Lexim011/Compliance huggingface dataset:
CCI-001550 (policy): The organization defines approved authorizations for controlling the flow of information within the system.
References: NIST: NIST SP 800-53 (v3): AC-4 NIST: NIST SP 800-53 Revision 4 (v4): AC-4 NIST: NIST SP 800-53A (v1): AC-4.1 (ii)
CCI-001551 (policy): The organization defines approved authorizations for controlling the flow of information between interconnected systems.
References: NIST: NIST SP 800-53 (v3): AC-4 NIST: NIST SP 800-53 Revision 4 (v4): AC-4 NIST: NIST SP 800-53A (v1): AC-4.1 (ii)
CCI-001552 (policy): The organization defines policy that allows or disallows information flows based on changing conditions or operational considerations.
References: NIST: NIST SP 800-53 (v3): AC-4 (3) NIST: NIST SP 800-53A (v1): AC-4 (3).1 (i)
CCI-001555 (technical): The information system uniquely identifies destination domains for information transfer.
References: NIST: NIST SP 800-53 (v3): AC-4 (17) (a) NIST: NIST SP 800-53A (v1): AC-4 (17).1 (iii)
CCI-001556 (technical): The information system uniquely authenticates destination domains for information transfer.
References: NIST: NIST SP 800-53 (v3): AC-4 (17) (a) NIST: NIST SP 800-53A (v1): AC-4 (17).1 (iv)
CCI-001557 (technical): The information system tracks problems associated with the information transfer.
References: NIST: NIST SP 800-53 (v3): AC-4 (17) c NIST: NIST SP 800-53A (v1): AC-4 (17).1 (vii)
CCI-001559 (policy): The organization identifies the individuals authorized to change the value of associated security attributes.
References: NIST: NIST SP 800-53 (v3): AC-16 (2) NIST: NIST SP 800-53 Revision 4 (v4): AC-16 (2) NIST: NIST SP 800-53A (v1): AC-16 (2).1 (i)
CCI-001560 (policy): The organization identifies individuals (or processes acting on behalf of individuals) authorized to associate organization-defined security attributes with organization-defined objects.
References: NIST: NIST SP 800-53 (v3): AC-16 (4) NIST: NIST SP 800-53 Revision 4 (v4): AC-16 (4) NIST: NIST SP 800-53A (v1): AC-16 (4).1 (i)
CCI-001561 (policy): The organization defines managed access control points for remote access to the information system.
References: NIST: NIST SP 800-53 (v3): AC-17 (3) NIST: NIST SP 800-53 Revision 4 (v4): AC-17 (3) NIST: NIST SP 800-53A (v1): AC-17 (3).1 (i)
CCI-001562 (policy): The organization defines the appropriate action(s) to be taken if an unauthorized remote connection is discovered.
References: NIST: NIST SP 800-53 (v3): AC-17 (5) NIST: NIST SP 800-53A (v1): AC-17 (5).1 (iii)
CCI-001563 (policy): The organization defines the appropriate action(s) to be taken if an unauthorized wireless connection is discovered.
References: NIST: NIST SP 800-53 (v3): AC-18 (2) NIST: NIST SP 800-53A (v1): AC-18 (2).1 (iii)
CCI-001574 (technical): The information system rejects or delays, as defined by the organization, network traffic which exceed the organization-defined thresholds.
References: NIST: NIST SP 800-53 (v3): AU-5 (3) NIST: NIST SP 800-53A (v1): AU-5 (3).1 (iii)
CCI-001575 (policy): The organization defines the system or system component for storing audit records that is a different system or system component than the system or component being audited.
References: NIST: NIST SP 800-53 (v3): AU-9 (2) NIST: NIST SP 800-53 Revision 4 (v4): AU-9 (2) NIST: NIST SP 800-53A (v1): AU-9 (2).1 (i)
CCI-001576 (technical): The information system produces a system-wide (logical or physical) audit trail of information system audit records.
References: NIST: NIST SP 800-53 (v3): AU-12 (1) NIST: NIST SP 800-53 Revision 4 (v4): AU-12 (1) NIST: NIST SP 800-53A (v1): AU-12 (1).1 (i)
CCI-001579 (policy): The organization conducts security control assessments using organization-defined forms of testing in accordance with organization-defined frequency and assessment techniques.
References: NIST: NIST SP 800-53 (v3): CA-2 (2) NIST: NIST SP 800-53A (v1): CA-2 (2).1 (ii)
CCI-001580 (policy): The organization identifies connections to external information systems (i.e., information systems outside of the authorization boundary).
References: NIST: NIST SP 800-53 (v3): CA-3 b NIST: NIST SP 800-53A (v1): CA-3.1 (i)
CCI-001581 (policy): The organization defines personnel or roles to whom the security status of the organization and the information system should be reported.
References: NIST: NIST SP 800-53 (v3): CA-7 a NIST: NIST SP 800-53 Revision 4 (v4): CA-7 g NIST: NIST SP 800-53A (v1): CA-7.1 (iii)
CCI-001583 (policy): The organization selects announced or unannounced assessments for each form of security control assessment.
References: NIST: NIST SP 800-53 (v3): CA-7 (2) NIST: NIST SP 800-53 Revision 4 (v4): CA-2 (2) NIST: NIST SP 800-53A (v1): CA-7 (2).1 (i)
CCI-001587 (policy): The organization, when analyzing new software in a separate test environment, looks for security impacts due to flaws, weaknesses, incompatibility, or intentional malice.
References: NIST: NIST SP 800-53 (v3): CM-4 (1) NIST: NIST SP 800-53A (v1): CM-4 (1).1 (ii)
CCI-001588 (policy): The organization-defined security configuration checklists reflect the most restrictive mode consistent with operational requirements.
