Lexim011/Compliance huggingface dataset:
CCI-004296 (policy): Develop privacy architectures for the system that describe how the architectures are integrated into and support the enterprise architecture.
References: NIST: NIST SP 800-53 Revision 5 (v5): PL-8 a 3
CCI-004297 (policy): Develop privacy architectures for the system that describe any assumptions about, and dependencies on, external systems and services.
References: NIST: NIST SP 800-53 Revision 5 (v5): PL-8 a 4
CCI-003076 (policy): Review and update the architectures in accordance with organization-defined frequency to reflect updates in the enterprise architecture.
References: NIST: NIST SP 800-53 Revision 4 (v4): PL-8 b NIST: NIST SP 800-53 Revision 5 (v5): PL-8 b
CCI-003077 (policy): Defines the frequency with which to review and update the system architecture.
References: NIST: NIST SP 800-53 Revision 4 (v4): PL-8 b NIST: NIST SP 800-53 Revision 5 (v5): PL-8 b
CCI-003078 (policy): Reflect planned security architecture changes in the security plans.
References: NIST: NIST SP 800-53 Revision 4 (v4): PL-8 c NIST: NIST SP 800-53 Revision 5 (v5): PL-8 c
CCI-003079 (policy): Reflect planned security architecture changes in the security Concept of Operations (CONOPS).
References: NIST: NIST SP 800-53 Revision 4 (v4): PL-8 c NIST: NIST SP 800-53 Revision 5 (v5): PL-8 c
CCI-003080 (policy): Reflect planned security architecture changes in the security organizational procurements and acquisitions.
References: NIST: NIST SP 800-53 Revision 4 (v4): PL-8 c NIST: NIST SP 800-53 Revision 5 (v5): PL-8 c
CCI-004298 (policy): Reflect planned privacy architecture changes in the privacy plans.
References: NIST: NIST SP 800-53 Revision 5 (v5): PL-8 c
CCI-004299 (policy): Reflect planned privacy architecture changes in the privacy Concept of Operations (CONOPS).
References: NIST: NIST SP 800-53 Revision 5 (v5): PL-8 c
CCI-004300 (policy): Reflect planned privacy architecture changes in the privacy organizational procurements and acquisitions.
References: NIST: NIST SP 800-53 Revision 5 (v5): PL-8 c
CCI-003081 (policy): Design the security architecture for the system using a defense-in-depth approach that allocates organization-defined controls to organization-defined locations.
References: NIST: NIST SP 800-53 Revision 4 (v4): PL-8 (1) (a) NIST: NIST SP 800-53 Revision 5 (v5): PL-8 (1) (a)
CCI-003082 (policy): Design the security architecture for the system using a defense-in-depth approach that allocates organization-defined controls to organization-defined architectural layers.
References: NIST: NIST SP 800-53 Revision 4 (v4): PL-8 (1) (a) NIST: NIST SP 800-53 Revision 5 (v5): PL-8 (1) (a)
CCI-003083 (policy): Defines the controls to be allocated to organization-defined locations for the security architecture.
References: NIST: NIST SP 800-53 Revision 4 (v4): PL-8 (1) (a) NIST: NIST SP 800-53 Revision 5 (v5): PL-8 (1) (a)
CCI-003084 (policy): Defines the controls to be allocated to the organization-defined security architectural layers.
References: NIST: NIST SP 800-53 Revision 4 (v4): PL-8 (1) (a) NIST: NIST SP 800-53 Revision 5 (v5): PL-8 (1) (a)
CCI-003085 (policy): Defines the locations to which the system allocates organization-defined controls in the security architecture.
References: NIST: NIST SP 800-53 Revision 4 (v4): PL-8 (1) (a) NIST: NIST SP 800-53 Revision 5 (v5): PL-8 (1) (a)
CCI-003086 (policy): Defines the architectural layers to which the system allocates organization-defined controls in the security architecture.
References: NIST: NIST SP 800-53 Revision 4 (v4): PL-8 (1) (a) NIST: NIST SP 800-53 Revision 5 (v5): PL-8 (1) (a)
CCI-004301 (policy): Design the privacy architecture for the system using a defense-in-depth approach that allocates organization-defined controls to organization-defined locations.
References: NIST: NIST SP 800-53 Revision 5 (v5): PL-8 (1) (a)
CCI-004302 (policy): Design the privacy architecture for the system using a defense-in-depth approach that allocates organization-defined controls to organization-defined architectural layers.
References: NIST: NIST SP 800-53 Revision 5 (v5): PL-8 (1) (a)
CCI-004303 (policy): Defines the controls to be allocated to organization-defined locations for the privacy architecture.
References: NIST: NIST SP 800-53 Revision 5 (v5): PL-8 (1) (a)
CCI-004304 (policy): Defines the controls to be allocated to the organization-defined privacy architectural layers.
References: NIST: NIST SP 800-53 Revision 5 (v5): PL-8 (1) (a)
CCI-004305 (policy): Defines the locations to which the system allocates organization-defined controls in the privacy architecture.
References: NIST: NIST SP 800-53 Revision 5 (v5): PL-8 (1) (a)
CCI-004306 (policy): Defines the architectural layers to which the system allocates organization-defined controls in the privacy architecture.
