53 Revision 5 (v5): SC-36 (1) (b)
CCI-004915 (policy): Synchronize the organization-defined duplicate systems or system components.
References: NIST: NIST SP 800-53 Revision 5 (v5): SC-36 (2)
CCI-004916 (policy): Defines the duplicate systems or system components to be synchronized.
References: NIST: NIST SP 800-53 Revision 5 (v5): SC-36 (2)
CCI-002521 (policy): Defines the out-of-band channels to be employed for the physical delivery or electronic transmission of organization-defined information, system components, or devices.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-37 NIST: NIST SP 800-53 Revision 5 (v5): SC-37
CCI-002522 (policy): Defines the information, system components, or devices that are to be electronically transmitted or physically delivered via organization-defined out-of-band channels.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-37 NIST: NIST SP 800-53 Revision 5 (v5): SC-37
CCI-002524 (policy): Employ organization-defined out-of-band channels for the physical delivery or electronic transmission of organization-defined information, system components, or devices to organization-defined individuals or systems.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-37 NIST: NIST SP 800-53 Revision 5 (v5): SC-37
CCI-002525 (policy): Defines the controls to be employed to ensure only organization-defined individuals or information systems receive organization-defined information, information system components, or devices.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-37 (1) NIST: NIST SP 800-53 Revision 5 (v5): SC-37 (1)
CCI-002526 (policy): Defines the information, system components, or devices which are to be received only by organization-defined individuals or systems.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-37 (1) NIST: NIST SP 800-53 Revision 5 (v5): SC-37 (1)
CCI-002527 (policy): Employ organization-defined controls to ensure only organization-defined individuals or systems receive the organization-defined information, system components, or devices.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-37 (1) NIST: NIST SP 800-53 Revision 5 (v5): SC-37 (1)
CCI-002528 (policy): Defines the operations security controls to be employed to protect key organizational information throughout the system development life cycle.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-38 NIST: NIST SP 800-53 Revision 5 (v5): SC-38
CCI-002529 (policy): Employ organization-defined operations security controls to protect key organizational information throughout the system development life cycle.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-38 NIST: NIST SP 800-53 Revision 5 (v5): SC-38
CCI-002530 (technical): Maintain a separate execution domain for each executing system process.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-39 NIST: NIST SP 800-53 Revision 5 (v5): SC-39
CCI-002531 (technical): Implement hardware separation mechanisms to facilitate process isolation.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-39 (1) NIST: NIST SP 800-53 Revision 5 (v5): SC-39 (1)
CCI-002532 (policy): Defines the multi-threaded processing in which a separate execution domain is maintained by the system for each thread.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-39 (2) NIST: NIST SP 800-53 Revision 5 (v5): SC-39 (2)
CCI-002533 (technical): Maintain a separate execution domain for each thread in organization-defined multi-threaded processing.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-39 (2) NIST: NIST SP 800-53 Revision 5 (v5): SC-39 (2)
CCI-002534 (policy): Defines types of signal parameter attacks or references to sources for such attacks from which the system protects organization-defined wireless links.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-40 NIST: NIST SP 800-53 Revision 5 (v5): SC-40
CCI-002535 (policy): Defines the external and internal wireless links the system is to protect from organization-defined types of signal parameter attacks or references to sources for such attacks.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-40 NIST: NIST SP 800-53 Revision 5 (v5): SC-40
CCI-002536 (technical): Protect organization-defined external and internal wireless links from organization-defined types of signal parameter attacks or references to sources for such attacks.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-40 NIST: NIST SP 800-53 Revision 5 (v5): SC-40
CCI-002537 (policy): Defines the level of protection against the effects of intentional electromagnetic interference to be achieved by implemented cryptographic mechanisms.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-40 (1) NIST: NIST SP 800-53 Revision 5 (v5): SC-40 (1)
CCI-002538 (technical): Implement cryptographic mechanisms that achieve an organization-defined level of protection against the effects of intentional electromagnetic interference.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-40 (1) NIST: NIST SP 800-53 Revision 5 (v5): SC-40 (1)
CCI-002539 (policy): Defines the level of reduction the system is to implement to reduce the detection potential of wireless links.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-40 (2) NIST: NIST SP 800-53 Revision 5 (v5): SC-40 (2)
CCI-002540 (technical): Implement cryptographic mechanisms to reduce the detection potential of wireless links to an organization-defined level of reduction.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-40 (2) NIST: NIST SP 800-53 Revision 5 (v5): SC-40 (2)
CCI-002541 (technical): Implement cryptographic mechanisms to identify and reject wireless transmissions that are deliberate attempts to achieve imitative or manipulative communications deception based on signal parameters.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-40 (3) NIST: NIST SP 800-53 Revision 5 (v5): SC-40 (3)
CCI-002542 (policy): Defines the wireless transmitters that are to have cryptographic mechanisms implemented to prevent the identification of the wireless transmitters.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-40 (4) NIST: NIST SP 800-53 Revision 5 (v5): SC-40 (4)
