Lexim011/Compliance huggingface dataset:
CCI-004982 (technical): Provide visibility into network traffic at external and key internal system interfaces to optimize the effectiveness of monitoring devices.
References: NIST: NIST SP 800-53 Revision 5 (v5): SI-4 (25)
CCI-001285 (policy): Receive system security alerts, advisories, and directives from organization-defined external organizations on an ongoing basis.
References: NIST: NIST SP 800-53 (v3): SI-5 a NIST: NIST SP 800-53 Revision 4 (v4): SI-5 a NIST: NIST SP 800-53 Revision 5 (v5): SI-5 a NIST: NIST SP 800-53A (v1): SI-5.1 (i)
CCI-002692 (policy): Defines the external organizations from which it receives information system security alerts, advisories, and directives.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-5 a NIST: NIST SP 800-53 Revision 5 (v5): SI-5 a
CCI-001286 (policy): Generate internal security alerts, advisories, and directives as deemed necessary.
References: NIST: NIST SP 800-53 (v3): SI-5 b NIST: NIST SP 800-53 Revision 4 (v4): SI-5 b NIST: NIST SP 800-53 Revision 5 (v5): SI-5 b NIST: NIST SP 800-53A (v1): SI-5.1 (ii)
CCI-001287 (policy): Disseminate security alerts, advisories, and directives to organization-defined personnel or roles, organization-defined elements within the organization, and/or organization-defined external organizations.
References: NIST: NIST SP 800-53 (v3): SI-5 c NIST: NIST SP 800-53 Revision 4 (v4): SI-5 c NIST: NIST SP 800-53 Revision 5 (v5): SI-5 c NIST: NIST SP 800-53A (v1): SI-5.1 (iv)
CCI-001288 (policy): Defines the personnel or roles to whom the organization will disseminate security alerts, advisories, and directives.
References: NIST: NIST SP 800-53 (v3): SI-5 c NIST: NIST SP 800-53 Revision 4 (v4): SI-5 c NIST: NIST SP 800-53 Revision 5 (v5): SI-5 c NIST: NIST SP 800-53A (v1): SI-5.1 (iii)
CCI-002693 (policy): Defines the elements within the organization to whom the organization will disseminate security alerts, advisories, and directives.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-5 c NIST: NIST SP 800-53 Revision 5 (v5): SI-5 c
CCI-002694 (policy): Defines the external organizations to which the organization will disseminate security alerts, advisories, and directives.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-5 c NIST: NIST SP 800-53 Revision 5 (v5): SI-5 c
CCI-001289 (policy): Implement security directives in accordance with established time frames, or notify the issuing organization of the degree of noncompliance.
References: NIST: NIST SP 800-53 (v3): SI-5 d NIST: NIST SP 800-53 Revision 4 (v4): SI-5 d NIST: NIST SP 800-53 Revision 5 (v5): SI-5 d NIST: NIST SP 800-53A (v1): SI-5.1 (v)
CCI-001290 (policy): Broadcast security alert and advisory information throughout the organization using organization-defined automated mechanisms.
References: NIST: NIST SP 800-53 (v3): SI-5 (1) NIST: NIST SP 800-53 Revision 4 (v4): SI-5 (1) NIST: NIST SP 800-53 Revision 5 (v5): SI-5 (1) NIST: NIST SP 800-53A (v1): SI-5 (1).1
CCI-004983 (policy): Defines the automated mechanisms for broadcasting security alert and advisory information.
References: NIST: NIST SP 800-53 Revision 5 (v5): SI-5 (1)
CCI-002695 (policy): Defines the security functions that require verification of correct operation.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-6 a NIST: NIST SP 800-53 Revision 5 (v5): SI-6 a
CCI-002696 (technical): Verify correct operation of organization-defined security functions.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-6 a NIST: NIST SP 800-53 Revision 5 (v5): SI-6 a
CCI-004984 (policy): Defines the privacy functions that require verification of correct operation.
References: NIST: NIST SP 800-53 Revision 5 (v5): SI-6 a
CCI-004985 (technical): Verify correct operation of organization-defined privacy functions.
References: NIST: NIST SP 800-53 Revision 5 (v5): SI-6 a
CCI-002697 (policy): Defines the frequency at which it will verify correct operation of organization-defined security functions.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-6 b NIST: NIST SP 800-53 Revision 5 (v5): SI-6 b
CCI-002698 (policy): Defines the system transitional states when the system will verify correct operation of organization-defined security functions.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-6 b NIST: NIST SP 800-53 Revision 5 (v5): SI-6 b
CCI-002699 (technical): Perform verification of the correct operation of organization-defined security functions: when the system is in an organization-defined transitional state; upon command by a user with appropriate privileges; and/or on an organization-defined frequency.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-6 b NIST: NIST SP 800-53 Revision 5 (v5): SI-6 b
CCI-004986 (policy): Defines the frequency at which it will verify correct operation of organization-defined privacy functions.
References: NIST: NIST SP 800-53 Revision 5 (v5): SI-6 b
CCI-004987 (policy): Defines the system transitional states when the system will verify correct operation of organization-defined privacy functions.
References: NIST: NIST SP 800-53 Revision 5 (v5): SI-6 b
CCI-004988 (technical): Perform verification of the correct operation of organization-defined privacy functions: when the system is in an organization-defined transitional state; upon command by a user with appropriate privileges; and/or on an organization-defined frequency.
References: NIST: NIST SP 800-53 Revision 5 (v5): SI-6 b
CCI-001294 (technical): Alert organization-defined personnel or roles of failed security verification tests.
References: NIST: NIST SP 800-53 (v3): SI-6 (1) NIST: NIST SP 800-53 Revision 4 (v4): SI-6 c NIST: NIST SP 800-53 Revision 5 (v5): SI-6 c NIST: NIST SP 800-53A (v1): SI-6 (1).1
CCI-002700 (policy): Defines the personnel or roles to be notified when security verification tests fail.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-6 c NIST: NIST SP 800-53 Revision 5 (v5): SI-6 c
CCI-004989 (technical): Alert organization-defined personnel or roles of failed privacy verification tests.