References: NIST: NIST SP 800-53 Revision 5 (v5): PL-8 (1) (a)
CCI-003087 (policy): Design the security architecture for the system using a defense-in-depth approach that ensures that the allocated controls operate in a coordinated and mutually reinforcing manner.
References: NIST: NIST SP 800-53 Revision 4 (v4): PL-8 (1) (b) NIST: NIST SP 800-53 Revision 5 (v5): PL-8 (1) (b)
CCI-004307 (policy): Design the privacy architecture for the system using a defense-in-depth approach that ensures that the allocated controls operate in a coordinated and mutually reinforcing manner.
References: NIST: NIST SP 800-53 Revision 5 (v5): PL-8 (1) (b)
CCI-003088 (policy): Require that organization-defined controls allocated to organization-defined locations and architectural layers be obtained from different suppliers.
References: NIST: NIST SP 800-53 Revision 4 (v4): PL-8 (2) NIST: NIST SP 800-53 Revision 5 (v5): PL-8 (2)
CCI-004308 (policy): Defines the controls that are allocated to the organization-defined locations and architectural layers.
References: NIST: NIST SP 800-53 Revision 5 (v5): PL-8 (2)
CCI-004309 (policy): Defines the locations and architectural layers that are obtained from different suppliers.
References: NIST: NIST SP 800-53 Revision 5 (v5): PL-8 (2)
CCI-003117 (policy): Centrally manage organization-defined controls and related processes.
References: NIST: NIST SP 800-53 Revision 4 (v4): PL-9 NIST: NIST SP 800-53 Revision 5 (v5): PL-9
CCI-003118 (policy): Defines the controls and related processes to be centrally managed.
References: NIST: NIST SP 800-53 Revision 4 (v4): PL-9 NIST: NIST SP 800-53 Revision 5 (v5): PL-9
CCI-004310 (policy): Select a control baseline for the system.
References: NIST: NIST SP 800-53 Revision 5 (v5): PL-10
CCI-004311 (policy): Tailor the selected control baseline by applying specified tailoring actions.
References: NIST: NIST SP 800-53 Revision 5 (v5): PL-11
CCI-000073 (policy): Develop an organization-wide information security program plan that provides an overview of the requirements for the security program and a description of the security program management controls and common controls in place or planned for meeting those requirements.
References: NIST: NIST SP 800-53 (v3): PM-1 a NIST: NIST SP 800-53 Revision 4 (v4): PM-1 a 1 NIST: NIST SP 800-53 Revision 5 (v5): PM-1 a 1 NIST: NIST SP 800-53A (v1): PM-1.1 (i)
CCI-000074 (policy): Develop an organization-wide information security program plan that is approved by a senior official with responsibility and accountability for the risk being incurred to organizational operations (including mission, functions, image, and reputation), organizational assets, individuals, other organizations, and the Nation.
References: NIST: NIST SP 800-53 (v3): PM-1 a NIST: NIST SP 800-53 Revision 4 (v4): PM-1 a 4 NIST: NIST SP 800-53 Revision 5 (v5): PM-1 a 4 NIST: NIST SP 800-53A (v1): PM-1.1 (i)
CCI-001680 (policy): Develop an organization-wide information security program plan that includes the identification and assignment of roles, responsibilities, management commitment, coordination among organizational entities, and compliance.
References: NIST: NIST SP 800-53 (v3): PM-1 a NIST: NIST SP 800-53 Revision 4 (v4): PM-1 a 2 NIST: NIST SP 800-53 Revision 5 (v5): PM-1 a 2 NIST: NIST SP 800-53A (v1): PM-1.1 (i)
CCI-002984 (policy): Develop an organization-wide information security program plan that reflects the coordination among organizational entities responsible for information security.
References: NIST: NIST SP 800-53 Revision 4 (v4): PM-1 a 3 NIST: NIST SP 800-53 Revision 5 (v5): PM-1 a 3
CCI-002985 (policy): Disseminate an organization-wide information security program plan that provides an overview of the requirements for the security program and a description of the security program management controls and common controls in place or planned for meeting those requirements.
References: NIST: NIST SP 800-53 Revision 4 (v4): PM-1 a 1 NIST: NIST SP 800-53 Revision 5 (v5): PM-1 a 1
CCI-002986 (policy): Disseminate an organization-wide information security program plan that includes the identification and assignment of roles, responsibilities, management commitment, coordination among organizational entities, and compliance.
References: NIST: NIST SP 800-53 Revision 4 (v4): PM-1 a 2 NIST: NIST SP 800-53 Revision 5 (v5): PM-1 a 2
CCI-002987 (policy): Disseminate an organization-wide information security plan that reflects the coordination among organizational entities responsible for information security.
References: NIST: NIST SP 800-53 Revision 4 (v4): PM-1 a 3 NIST: NIST SP 800-53 Revision 5 (v5): PM-1 a 3
CCI-002988 (policy): Disseminate an organization-wide information security program plan that is approved by a senior official with responsibility and accountability for the risk being incurred to organizational operations (including mission, functions, image, and reputation), organizational assets, individuals, other organizations, and the Nation.