References: NIST: NIST SP 800-53 (v3): CM-6 a NIST: NIST SP 800-53 Revision 4 (v4): CM-6 a NIST: NIST SP 800-53A (v1): CM-6.1 (ii)
CCI-001589 (technical): The organization incorporates detection of unauthorized, security-relevant configuration changes into the organization‚Äôs incident response capability to ensure they are tracked.
References: NIST: NIST SP 800-53 (v3): CM-6 (3) NIST: NIST SP 800-53A (v1): CM-6 (3).1 (ii)
CCI-001590 (policy): The organization develops a list of software programs authorized to execute on the information system.
References: NIST: NIST SP 800-53 (v3): CM-7 (2) NIST: NIST SP 800-53A (v1): CM-7 (2).1 (i)
CCI-001591 (policy): The organization develops a list of software programs not authorized to execute on the information system.
References: NIST: NIST SP 800-53 (v3): CM-7 (2) NIST: NIST SP 800-53A (v1): CM-7 (2).1 (i)
CCI-001593 (policy): The organization maintains a list of software programs authorized to execute on the information system.
References: NIST: NIST SP 800-53 (v3): CM-7 (2) NIST: NIST SP 800-53A (v1): CM-7 (2).1 (i)
CCI-001594 (policy): The organization maintains a list of software programs not authorized to execute on the information system.
References: NIST: NIST SP 800-53 (v3): CM-7 (2) NIST: NIST SP 800-53A (v1): CM-7 (2).1 (i)
CCI-001595 (policy): The organization maintains rules authorizing the terms and conditions of software program usage on the information system.
References: NIST: NIST SP 800-53 (v3): CM-7 (2) NIST: NIST SP 800-53A (v1): CM-7 (2).1 (i)
CCI-001603 (policy): The contingency plan identifies the primary storage site hazards.
References: NIST: NIST SP 800-53 (v3): CP-6 (1) NIST: NIST SP 800-53A (v1): CP-6 (1).1 (i)
CCI-001605 (policy): The contingency plan identifies the primary processing site hazards.
References: NIST: NIST SP 800-53 (v3): CP-7 (1) NIST: NIST SP 800-53A (v1): CP-7 (1).1 (i)
CCI-001607 (policy): The organization establishes alternate telecommunications services to support the information system.
References: NIST: NIST SP 800-53 (v3): CP-8 (2) NIST: NIST SP 800-53A (v1): CP-8.1 (i)
CCI-001608 (policy): The organization identifies the primary provider's telecommunications service hazards.
References: NIST: NIST SP 800-53 (v3): CP-8 (3) NIST: NIST SP 800-53A (v1): CP-8 (3).1 (i)
CCI-001611 (policy): The organization defines the minimum number of special characters for password complexity enforcement.
References: NIST: NIST SP 800-53 (v3): IA-5 (1) (a) NIST: NIST SP 800-53 Revision 4 (v4): IA-5 (1) (a) NIST: NIST SP 800-53A (v1): IA-5 (1).1 (i)
CCI-001612 (policy): The organization defines the minimum number of upper case characters for password complexity enforcement.
References: NIST: NIST SP 800-53 (v3): IA-5 (1) (a) NIST: NIST SP 800-53 Revision 4 (v4): IA-5 (1) (a) NIST: NIST SP 800-53A (v1): IA-5 (1).1 (i)
CCI-001613 (policy): The organization defines the minimum number of lower case characters for password complexity enforcement.
References: NIST: NIST SP 800-53 (v3): IA-5 (1) (a) NIST: NIST SP 800-53 Revision 4 (v4): IA-5 (1) (a) NIST: NIST SP 800-53A (v1): IA-5 (1).1 (i)
CCI-001614 (policy): The organization defines the minimum number of numeric characters for password complexity enforcement.
References: NIST: NIST SP 800-53 (v3): IA-5 (1) (a) NIST: NIST SP 800-53 Revision 4 (v4): IA-5 (1) (a) NIST: NIST SP 800-53A (v1): IA-5 (1).1 (i)
CCI-001615 (policy): The organization defines the minimum number of characters that are changed when new passwords are created.
References: NIST: NIST SP 800-53 (v3): IA-5 (1) (b) NIST: NIST SP 800-53 Revision 4 (v4): IA-5 (1) (b) NIST: NIST SP 800-53A (v1): IA-5 (1).1 (ii)
CCI-001616 (policy): The organization defines minimum password lifetime restrictions.
References: NIST: NIST SP 800-53 (v3): IA-5 (1) (b) NIST: NIST SP 800-53 Revision 4 (v4): IA-5 (1) (d) NIST: NIST SP 800-53A (v1): IA-5 (1).1 (ii)
CCI-001617 (policy): The organization defines maximum password lifetime restrictions.
References: NIST: NIST SP 800-53 (v3): IA-5 (1) (d) NIST: NIST SP 800-53 Revision 4 (v4): IA-5 (1) (d) NIST: NIST SP 800-53A (v1): IA-5 (1).1 (iii)
CCI-001618 (policy): The organization defines the number of generations for which password reuse is prohibited.
References: NIST: NIST SP 800-53 (v3): IA-5 (1) (d) NIST: NIST SP 800-53 Revision 4 (v4): IA-5 (1) (e) NIST: NIST SP 800-53A (v1): IA-5 (1).1 (iv)
CCI-001619 (technical): The information system enforces password complexity by the minimum number of special characters used.