CCI-002543 (technical): Implement cryptographic mechanisms to prevent the identification of organization-defined wireless transmitters by using the transmitter signal parameters.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-40 (4) NIST: NIST SP 800-53 Revision 5 (v5): SC-40 (4)
CCI-002544 (policy): Defines the systems or system components on which organization-defined connection ports or input/output devices are to be physically or logically disabled or removed.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-41 NIST: NIST SP 800-53 Revision 5 (v5): SC-41
CCI-002545 (policy): Defines the connection ports or input/output devices that are to be physically or logically disabled or removed from organization-defined systems or system components.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-41 NIST: NIST SP 800-53 Revision 5 (v5): SC-41
CCI-002546 (technical): Physically or logically disable or remove organization-defined connection ports or input/output devices on organization-defined systems or system components.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-41 NIST: NIST SP 800-53 Revision 5 (v5): SC-41
CCI-002547 (policy): Defines the exceptions where remote activation of sensors is allowed.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-42 a NIST: NIST SP 800-53 Revision 5 (v5): SC-42 a
CCI-002548 (technical): Prohibit the use of devices possessing organization-defined environmental sensing capabilities in organization-defined facilities, areas, or systems; and/or the remote activation of environmental sensing capabilities on organizational systems or system components except for the organization-defined exceptions where remote activation of sensors is allowed.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-42 a NIST: NIST SP 800-53 Revision 5 (v5): SC-42 a
CCI-002556 (policy): Defines the environmental sensing capabilities prohibited on devices used in organization-defined facilities, areas, or systems.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-42 (3) NIST: NIST SP 800-53 Revision 5 (v5): SC-42 a
CCI-002557 (policy): Defines the facilities, areas, or systems where devices processing organization-defined environmental sensing capabilities are prohibited.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-42 (3) NIST: NIST SP 800-53 Revision 5 (v5): SC-42 a
CCI-002549 (policy): Defines the class of users to receive explicit indication of sensor use.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-42 b NIST: NIST SP 800-53 Revision 5 (v5): SC-42 b
CCI-002550 (technical): Provide an explicit indication of sensor use to the organization-defined class of users.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-42 b NIST: NIST SP 800-53 Revision 5 (v5): SC-42 b
CCI-002551 (policy): Defines the sensors to be configured so that collected data or information is reported only to authorized individuals or roles.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-42 (1) NIST: NIST SP 800-53 Revision 5 (v5): SC-42 (1)
CCI-002552 (policy): Verify that the system is configured so that data or information collected by the organization-defined sensors is only reported to authorized individuals or roles.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-42 (1) NIST: NIST SP 800-53 Revision 5 (v5): SC-42 (1)
CCI-002553 (policy): Defines the measures to be employed to ensure data or information collected by organization-defined sensors is used only for authorized purposes.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-42 (2) NIST: NIST SP 800-53 Revision 5 (v5): SC-42 (2)
CCI-002554 (policy): Defines the sensors that are to collect data or information for authorized purposes.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-42 (2) NIST: NIST SP 800-53 Revision 5 (v5): SC-42 (2)
CCI-002555 (policy): Employ organization-defined measures, so that data or information collected by organization-defined sensors is only used for authorized purposes.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-42 (2) NIST: NIST SP 800-53 Revision 5 (v5): SC-42 (2)
CCI-004917 (policy): Defines sensors to facilitate an individual's awareness that personally identifiable information is being collected.
References: NIST: NIST SP 800-53 Revision 5 (v5): SC-42 (4)
CCI-004918 (policy): Defines measures to facility an individual's awareness that personally identifiable information is being collected.
References: NIST: NIST SP 800-53 Revision 5 (v5): SC-42 (4)
CCI-004919 (policy): Employ organization-defined measures to facilitate an individual's awareness that personally identifiable information is being collected by organization-defined sensors.
References: NIST: NIST SP 800-53 Revision 5 (v5): SC-42 (4)
CCI-004920 (policy): Defines sensors that are configured to minimize the collection of information about individuals that is not needed.
References: NIST: NIST SP 800-53 Revision 5 (v5): SC-42 (5)
CCI-004921 (policy): Employ organization-defined sensors that are configured to minimize the collection of information about individuals that is not needed.
References: NIST: NIST SP 800-53 Revision 5 (v5): SC-42 (5)
CCI-002559 (policy): Defines the system components for which usage restrictions and implementation guidance are to be established.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-43 a NIST: NIST SP 800-53 Revision 5 (v5): SC-43 a
CCI-002560 (policy): Establish usage restrictions and implementation guidance for organization-defined system components based on the potential to cause damage to the system if used maliciously.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-43 a NIST: NIST SP 800-53 Revision 5 (v5): SC-43 a
CCI-002561 (policy): Authorize the use of organization-defined system components which have the potential to cause damage to the system if used maliciously.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-43 b NIST: NIST SP 800-53 Revision 5 (v5): SC-43 b