References: NIST: NIST SP 800-53 Revision 4 (v4): PM-1 a 4 NIST: NIST SP 800-53 Revision 5 (v5): PM-1 a 4
CCI-000075 (policy): Review and update the organization-wide information security program plan on an organization-defined frequency.
References: NIST: NIST SP 800-53 (v3): PM-1 b NIST: NIST SP 800-53 Revision 4 (v4): PM-1 b NIST: NIST SP 800-53 Revision 5 (v5): PM-1 b NIST: NIST SP 800-53A (v1): PM-1.1 (iii)
CCI-000076 (policy): Defines the frequency with which to review and update the organization-wide information security program plan.
References: NIST: NIST SP 800-53 (v3): PM-1 b NIST: NIST SP 800-53 Revision 4 (v4): PM-1 b NIST: NIST SP 800-53 Revision 5 (v5): PM-1 b NIST: NIST SP 800-53A (v1): PM-1.1 (ii)
CCI-004312 (policy): Review and update the organization-wide information security program plan following organization-defined events.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-1 b
CCI-004313 (policy): Defines the events for reviewing and updating the organization-wide information security program plan.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-1 b
CCI-002989 (policy): Protect the information security program plan from unauthorized disclosure.
References: NIST: NIST SP 800-53 Revision 4 (v4): PM-1 d NIST: NIST SP 800-53 Revision 5 (v5): PM-1 c
CCI-002990 (policy): Protect the information security program plan from unauthorized modification.
References: NIST: NIST SP 800-53 Revision 4 (v4): PM-1 d NIST: NIST SP 800-53 Revision 5 (v5): PM-1 c
CCI-000078 (policy): Appoint a Senior Information Security Officer with the mission and resources to coordinate, develop, implement, and maintain an organization-wide information security program.
References: NIST: NIST SP 800-53 (v3): PM-2 NIST: NIST SP 800-53 Revision 4 (v4): PM-2 NIST: NIST SP 800-53 Revision 5 (v5): PM-2 NIST: NIST SP 800-53A (v1): PM-2.1 (i and ii)
CCI-000080 (policy): Include the resources needed to implement the information security programs in capital planning and investment requests and document all exceptions to this requirement.
References: NIST: NIST SP 800-53 (v3): PM-3 a NIST: NIST SP 800-53 Revision 4 (v4): PM-3 a NIST: NIST SP 800-53 Revision 5 (v5): PM-3 a NIST: NIST SP 800-53A (v1): PM-3.1 (i and ii)
CCI-004314 (policy): Include the resources needed to implement the information security programs in capital planning and investment requests.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-3 a
CCI-004315 (policy): Include the resources needed to implement the information privacy programs in capital planning and investment requests.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-3 a
CCI-004316 (policy): Prepare documentation required for addressing information security programs in capital planning and investment requests in accordance with applicable laws, Executive Orders, directives, policies, regulations, and standards.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-3 b
CCI-004317 (policy): Prepare documentation required for addressing information privacy programs in capital planning and investment requests in accordance with applicable laws, Executive Orders, directives, policies, regulations, and standards.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-3 b
CCI-000141 (policy): Make available for expenditure, the planned information security resources.
References: NIST: NIST SP 800-53 (v3): PM-3 c NIST: NIST SP 800-53 Revision 4 (v4): PM-3 c NIST: NIST SP 800-53 Revision 5 (v5): PM-3 c NIST: NIST SP 800-53A (v1): PM-3.1 (iv)
CCI-004318 (policy): Make available for expenditure, the planned information privacy resources.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-3 c
CCI-000142 (policy): Implement a process to ensure that plans of action and milestones for the information security program and the associated organizational systems are maintained.
References: NIST: NIST SP 800-53 (v3): PM-4 NIST: NIST SP 800-53 Revision 4 (v4): PM-4 a 1 NIST: NIST SP 800-53 Revision 5 (v5): PM-4 a 1 NIST: NIST SP 800-53A (v1): PM-4.1 (i)
CCI-000170 (policy): Implement a process to ensure that plans of action and milestones for the security program and associated organizational systems document the remedial information security actions to adequately respond to risk to organizational operations and assets, individuals, other organizations, and the Nation.
References: NIST: NIST SP 800-53 (v3): PM-4 NIST: NIST SP 800-53 Revision 4 (v4): PM-4 a 2 NIST: NIST SP 800-53 Revision 5 (v5): PM-4 a 2 NIST: NIST SP 800-53A (v1): PM-4.1 (ii)
CCI-002991 (policy): Implement a process to ensure that plans of action and milestones for the information security program and associated organizational systems are developed.