References: NIST: NIST SP 800-53 (v3): IA-5 (1) (a) NIST: NIST SP 800-53 Revision 4 (v4): IA-5 (1) (a) NIST: NIST SP 800-53A (v1): IA-5 (1).1 (v)
CCI-001620 (policy): The organization defines the types of and/or specific authenticators for which the registration process must be carried out in person before a designated registration authority with authorization by a designated organizational official (e.g., a supervisor).
References: NIST: NIST SP 800-53 (v3): IA-5 (3) NIST: NIST SP 800-53A (v1): IA-5 (3).1 (i)
CCI-001622 (policy): The organization identifies personnel with incident response roles and responsibilities with respect to the information system.
References: NIST: NIST SP 800-53 (v3): IR-2 NIST: NIST SP 800-53A (v1): IR-2.1 (i)
CCI-001623 (policy): The incident response training material addresses the procedures and activities necessary to fulfill identified organizational incident response roles and responsibilities.
References: NIST: NIST SP 800-53 (v3): IR-2 NIST: NIST SP 800-53A (v1): IR-2.1 (iii)
CCI-001624 (policy): The organization documents the results of incident response tests.
References: NIST: NIST SP 800-53 (v3): IR-3 NIST: NIST SP 800-53 Revision 4 (v4): IR-3 NIST: NIST SP 800-53A (v1): IR-3.1 (iv)
CCI-001626 (policy): The organization employs automated mechanisms to assist in the collection of security incident information.
References: NIST: NIST SP 800-53 (v3): IR-5 (1) NIST: NIST SP 800-53 Revision 4 (v4): IR-5 (1) NIST: NIST SP 800-53A (v1): IR-5 (1).1 (ii)
CCI-001627 (policy): The organization employs automated mechanisms to assist in the analysis of security incident information.
References: NIST: NIST SP 800-53 (v3): IR-5 (1) NIST: NIST SP 800-53 Revision 4 (v4): IR-5 (1) NIST: NIST SP 800-53A (v1): IR-5 (1).1 (iii)
CCI-001629 (policy): The organization employs automated mechanisms to produce up-to-date, accurate, complete, and available records of all maintenance and repair actions needed, in process, and complete.
References: NIST: NIST SP 800-53 (v3): MA-2 (2) NIST: NIST SP 800-53A (v1): MA-2 (2).1 (ii)
CCI-001630 (policy): Designated organizational personnel review the maintenance records of the non-local maintenance and diagnostic sessions.
References: NIST: NIST SP 800-53 (v3): MA-4 (1) NIST: NIST SP 800-53A (v1): MA-4 (1).1 (ii)
CCI-001633 (policy): The organization defines removable media types and information output requiring marking.
References: NIST: NIST SP 800-53 (v3): MP-3 a NIST: NIST SP 800-53A (v1): MP-3.1 (i)
CCI-001634 (policy): The organization identifies authorized personnel with appropriate clearances and access authorizations for gaining physical access to the facility containing an information system that processes classified information.
References: NIST: NIST SP 800-53 (v3): PE-2 (3) NIST: NIST SP 800-53A (v1): PE-2 (3).1 (i)
CCI-001639 (policy): The organization makes readily available to individuals requiring access to the information system the rules that describe their responsibilities and expected behavior with regard to information and information system usage.
References: NIST: NIST SP 800-53 (v3): PL-4 a NIST: NIST SP 800-53 Revision 4 (v4): PL-4 a NIST: NIST SP 800-53A (v1): PL-4.1 (ii)
CCI-001644 (policy): The organization employs vulnerability scanning procedures that can demonstrate the depth of coverage (i.e., vulnerabilities checked).
References: NIST: NIST SP 800-53 (v3): RA-5 (3) NIST: NIST SP 800-53A (v1): RA-5 (3).1 (ii)
CCI-001647 (policy): The organization requires the use of a FIPS-validated, cryptographic module for a technology product that relies on cryptographic functionality to enforce its security policy when no U.S. Government Protection Profile exists for such a specific technology type.
References: NIST: NIST SP 800-53 (v3): SA-4 (7) (b) NIST: NIST SP 800-53A (v1): SA-4 (7).1 (iii)
CCI-001648 (policy): The organization makes available to authorized personnel the source code for the information system to permit analysis and testing.
References: NIST: NIST SP 800-53 (v3): SA-5 (5) NIST: NIST SP 800-53A (v1): SA-5 (5).1
CCI-001649 (policy): The organization identifies and documents (as appropriate) explicit rules to be enforced when governing the installation of software by users.
References: NIST: NIST SP 800-53 (v3): SA-7 NIST: NIST SP 800-53A (v1): SA-7.1 (i)
CCI-001650 (policy): The organization requires the information system developers to manage and control changes to the information system during development.
References: NIST: NIST SP 800-53 (v3): SA-10 (b) NIST: NIST SP 800-53A (v1): SA-10.1 (ii)
CCI-001651 (policy): The organization requires the information system integrators to manage and control changes to the information system during development.
References: NIST: NIST SP 800-53 (v3): SA-10 (b) NIST: NIST SP 800-53A (v1): SA-10.1 (ii)
CCI-001652 (policy): The organization requires the information system developers to manage and control changes to the information system during implementation.
References: NIST: NIST SP 800-53 (v3): SA-10 (b) NIST: NIST SP 800-53A (v1): SA-10.1 (ii)
CCI-001653 (policy): The organization requires the information system integrators to manage and control changes to the information system during implementation.
References: NIST: NIST SP 800-53 (v3): SA-10 (b) NIST: NIST SP 800-53A (v1): SA-10.1 (ii)
CCI-001654 (policy): The organization requires the information system developers to manage and control changes to the information system during modification.
