Lexim011/Compliance huggingface dataset:
CCI-000035 (technical): Provide the capability for privileged administrators to configure the organization-defined security or privacy policy filters to support different security or privacy policies.
References: NIST: NIST SP 800-53 (v3): AC-4 (11) NIST: NIST SP 800-53 Revision 4 (v4): AC-4 (11) NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (11) NIST: NIST SP 800-53A (v1): AC-4 (11).1 (ii)
CCI-001554 (policy): Defines the security or privacy policy filters that privileged administrators have the capability to configure.
References: NIST: NIST SP 800-53 (v3): AC-4 (11) NIST: NIST SP 800-53 Revision 4 (v4): AC-4 (11) NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (11) NIST: NIST SP 800-53A (v1): AC-4 (11).1 (i)
CCI-002200 (policy): Defines the data type identifiers to be used to validate data being transferred between different security domains.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-4 (12) NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (12)
CCI-002201 (technical): When transferring information between different security domains, use organization-defined data type identifiers to validate data essential for information flow decisions.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-4 (12) NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (12)
CCI-000219 (technical): When transferring information between different security domains, decompose information into organization-defined policy-relevant subcomponents for submission to policy enforcement mechanisms.
References: NIST: NIST SP 800-53 (v3): AC-4 (13) NIST: NIST SP 800-53 Revision 4 (v4): AC-4 (13) NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (13) NIST: NIST SP 800-53A (v1): AC-4 (13).1
CCI-002202 (policy): Defines the policy-relevant subcomponents into which information being transferred between different security domains is to be decomposed for submission to policy enforcement mechanisms.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-4 (13) NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (13)
CCI-001371 (policy): Defines security or privacy policy filters requiring fully enumerated formats which are to be implemented when transferring information between different security domains.
References: NIST: NIST SP 800-53 (v3): AC-4 (14) NIST: NIST SP 800-53 Revision 4 (v4): AC-4 (14) NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (14) NIST: NIST SP 800-53A (v1): AC-4 (14).1 (i)
CCI-001372 (technical): When transferring information between different security domains, implement organization-defined security or privacy policy filters requiring fully enumerated formats that restrict data structure and content.
References: NIST: NIST SP 800-53 (v3): AC-4 (14) NIST: NIST SP 800-53 Revision 4 (v4): AC-4 (14) NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (14) NIST: NIST SP 800-53A (v1): AC-4 (14).1 (ii)
CCI-001373 (technical): When transferring information between different security domains, examine the information for the presence of organization-defined unsanctioned information.
References: NIST: NIST SP 800-53 (v3): AC-4 (15) NIST: NIST SP 800-53 Revision 4 (v4): AC-4 (15) NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (15) NIST: NIST SP 800-53A (v1): AC-4 (15).1 (i)
CCI-001374 (technical): When transferring information between different security domains, prohibit the transfer of such information in accordance with the organization-defined security pr privacy policy.
References: NIST: NIST SP 800-53 (v3): AC-4 (15) NIST: NIST SP 800-53 Revision 4 (v4): AC-4 (15) NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (15) NIST: NIST SP 800-53A (v1): AC-4 (15).1 (ii)
CCI-002203 (policy): Defines the unsanctioned information when transferring information between different security domains.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-4 (15) NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (15)
CCI-002204 (policy): Defines the security or privacy policy which prohibits the transfer of unsanctioned information between different security domains.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-4 (15) NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (15)
CCI-002205 (technical): Uniquely identify and authenticate source by organization, system, application, service, and/or individual for information transfer.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-4 (17) NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (17)
CCI-002207 (technical): Uniquely identify and authenticate destination points by organization, system, application, service, and/or individual for information transfer.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-4 (17) NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (17)
CCI-002211 (technical): When transferring information between different security domains, implement organization-defined security or privacy filters on metadata.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-4 (19) NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (19)
CCI-003666 (technical): Defines the security or privacy policy filters implemented when transferring information between security domains.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (19)
CCI-002212 (policy): Defines the solutions in approved configurations to be employed to control the flow of organization-defined information across security domains.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-4 (20) NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (20)
CCI-002213 (policy): Defines the information to be subjected to flow control across security domains.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-4 (20) NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (20)
CCI-002214 (policy): Employ organization-defined solutions in approved configurations to control the flow of organization-defined information across security domains.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-4 (20) NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (20)
CCI-002215 (policy): Defines the mechanisms and/or techniques to be used to logically or physically separate information flows.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-4 (21) NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (21)
CCI-002216 (policy): Defines the types of information required to accomplish logical or physical separation of information flows.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-4 (21) NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (21)
CCI-002217 (policy): Separate information flows logically or physically using organization-defined mechanisms and/or techniques to accomplish organization-defined required separations by types of information.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-4 (21) NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (21)
CCI-002218 (technical): Provide access from a single device to computing platforms, applications, or data residing on multiple different security domains, while preventing any information flow between the different security domains.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-4 (22) NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (22)
CCI-003667 (policy, technical): When transferring information between security domains, modify non-releasable information by implementing organization-defined modification action.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (23)