References: NIST: NIST SP 800-53 Revision 5 (v5): SI-6 c
CCI-004990 (policy): Defines the personnel or roles to be notified when privacy verification tests fail.
References: NIST: NIST SP 800-53 Revision 5 (v5): SI-6 c
CCI-002701 (policy): Defines alternative action(s) to be taken when anomalies in the operation of organization-defined security functions are discovered.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-6 d NIST: NIST SP 800-53 Revision 5 (v5): SI-6 d
CCI-002702 (technical): Shut the system down, restart the system, and/or initiate organization-defined alternative action(s) when anomalies in the operation of the organization-defined security functions are discovered.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-6 d NIST: NIST SP 800-53 Revision 5 (v5): SI-6 d
CCI-004991 (policy): Defines alternative action(s) to be taken when anomalies in the operation of organization-defined privacy functions are discovered.
References: NIST: NIST SP 800-53 Revision 5 (v5): SI-6 d
CCI-004992 (technical): Shut the system down, restart the system, and/or initiate organization-defined alternative action(s) when anomalies in the operation of the organization-defined privacy functions are discovered.
References: NIST: NIST SP 800-53 Revision 5 (v5): SI-6 d
CCI-001295 (technical): Implement automated mechanisms to support the management of distributed security function testing.
References: NIST: NIST SP 800-53 (v3): SI-6 (2) NIST: NIST SP 800-53 Revision 4 (v4): SI-6 (2) NIST: NIST SP 800-53 Revision 5 (v5): SI-6 (2) NIST: NIST SP 800-53A (v1): SI-6 (2).1
CCI-004993 (technical): Implement automated mechanisms to support the management of distributed privacy function testing.
References: NIST: NIST SP 800-53 Revision 5 (v5): SI-6 (2)
CCI-001296 (policy): Report the results of security function verification to organization-defined personnel or roles.
References: NIST: NIST SP 800-53 (v3): SI-6 (3) NIST: NIST SP 800-53 Revision 4 (v4): SI-6 (3) NIST: NIST SP 800-53 Revision 5 (v5): SI-6 (3) NIST: NIST SP 800-53A (v1): SI-6 (3).1 (ii)
CCI-001675 (policy): Defines the personnel or roles that are to receive reports on the results of security function verification.
References: NIST: NIST SP 800-53 (v3): SI-6 (3) NIST: NIST SP 800-53 Revision 4 (v4): SI-6 (3) NIST: NIST SP 800-53 Revision 5 (v5): SI-6 (3) NIST: NIST SP 800-53A (v1): SI-6 (3).1 (i)
CCI-004994 (policy): Report the results of privacy function verification to organization-defined personnel or roles.
References: NIST: NIST SP 800-53 Revision 5 (v5): SI-6 (3)
CCI-004995 (policy): Defines the personnel or roles that are to receive reports on the results of privacy function verification.
References: NIST: NIST SP 800-53 Revision 5 (v5): SI-6 (3)
CCI-002703 (policy): Defines the software, firmware, and information which will be subjected to integrity verification tools to detect unauthorized changes.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-7 NIST: NIST SP 800-53 Revision 5 (v5): SI-7
CCI-002704 (policy): Employ integrity verification tools to detect unauthorized changes to organization-defined software, firmware, and information.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-7 NIST: NIST SP 800-53 Revision 5 (v5): SI-7 a
CCI-004996 (policy, technical): Take organization-defined actions when unauthorized changes to the software, firmware, and information are detected.
References: NIST: NIST SP 800-53 Revision 5 (v5): SI-7 b
CCI-004997 (policy, technical): Defines the actions to be taken when unauthorized changes to the software, firmware, and information are detected.
References: NIST: NIST SP 800-53 Revision 5 (v5): SI-7 b
CCI-002705 (policy): Defines the software on which integrity checks will be performed.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-7 (1) NIST: NIST SP 800-53 Revision 5 (v5): SI-7 (1)
CCI-002706 (policy): Defines the firmware on which integrity checks will be performed.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-7 (1) NIST: NIST SP 800-53 Revision 5 (v5): SI-7 (1)
CCI-002707 (policy): Defines the information on which integrity checks will be performed.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-7 (1) NIST: NIST SP 800-53 Revision 5 (v5): SI-7 (1)
CCI-002708 (policy): Defines the transitional state or security-relevant events when performing integrity checks on software, firmware, and information.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-7 (1) NIST: NIST SP 800-53 Revision 5 (v5): SI-7 (1)
CCI-002709 (policy): Defines the frequency at which integrity checks of software, firmware, and information will be performed.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-7 (1) NIST: NIST SP 800-53 Revision 5 (v5): SI-7 (1)
CCI-002710 (technical): Perform an integrity check of organization-defined software at startup, at organization-defined transitional states or security-relevant events, or on an organization-defined frequency.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-7 (1) NIST: NIST SP 800-53 Revision 5 (v5): SI-7 (1)
CCI-002711 (technical): Perform an integrity check of organization-defined firmware at startup, at organization-defined transitional states or security-relevant events, or on an organization-defined frequency.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-7 (1) NIST: NIST SP 800-53 Revision 5 (v5): SI-7 (1)
CCI-002712 (technical): Perform an integrity check of organization-defined information at startup, at organization-defined transitional states or security-relevant events, or on an organization-defined frequency.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-7 (1) NIST: NIST SP 800-53 Revision 5 (v5): SI-7 (1)
CCI-001300 (policy): Employ automated tools that provide notification to organization-defined personnel or roles upon discovering discrepancies during integrity verification.