References: NIST: NIST SP 800-53 (v3): SA-10 (b) NIST: NIST SP 800-53A (v1): SA-10.1 (ii)
CCI-001655 (policy): The organization requires the information system integrators to manage and control changes to the information system during modification.
References: NIST: NIST SP 800-53 (v3): SA-10 (b) NIST: NIST SP 800-53A (v1): SA-10.1 (ii)
CCI-001656 (policy): The organization defines the security functions of the information system to be isolated from nonsecurity functions.
References: NIST: NIST SP 800-53 (v3): SC-3 NIST: NIST SP 800-53A (v1): SC-3.1 (i)
CCI-001657 (policy): The organization defines the external boundary of the information system.
References: NIST: NIST SP 800-53 (v3): SC-7 a NIST: NIST SP 800-53A (v1): SC-7.1 (i)
CCI-001658 (policy): The organization defines key internal boundaries of the information system.
References: NIST: NIST SP 800-53 (v3): SC-7 a NIST: NIST SP 800-53A (v1): SC-7.1 (ii)
CCI-001659 (policy): The organization defines the mediation necessary for public access to the organization's internal networks.
References: NIST: NIST SP 800-53 (v3): SC-7 (2) NIST: NIST SP 800-53A (v1): SC-7 (2).1 (i)
CCI-001660 (policy): The organization defines the measures to protect against unauthorized physical connections across boundary protections implemented at organization-defined managed interfaces.
References: NIST: NIST SP 800-53 (v3): SC-7 (14) NIST: NIST SP 800-53A (v1): SC-7 (14).1 (ii)
CCI-001666 (policy): The organization employs cryptographic mechanisms to prevent unauthorized modification of information at rest unless otherwise protected by alternative physical measures.
References: NIST: NIST SP 800-53 (v3): SC-28 (1) NIST: NIST SP 800-53A (v1): SC-28 (1).1 (ii)
CCI-001667 (policy): The organization compares the time measured between flaw identification and flaw remediation with organization-defined benchmarks.
References: NIST: NIST SP 800-53 (v3): SI-2 (3) NIST: NIST SP 800-53A (v1): SI-2 (3).1 (iii)
CCI-001668 (technical): The organization employs malicious code protection mechanisms at workstations, servers, or mobile computing devices on the network to detect and eradicate malicious code transported by electronic mail, electronic mail attachments, web accesses, removable media, or other common means or inserted through the exploitation of information system vulnerabilities.
References: NIST: NIST SP 800-53 (v3): SI-3 a NIST: NIST SP 800-53A (v1): SI-3.1 (ii)
CCI-001672 (technical): The organization employs a wireless intrusion detection system to identify rogue wireless devices.
References: NIST: NIST SP 800-53 (v3): SI-4 (14) NIST: NIST SP 800-53A (v1): SI-4 (14).1 (ii)
CCI-001674 (technical): The information system responds to security function anomalies in accordance with organization-defined responses and alternative action(s).
References: NIST: NIST SP 800-53 (v3): SI-6 NIST: NIST SP 800-53A (v1): SI-6.1 (v)
CCI-001676 (policy): The organization defines, for periodic security function verification, the frequency of the verifications.
References: NIST: NIST SP 800-53 (v3): SI-6 NIST: NIST SP 800-53A (v1): SI-6.1 (ii)
CCI-001677 (technical): The organization employs spam protection mechanisms at workstations, servers, or mobile computing devices on the network to detect and take action on unsolicited messages transported by electronic mail, electronic mail attachments, web accesses, removable media, or other common means.
References: NIST: NIST SP 800-53 (v3): SI-8 a NIST: NIST SP 800-53A (v1): SI-8.1 (ii)
CCI-001679 (policy): The organization provides a mechanism to exchange active and standby roles of the components.
References: NIST: NIST SP 800-53 (v3): SI-13 b NIST: NIST SP 800-53A (v1): SI-13.1 (iv)
CCI-001681 (policy): The organization defines the frequency at which each form of security control assessment should be conducted.
References: NIST: NIST SP 800-53 (v3): CA-7 (2) NIST: NIST SP 800-53 Revision 4 (v4): CA-2 (2) NIST: NIST SP 800-53A (v1): CA-7(2).1 (i)
CCI-001683 (technical): The information system notifies organization-defined personnel or roles for account creation actions.
References: NIST: NIST SP 800-53 (v3): AC-2 (4) NIST: NIST SP 800-53 Revision 4 (v4): AC-2 (4) NIST: NIST SP 800-53A (v1): AC-2 (4).1 (i and ii)
CCI-001684 (technical): The information system notifies organization-defined personnel or roles for account modification actions.
References: NIST: NIST SP 800-53 (v3): AC-2 (4) NIST: NIST SP 800-53 Revision 4 (v4): AC-2 (4) NIST: NIST SP 800-53A (v1): AC-2 (4).1 (i and ii)
CCI-001685 (technical): The information system notifies organization-defined personnel or roles for account disabling actions.
References: NIST: NIST SP 800-53 (v3): AC-2 (4) NIST: NIST SP 800-53 Revision 4 (v4): AC-2 (4) NIST: NIST SP 800-53A (v1): AC-2 (4).1 (i and ii)
CCI-001686 (technical): The information system notifies organization-defined personnel or roles for account removal actions.
References: NIST: NIST SP 800-53 (v3): AC-2 (4) NIST: NIST SP 800-53 Revision 4 (v4): AC-2 (4) NIST: NIST SP 800-53A (v1): AC-2 (4).1 (i and ii)
CCI-001689 (policy): The organization, if an information system component failure is detected, automatically shuts down the information system.