CCI-003668 (policy, technical): Defines the modification action when transferring information between different security domains.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (23)
CCI-003669 (technical): When transferring information between different security domains, parse incoming data into an internal normalized format.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (24)
CCI-003670 (technical): When transferring information between different security domains, regenerate the data to be consistent with its intended specification.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (24)
CCI-003671 (technical): When transferring information between different security domains, sanitize data to minimize delivery of malicious content, command and control of malicious code, malicious code augmentation, and steganography encoded data; spillage of sensitive information in accordance with organization-defined policy.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (25)
CCI-003672 (technical): Defines the policy when transferring information between different security domains.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (25)
CCI-003673 (policy, technical): When transferring information between different security domains, record and audit content filtering actions and results for the information being filtered.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (26)
CCI-003674 (technical): When transferring information between different security domains, implement content filtering solutions that provide redundant and independent filtering mechanisms for each data type.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (27)
CCI-003675 (technical): When transferring information between different security domains, implement a linear content filter pipeline that is enforced with discretionary and mandatory access controls.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (28)
CCI-003676 (policy, technical): When transferring information between different security domains, employ content filter orchestration engines to ensure that content filtering mechanisms successfully complete execution without errors.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (29) (a)
CCI-003677 (policy, technical): When transferring information between different security domains, employ content filter orchestration engines to ensure that content filtering actions occur in the correct order and comply with organization-defined policy.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (29) (b)
CCI-003678 (technical): When transferring information between different security domains, implement content filtering mechanisms using multiple processes.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (30)
CCI-003679 (technical): When transferring information between different security domains, prevent the transfer of failed content to the receiving domain.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (31)
CCI-003680 (technical): When transferring information between different security domains, the process that transfers information between filter pipelines does not filter message content.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (32) (a)
CCI-003681 (technical): When transferring information between different security domains, the process that transfers information between filter pipelines validates filtering metadata.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (32) (b)
CCI-003682 (technical): When transferring information between different security domains, the process that transfers information between filter pipelines ensures the content associated with the filtering metadata has successfully completed filtering.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (32) (c)
CCI-003683 (technical): When transferring information between different security domains, the process that transfers information between filter pipelines transfers the content to the destination filter pipeline.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-4 (32) (d)
CCI-002219 (policy): Defines the duties of individuals requiring separation.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-5 a NIST: NIST SP 800-53 Revision 5 (v5): AC-5 a
CCI-003684 (policy): Identify and document organization defined duties of individuals requiring separation.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-5 a
CCI-002220 (policy): Define system access authorizations to support separation of duties.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-5 c NIST: NIST SP 800-53 Revision 5 (v5): AC-5 b
CCI-000225 (policy): Employ the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) which are necessary to accomplish assigned organizational tasks.
References: NIST: NIST SP 800-53 (v3): AC-6 NIST: NIST SP 800-53 Revision 4 (v4): AC-6 NIST: NIST SP 800-53 Revision 5 (v5): AC-6 NIST: NIST SP 800-53A (v1): AC-6.1
CCI-001558 (policy): Defines the security functions (deployed in hardware, software, and firmware) for which access must be authorized.
References: NIST: NIST SP 800-53 (v3): AC-6 (1) NIST: NIST SP 800-53 Revision 4 (v4): AC-6 (1) NIST: NIST SP 800-53 Revision 5 (v5): AC-6 (1) (a) NIST: NIST SP 800-53A (v1): AC-6 (1).1 (i)
CCI-002222 (policy): Authorize access for organization-defined individuals or roles to organization-defined security functions (deployed in hardware, software, and firmware).
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-6 (1) NIST: NIST SP 800-53 Revision 5 (v5): AC-6 (1) (a)
CCI-003685 (policy): Defines the individuals or roles who authorize access to organization-defined security functions.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-6 (1) (a)
CCI-002221 (policy): Defines the security-relevant information for which access must be explicitly authorized.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-6 (1) NIST: NIST SP 800-53 Revision 5 (v5): AC-6 (1) (b)
CCI-002223 (policy): Authorize access for organization-defined individuals or roles to organization-defined security-relevant information.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-6 (1) NIST: NIST SP 800-53 Revision 5 (v5): AC-6 (1) (b)
CCI-003686 (policy): Defines the individuals or roles who authorize access to organization-defined security-relevant information.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-6 (1) (b)
CCI-000039 (policy): Require that users of system accounts, or roles, with access to organization-defined security functions or security-relevant information, use non-privileged accounts or roles, when accessing nonsecurity functions.
References: NIST: NIST SP 800-53 (v3): AC-6 (2) NIST: NIST SP 800-53 Revision 4 (v4): AC-6 (2) NIST: NIST SP 800-53 Revision 5 (v5): AC-6 (2) NIST: NIST SP 800-53A (v1): AC-6 (2).1 (ii)
CCI-001419 (policy): Defines the security functions or security-relevant information to which users of system accounts, or roles, have access.
References: NIST: NIST SP 800-53 (v3): AC-6 (2) NIST: NIST SP 800-53 Revision 4 (v4): AC-6 (2) NIST: NIST SP 800-53 Revision 5 (v5): AC-6 (2) NIST: NIST SP 800-53A (v1): AC-6 (2).1 (i)
CCI-000041 (policy): Authorize network access to organization-defined privileged commands only for organization-defined compelling operational needs.