References: NIST: NIST SP 800-53 Revision 4 (v4): PM-4 a 1 NIST: NIST SP 800-53 Revision 5 (v5): PM-4 a 1
CCI-004319 (policy): Implement a process to ensure that plans of action and milestones for the privacy program and the associated organizational systems are maintained.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-4 a 1
CCI-004320 (policy): Implement a process to ensure that plans of action and milestones for the privacy program and associated organizational systems are developed.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-4 a 1
CCI-004321 (policy): Implement a process to ensure that plans of action and milestones for the supply chain risk management programs and the associated organizational systems are maintained.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-4 a 1
CCI-004322 (policy): Implement a process to ensure that plans of action and milestones for the supply chain risk management programs and the associated organizational systems are developed.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-4 a 1
CCI-004323 (policy): Implement a process to ensure that plans of action and milestones for the privacy program and associated organizational systems document the remedial information privacy actions to adequately respond to risk to organizational operations and assets, individuals, other organizations, and the Nation.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-4 a 2
CCI-004324 (policy): Implement a process to ensure that plans of action and milestones for the supply chain risk management program and associated organizational systems document the remedial information supply chain risk management actions to adequately respond to risk to organizational operations and assets, individuals, other organizations, and the Nation.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-4 a 2
CCI-004325 (policy): Implement a process to ensure that plans of action and milestones for the security program and associated organizational systems are reported in accordance with established reporting requirements.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-4 a 3
CCI-004326 (policy): Implement a process to ensure that plans of action and milestones for the privacy program and associated organizational systems are reported in accordance with established reporting requirements.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-4 a 3
CCI-004327 (policy): Implement a process to ensure that plans of action and milestones for the supply chain risk management program and associated organizational systems are reported in accordance with established reporting requirements.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-4 a 3
CCI-002993 (policy): Review plans of action and milestones for the security program and associated organization systems for consistency with the organizational risk management strategy and organization-wide priorities for risk response actions.
References: NIST: NIST SP 800-53 Revision 4 (v4): PM-4 b NIST: NIST SP 800-53 Revision 5 (v5): PM-4 b
CCI-004328 (policy): Develop an inventory of organizational systems.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-5
CCI-004329 (policy): Update, on an organization-defined frequency, an inventory of organizational systems.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-5
CCI-004330 (policy): Defines the frequency with which to update the inventory of organizational systems.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-5
CCI-004331 (policy): Establish an inventory of all systems, applications, and projects that process personally identifiable information.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-5 (1)
CCI-004332 (policy): Maintain an inventory of all systems, applications, and projects that process personally identifiable information.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-5 (1)
CCI-004333 (policy): Update on an organization-defined frequency, an inventory of all systems, applications, and projects that process personally identifiable information.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-5 (1)
CCI-004334 (policy): Defines the frequency of which an inventory of all systems, applications, and projects that process personally identifiable information will be updated.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-5 (1)
CCI-000209 (policy): Develop the results of information security measures of performance.
References: NIST: NIST SP 800-53 (v3): PM-6 NIST: NIST SP 800-53 Revision 4 (v4): PM-6 NIST: NIST SP 800-53 Revision 5 (v5): PM-6 NIST: NIST SP 800-53A (v1): PM-6.1 (i)
CCI-000210 (policy): Monitor the results of information security measures of performance.
References: NIST: NIST SP 800-53 (v3): PM-6 NIST: NIST SP 800-53 Revision 4 (v4): PM-6 NIST: NIST SP 800-53 Revision 5 (v5): PM-6 NIST: NIST SP 800-53A (v1): PM-6.1 (ii)
CCI-000211 (policy): Report on the results of information security measures of performance.
References: NIST: NIST SP 800-53 (v3): PM-6 NIST: NIST SP 800-53 Revision 4 (v4): PM-6 NIST: NIST SP 800-53 Revision 5 (v5): PM-6 NIST: NIST SP 800-53A (v1): PM-6.1 (iii)
CCI-004335 (policy): Develop the results of information privacy measures of performance.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-6
CCI-004336 (policy): Monitor the results of information privacy measures of performance.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-6
CCI-004337 (policy): Report on the results of information privacy measures of performance.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-6
CCI-000212 (policy): Develop an enterprise architecture with consideration for information security and the resulting risk to organizational operations, organizational assets, individuals, other organizations, and the Nation.
References: NIST: NIST SP 800-53 (v3): PM-7 NIST: NIST SP 800-53 Revision 4 (v4): PM-7 NIST: NIST SP 800-53 Revision 5 (v5): PM-7 NIST: NIST SP 800-53A (v1): PM-7.1
CCI-004338 (policy): Develop an enterprise architecture with consideration for information privacy and the resulting risk to organizational operations, organizational assets, individuals, other organizations, and the Nation.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-7
CCI-004339 (policy): Maintain an enterprise architecture with consideration for information security and the resulting risk to organizational operations, organizational assets, individuals, other organizations, and the Nation.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-7
CCI-004340 (policy): Maintain an enterprise architecture with consideration for information privacy and the resulting risk to organizational operations, organizational assets, individuals, other organizations, and the Nation.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-7
CCI-004341 (policy): Offload organization-defined non-essential functions or services to other systems, system components, or an external provider.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-7 (1)
CCI-004342 (policy): Defines the non-essential functions or services to be offloaded to other systems, system components, or an external provider.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-7 (1)
CCI-000216 (policy): Address information security issues in the development and documentation of a critical infrastructure and key resources protection plan.
References: NIST: NIST SP 800-53 (v3): PM-8 NIST: NIST SP 800-53 Revision 4 (v4): PM-8 NIST: NIST SP 800-53 Revision 5 (v5): PM-8 NIST: NIST SP 800-53A (v1): PM-8.1 (I and iii)
CCI-001640 (policy): Address information security issues in the updating of a critical infrastructure and key resources protection plan.