References: NIST: NIST SP 800-53 (v3): SI-13 (4) (b) NIST: NIST SP 800-53A (v1): SI-13 (4).1 (iii)
CCI-001690 (policy): The organization protects, as required, vendor/manufacturer documentation that describes the security-relevant external interfaces to the information system.
References: NIST: NIST SP 800-53 (v3): SA-5 (1) NIST: NIST SP 800-53A (v1): SA-5 (1).1 (i)
CCI-001691 (policy): The organization makes available to authorized personnel vendor/manufacturer documentation that describes the security-relevant external interfaces to the information system with sufficient detail to permit analysis and testing.
References: NIST: NIST SP 800-53 (v3): SA-5 (1) NIST: NIST SP 800-53A (v1): SA-5 (1).1 (i)
CCI-001692 (policy): The organization makes available to authorized personnel vendor/manufacturer documentation that describes the low-level design of the information system in terms of modules and implementation details of the security controls employed within the system with sufficient detail to permit analysis and testing.
References: NIST: NIST SP 800-53 (v3): SA-5 (4) NIST: NIST SP 800-53A (v1): SA-5 (4).1
CCI-001693 (technical): The information system enforces a Discretionary Access Control (DAC) policy that limits propagation of access rights.
References: NIST: NIST SP 800-53 (v3): AC-3 (4) NIST: NIST SP 800-53A (v1): AC-3 (4).1
CCI-001694 (technical): The information system enforces a Discretionary Access Control (DAC) policy that includes or excludes access to the granularity of a single user.
References: NIST: NIST SP 800-53 (v3): AC-3 (4) NIST: NIST SP 800-53A (v1): AC-3 (4).1
CCI-001747 (policy): The organization defines critical software components the information system will prevent from being installed without verification the component has been digitally signed using a certificate that is recognized and approved by the organization.
References: NIST: NIST SP 800-53 Revision 4 (v4): CM-5 (3)
CCI-001748 (policy): The organization defines critical firmware components the information system will prevent from being installed without verification the component has been digitally signed using a certificate that is recognized and approved by the organization.
References: NIST: NIST SP 800-53 Revision 4 (v4): CM-5 (3)
CCI-001749 (technical): The information system prevents the installation of organization-defined software components without verification the software component has been digitally signed using a certificate that is recognized and approved by the organization.
References: NIST: NIST SP 800-53 Revision 4 (v4): CM-5 (3)
CCI-001750 (technical): The information system prevents the installation of organization-defined firmware components without verification the firmware component has been digitally signed using a certificate that is recognized and approved by the organization.
References: NIST: NIST SP 800-53 Revision 4 (v4): CM-5 (3)
CCI-001769 (policy): The organization defines the frequency on which it will update the list of unauthorized software programs.
References: NIST: NIST SP 800-53 Revision 4 (v4): CM-7 (4) (c)
CCI-001771 (policy): The organization updates the list of unauthorized software programs per organization-defined frequency.
References: NIST: NIST SP 800-53 Revision 4 (v4): CM-7 (4) (c)
CCI-001776 (policy): The organization defines the frequency on which it will update the list of authorized software programs.
References: NIST: NIST SP 800-53 Revision 4 (v4): CM-7 (5) (c)
CCI-001778 (policy): The organization updates the list of authorized software programs per organization-defined frequency.
References: NIST: NIST SP 800-53 Revision 4 (v4): CM-7 (5) (c)
CCI-001781 (policy): The organization defines the frequency on which the information system component inventory is to be updated.
References: NIST: NIST SP 800-53 Revision 4 (v4): CM-8 b
CCI-001782 (policy): The organization updates the information system component inventory per organization-defined frequency.
References: NIST: NIST SP 800-53 Revision 4 (v4): CM-8 b
CCI-001787 (policy): The organization defines the acquired information system components that are to be assigned to an information system.
References: NIST: NIST SP 800-53 Revision 4 (v4): CM-8 (9) (a)
CCI-001790 (policy): The organization develops a configuration management plan for the information system that establishes a process for identifying configuration items throughout the system development life cycle.
References: NIST: NIST SP 800-53 Revision 4 (v4): CM-9 b
CCI-001791 (policy): The organization documents a configuration management plan for the information system that establishes a process for identifying configuration items throughout the system development life cycle.
References: NIST: NIST SP 800-53 Revision 4 (v4): CM-9 b
CCI-001793 (policy): The organization develops a configuration management plan for the information system that establishes a process for managing the configuration of the configuration items.
References: NIST: NIST SP 800-53 Revision 4 (v4): CM-9 b
CCI-001794 (policy): The organization documents a configuration management plan for the information system that establishes a process for managing the configuration of the configuration items.
References: NIST: NIST SP 800-53 Revision 4 (v4): CM-9 b
CCI-001796 (policy): The organization develops a configuration management plan for the information system that places the configuration items under configuration management.
References: NIST: NIST SP 800-53 Revision 4 (v4): CM-9 c
CCI-001797 (policy): The organization documents a configuration management plan for the information system that places the configuration items under configuration management.
References: NIST: NIST SP 800-53 Revision 4 (v4): CM-9 c
CCI-001800 (policy): The organization documents a configuration management plan for the information system that protects the configuration management plan from unauthorized disclosure and modification.
References: NIST: NIST SP 800-53 Revision 4 (v4): CM-9 d
CCI-001810 (policy): The organization defines the personnel or roles to be notified when unauthorized software is detected.
References: NIST: NIST SP 800-53 Revision 4 (v4): CM-11 (1)
CCI-001811 (technical): The information system alerts organization-defined personnel or roles when the unauthorized installation of software is detected.
References: NIST: NIST SP 800-53 Revision 4 (v4): CM-11 (1)
CCI-001812 (technical): The information system prohibits user installation of software without explicit privileged status.