References: NIST: NIST SP 800-53 (v3): AC-6 (3) NIST: NIST SP 800-53 Revision 4 (v4): AC-6 (3) NIST: NIST SP 800-53 Revision 5 (v5): AC-6 (3) NIST: NIST SP 800-53A (v1): AC-6 (3).1 (ii)
CCI-000042 (policy): Document the rationale for authorized network access to organization-defined privileged commands in the security plan for the system.
References: NIST: NIST SP 800-53 (v3): AC-6 (3) NIST: NIST SP 800-53 Revision 4 (v4): AC-6 (3) NIST: NIST SP 800-53 Revision 5 (v5): AC-6 (3) NIST: NIST SP 800-53A (v1): AC-6 (3).1 (iii)
CCI-001420 (policy): Defines the privileged commands to which network access is to be authorized only for organization-defined compelling operational needs.
References: NIST: NIST SP 800-53 (v3): AC-6 (3) NIST: NIST SP 800-53 Revision 4 (v4): AC-6 (3) NIST: NIST SP 800-53 Revision 5 (v5): AC-6 (3) NIST: NIST SP 800-53A (v1): AC-6 (3).1 (i)
CCI-002224 (policy): Defines the compelling operational needs that must be met in order to be authorized network access to organization-defined privileged commands.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-6 (3) NIST: NIST SP 800-53 Revision 5 (v5): AC-6 (3)
CCI-002225 (policy, technical): Provide separate processing domains to enable finer-grained allocation of user privileges.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-6 (4) NIST: NIST SP 800-53 Revision 5 (v5): AC-6 (4)
CCI-002226 (policy): Defines the personnel or roles to whom privileged accounts are to be restricted on the information system.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-6 (5) NIST: NIST SP 800-53 Revision 5 (v5): AC-6 (5)
CCI-002227 (policy): Restrict privileged accounts on the system to organization-defined personnel or roles.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-6 (5) NIST: NIST SP 800-53 Revision 5 (v5): AC-6 (5)
CCI-001422 (policy): Prohibit privileged access to the system by non-organizational users.
References: NIST: NIST SP 800-53 (v3): AC-6 (6) NIST: NIST SP 800-53 Revision 4 (v4): AC-6 (6) NIST: NIST SP 800-53 Revision 5 (v5): AC-6 (6) NIST: NIST SP 800-53A (v1): AC-6 (6).1
CCI-002228 (policy): Defines the frequency on which it conducts reviews of the privileges assigned to organization-defined roles or classes of users.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-6 (7) (a) NIST: NIST SP 800-53 Revision 5 (v5): AC-6 (7) (a)
CCI-002229 (policy): Defines the roles or classes of users that are to have their privileges reviewed on an organization-defined frequency.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-6 (7) (a) NIST: NIST SP 800-53 Revision 5 (v5): AC-6 (7) (a)
CCI-002230 (policy): Review, on an organization-defined frequency, the privileges assigned to organization-defined roles or classes of users to validate the need for such privileges.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-6 (7) (a) NIST: NIST SP 800-53 Revision 5 (v5): AC-6 (7) (a)
CCI-002231 (policy): Reassign or remove privileges, if necessary, to correctly reflect organizational mission and business needs.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-6 (7) (b) NIST: NIST SP 800-53 Revision 5 (v5): AC-6 (7) (b)
CCI-002232 (policy): Defines the software that is prevented from executing at a higher privilege than users executing the software.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-6 (8) NIST: NIST SP 800-53 Revision 5 (v5): AC-6 (8)
CCI-002233 (technical): Prevent the organization-defined software from executing at higher privilege levels than users executing the software.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-6 (8) NIST: NIST SP 800-53 Revision 5 (v5): AC-6 (8)
CCI-002234 (technical): Log the execution of privileged functions.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-6 (9) NIST: NIST SP 800-53 Revision 5 (v5): AC-6 (9)
CCI-002235 (technical): Prevent non-privileged users from executing privileged functions.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-6 (10) NIST: NIST SP 800-53 Revision 5 (v5): AC-6 (10)
CCI-000043 (policy): Defines the maximum number of consecutive invalid logon attempts to the information system by a user during an organization-defined time period.
References: NIST: NIST SP 800-53 (v3): AC-7 NIST: NIST SP 800-53 Revision 4 (v4): AC-7 NIST: NIST SP 800-53 Revision 5 (v5): AC-7 a NIST: NIST SP 800-53A (v1): AC-7.1 (i)
CCI-000044 (technical): Enforce the organization-defined limit of consecutive invalid logon attempts by a user during the organization-defined time period.
References: NIST: NIST SP 800-53 (v3): AC-7 a NIST: NIST SP 800-53 Revision 4 (v4): AC-7 a NIST: NIST SP 800-53 Revision 5 (v5): AC-7 a NIST: NIST SP 800-53A (v1): AC-7.1 (ii)
CCI-001423 (policy): Defines the time period in which the organization-defined maximum number of consecutive invalid logon attempts occur.