References: NIST: NIST SP 800-53 (v3): SI-7 (2) NIST: NIST SP 800-53 Revision 4 (v4): SI-7 (2) NIST: NIST SP 800-53 Revision 5 (v5): SI-7 (2) NIST: NIST SP 800-53A (v1): SI-7 (2).1
CCI-002713 (policy): Defines the personnel or roles to be notified when discrepancies are discovered during integrity verification.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-7 (2) NIST: NIST SP 800-53 Revision 5 (v5): SI-7 (2)
CCI-001301 (policy): Employ centrally managed integrity verification tools.
References: NIST: NIST SP 800-53 (v3): SI-7 (3) NIST: NIST SP 800-53 Revision 4 (v4): SI-7 (3) NIST: NIST SP 800-53 Revision 5 (v5): SI-7 (3) NIST: NIST SP 800-53A (v1): SI-7 (3).1
CCI-002714 (policy): Defines the controls that are to be employed when integrity violations are discovered.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-7 (5) NIST: NIST SP 800-53 Revision 5 (v5): SI-7 (5)
CCI-002715 (technical): Automatically shut the system down, restart the system, and/or implement organization-defined controls when integrity violations are discovered.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-7 (5) NIST: NIST SP 800-53 Revision 5 (v5): SI-7 (5)
CCI-002716 (technical): Implement cryptographic mechanisms to detect unauthorized changes to software.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-7 (6) NIST: NIST SP 800-53 Revision 5 (v5): SI-7 (6)
CCI-002717 (technical): Implement cryptographic mechanisms to detect unauthorized changes to firmware.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-7 (6) NIST: NIST SP 800-53 Revision 5 (v5): SI-7 (6)
CCI-002718 (technical): Implement cryptographic mechanisms to detect unauthorized changes to information.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-7 (6) NIST: NIST SP 800-53 Revision 5 (v5): SI-7 (6)
CCI-002719 (policy): Defines the unauthorized security-relevant changes to the system that are to be incorporated into the organizational incident response capability.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-7 (7) NIST: NIST SP 800-53 Revision 5 (v5): SI-7 (7)
CCI-002720 (policy): Incorporate the detection of organization-defined security-relevant unauthorized changes into the organizational incident response capability.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-7 (7) NIST: NIST SP 800-53 Revision 5 (v5): SI-7 (7)
CCI-002721 (policy): Defines the personnel or roles that are to be alerted when a potential integrity violation is detected.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-7 (8) NIST: NIST SP 800-53 Revision 5 (v5): SI-7 (8)
CCI-002722 (policy): Defines other actions that can be taken when a potential integrity violation is detected.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-7 (8) NIST: NIST SP 800-53 Revision 5 (v5): SI-7 (8)
CCI-002723 (technical): Upon detection of a potential integrity violation, provides the capability to audit the event.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-7 (8) NIST: NIST SP 800-53 Revision 5 (v5): SI-7 (8)
CCI-002724 (technical): Upon detection of a potential integrity violation, initiate one or more of the following actions: generate an audit record; alert the current user; alert organization-defined personnel or roles; and/or organization-defined other actions.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-7 (8) NIST: NIST SP 800-53 Revision 5 (v5): SI-7 (8)
CCI-002725 (policy): Defines the system component which will have the integrity of the boot process verified.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-7 (9) NIST: NIST SP 800-53 Revision 5 (v5): SI-7 (9)
CCI-002726 (technical): Verify the integrity of the boot process of organization-defined system components.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-7 (9) NIST: NIST SP 800-53 Revision 5 (v5): SI-7 (9)
CCI-002727 (policy): Defines the mechanisms to be implemented to protect the integrity of the boot firmware in organization-defined system components.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-7 (10) NIST: NIST SP 800-53 Revision 5 (v5): SI-7 (10)
CCI-002728 (policy): Defines the system components on which organization-defined mechanisms will be implemented to protect the integrity of the boot firmware.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-7 (10) NIST: NIST SP 800-53 Revision 5 (v5): SI-7 (10)
CCI-002729 (technical): Implement organization-defined mechanisms to protect the integrity of boot firmware in organization-defined system components.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-7 (10) NIST: NIST SP 800-53 Revision 5 (v5): SI-7 (10)
CCI-002732 (policy): Defines the user-installed software that is to have its integrity verified prior to execution.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-7 (12) NIST: NIST SP 800-53 Revision 5 (v5): SI-7 (12)
CCI-002733 (policy): Require that the integrity of organization-defined user-installed software be verified prior to execution.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-7 (12) NIST: NIST SP 800-53 Revision 5 (v5): SI-7 (12)
CCI-002734 (policy): Defines the personnel or roles which have the authority to explicitly approve binary or machine-executable code.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-7 (13) NIST: NIST SP 800-53 Revision 5 (v5): SI-7 (13)
CCI-002739 (policy): Defines the software or firmware components on which cryptographic mechanisms are to be implemented to support authentication prior to installation.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-7 (15) NIST: NIST SP 800-53 Revision 5 (v5): SI-7 (15)
CCI-002740 (technical): Implement cryptographic mechanisms to authenticate organization-defined software or firmware components prior to installation.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-7 (15) NIST: NIST SP 800-53 Revision 5 (v5): SI-7 (15)
CCI-001321 (policy): Prohibit processes from executing without supervision for more than an organization-defined time period.
References: NIST: NIST SP 800-53 (v3): SI-13 (2) NIST: NIST SP 800-53 Revision 4 (v4): SI-7 (16) NIST: NIST SP 800-53 Revision 5 (v5): SI-7 (16) NIST: NIST SP 800-53A (v1): SI-13 (2).1 (ii)
CCI-001322 (policy): Defines a time period that is the longest a process is allowed to execute without supervision.
References: NIST: NIST SP 800-53 (v3): SI-13 (2) NIST: NIST SP 800-53 Revision 4 (v4): SI-7 (16) NIST: NIST SP 800-53 Revision 5 (v5): SI-7 (16) NIST: NIST SP 800-53A (v1): SI-13 (2).1 (i)
CCI-004998 (technical): Implement organization-defined controls for application self-protection at runtime.