References: NIST: NIST SP 800-53 Revision 4 (v4): CM-11 (2)
CCI-001814 (technical): The Information system supports auditing of the enforcement actions.
References: NIST: NIST SP 800-53 Revision 4 (v4): CM-5 (1)
CCI-001820 (policy): The organization documents a configuration management policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.
References: NIST: NIST SP 800-53 Revision 4 (v4): CM-1 a 1
CCI-001823 (policy): The organization documents the procedures to facilitate the implementation of the configuration management policy and associated configuration management controls.
References: NIST: NIST SP 800-53 Revision 4 (v4): CM-1 a 2
CCI-001826 (policy): The organization defines the circumstances upon which the organization reviews the information system changes to determine whether unauthorized changes have occurred.
References: NIST: NIST SP 800-53 Revision 4 (v4): CM-5 (2)
CCI-001827 (policy): The organization defines the frequency with which to review information system privileges.
References: NIST: NIST SP 800-53 Revision 4 (v4): CM-5 (5) (b)
CCI-001828 (policy): The organization defines the frequency with which to reevaluate information system privileges.
References: NIST: NIST SP 800-53 Revision 4 (v4): CM-5 (5) (b)
CCI-001829 (policy): The organization reviews information system privileges per an organization-defined frequency.
References: NIST: NIST SP 800-53 Revision 4 (v4): CM-5 (5) (b)
CCI-001830 (policy): The organization reevaluates information system privileges per an organization-defined frequency.
References: NIST: NIST SP 800-53 Revision 4 (v4): CM-5 (5) (b)
CCI-001831 (policy): The organization documents an audit and accountability policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.
References: NIST: NIST SP 800-53 Revision 4 (v4): AU-1 a 1
CCI-001833 (policy): The organization documents procedures to facilitate the implementation of the audit and accountability policy and associated audit and accountability controls.
References: NIST: NIST SP 800-53 Revision 4 (v4): AU-1 a 2
CCI-001835 (policy): The organization defines the frequency on which it will review the audit and accountability policy.
References: NIST: NIST SP 800-53 Revision 4 (v4): AU-1 b 1
CCI-001836 (policy): The organization defines the frequency on which it will update the audit and accountability policy.
References: NIST: NIST SP 800-53 Revision 4 (v4): AU-1 b 1
CCI-001837 (policy): The organization reviews the audit and accountability policy on an organization-defined frequency.
References: NIST: NIST SP 800-53 Revision 4 (v4): AU-1 b 1
CCI-001838 (policy): The organization updates the audit and accountability policy on an organization-defined frequency.
References: NIST: NIST SP 800-53 Revision 4 (v4): AU-1 b 1
CCI-001839 (policy): The organization defines the frequency on which it will review the audit and accountability procedures.
References: NIST: NIST SP 800-53 Revision 4 (v4): AU-1 b 2
CCI-001840 (policy): The organization defines the frequency on which it will update the audit and accountability procedures.
References: NIST: NIST SP 800-53 Revision 4 (v4): AU-1 b 2
CCI-001841 (policy): The organization reviews the audit and accountability procedures on an organization-defined frequency.
References: NIST: NIST SP 800-53 Revision 4 (v4): AU-1 b 2
CCI-001842 (policy): The organization updates the audit and accountability procedures on an organization-defined frequency.
References: NIST: NIST SP 800-53 Revision 4 (v4): AU-1 b 2
CCI-001843 (policy): The organization defines a frequency for updating the list of organization-defined auditable events.
References: NIST: NIST SP 800-53 Revision 4 (v4): AU-2 (3)
CCI-001844 (technical): The information system provides centralized management and configuration of the content to be captured in audit records generated by organization-defined information system components.
References: NIST: NIST SP 800-53 Revision 4 (v4): AU-3 (2)
CCI-001845 (technical): The information system provides centralized configuration of the content to be captured in audit records generated by organization-defined information system components.
References: NIST: NIST SP 800-53 Revision 4 (v4): AU-3 (2)
CCI-001846 (policy): The organization defines information system components that will generate the audit records which are to be captured for centralized management of the content.
References: NIST: NIST SP 800-53 Revision 4 (v4): AU-3 (2)
CCI-001847 (policy): The organization defines information system components that will generate the audit records which are to be captured for centralized configuration of the content.
References: NIST: NIST SP 800-53 Revision 4 (v4): AU-3 (2)
CCI-001872 (policy): The organization adjusts the level of audit review and analysis within the information system when there is a change in risk based on law enforcement information, intelligence information, or other credible sources of information.
References: NIST: NIST SP 800-53 Revision 4 (v4): AU-6 (10)
CCI-001873 (policy): The organization adjusts the level of audit analysis within the information system when there is a change in risk based on law enforcement information, intelligence information, or other credible sources of information.
References: NIST: NIST SP 800-53 Revision 4 (v4): AU-6 (10)
CCI-001874 (policy): The organization adjusts the level of audit reporting within the information system when there is a change in risk based on law enforcement information, intelligence information, or other credible sources of information.
References: NIST: NIST SP 800-53 Revision 4 (v4): AU-6 (10)
CCI-001884 (policy): The organization defines the audit fields within audit records to be sorted for events of interest by the information system.
References: NIST: NIST SP 800-53 Revision 4 (v4): AU-7 (2)
CCI-001885 (policy): The organization defines the audit fields within audit records to be searched for events of interest by the information system.
References: NIST: NIST SP 800-53 Revision 4 (v4): AU-7 (2)
CCI-001886 (technical): The information system provides the capability to sort audit records for events of interest based on the content of organization-defined audit fields within audit records.