References: NIST: NIST SP 800-53 (v3): PM-8 NIST: NIST SP 800-53 Revision 4 (v4): PM-8 NIST: NIST SP 800-53 Revision 5 (v5): PM-8 NIST: NIST SP 800-53A (v1): PM-8.1 (ii)
CCI-004343 (policy): Address information privacy issues in the development and documentation of a critical infrastructure and key resources protection plan.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-8
CCI-004344 (policy): Address information privacy issues in the updating of a critical infrastructure and key resources protection plan.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-8
CCI-000227 (policy): Develop a comprehensive strategy to manage security risk to organizational operations and assets, individuals, other organizations, and the Nation associated with the operation and use of information systems.
References: NIST: NIST SP 800-53 (v3): PM-9 a NIST: NIST SP 800-53 Revision 4 (v4): PM-9 a NIST: NIST SP 800-53 Revision 5 (v5): PM-9 a 1 NIST: NIST SP 800-53A (v1): PM-9.1 (i)
CCI-004345 (policy): Develop a comprehensive strategy to manage privacy risk to individuals resulting from the authorized processing of personally identifiable information.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-9 a 2
CCI-000228 (policy): Implement the risk management strategy consistently across the organization.
References: NIST: NIST SP 800-53 (v3): PM-9 b NIST: NIST SP 800-53 Revision 4 (v4): PM-9 b NIST: NIST SP 800-53 Revision 5 (v5): PM-9 b NIST: NIST SP 800-53A (v1): PM-9.1 (ii)
CCI-002994 (policy): Review and update the risk management strategy in accordance with organization-defined frequency or as required, to address organizational changes.
References: NIST: NIST SP 800-53 Revision 4 (v4): PM-9 c NIST: NIST SP 800-53 Revision 5 (v5): PM-9 c
CCI-002995 (policy): Defines the frequency with which to review and update the risk management strategy to address organizational changes.
References: NIST: NIST SP 800-53 Revision 4 (v4): PM-9 c NIST: NIST SP 800-53 Revision 5 (v5): PM-9 c
CCI-004346 (policy): Manage the security state of organizational systems and the environments in which those systems operate through authorization processes.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-10 a
CCI-004347 (policy): Manage the privacy state of organizational systems and the environments in which those systems operate through authorization processes.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-10 a
CCI-000233 (policy): Designate individuals to fulfill specific roles and responsibilities within the organizational risk management process.
References: NIST: NIST SP 800-53 (v3): PM-10 b NIST: NIST SP 800-53 Revision 4 (v4): PM-10 b NIST: NIST SP 800-53 Revision 5 (v5): PM-10 b NIST: NIST SP 800-53A (v1): PM-10.1 (ii)
CCI-000234 (policy): Integrate the authorization processes into an organization-wide risk management program.
References: NIST: NIST SP 800-53 (v3): PM-10 c NIST: NIST SP 800-53 Revision 4 (v4): PM-10 c NIST: NIST SP 800-53 Revision 5 (v5): PM-10 c NIST: NIST SP 800-53A (v1): PM-10.1 (iii)
CCI-000235 (policy): Define organizational mission and business processes with consideration for information security and the resulting risk to organizational operations, organizational assets, individuals, other organizations, and the Nation.
References: NIST: NIST SP 800-53 (v3): PM-11 a NIST: NIST SP 800-53 Revision 4 (v4): PM-11 a NIST: NIST SP 800-53 Revision 5 (v5): PM-11 a NIST: NIST SP 800-53A (v1): PM-11.1 (i)
CCI-004348 (policy): Define organizational mission and business processes with consideration for information privacy and the resulting risk to organizational operations, organizational assets, individuals, other organizations, and the Nation.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-11 a
CCI-000236 (policy): Determine information protection needs arising from the defined mission and business processes.
References: NIST: NIST SP 800-53 (v3): PM-11 b NIST: NIST SP 800-53 Revision 4 (v4): PM-11 b NIST: NIST SP 800-53 Revision 5 (v5): PM-11 b NIST: NIST SP 800-53A (v1): PM-11.1 (ii)
CCI-004349 (policy): Determine personally identifiable information processing needs arising from the defined mission and business processes.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-11 b
CCI-004350 (policy): Review and revise the mission and business processes on an organization-defined frequency.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-11 c
CCI-004351 (policy): Defines the frequency at which the mission and business processes are reviewed and revised.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-11 c
CCI-002996 (policy): Implement an insider threat program that includes a cross-discipline insider threat incident handling team.
References: NIST: NIST SP 800-53 Revision 4 (v4): PM-12 NIST: NIST SP 800-53 Revision 5 (v5): PM-12
CCI-002997 (policy): Establish a security workforce development and improvement program.
References: NIST: NIST SP 800-53 Revision 4 (v4): PM-13 NIST: NIST SP 800-53 Revision 5 (v5): PM-13
CCI-004352 (policy): Establish a privacy workforce development and improvement program.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-13
CCI-002998 (policy): Implement a process for ensuring that organizational plans for conducting security testing activities associated with organizational systems are developed.