References: NIST: NIST SP 800-53 Revision 5 (v5): SI-7 (17)
CCI-004999 (policy): Defines the controls to be implemented for runtime application self-protection.
References: NIST: NIST SP 800-53 Revision 5 (v5): SI-7 (17)
CCI-002741 (policy): Employ spam protection mechanisms at system entry points to detect and take action on unsolicited messages.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-8 a NIST: NIST SP 800-53 Revision 5 (v5): SI-8 a
CCI-002742 (policy): Employ spam protection mechanisms at system exit points to detect and take action on unsolicited messages.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-8 a NIST: NIST SP 800-53 Revision 5 (v5): SI-8 a
CCI-005000 (policy): Update spam protection mechanisms when new releases are available in accordance with organizational configuration management policy.
References: NIST: NIST SP 800-53 Revision 5 (v5): SI-8 b
CCI-005001 (policy): Update spam protection mechanisms when new releases are available in accordance with organizational configuration management procedures.
References: NIST: NIST SP 800-53 Revision 5 (v5): SI-8 b
CCI-001308 (technical): Automatically update spam protection mechanisms on an organization-defined frequency.
References: NIST: NIST SP 800-53 (v3): SI-8 (2) NIST: NIST SP 800-53 Revision 4 (v4): SI-8 (2) NIST: NIST SP 800-53 Revision 5 (v5): SI-8 (2) NIST: NIST SP 800-53A (v1): SI-8 (2).1
CCI-005002 (policy): Defines the frequency for updating spam protection mechanisms.
References: NIST: NIST SP 800-53 Revision 5 (v5): SI-8 (2)
CCI-002743 (technical): Implement spam protection mechanisms with a learning capability to more effectively identify legitimate communications traffic.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-8 (3) NIST: NIST SP 800-53 Revision 5 (v5): SI-8 (3)
CCI-001310 (technical): Checks the validity of organization-defined information inputs to the system.
References: NIST: NIST SP 800-53 (v3): SI-10 NIST: NIST SP 800-53 Revision 4 (v4): SI-10 NIST: NIST SP 800-53 Revision 5 (v5): SI-10 NIST: NIST SP 800-53A (v1): SI-10.1
CCI-002744 (policy): Defines the inputs on which the system is to conduct validity checks.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-10 NIST: NIST SP 800-53 Revision 5 (v5): SI-10
CCI-002745 (policy): Defines the inputs defined in base control (SI-10), which provide a manual override capability for input validation.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-10 (1) (a) NIST: NIST SP 800-53 Revision 5 (v5): SI-10 (1) (a)
CCI-002746 (technical): Provide a manual override capability for input validation of organization-defined inputs defined in base control (SI-10).
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-10 (1) (a) NIST: NIST SP 800-53 Revision 5 (v5): SI-10 (1) (a)
CCI-002747 (policy): Defines the individuals who have the authorization to use the manual override capability for input validation.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-10 (1) (b) NIST: NIST SP 800-53 Revision 5 (v5): SI-10 (1) (b)
CCI-002748 (technical): Restrict the use of the manual override capability to only organization-defined authorized individuals.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-10 (1) (b) NIST: NIST SP 800-53 Revision 5 (v5): SI-10 (1) (b)
CCI-002749 (technical): Audit the use of the manual override capability.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-10 (1) (c) NIST: NIST SP 800-53 Revision 5 (v5): SI-10 (1) (c)
CCI-002750 (policy): Defines the time-period within which input validation errors are to be reviewed.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-10 (2) NIST: NIST SP 800-53 Revision 5 (v5): SI-10 (2)
CCI-002751 (policy): Defines the time-period within which input validation errors are to be resolved.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-10 (2) NIST: NIST SP 800-53 Revision 5 (v5): SI-10 (2)
CCI-002752 (policy): Review input validation errors within an organization-defined time period.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-10 (2) NIST: NIST SP 800-53 Revision 5 (v5): SI-10 (2)
CCI-002753 (policy): Resolve input validation errors within an organization-defined time period.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-10 (2) NIST: NIST SP 800-53 Revision 5 (v5): SI-10 (2)
CCI-002754 (policy, technical): Verify that the system behaves in a predictable and documented manner that reflects organizational and system objectives when invalid inputs are received.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-10 (3) NIST: NIST SP 800-53 Revision 5 (v5): SI-10 (3)
CCI-002755 (policy, technical): Account for timing interactions among system components in determining appropriate responses for invalid inputs.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-10 (4) NIST: NIST SP 800-53 Revision 5 (v5): SI-10 (4)
CCI-002756 (policy): Defines the trusted sources to which the usage of information inputs will be restricted (e.g., whitelisting).
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-10 (5) NIST: NIST SP 800-53 Revision 5 (v5): SI-10 (5)
CCI-002757 (policy): Defines the acceptable formats to which information inputs are restricted.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-10 (5) NIST: NIST SP 800-53 Revision 5 (v5): SI-10 (5)
CCI-002758 (policy): Restrict the use of information inputs to organization-defined trusted sources and/or organization-defined formats.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-10 (5) NIST: NIST SP 800-53 Revision 5 (v5): SI-10 (5)
CCI-005003 (technical): Prevent untrusted data injections.
References: NIST: NIST SP 800-53 Revision 5 (v5): SI-10 (6)
CCI-001312 (technical): Generates error messages that provide information necessary for corrective actions without revealing information that could be exploited.
References: NIST: NIST SP 800-53 (v3): SI-11 b NIST: NIST SP 800-53 Revision 4 (v4): SI-11 a NIST: NIST SP 800-53 Revision 5 (v5): SI-11 a NIST: NIST SP 800-53A (v1): SI-11.1 (iii)
CCI-001314 (technical): Reveal error messages only to organization-defined personnel or roles.