References: NIST: NIST SP 800-53 (v3): AC-7 NIST: NIST SP 800-53 Revision 4 (v4): AC-7 NIST: NIST SP 800-53 Revision 5 (v5): AC-7 a NIST: NIST SP 800-53A (v1): AC-7.1 (i)
CCI-002236 (policy): Defines the time period the information system will automatically lock the account or node when the maximum number of unsuccessful logon attempts is exceeded.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-7 b NIST: NIST SP 800-53 Revision 5 (v5): AC-7 b
CCI-002237 (policy): Defines the delay algorithm to delay the next logon prompt when the maximum number of unsuccessful logon attempts is exceeded.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-7 b NIST: NIST SP 800-53 Revision 5 (v5): AC-7 b
CCI-002238 (technical): Automatically lock the account or node for either an organization-defined time period, until the locked account or node is released by an administrator, or delays the next logon prompt according to the organization-defined delay algorithm when the maximum number of unsuccessful logon attempts is exceeded.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-7 b NIST: NIST SP 800-53 Revision 5 (v5): AC-7 b
CCI-002239 (policy): Defines the mobile devices that are to be purged or wiped after an organization-defined number of consecutive, unsuccessful device logon attempts.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-7 (2) NIST: NIST SP 800-53 Revision 5 (v5): AC-7 (2)
CCI-002240 (policy): Defines the purging or wiping requirements and techniques to be used on organization-defined mobile devices after an organization-defined number of consecutive, unsuccessful device logon attempts.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-7 (2) NIST: NIST SP 800-53 Revision 5 (v5): AC-7 (2)
CCI-002241 (policy): Defines the number of consecutive, unsuccessful device logon attempts after which the organization-defined mobile devices will be purged or wiped.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-7 (2) NIST: NIST SP 800-53 Revision 5 (v5): AC-7 (2)
CCI-002242 (technical): Purge or wipe information from organization-defined mobile devices based on organization-defined purging or wiping requirements and techniques after an organization-defined number of consecutive, unsuccessful device logon attempts.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-7 (2) NIST: NIST SP 800-53 Revision 5 (v5): AC-7 (2)
CCI-003687 (policy): Limit the number of unsuccessful biometric logon attempts to an organization-defined number.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-7 (3)
CCI-003688 (policy): Defines the number of allowed unsuccessful biometric logon attempts.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-7 (3)
CCI-003689 (policy, technical): Allow the use of organization-defined authentication factors that are different from the primary authentication factors after the number of organization-defined consecutive invalid logon attempts have been exceeded.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-7 (4) (a)
CCI-003690 (policy, technical): Defines the authentication factors after a number of organization-defined consecutive invalid logon attempts have been executed.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-7 (4) (a)
CCI-003691 (policy, technical): Enforce a limit of organization-defined number consecutive invalid logon attempts through use of the alternative factors by a user during a organization-defined time period.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-7 (4) (b)
CCI-003692 (policy, technical): Defines the number enforced for logon attempts.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-7 (4) (b)
CCI-000048 (technical): Display an organization-defined system use notification message or banner to users before granting access to the system that provides privacy and security notices consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidelines.
References: NIST: NIST SP 800-53 (v3): AC-8 a NIST: NIST SP 800-53 Revision 4 (v4): AC-8 a NIST: NIST SP 800-53 Revision 5 (v5): AC-8 a NIST: NIST SP 800-53A (v1): AC-8.1 (ii)
CCI-002243 (policy): Organization-defined system use notification message or banner is to state that users are accessing a U.S. Government system.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-8 a 1 NIST: NIST SP 800-53 Revision 5 (v5): AC-8 a 1
CCI-002244 (policy): Organization-defined system use notification message or banner is to state that system usage may be monitored, recorded, and subject to audit.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-8 a 2 NIST: NIST SP 800-53 Revision 5 (v5): AC-8 a 2
CCI-002245 (policy): Organization-defined system use notification message or banner is to state that unauthorized use of the system is prohibited and subject to criminal and civil penalties.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-8 a 3 NIST: NIST SP 800-53 Revision 5 (v5): AC-8 a 3
CCI-002246 (policy): Organization-defined system use notification message or banner is to state that use of the system indicates consent to monitoring and recording.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-8 a 4 NIST: NIST SP 800-53 Revision 5 (v5): AC-8 a 4
CCI-002247 (policy): Defines the use notification message or banner the system displays to users before granting access to the system.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-8 a NIST: NIST SP 800-53 Revision 5 (v5): AC-8 a
CCI-000050 (technical): Retain the notification message or banner on the screen until users acknowledge the usage conditions and take explicit actions to log on to or further access the system.
References: NIST: NIST SP 800-53 (v3): AC-8 b NIST: NIST SP 800-53 Revision 4 (v4): AC-8 b NIST: NIST SP 800-53 Revision 5 (v5): AC-8 b NIST: NIST SP 800-53A (v1): AC-8.1 (iii)
CCI-001384 (technical): For publicly accessible systems, display system use information with organization-defined conditions before granting further access to the publicly accessible system.