References: NIST: NIST SP 800-53 Revision 4 (v4): PM-14 a 1 NIST: NIST SP 800-53 Revision 5 (v5): PM-14 a 1
CCI-002999 (policy): Implement a process for ensuring that organizational plans for conducting security testing activities associated with organizational systems are maintained.
References: NIST: NIST SP 800-53 Revision 4 (v4): PM-14 a 1 NIST: NIST SP 800-53 Revision 5 (v5): PM-14 a 1
CCI-003000 (policy): Implement a process for ensuring that organizational plans for conducting security training activities associated with organizational systems are developed.
References: NIST: NIST SP 800-53 Revision 4 (v4): PM-14 a 1 NIST: NIST SP 800-53 Revision 5 (v5): PM-14 a 1
CCI-003001 (policy): Implement a process for ensuring that organizational plans for conducting security training activities associated with organizational systems are maintained.
References: NIST: NIST SP 800-53 Revision 4 (v4): PM-14 a 1 NIST: NIST SP 800-53 Revision 5 (v5): PM-14 a 1
CCI-003002 (policy): Implement a process for ensuring that organizational plans for conducting security monitoring activities associated with organizational systems are developed.
References: NIST: NIST SP 800-53 Revision 4 (v4): PM-14 a 1 NIST: NIST SP 800-53 Revision 5 (v5): PM-14 a 1
CCI-003003 (policy): Implement a process for ensuring that organizational plans for conducting security monitoring activities associated with organizational information systems are maintained.
References: NIST: NIST SP 800-53 Revision 4 (v4): PM-14 a 1 NIST: NIST SP 800-53 Revision 5 (v5): PM-14 a 1
CCI-003004 (policy): Implement a process for ensuring that organizational plans for conducting security testing associated with organizational systems continue to be executed.
References: NIST: NIST SP 800-53 Revision 4 (v4): PM-14 a 2 NIST: NIST SP 800-53 Revision 5 (v5): PM-14 a 2
CCI-003005 (policy): Implement a process for ensuring that organizational plans for conducting security training associated with organizational systems continue to be executed.
References: NIST: NIST SP 800-53 Revision 4 (v4): PM-14 a 2 NIST: NIST SP 800-53 Revision 5 (v5): PM-14 a 2
CCI-003006 (policy): Implement a process for ensuring that organizational plans for conducting security monitoring activities associated with organizational systems continue to be executed.
References: NIST: NIST SP 800-53 Revision 4 (v4): PM-14 a 2 NIST: NIST SP 800-53 Revision 5 (v5): PM-14 a 2
CCI-004353 (policy): Implement a process for ensuring that organizational plans for conducting privacy testing activities associated with organizational systems are developed.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-14 a 1
CCI-004354 (policy): Implement a process for ensuring that organizational plans for conducting privacy testing activities associated with organizational systems are maintained.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-14 a 1
CCI-004355 (policy): Implement a process for ensuring that organizational plans for conducting privacy training activities associated with organizational systems are developed.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-14 a 1
CCI-004356 (policy): Implement a process for ensuring that organizational plans for conducting privacy training activities associated with organizational systems are maintained.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-14 a 1
CCI-004357 (policy): Implement a process for ensuring that organizational plans for conducting privacy monitoring activities associated with organizational systems are developed.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-14 a 1
CCI-004358 (policy): Implement a process for ensuring that organizational plans for conducting privacy monitoring activities associated with organizational information systems are maintained.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-14 a 1
CCI-004359 (policy): Implement a process for ensuring that organizational plans for conducting privacy testing associated with organizational systems continue to be executed.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-14 a 2
CCI-004360 (policy): Implement a process for ensuring that organizational plans for conducting privacy training associated with organizational systems continue to be executed.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-14 a 2
CCI-004361 (policy): Implement a process for ensuring that organizational plans for conducting privacy monitoring activities associated with organizational systems continue to be executed.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-14 a 2
CCI-003007 (policy): Review testing plans for consistency with the organizational risk management strategy and organization-wide priorities for risk response actions.
References: NIST: NIST SP 800-53 Revision 4 (v4): PM-14 b NIST: NIST SP 800-53 Revision 5 (v5): PM-14 b
CCI-003008 (policy): Review training plans for consistency with the organizational risk management strategy and organization-wide priorities for risk response actions.
References: NIST: NIST SP 800-53 Revision 4 (v4): PM-14 b NIST: NIST SP 800-53 Revision 5 (v5): PM-14 b
CCI-003009 (policy): Review monitoring plans for consistency with the organizational risk management strategy and organization-wide priorities for risk response actions.
References: NIST: NIST SP 800-53 Revision 4 (v4): PM-14 b NIST: NIST SP 800-53 Revision 5 (v5): PM-14 b
CCI-003010 (policy): Establish and institutionalize contact with selected groups and associations within the security community to facilitate ongoing security education and training for organizational personnel.
References: NIST: NIST SP 800-53 Revision 4 (v4): PM-15 a NIST: NIST SP 800-53 Revision 5 (v5): PM-15 a
CCI-004362 (policy): Establish and institutionalize contact with selected groups and associations within the privacy community to facilitate ongoing privacy education and training for organizational personnel.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-15 a
CCI-003011 (policy): Establish and institutionalize contact with selected groups and associations within the security community to maintain currency with recommended security practices, techniques, and technologies.