References: NIST: NIST SP 800-53 (v3): SI-11 c NIST: NIST SP 800-53 Revision 4 (v4): SI-11 b NIST: NIST SP 800-53 Revision 5 (v5): SI-11 b NIST: NIST SP 800-53A (v1): SI-11.1 (iv)
CCI-002759 (policy): Defines the personnel or roles to whom error messages are to be revealed.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-11 b NIST: NIST SP 800-53 Revision 5 (v5): SI-11 b
CCI-001315 (policy): Manage information within the system and information output from the system in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and operational requirements.
References: NIST: NIST SP 800-53 (v3): SI-12 NIST: NIST SP 800-53 Revision 4 (v4): SI-12 NIST: NIST SP 800-53 Revision 5 (v5): SI-12 NIST: NIST SP 800-53A (v1): SI-12.1 (i)
CCI-001678 (policy): Retain information within the system and information output from the system in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and operational requirements.
References: NIST: NIST SP 800-53 (v3): SI-12 NIST: NIST SP 800-53 Revision 4 (v4): SI-12 NIST: NIST SP 800-53 Revision 5 (v5): SI-12 NIST: NIST SP 800-53A (v1): SI-12.1 (ii)
CCI-005004 (policy): Limit personally identifiable information being processed in the information life cycle to the organization-defined elements of personally identifiable information.
References: NIST: NIST SP 800-53 Revision 5 (v5): SI-12 (1)
CCI-005005 (policy): Defines the elements of personally identifiable information being processed in the information life cycle.
References: NIST: NIST SP 800-53 Revision 5 (v5): SI-12 (1)
CCI-005006 (policy): Use organization-defined techniques to minimize the use of personally identifiable information for research, testing, or training, in accordance with the privacy risk assessment.
References: NIST: NIST SP 800-53 Revision 5 (v5): SI-12 (2)
CCI-005007 (policy): Defines the techniques for minimizing the use of personally identifiable information for research, testing, or training.
References: NIST: NIST SP 800-53 Revision 5 (v5): SI-12 (2)
CCI-005008 (policy): Use organization-defined techniques to dispose of, destroy, or erase information following the retention period.
References: NIST: NIST SP 800-53 Revision 5 (v5): SI-12 (3)
CCI-002760 (policy): Determines mean time to failure (MTTF) for organization-defined system components in specific environments of operation.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-13 a NIST: NIST SP 800-53 Revision 5 (v5): SI-13 a
CCI-002761 (policy): Defines the system components in specific environments of operation for which the mean time to failure (MTTF) is to be determined.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-13 a NIST: NIST SP 800-53 Revision 5 (v5): SI-13 a
CCI-001318 (policy): Provide substitute system components.
References: NIST: NIST SP 800-53 (v3): SI-13 b NIST: NIST SP 800-53 Revision 4 (v4): SI-13 b NIST: NIST SP 800-53 Revision 5 (v5): SI-13 b NIST: NIST SP 800-53A (v1): SI-13.1 (iii)
CCI-002762 (policy): Defines the mean time to failure (MTTF) substitution criteria to be employed as a means to determine the need to exchange active and standby components.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-13 b NIST: NIST SP 800-53 Revision 5 (v5): SI-13 b
CCI-002763 (policy): Provides a means to exchange active and standby components in accordance with the organization-defined mean time to failure (MTTF) substitution criteria.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-13 b NIST: NIST SP 800-53 Revision 5 (v5): SI-13 b
CCI-001319 (policy): Takes system components out of service by transferring component responsibilities to a substitute component no later than an organization-defined fraction or percentage of mean time to failure (MTTF).
References: NIST: NIST SP 800-53 (v3): SI-13 (1) NIST: NIST SP 800-53 Revision 4 (v4): SI-13 (1) NIST: NIST SP 800-53 Revision 5 (v5): SI-13 (1) NIST: NIST SP 800-53A (v1): SI-13 (1).1 (ii)
CCI-001320 (policy): Defines the maximum fraction or percentage of mean time to failure (MTTF) used to determine when system components are taken out of service by transferring component responsibilities to substitute components.
References: NIST: NIST SP 800-53 (v3): SI-13 (1) NIST: NIST SP 800-53 Revision 4 (v4): SI-13 (1) NIST: NIST SP 800-53 Revision 5 (v5): SI-13 (1) NIST: NIST SP 800-53A (v1): SI-13 (1).1 (i)
CCI-001323 (policy): Manually initiate transfers between active and standby system components when the use of the active component reaches an organization-defined percentage of the mean time to failure..
References: NIST: NIST SP 800-53 (v3): SI-13 (3) NIST: NIST SP 800-53 Revision 4 (v4): SI-13 (3) NIST: NIST SP 800-53 Revision 5 (v5): SI-13 (3) NIST: NIST SP 800-53A (v1): SI-13 (3).1 (iii)
CCI-005009 (policy): Defines the percentage of the mean time to failure used to manually initiate transfer between active and standby system components.
References: NIST: NIST SP 800-53 Revision 5 (v5): SI-13 (3)
CCI-001326 (policy): If system component failures are detected, ensure standby components are successfully and transparently installed within an organization-defined time period.
References: NIST: NIST SP 800-53 (v3): SI-13 (4) (a) NIST: NIST SP 800-53 Revision 4 (v4): SI-13 (4) (a) NIST: NIST SP 800-53 Revision 5 (v5): SI-13 (4) (a) NIST: NIST SP 800-53A (v1): SI-13 (4).1 (iii)
CCI-001327 (policy): Defines a time period for a standby system component to be successfully and transparently installed for the system component that has failed.
References: NIST: NIST SP 800-53 (v3): SI-13 (4) (a) NIST: NIST SP 800-53 Revision 4 (v4): SI-13 (4) (a) NIST: NIST SP 800-53 Revision 5 (v5): SI-13 (4) (a) NIST: NIST SP 800-53A (v1): SI-13 (4).1 (i)
CCI-001328 (technical): If system component failures are detected, activate an organization-defined alarm, automatically shut down the system, and/or organization-defined action.