References: NIST: NIST SP 800-53 (v3): AC-8 c NIST: NIST SP 800-53 Revision 4 (v4): AC-8 c 1 NIST: NIST SP 800-53 Revision 5 (v5): AC-8 c 1 NIST: NIST SP 800-53A (v1): AC-8.2 (i)
CCI-001385 (technical): For publicly accessible systems, displays references, if any, to monitoring that are consistent with privacy accommodations for such systems that generally prohibit those activities.
References: NIST: NIST SP 800-53 (v3): AC-8 c NIST: NIST SP 800-53 Revision 4 (v4): AC-8 c 2 NIST: NIST SP 800-53 Revision 5 (v5): AC-8 c 2 NIST: NIST SP 800-53A (v1): AC-8.2 (ii)
CCI-001386 (technical): For publicly accessible systems, displays references, if any, to recording that are consistent with privacy accommodations for such systems that generally prohibit those activities.
References: NIST: NIST SP 800-53 (v3): AC-8 c NIST: NIST SP 800-53 Revision 4 (v4): AC-8 c 2 NIST: NIST SP 800-53 Revision 5 (v5): AC-8 c 2 NIST: NIST SP 800-53A (v1): AC-8.2 (ii)
CCI-001387 (technical): For publicly accessible systems, displays references, if any, to auditing that are consistent with privacy accommodations for such systems that generally prohibit those activities.
References: NIST: NIST SP 800-53 (v3): AC-8 c NIST: NIST SP 800-53 Revision 4 (v4): AC-8 c 2 NIST: NIST SP 800-53 Revision 5 (v5): AC-8 c 2 NIST: NIST SP 800-53A (v1): AC-8.2 (ii)
CCI-001388 (technical): For publicly accessible systems, includes a description of the authorized uses of the system.
References: NIST: NIST SP 800-53 (v3): AC-8 c NIST: NIST SP 800-53 Revision 4 (v4): AC-8 c 3 NIST: NIST SP 800-53 Revision 5 (v5): AC-8 c 3 NIST: NIST SP 800-53A (v1): AC-8.2 (iii)
CCI-002248 (policy): Defines the conditions of use which are to be displayed to users of the system before granting further access.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-8 c 1 NIST: NIST SP 800-53 Revision 5 (v5): AC-8 c 1
CCI-000052 (technical): Notify the user, upon successful logon (access) to the system, of the date and time of the last logon (access).
References: NIST: NIST SP 800-53 (v3): AC-9 NIST: NIST SP 800-53 Revision 4 (v4): AC-9 NIST: NIST SP 800-53 Revision 5 (v5): AC-9 NIST: NIST SP 800-53A (v1): AC-9.1
CCI-000053 (technical): Notify the user, upon successful logon/access, of the number of unsuccessful logon/access attempts since the last successful logon/access.
References: NIST: NIST SP 800-53 (v3): AC-9 (1) NIST: NIST SP 800-53 Revision 4 (v4): AC-9 (1) NIST: NIST SP 800-53 Revision 5 (v5): AC-9 (1) NIST: NIST SP 800-53A (v1): AC-9 (1).1
CCI-001389 (policy): Defines the time period that the system notifies the user of the number of successful logon/access attempts.
References: NIST: NIST SP 800-53 (v3): AC-9 (2) NIST: NIST SP 800-53 Revision 4 (v4): AC-9 (2) NIST: NIST SP 800-53 Revision 5 (v5): AC-9 (2) NIST: NIST SP 800-53A (v1): AC-9 (2).1 (i)
CCI-001390 (policy): Defines the time period that the system notifies the user of the number of unsuccessful logon/access attempts.
References: NIST: NIST SP 800-53 (v3): AC-9 (2) NIST: NIST SP 800-53 Revision 4 (v4): AC-9 (2) NIST: NIST SP 800-53 Revision 5 (v5): AC-9 (2) NIST: NIST SP 800-53A (v1): AC-9 (2).1 (i)
CCI-001391 (technical): Notify the user, upon successful logon, of the number of successful logons/accesses during the organization-defined time period.
References: NIST: NIST SP 800-53 (v3): AC-9 (2) NIST: NIST SP 800-53 Revision 4 (v4): AC-9 (2) NIST: NIST SP 800-53 Revision 5 (v5): AC-9 (2) NIST: NIST SP 800-53A (v1): AC-9 (2).1 (ii)
CCI-001392 (technical): Notify the user, upon successful logon, of the number of unsuccessful logon/access attempts during the organization-defined time period.
References: NIST: NIST SP 800-53 (v3): AC-9 (2) NIST: NIST SP 800-53 Revision 4 (v4): AC-9 (2) NIST: NIST SP 800-53 Revision 5 (v5): AC-9 (2) NIST: NIST SP 800-53A (v1): AC-9 (2).1 (ii)
CCI-001393 (policy): Defines the security-related characteristics/parameters of the user's account which, when changed, will result in a notification being provided to the user during the organization-defined time period.