References: NIST: NIST SP 800-53 Revision 4 (v4): AU-7 (2)
CCI-001887 (technical): The information system provides the capability to search audit records for events of interest based on the content of organization-defined audit fields within audit records.
References: NIST: NIST SP 800-53 Revision 4 (v4): AU-7 (2)
CCI-001891 (technical): The information system compares internal information system clocks on an organization-defined frequency with an organization-defined authoritative time source.
References: NIST: NIST SP 800-53 Revision 4 (v4): AU-8 (1) (a)
CCI-001892 (policy): The organization defines the time difference which, when exceeded, will require the information system to synchronize the internal information system clocks to the organization-defined authoritative time source.
References: NIST: NIST SP 800-53 Revision 4 (v4): AU-8 (1) (b)
CCI-001893 (technical): The information system identifies a secondary authoritative time source that is located in a different geographic region than the primary authoritative time source.
References: NIST: NIST SP 800-53 Revision 4 (v4): AU-8 (2)
CCI-001916 (policy): The organization employs automated mechanisms to determine if organizational information has been disclosed in an unauthorized manner.
References: NIST: NIST SP 800-53 Revision 4 (v4): AU-13 (1)
CCI-001921 (policy): The organization defines the alternative audit functionality to be provided in the event of a failure in the primary audit capability.
References: NIST: NIST SP 800-53 Revision 4 (v4): AU-15
CCI-001922 (policy): The organization provides an alternative audit capability in the event of a failure in primary audit capability that provides organization-defined alternative audit functionality.
References: NIST: NIST SP 800-53 Revision 4 (v4): AU-15
CCI-001932 (policy): The organization documents an identification and authentication policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.
References: NIST: NIST SP 800-53 Revision 4 (v4): IA-1 a 1
CCI-001933 (policy): The organization defines the personnel or roles to be recipients of the identification and authentication policy and the procedures to facilitate the implementation of the identification and authentication policy and associated identification and authentication controls.
References: NIST: NIST SP 800-53 Revision 4 (v4): IA-1 a 1
CCI-001934 (policy): The organization documents procedures to facilitate the implementation of the identification and authentication policy and associated identification and authentication controls.
References: NIST: NIST SP 800-53 Revision 4 (v4): IA-1 a 2
CCI-001935 (policy): The organization defines the strength of mechanism requirements for the device that is separate from the system gaining access to privileged accounts.
References: NIST: NIST SP 800-53 Revision 4 (v4): IA-2 (6)
CCI-001936 (technical): The information system implements multifactor authentication for network access to privileged accounts such that one of the factors is provided by a device separate from the system gaining access.
References: NIST: NIST SP 800-53 Revision 4 (v4): IA-2 (6)
CCI-001937 (technical): The device used in the information system implementation of multifactor authentication for network access to privileged accounts meets organization-defined strength of mechanism requirements.
References: NIST: NIST SP 800-53 Revision 4 (v4): IA-2 (6)
CCI-001938 (policy): The organization defines the strength of mechanism requirements for the device that is separate from the system gaining access to non-privileged accounts.
References: NIST: NIST SP 800-53 Revision 4 (v4): IA-2 (7)
CCI-001939 (technical): The information system implements multifactor authentication for network access to non-privileged accounts such that one of the factors is provided by a device separate from the system gaining access.
References: NIST: NIST SP 800-53 Revision 4 (v4): IA-2 (7)
CCI-001940 (technical): The device used in the information system implementation of multifactor authentication for network access to non-privileged accounts meets organization-defined strength of mechanism requirements.
References: NIST: NIST SP 800-53 Revision 4 (v4): IA-2 (7)
CCI-001942 (technical): The information system implements replay-resistant authentication mechanisms for network access to non-privileged accounts.
References: NIST: NIST SP 800-53 Revision 4 (v4): IA-2 (9)
CCI-001947 (policy): The organization defines the strength of mechanism requirements for the device that is separate from the system gaining access and is to provide one factor of a multifactor authentication for remote access to privileged accounts.
References: NIST: NIST SP 800-53 Revision 4 (v4): IA-2 (11)
CCI-001948 (technical): The information system implements multifactor authentication for remote access to privileged accounts such that one of the factors is provided by a device separate from the system gaining access.
References: NIST: NIST SP 800-53 Revision 4 (v4): IA-2 (11)
CCI-001949 (technical): The device used in the information system implementation of multifactor authentication for remote access to privileged accounts meets organization-defined strength of mechanism requirements.
References: NIST: NIST SP 800-53 Revision 4 (v4): IA-2 (11)
CCI-001950 (policy): The organization defines the strength of mechanism requirements for the device that is separate from the system gaining access and is to provide one factor of a multifactor authentication for remote access to non-privileged accounts.
References: NIST: NIST SP 800-53 Revision 4 (v4): IA-2 (11)
CCI-001951 (technical): The information system implements multifactor authentication for remote access to non-privileged accounts such that one of the factors is provided by a device separate from the system gaining access.
References: NIST: NIST SP 800-53 Revision 4 (v4): IA-2 (11)
CCI-001952 (technical): The device used in the information system implementation of multifactor authentication for remote access to non-privileged accounts meets organization-defined strength of mechanism requirements.
References: NIST: NIST SP 800-53 Revision 4 (v4): IA-2 (11)
CCI-001964 (policy): The organization defines the configuration management process that is to handle the device identification procedures.
References: NIST: NIST SP 800-53 Revision 4 (v4): IA-3 (4)
CCI-001979 (policy): The organization requires the registration process to receive an individual identifier be conducted in person before a designated registration authority.