References: NIST: NIST SP 800-53 (v3): SI-13 (4) (b) NIST: NIST SP 800-53 Revision 4 (v4): SI-13 (4) (b) NIST: NIST SP 800-53 Revision 5 (v5): SI-13 (4) (b) NIST: NIST SP 800-53A (v1): SI-13 (4).1 (iii)
CCI-001329 (policy): Defines the alarm to be activated when a system component failure is detected.
References: NIST: NIST SP 800-53 (v3): SI-13 (4) (b) NIST: NIST SP 800-53 Revision 4 (v4): SI-13 (4) (b) NIST: NIST SP 800-53 Revision 5 (v5): SI-13 (4) (b) NIST: NIST SP 800-53A (v1): SI-13 (4).1 (ii)
CCI-005010 (policy): Defines the action to be taken when system failures are detected.
References: NIST: NIST SP 800-53 Revision 5 (v5): SI-13 (4) (b)
CCI-000558 (policy): Defines the real-time or near-real-time failover capability to be provided for the system.
References: NIST: NIST SP 800-53 (v3): CP-10 (5) NIST: NIST SP 800-53 Revision 4 (v4): SI-13 (5) NIST: NIST SP 800-53 Revision 5 (v5): SI-13 (5) NIST: NIST SP 800-53A (v1): CP-10 (5).1 (i)
CCI-000559 (policy): Provide real-time or near-real-time organization-defined failover capability for the system.
References: NIST: NIST SP 800-53 (v3): CP-10 (5) NIST: NIST SP 800-53 Revision 4 (v4): SI-13 (5) NIST: NIST SP 800-53 Revision 5 (v5): SI-13 (5) NIST: NIST SP 800-53A (v1): CP-10 (5).1 (ii)
CCI-002764 (policy): Defines non-persistent system components and services to be implemented.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-14 NIST: NIST SP 800-53 Revision 5 (v5): SI-14
CCI-002765 (policy): Defines the frequency at which the organization-defined non-persistent system components and services will be terminated.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-14 NIST: NIST SP 800-53 Revision 5 (v5): SI-14
CCI-002766 (policy): Implement organization-defined non-persistence system components and services that are initiated in a known state.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-14 NIST: NIST SP 800-53 Revision 5 (v5): SI-14
CCI-002767 (policy): Implement organization-defined non-persistence system components and services that are terminated upon end of session of use and/or periodically at an organization-defined frequency.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-14 NIST: NIST SP 800-53 Revision 5 (v5): SI-14
CCI-002768 (policy): Defines the trusted sources from which it obtains software and data employed during the refreshing of non-persistent system components and services.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-14 (1) NIST: NIST SP 800-53 Revision 5 (v5): SI-14 (1)
CCI-002769 (policy): Obtain software and data employed during non-persistent system component and service refreshes are obtained from organization-defined trusted sources.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-14 (1) NIST: NIST SP 800-53 Revision 5 (v5): SI-14 (1)
CCI-005011 (policy): Refresh organization-defined information on an organization-defined frequency, or generate organization-defined information on demand.
References: NIST: NIST SP 800-53 Revision 5 (v5): SI-14 (2) (a)
CCI-005012 (policy): Defines the information to be refreshed on an organization-defined frequency.
References: NIST: NIST SP 800-53 Revision 5 (v5): SI-14 (2) (a)
CCI-005013 (policy): Defines the frequency at which to refresh organization-defined information.
References: NIST: NIST SP 800-53 Revision 5 (v5): SI-14 (2) (a)
CCI-005014 (policy): Defines the information to be generated on demand.
References: NIST: NIST SP 800-53 Revision 5 (v5): SI-14 (2) (a)
CCI-005015 (policy): Delete information when no longer needed.
References: NIST: NIST SP 800-53 Revision 5 (v5): SI-14 (2) (b)
CCI-005016 (policy): Refresh connections to the system on demand.
References: NIST: NIST SP 800-53 Revision 5 (v5): SI-14 (3)
CCI-005017 (policy): Terminate connections after completion of a request, or a period of non-use.
References: NIST: NIST SP 800-53 Revision 5 (v5): SI-14 (3)
CCI-002770 (policy): Defines the software programs and/or applications from which the system is to validate the information output to ensure the information is consistent with expected content.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-15 NIST: NIST SP 800-53 Revision 5 (v5): SI-15
CCI-002771 (technical): Validate information output from organization-defined software programs and/or applications to ensure that the information is consistent with the expected content.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-15 NIST: NIST SP 800-53 Revision 5 (v5): SI-15
CCI-002823 (policy): Defines the controls to be implemented to protect the system's memory from unauthorized code execution.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-16 NIST: NIST SP 800-53 Revision 5 (v5): SI-16
CCI-002824 (technical): Implement organization-defined controls to protect its memory from unauthorized code execution.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-16 NIST: NIST SP 800-53 Revision 5 (v5): SI-16
CCI-002773 (policy): Defines the fail-safe procedures to be implemented when organization-defined failure conditions occur.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-17 NIST: NIST SP 800-53 Revision 5 (v5): SI-17
CCI-002774 (policy): Defines the failure conditions which, when they occur, will result in the information system implementing organization-defined fail-safe procedures.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-17 NIST: NIST SP 800-53 Revision 5 (v5): SI-17
CCI-002775 (technical): Implement organization-defined fail-safe procedures when organization-defined failure conditions occur.
References: NIST: NIST SP 800-53 Revision 4 (v4): SI-17 NIST: NIST SP 800-53 Revision 5 (v5): SI-17
CCI-005018 (policy, technical): Check the accuracy, relevance, timeliness, and completeness of personally identifiable information across the information life cycle, on an organization-defined frequency.
References: NIST: NIST SP 800-53 Revision 5 (v5): SI-18 a
CCI-005019 (policy): Defines the frequency for checking the accuracy, relevance, timeliness, and completeness of personally identifiable information.