References: NIST: NIST SP 800-53 Revision 4 (v4): PM-15 b NIST: NIST SP 800-53 Revision 5 (v5): PM-15 b
CCI-004363 (policy): Establish and institutionalize contact with selected groups and associations within the privacy community to maintain currency with recommended privacy practices, techniques, and technologies.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-15 b
CCI-003012 (policy): Establish and institutionalize contact with selected groups and associations within the security community to share current security information including threats, vulnerabilities, and incidents.
References: NIST: NIST SP 800-53 Revision 4 (v4): PM-15 c NIST: NIST SP 800-53 Revision 5 (v5): PM-15 c
CCI-004364 (policy): Establish and institutionalize contact with selected groups and associations within the privacy community to share current privacy information including threats, vulnerabilities, and incidents.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-15 c
CCI-003013 (policy): Implement a threat awareness program that includes a cross-organization information-sharing capability for threat intelligence.
References: NIST: NIST SP 800-53 Revision 4 (v4): PM-16 NIST: NIST SP 800-53 Revision 5 (v5): PM-16
CCI-004365 (policy): Employ automated means to maximize the effectiveness of sharing threat intelligence information.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-16 (1)
CCI-004366 (policy): Establish policy to ensure that the requirements for the protection of Controlled Unclassified Information that is processed, stored or transmitted on external systems, are implemented in accordance with applicable laws, Executive Orders, directives, policies, regulations, and standards.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-17 a
CCI-004367 (policy): Establish procedures to ensure that the requirements for the protection of Controlled Unclassified Information that is processed, stored or transmitted on external systems, are implemented in accordance with applicable laws, Executive Orders, directives, policies, regulations, and standards.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-17 a
CCI-004368 (policy): Review and update the policy for Controlled Unclassified Information on an organization-defined frequency.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-17 b
CCI-004369 (policy): Defines the frequency in which the policy for Controlled Unclassified information is reviewed and updated.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-17 b
CCI-004370 (policy): Review and update the procedures for Controlled Unclassified Information on an organization-defined frequency.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-17 b
CCI-004371 (policy): Defines the frequency in which the procedures for Controlled Unclassified information is reviewed and updated.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-17 b
CCI-004372 (policy): Develop an organization-wide privacy program plan that provides an overview of the agency's privacy program.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-18 a
CCI-004373 (policy): Disseminate an organization-wide privacy program plan that provides an overview of the agency's privacy program.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-18 a
CCI-004374 (policy): Develop an organization-wide privacy program plan that provides an overview of the agency's privacy program and includes a description of the structure of the privacy program and the resources dictated to the privacy program.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-18 a 1
CCI-004375 (policy): Disseminate an organization-wide privacy program plan that provides an overview of the agency's privacy program and includes a description of the structure of the privacy program and the resources dictated to the privacy program.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-18 a 1
CCI-004376 (policy): Develop an organization-wide privacy program plan that provides an overview of the agency's privacy program and provides an overview of the requirements for the privacy program.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-18 a 2
CCI-004377 (policy): Disseminate an organization-wide privacy program plan that provides an overview of the agency's privacy program and provides an overview of the requirements for the privacy program.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-18 a 2
CCI-004378 (policy): Develop an organization-wide privacy program plan that provides an overview of the agency's privacy program and a description of the privacy program management controls and common controls in place or planned for meeting those requirements.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-18 a 2
CCI-004379 (policy): Disseminate an organization-wide privacy program plan that provides an overview of the agency's privacy program and a description of the privacy program management controls and common controls in place or planned for meeting those requirements.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-18 a 2
CCI-004380 (policy): Develop an organization-wide privacy program plan that provides an overview of the agency's privacy program and includes the role of the Senior Agency Official for Privacy and the identification and assignment of the roles of other privacy officials and staff and their responsibilities.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-18 a 3
CCI-004381 (policy): Disseminate an organization-wide privacy program plan that provides an overview of the agency's privacy program and includes the role of the Senior Agency Official for Privacy and the identification and assignment of the roles of other privacy officials and staff and their responsibilities.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-18 a 3
CCI-004382 (policy): Develop an organization-wide privacy program plan that provides an overview of the agency's privacy program and describes management commitment, compliance, and the strategic goals and objectives of the privacy program.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-18 a 4
CCI-004383 (policy): Disseminate an organization-wide privacy program plan that provides an overview of the agency's privacy program and describes management commitment, compliance, and the strategic goals and objectives of the privacy program.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-18 a 4
CCI-004384 (policy): Develop an organization-wide privacy program plan that provides an overview of the agency's privacy program and reflects coordination among organizational entities responsible for the different aspects of privacy.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-18 a 5
CCI-004385 (policy): Disseminate an organization-wide privacy program plan that provides an overview of the agency's privacy program and reflects coordination among organizational entities responsible for the different aspects of privacy.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-18 a 5
CCI-004386 (policy): Develop an organization-wide privacy program plan that provides an overview of the agency's privacy program and is approved by a senior official with responsibility and accountability for the privacy risk being incurred to organizational operations (including mission, functions, image, and reputation), organizational assets, individuals, other organizations, and the Nation.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-18 a 6