References: NIST: NIST SP 800-53 (v3): AC-9 (3) NIST: NIST SP 800-53 Revision 4 (v4): AC-9 (3) NIST: NIST SP 800-53 Revision 5 (v5): AC-9 (3) NIST: NIST SP 800-53A (v1): AC-9 (3).1 (ii)
CCI-001394 (policy): Defines the time period during which organization-defined security-related changes to the user's account are to be tracked.
References: NIST: NIST SP 800-53 (v3): AC-9 (3) NIST: NIST SP 800-53 Revision 4 (v4): AC-9 (3) NIST: NIST SP 800-53 Revision 5 (v5): AC-9 (3) NIST: NIST SP 800-53A (v1): AC-9 (3).1 (i)
CCI-001395 (technical): Notify the user, upon successful logon, of changes to organization-defined security-related characteristics/parameters of the user's account during the organization-defined time-period.
References: NIST: NIST SP 800-53 (v3): AC-9 (3) NIST: NIST SP 800-53 Revision 4 (v4): AC-9 (3) NIST: NIST SP 800-53 Revision 5 (v5): AC-9 (3) NIST: NIST SP 800-53A (v1): AC-9 (3).1 (ii)
CCI-002249 (policy): Defines the additional information to be included in the notification to the user upon successful logon.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-9 (4) NIST: NIST SP 800-53 Revision 5 (v5): AC-9 (4)
CCI-002250 (technical): Notify the user, upon successful logon, of the following additional information: organization-defined additional information.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-9 (4) NIST: NIST SP 800-53 Revision 5 (v5): AC-9 (4)
CCI-000054 (technical): Limit the number of concurrent sessions for each organization-defined account and/or account type to an organization-defined number.
References: NIST: NIST SP 800-53 (v3): AC-10 NIST: NIST SP 800-53 Revision 4 (v4): AC-10 NIST: NIST SP 800-53 Revision 5 (v5): AC-10 NIST: NIST SP 800-53A (v1): AC-10.1 (ii)
CCI-000055 (policy): Defines the maximum number of concurrent sessions to be allowed for each organization-defined account and/or account type.
References: NIST: NIST SP 800-53 (v3): AC-10 NIST: NIST SP 800-53 Revision 4 (v4): AC-10 NIST: NIST SP 800-53 Revision 5 (v5): AC-10 NIST: NIST SP 800-53A (v1): AC-10.1 (i)
CCI-002252 (policy): Defines the accounts and/or account types for which will limit the number of concurrent sessions.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-10 NIST: NIST SP 800-53 Revision 5 (v5): AC-10
CCI-000057 (technical): The information system initiates a session lock after the organization-defined time period of inactivity.
References: NIST: NIST SP 800-53 (v3): AC-11 a NIST: NIST SP 800-53 Revision 4 (v4): AC-11 a NIST: NIST SP 800-53 Revision 5 (v5): AC-11 a NIST: NIST SP 800-53A (v1): AC-11.1 (ii)
CCI-000059 (policy): Defines the time-period of inactivity after which the system initiates a device lock.
References: NIST: NIST SP 800-53 (v3): AC-11 a NIST: NIST SP 800-53 Revision 4 (v4): AC-11 a NIST: NIST SP 800-53 Revision 5 (v5): AC-11 a NIST: NIST SP 800-53A (v1): AC-11.1 (i)
CCI-000056 (technical): Retain the device lock until the user reestablishes access using established identification and authentication procedures.
References: NIST: NIST SP 800-53 (v3): AC-11 b NIST: NIST SP 800-53 Revision 4 (v4): AC-11 b NIST: NIST SP 800-53 Revision 5 (v5): AC-11 b NIST: NIST SP 800-53A (v1): AC-11.1 (iii)
CCI-000060 (technical): Conceal, via the device lock, information previously visible on the display with a publicly viewable image.
References: NIST: NIST SP 800-53 (v3): AC-11 (1) NIST: NIST SP 800-53 Revision 4 (v4): AC-11 (1) NIST: NIST SP 800-53 Revision 5 (v5): AC-11 (1) NIST: NIST SP 800-53A (v1): AC-11 (1).1
CCI-002360 (policy): Defines the conditions or trigger events requiring session disconnect when automatically terminating a user session.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-12 NIST: NIST SP 800-53 Revision 5 (v5): AC-12
CCI-002361 (technical): Automatically terminate a user session after organization-defined conditions or trigger events requiring session disconnect.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-12 NIST: NIST SP 800-53 Revision 5 (v5): AC-12
CCI-002362 (policy): Defines the information resources requiring authentication in order to gain access.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-12 (1) NIST: NIST SP 800-53 Revision 5 (v5): AC-12 (1)
CCI-002363 (technical): Provide a logout capability for user-initiated communications sessions whenever authentication is used to gain access to organization-defined information resources.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-12 (1) NIST: NIST SP 800-53 Revision 5 (v5): AC-12 (1)
CCI-002364 (technical): Display an explicit logout message to users indicating the reliable termination of authenticated communications sessions.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-12 (1) NIST: NIST SP 800-53 Revision 5 (v5): AC-12 (2)
CCI-003693 (technical): Display an explicit message to users indicating that the session will end at an organization-defined time until end of session.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-12 (3)
CCI-003694 (technical): Defines the time until end of session, indicating the session will end.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-12 (3)
CCI-000061 (policy): Identify organization-defined user actions that can be performed on the system without identification or authentication consistent with organizational missions/business functions.