References: NIST: NIST SP 800-53 Revision 5 (v5): SI-18 a
CCI-005020 (policy, technical): Correct or delete inaccurate or outdated personally identifiable information.
References: NIST: NIST SP 800-53 Revision 5 (v5): SI-18 b 1
CCI-005021 (policy, technical): Correct or delete personally identifiable information that is inaccurate or outdated, incorrectly determined regarding impact, or incorrectly de-identified using organization-defined mechanisms.
References: NIST: NIST SP 800-53 Revision 5 (v5): SI-18 (1)
CCI-005022 (policy): Defines the automated mechanisms for identifying inaccurate or outdated, incorrectly determined regarding impact, or incorrectly de-identified personally identifiable information.
References: NIST: NIST SP 800-53 Revision 5 (v5): SI-18 (1)
CCI-005023 (policy, technical): Employ data tags to automate the correction or deletion of personally identifiable information across the information life cycle within organizational systems.
References: NIST: NIST SP 800-53 Revision 5 (v5): SI-18 (2)
CCI-005024 (policy, technical): Collect personally identifiable information directly from the individual.
References: NIST: NIST SP 800-53 Revision 5 (v5): SI-18 (3)
CCI-005025 (policy, technical): Correct or delete personally identifiable information upon request by individuals or their designated representatives.
References: NIST: NIST SP 800-53 Revision 5 (v5): SI-18 (4)
CCI-005026 (policy, technical): Notify organization-defined recipients of personally identifiable information that the personally identifiable information has been corrected or deleted.
References: NIST: NIST SP 800-53 Revision 5 (v5): SI-18 (5)
CCI-005027 (policy): Defines the recipients of personally identifiable information who are to be notified when the personally identifiable information is corrected or deleted.
References: NIST: NIST SP 800-53 Revision 5 (v5): SI-18 (5)
CCI-005028 (policy, technical): Notify individuals that the personally identifiable information has been corrected or deleted.
References: NIST: NIST SP 800-53 Revision 5 (v5): SI-18 (5)
CCI-005029 (policy, technical): Remove the following elements of personally identifiable information from datasets.
References: NIST: NIST SP 800-53 Revision 5 (v5): SI-19 a
CCI-005030 (policy): Defines the elements of personally identifiable information to be removed from datasets.
References: NIST: NIST SP 800-53 Revision 5 (v5): SI-19 a
CCI-005031 (policy, technical): Evaluate organization-defined frequency for effectiveness of de-identification.
References: NIST: NIST SP 800-53 Revision 5 (v5): SI-19 b
CCI-005032 (policy): Defines the frequency for evaluating for effectiveness of de-identification.
References: NIST: NIST SP 800-53 Revision 5 (v5): SI-19 b
CCI-005033 (policy, technical): De-identify the dataset upon collection by not collecting personally identifiable information.
References: NIST: NIST SP 800-53 Revision 5 (v5): SI-19 (1)
CCI-005034 (policy, technical): Prohibit archiving personally identifiable information elements if those elements in a dataset will not be needed after the dataset is archived.
References: NIST: NIST SP 800-53 Revision 5 (v5): SI-19 (2)
CCI-005035 (policy, technical): Remove personally identifiable information elements from a dataset prior to its release if those elements in the dataset do not need to be part of the data release.
References: NIST: NIST SP 800-53 Revision 5 (v5): SI-19 (3)
CCI-005036 (technical): Remove, mask, encrypt, hash, or replace direct identifiers in a dataset.
References: NIST: NIST SP 800-53 Revision 5 (v5): SI-19 (4)
CCI-005037 (policy, technical): Manipulate numerical data, contingency tables, and statistical findings so that no individual or organization is identifiable in the results of the analysis.
References: NIST: NIST SP 800-53 Revision 5 (v5): SI-19 (5)
CCI-005038 (policy, technical): Prevent disclosure of personally identifiable information by adding non-deterministic noise to the results of mathematical operations before the results are reported.
References: NIST: NIST SP 800-53 Revision 5 (v5): SI-19 (6)
CCI-005039 (policy): Perform de-identification using validated algorithms and software that is validated to implement the algorithms.
References: NIST: NIST SP 800-53 Revision 5 (v5): SI-19 (7)
CCI-005040 (policy, technical): Perform a motivated intruder test on the de-identified dataset to determine if the identified data remains or if the de-identified data can be re-identified.
References: NIST: NIST SP 800-53 Revision 5 (v5): SI-19 (8)
CCI-005041 (policy, technical): Embed data or capabilities in the following systems or system components to determine if organizational data has been exfiltrated or improperly removed from the organization.
References: NIST: NIST SP 800-53 Revision 5 (v5): SI-20
CCI-005042 (policy): Defines the systems or system components used to determine if organizational data has been exfiltrated or improperly removed from the organization.
References: NIST: NIST SP 800-53 Revision 5 (v5): SI-20
CCI-005043 (policy, technical): Refresh organization-defined information at organization-defined frequencies or generate the information on demand and delete the information when no longer needed.
References: NIST: NIST SP 800-53 Revision 5 (v5): SI-21
CCI-005044 (policy): Defines the information to be refreshed at organization-defined frequencies or generate the information on demand and delete the information when no longer needed.
References: NIST: NIST SP 800-53 Revision 5 (v5): SI-21
CCI-005045 (policy): Defines the frequencies for refreshing organization-defined information.
References: NIST: NIST SP 800-53 Revision 5 (v5): SI-21
CCI-005046 (policy, technical): Identify the following alternate sources of information for organization-defined essential functions and services.
References: NIST: NIST SP 800-53 Revision 5 (v5): SI-22 a
CCI-005047 (policy): Defines the alternative information sources for identifying organization-defined essential functions and services.