CCI-004387 (policy): Disseminate an organization-wide privacy program plan that provides an overview of the agency's privacy program and is approved by a senior official with responsibility and accountability for the privacy risk being incurred to organizational operations (including mission, functions, image, and reputation), organizational assets, individuals, other organizations, and the Nation.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-18 a 6
CCI-004388 (policy): Update the plan on an organization-defined frequency.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-18 a 6
CCI-004389 (policy): Update the plan to address changes in federal privacy laws and policy and organizational changes and problems identified during plan implementation or privacy control assessments.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-18 b
CCI-004390 (policy): Appoint a Senior Agency Official for Privacy with the authority, mission, accountability, and resources to coordinate applicable privacy requirements.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-19
CCI-004391 (policy): Appoint a Senior Agency Official for Privacy with the authority, mission, accountability, and resources to develop applicable privacy requirements.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-19
CCI-004392 (policy): Appoint a Senior Agency Official for Privacy with the authority, mission, accountability, and resources to implement applicable privacy requirements.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-19
CCI-004393 (policy): Appoint a Senior Agency Official for Privacy with the authority, mission, accountability, and resources to manage privacy risks through the organization-wide privacy program.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-19
CCI-004394 (policy): Maintain a central resource webpage on the organization's principle public website that serves as a central source of information about the organization's privacy plan.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-20
CCI-004395 (policy): Ensure that the public has access to information about organizational privacy activities.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-20 a
CCI-004396 (policy): Ensure that the public can communicate with its Senior Agency Official for Privacy.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-20 a
CCI-004397 (policy): Ensure that organizational privacy practices and reports are publicly available.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-20 b
CCI-004398 (policy): Employ publicly facing email addresses and/or phone lines to enable the public to provide feedback and/or direct questions to privacy offices regarding privacy practices.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-20 c
CCI-004399 (policy): Develop and post privacy policies on all external-facing websites, mobile applications, and other digital services that are written in plain language.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-20 (1) (a)
CCI-004400 (policy): Develop and post privacy policies on all external-facing websites, mobile applications, and other digital services that are organized in a way that is easy to understand and navigate.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-20 (1) (a)
CCI-004401 (policy): Develop and post privacy policies on all external-facing websites, mobile applications, and other digital services that provide information needed by the public to make an informed about whether and how to interact with the organization.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-20 (1) (b)
CCI-004402 (policy): Develop and post privacy policies on all external-facing websites, mobile applications, and other digital services that are updated whenever the organization makes a substantive change to the practices it describes.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-20 (1) (c)
CCI-004403 (policy): Develop and post privacy policies on all external-facing websites, mobile applications, and other digital services that includes a time/date stamp to inform the public of the date of the most recent changes.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-20 (1) (c)
CCI-004404 (policy): Develop an accurate accounting of disclosures of personally identifiable information.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-21 a
CCI-004405 (policy): Maintain an accurate accounting of disclosures of personally identifiable information.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-21 a
CCI-004406 (policy): Develop an accurate accounting of disclosures of personally identifiable information, including date, nature, and purpose of each disclosure of a record.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-21 a 1
CCI-004407 (policy): Maintain an accurate accounting of disclosures of personally identifiable information, including date, nature, and purpose of each disclosure of a record.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-21 a 1
CCI-004408 (policy): Develop an accurate accounting of disclosures of personally identifiable information, including name and address, or other contact information of the individual or organization to which the disclosure was made.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-21 a 2
CCI-004409 (policy): Maintain an accurate accounting of disclosures of personally identifiable information, including name and address, or other contact information of the individual or organization to which the disclosure was made.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-21 a 2
CCI-004410 (policy): Retain the accounting of disclosures for the length of the time the personally identifiable information is maintained or five years after the disclosure is made, whichever is longer.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-21 b
CCI-004411 (policy): Make the accounting of disclosures available to the individual to whom the personally identifiable information relates upon request.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-21 c
CCI-004412 (policy): Develop and document organization-wide policies for reviewing for the accuracy, relevance, timeliness, and completeness of personally identifiable information across the information life cycle.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-22 a
CCI-004413 (policy): Develop and document organization-wide procedures for reviewing for the accuracy, relevance, timeliness, and completeness of personally identifiable information across the information life cycle.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-22 a
CCI-004414 (policy): Develop and document organization-wide policies for correcting or deleting inaccurate or outdated personally identifiable information.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-22 b
CCI-004415 (policy): Develop and document organization-wide procedures for correcting or deleting inaccurate or outdated personally identifiable information.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-22 b
CCI-004416 (policy): Develop and document organization-wide policies for disseminating notice of corrected or deleted personally identifiable information to individuals or other appropriate entities.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-22 c
CCI-004417 (policy): Develop and document organization-wide procedures for disseminating notice of corrected or deleted personally identifiable information to individuals or other appropriate entities.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-22 c
CCI-004418 (policy): Develop and document organization-wide policies for appeals of adverse decisions on correction or deletion requests.
References: NIST: NIST SP 800-53 Revision 5 (v5): PM-22 d