References: NIST: NIST SP 800-53 (v3): AC-14 a NIST: NIST SP 800-53 Revision 4 (v4): AC-14 a NIST: NIST SP 800-53 Revision 5 (v5): AC-14 a NIST: NIST SP 800-53A (v1): AC-14.1 (i)
CCI-003695 (policy): Defines the user actions that can be performed on the system without identification or authentication consistent with organizational missions/business functions.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-14 a
CCI-000232 (policy): Document and provide supporting rationale in the security plan for the system, user actions not requiring identification and authentication.
References: NIST: NIST SP 800-53 (v3): AC-14 b NIST: NIST SP 800-53 Revision 4 (v4): AC-14 b NIST: NIST SP 800-53 Revision 5 (v5): AC-14 b NIST: NIST SP 800-53A (v1): AC-14.1 (ii)
CCI-002256 (policy): Defines security attributes having organization-defined types of security attribute values which are associated with information in storage.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-16 a NIST: NIST SP 800-53 Revision 5 (v5): AC-16 a
CCI-002257 (policy): Defines security attributes having organization-defined types of security attribute values which are associated with information in process.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-16 a NIST: NIST SP 800-53 Revision 5 (v5): AC-16 a
CCI-002258 (policy): Defines security attributes, having organization-defined types of security attribute values, which are associated with information in transmission.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-16 a NIST: NIST SP 800-53 Revision 5 (v5): AC-16 a
CCI-002259 (policy): Defines security attribute values associated with organization-defined types of security attributes for information in storage.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-16 a NIST: NIST SP 800-53 Revision 5 (v5): AC-16 a
CCI-002260 (policy): Defines security attribute values associated with organization-defined types of security attributes for information in process.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-16 a NIST: NIST SP 800-53 Revision 5 (v5): AC-16 a
CCI-002261 (policy): Defines security attribute values associated with organization-defined types of security attributes for information in transmission.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-16 a NIST: NIST SP 800-53 Revision 5 (v5): AC-16 a
CCI-002262 (technical): Provides the means to associate organization-defined types of security attributes having organization-defined security attribute values with information in storage.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-16 a NIST: NIST SP 800-53 Revision 5 (v5): AC-16 a
CCI-002263 (technical): Provides the means to associate organization-defined types of security attributes having organization-defined security attribute values with information in process.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-16 a NIST: NIST SP 800-53 Revision 5 (v5): AC-16 a
CCI-002264 (technical): Provides the means to associate organization-defined types of security attributes having organization-defined security attribute values with information in transmission.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-16 a NIST: NIST SP 800-53 Revision 5 (v5): AC-16 a
CCI-003696 (policy): Defines privacy attributes having organization-defined types of privacy attribute values which are associated with information in storage.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-16 a
CCI-003697 (policy): Defines privacy attributes having organization-defined types of privacy attribute values which are associated with information in process.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-16 a
CCI-003698 (policy): Defines privacy attributes, having organization-defined types of privacy attribute values, which are associated with information in transmission.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-16 a
CCI-003699 (policy): Defines privacy attribute values associated with organization-defined types of privacy attributes for information in storage.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-16 a
CCI-003700 (policy): Defines privacy attribute values associated with organization-defined types of privacy attributes for information in process.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-16 a
CCI-003701 (policy): Defines privacy attribute values associated with organization-defined types of privacy attributes for information in transmission.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-16 a
CCI-002265 (policy): Ensure that the security attribute associations are made with the information.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-16 b NIST: NIST SP 800-53 Revision 5 (v5): AC-16 b
CCI-002266 (policy): Ensure that the security attribute associations are retained with the information.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-16 b NIST: NIST SP 800-53 Revision 5 (v5): AC-16 b
CCI-003702 (policy): Ensure that the privacy attribute associations are made with the information.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-16 b
CCI-003703 (policy): Ensure that the privacy attribute associations are restrained with the information.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-16 b
CCI-002267 (policy): Defines the security attributes that are permitted for organization-defined systems.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-16 c NIST: NIST SP 800-53 Revision 5 (v5): AC-16 c
CCI-002268 (policy): Defines the systems for which permitted organization-defined attributes are to be established.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-16 c NIST: NIST SP 800-53 Revision 5 (v5): AC-16 c
CCI-002269 (policy): Establish the following permitted organization-defined security attributes in AC-16a for organization-defined systems.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-16 c NIST: NIST SP 800-53 Revision 5 (v5): AC-16 c
CCI-003704 (policy): Establish the following permitted organization-defined privacy attributes defined in AC-16a for organization-defined systems.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-16 c
CCI-003705 (policy): Defines the privacy attributes that are permitted for organization-defined systems.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-16 c
CCI-002270 (policy): Defines the attribute values or ranges permitted for each of the established security attributes.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-16 d NIST: NIST SP 800-53 Revision 5 (v5): AC-16 d
CCI-002271 (policy): Determine the following permitted attribute value or ranges for each of the established attributes.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-16 d NIST: NIST SP 800-53 Revision 5 (v5): AC-16 d
CCI-003706 (policy): Defines the attribute values or ranges permitted for each of the established privacy attributes.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-16 d
CCI-003707 (policy): Audit changes to the attributes.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-16 e
CCI-003708 (policy): Review organization-defined security attributes for applicability on an organization-defined frequency.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-16 f
CCI-003709 (policy): Review organization-defined privacy attributes for applicability on an organization-defined frequency.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-16 f
CCI-003710 (policy): Defines the security and privacy attributes to be reviewed for applicability.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-16 f
CCI-003711 (policy): Defines the frequency of which the security and privacy attributes will be reviewed.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-16 f
CCI-001424 (technical): Dynamically associate security attributes with organization-defined subjects in accordance with organization-defined security policies as information is created and combined.