References: NIST: NIST SP 800-53 Revision 5 (v5): SI-22 a
CCI-005048 (policy, technical): Use an alternate information source for the execution of essential functions or services on organization-defined systems or system components when the primary source of information is corrupted or unavailable.
References: NIST: NIST SP 800-53 Revision 5 (v5): SI-22 b
CCI-005049 (policy): Defines the systems or system components used as an alternate information source for the execution of essential functions or services when the primary source of information is corrupted or unavailable.
References: NIST: NIST SP 800-53 Revision 5 (v5): SI-22 b
CCI-005050 (policy, technical): Based on organization-defined circumstances, fragment the following information.
References: NIST: NIST SP 800-53 Revision 5 (v5): SI-23 a
CCI-005051 (policy): Defines the information for fragmentation.
References: NIST: NIST SP 800-53 Revision 5 (v5): SI-23 a
CCI-005052 (policy): Defines the circumstances for fragmenting organization-defined information.
References: NIST: NIST SP 800-53 Revision 5 (v5): SI-23 a
CCI-005053 (policy, technical): Based on organization-defined circumstances, distribute the fragmented information across the following systems or system components.
References: NIST: NIST SP 800-53 Revision 5 (v5): SI-23 b
CCI-005054 (policy): Defines the systems or system components used to distribute fragmented information.
References: NIST: NIST SP 800-53 Revision 5 (v5): SI-23 b
CCI-005055 (policy): Defines the circumstances for distributing fragmented information across organization-defined systems or system components.
References: NIST: NIST SP 800-53 Revision 5 (v5): SI-23 b
CCI-005056 (policy): Disseminate an organization-level, mission/business process-level, and/or system-level supply chain risk management policy to organization-defined personnel or roles.
References: NIST: NIST SP 800-53 Revision 5 (v5): SR-1 a 1
CCI-005057 (policy): Develop and document an organization-level, mission/business process-level, and/or system-level supply chain risk management policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.
References: NIST: NIST SP 800-53 Revision 5 (v5): SR-1 a 1 (a)
CCI-005058 (policy): Develop and document organization-level, mission/business process-level, and/or system-level supply chain risk management policy that is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines.
References: NIST: NIST SP 800-53 Revision 5 (v5): SR-1 a 1 (b)
CCI-005059 (policy): Develop and document procedures to facilitate the implementation of the supply chain risk management policy and the associated supply chain risk management controls.
References: NIST: NIST SP 800-53 Revision 5 (v5): SR-1 a 2
CCI-005060 (policy): Designate an organization-defined official to manage the development and documentation of the supply chain risk management policy.
References: NIST: NIST SP 800-53 Revision 5 (v5): SR-1 b
CCI-005061 (policy): Designate an organization-defined official to manage the development and documentation of the supply chain risk management procedures.
References: NIST: NIST SP 800-53 Revision 5 (v5): SR-1 b
CCI-005062 (policy): Designate an organization-defined official to manage the dissemination of the supply chain risk management policy.
References: NIST: NIST SP 800-53 Revision 5 (v5): SR-1 b
CCI-005063 (policy): Designate an organization-defined official to manage the dissemination of the supply chain risk management procedures.
References: NIST: NIST SP 800-53 Revision 5 (v5): SR-1 b
CCI-005064 (policy): Review and update the current supply chain risk management policy on an organization-defined frequency.
References: NIST: NIST SP 800-53 Revision 5 (v5): SR-1 c 1
CCI-005065 (policy): Defines the frequency for reviewing and updating the current supply chain risk management policy.
References: NIST: NIST SP 800-53 Revision 5 (v5): SR-1 c 1
CCI-005066 (policy): Review and update the current supply chain risk management policy following organization-defined events.
References: NIST: NIST SP 800-53 Revision 5 (v5): SR-1 c 1
CCI-005067 (policy): Defines the events following reviewing and updating the current supply chain risk management policy.
References: NIST: NIST SP 800-53 Revision 5 (v5): SR-1 c 1
CCI-005068 (policy): Review and update the current supply chain risk management procedures on an organization-defined frequency.
References: NIST: NIST SP 800-53 Revision 5 (v5): SR-1 c 2
CCI-005069 (policy): Defines the frequency for reviewing and updating the current supply chain risk management procedures.
References: NIST: NIST SP 800-53 Revision 5 (v5): SR-1 c 2
CCI-005070 (policy): Review and update the current supply chain risk management procedures following organization-defined events.
References: NIST: NIST SP 800-53 Revision 5 (v5): SR-1 c 2
CCI-005071 (policy): Defines the events following reviewing and updating the current supply chain risk management procedures.
References: NIST: NIST SP 800-53 Revision 5 (v5): SR-1 c 2
CCI-005072 (policy): Develop a plan for managing supply chain risks associated with the research and development, design, manufacturing, acquisition, delivery, integration, operations and maintenance, and disposal of the following systems, system components, or system services.
References: NIST: NIST SP 800-53 Revision 5 (v5): SR-2 a
CCI-005073 (policy): Defines the systems, system components, or system services that a plan for managing supply chain risks are developed.
References: NIST: NIST SP 800-53 Revision 5 (v5): SR-2 a
CCI-005074 (policy): Review and update the supply chain risk management plan on an organization-defined frequency, or as required, to address threat, organizational or environmental changes.
References: NIST: NIST SP 800-53 Revision 5 (v5): SR-2 b
CCI-005075 (policy): Defines the frequency for reviewing and updating the supply chain risk management plan.
References: NIST: NIST SP 800-53 Revision 5 (v5): SR-2 b
CCI-005076 (policy): Protect the supply chain risk management plan from unauthorized disclosure and modification.
References: NIST: NIST SP 800-53 Revision 5 (v5): SR-2 c
CCI-005077 (policy): Establish a supply chain risk management team consisting of organization-defined personnel, roles, and responsibilities to lead and support the following SCRM activities.
References: NIST: NIST SP 800-53 Revision 5 (v5): SR-2 (1)