References: NIST: NIST SP 800-53 (v3): AC-16 (1) NIST: NIST SP 800-53 Revision 4 (v4): AC-16 (1) NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (1) NIST: NIST SP 800-53A (v1): AC-16 (1).1
CCI-002272 (technical): Dynamically associate security attributes with organization-defined objects in accordance with organization-defined security policies as information is created and combined.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-16 (1) NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (1)
CCI-002273 (policy): Defines the security policies to adhere to when dynamically associating security attributes with organization-defined subjects and objects.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-16 (1) NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (1)
CCI-002274 (policy): Defines the subjects with which the information system is to dynamically associate security attributes as information is created and combined.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-16 (1) NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (1)
CCI-002275 (policy): Defines the objects with which the information system is to dynamically associate security attributes as information is created and combined.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-16 (1) NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (1)
CCI-003712 (technical): Dynamically associate privacy attributes with organization-defined subjects in accordance with organization-defined privacy policies as information is created and combined.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (1)
CCI-003713 (technical): Dynamically associate privacy attributes with organization-defined objects in accordance with organization-defined privacy policies as information is created and combined.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (1)
CCI-003714 (technical): Defines the privacy policies to adhere to when dynamically associating security attributes with organization-defined subjects and objects.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (1)
CCI-001425 (technical): Provides authorized individuals (or processes acting on behalf of individuals) the capability to change the value of associated security attributes.
References: NIST: NIST SP 800-53 (v3): AC-16 (2) NIST: NIST SP 800-53 Revision 4 (v4): AC-16 (2) NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (2) NIST: NIST SP 800-53A (v1): AC-16 (2).1 (ii)
CCI-002277 (technical): Provides authorized individuals (or processes acting on behalf of individuals) the capability to define the value of associated security attributes.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-16 (2) NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (2)
CCI-003715 (technical): Provides authorized individuals (or processes acting on behalf of individuals) the capability to change the value of associated privacy attributes.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (2)
CCI-003716 (technical): Provides authorized individuals (or processes acting on behalf of individuals) the capability to define the value of associated privacy attributes.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (2)
CCI-002278 (policy): Defines the security attributes for which the association and integrity to organization-defined subjects and objects is maintained.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-16 (3) NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (3)
CCI-002279 (policy): Defines the subjects for which the association and integrity of organization-defined security attributes is maintained.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-16 (3) NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (3)
CCI-002280 (policy): Defines the objects for which the association and integrity of organization-defined security attributes is maintained.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-16 (3) NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (3)
CCI-002281 (technical): Maintain the association of organization-defined security attributes to organization-defined subjects.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-16 (3) NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (3)
CCI-002282 (technical): Maintain the association of organization-defined security attributes to organization-defined objects.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-16 (3) NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (3)
CCI-002283 (technical): Maintain the integrity of organization-defined security attributes associated with organization-defined subjects.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-16 (3) NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (3)
CCI-002284 (technical): Maintain the integrity of organization-defined security attributes associated with organization-defined objects.
References: NIST: NIST SP 800-53 Revision 4 (v4): AC-16 (3) NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (3)
CCI-003717 (technical): Defines the privacy attributes for which the association and integrity to organization-defined subjects and objects is maintained.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (3)
CCI-003718 (technical): Maintain the association of organization-defined privacy attributes to organization-defined subjects.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (3)
CCI-003719 (technical): Maintain the association of organization-defined privacy attributes to organization-defined objects.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (3)
CCI-003720 (technical): Maintain the integrity of organization-defined privacy attributes associated with organization-defined subjects.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (3)
CCI-003721 (technical): Maintain the integrity of organization-defined privacy attributes associated with organization-defined objects.
References: NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (3)
CCI-001428 (technical): Displays security attributes in human-readable form on each object that the system transmits to output devices to identify organization-identified special dissemination, handling, or distribution instructions using organization-identified human-readable, standard naming conventions.
References: NIST: NIST SP 800-53 (v3): AC-16 (5) NIST: NIST SP 800-53 Revision 4 (v4): AC-16 (5) NIST: NIST SP 800-53 Revision 5 (v5): AC-16 (4) NIST: NIST SP 800-53A (v1): AC-16 (5).1 (iii)