References: NIST: NIST SP 800-53 Revision 4 (v4): IA-4 (7)
CCI-001982 (policy): The organization manages information system authenticators by establishing administrative procedures for lost/compromised authenticators.
References: NIST: NIST SP 800-53 Revision 4 (v4): IA-5 d
CCI-001983 (policy): The organization manages information system authenticators by establishing administrative procedures for damaged authenticators.
References: NIST: NIST SP 800-53 Revision 4 (v4): IA-5 d
CCI-001986 (policy): The organization manages information system authenticators by implementing administrative procedures for lost/compromised authenticators.
References: NIST: NIST SP 800-53 Revision 4 (v4): IA-5 d
CCI-001987 (policy): The organization manages information system authenticators by implementing administrative procedures for damaged authenticators.
References: NIST: NIST SP 800-53 Revision 4 (v4): IA-5 d
CCI-001989 (policy): The organization manages information system authenticators by changing default content of authenticators prior to information system installation.
References: NIST: NIST SP 800-53 Revision 4 (v4): IA-5 e
CCI-001991 (technical): The information system, for PKI-based authentication, implements a local cache of revocation data to support path discovery and validation in case of inability to access revocation information via the network.
References: NIST: NIST SP 800-53 Revision 4 (v4): IA-5 (2) (d)
CCI-001992 (policy): The organization defines the personnel or roles responsible for authorizing the organization's registration authority accountable for the authenticator registration process.
References: NIST: NIST SP 800-53 Revision 4 (v4): IA-5 (3)
CCI-001993 (policy): The organization defines the registration authority accountable for the authenticator registration process.
References: NIST: NIST SP 800-53 Revision 4 (v4): IA-5 (3)
CCI-001994 (policy): The organization defines the types of and/or specific authenticators that are subject to the authenticator registration process.
References: NIST: NIST SP 800-53 Revision 4 (v4): IA-5 (3)
CCI-001995 (policy): The organization requires that the registration process, to receive organization-defined types of and/or specific authenticators, be conducted in person, or by a trusted third-party, before an organization-defined registration authority with authorization by organization-defined personnel or roles.
References: NIST: NIST SP 800-53 Revision 4 (v4): IA-5 (3)
CCI-001996 (policy): The organization defines the requirements required by the automated tools to determine if password authenticators are sufficiently strong.
References: NIST: NIST SP 800-53 Revision 4 (v4): IA-5 (4)
CCI-001997 (policy): The organization employs automated tools to determine if password authenticators are sufficiently strong to satisfy organization-defined requirements.
References: NIST: NIST SP 800-53 Revision 4 (v4): IA-5 (4)
CCI-001999 (policy): The organization defines the external organizations to be coordinated with for cross-organization management of credentials.
References: NIST: NIST SP 800-53 Revision 4 (v4): IA-5 (9)
CCI-002000 (policy): The organization coordinates with organization-defined external organizations for cross-organization management of credentials.
References: NIST: NIST SP 800-53 Revision 4 (v4): IA-5 (9)
CCI-002002 (policy): The organization defines the token quality requirements to be employed by the information system mechanisms for token-based authentication.
References: NIST: NIST SP 800-53 Revision 4 (v4): IA-5 (11)
CCI-002003 (technical): The information system, for token-based authentication, employs mechanisms that satisfy organization-defined token quality requirements.
References: NIST: NIST SP 800-53 Revision 4 (v4): IA-5 (11)
CCI-002011 (technical): The information system accepts FICAM-approved third-party credentials.
References: NIST: NIST SP 800-53 Revision 4 (v4): IA-8 (2)
CCI-002012 (policy): The organization defines the information systems which will employ only FICAM-approved information system components.
References: NIST: NIST SP 800-53 Revision 4 (v4): IA-8 (3)
CCI-002013 (policy): The organization employs only FICAM-approved information system components in organization-defined information systems to accept third-party credentials.
References: NIST: NIST SP 800-53 Revision 4 (v4): IA-8 (3)
CCI-002014 (technical): The information system conforms to FICAM-issued profiles.
References: NIST: NIST SP 800-53 Revision 4 (v4): IA-8 (4)
CCI-002017 (policy): The organization defines the information system services requiring identification.
References: NIST: NIST SP 800-53 Revision 4 (v4): IA-9
CCI-002019 (policy): The organization defines the security safeguards to be used when identifying information system services.
References: NIST: NIST SP 800-53 Revision 4 (v4): IA-9
CCI-002020 (policy): The organization defines the security safeguards to be used when authenticating information system services.
References: NIST: NIST SP 800-53 Revision 4 (v4): IA-9
CCI-002023 (policy): The organization ensures that service providers receive identification information.
References: NIST: NIST SP 800-53 Revision 4 (v4): IA-9 (1)
CCI-002024 (policy): The organization ensures that service providers validate identification information.
References: NIST: NIST SP 800-53 Revision 4 (v4): IA-9 (1)
CCI-002025 (policy): The organization ensures that service providers transmit identification information.
References: NIST: NIST SP 800-53 Revision 4 (v4): IA-9 (1)
CCI-002026 (policy): The organization ensures that service providers receive authentication information.
References: NIST: NIST SP 800-53 Revision 4 (v4): IA-9 (1)
CCI-002027 (policy): The organization ensures that service providers validate authentication information.
References: NIST: NIST SP 800-53 Revision 4 (v4): IA-9 (1)
CCI-002028 (policy): The organization ensures that service providers transmit authentication information.
References: NIST: NIST SP 800-53 Revision 4 (v4): IA-9 (1)
CCI-002029 (policy): The organization defines the services between which identification decisions are to be transmitted.
References: NIST: NIST SP 800-53 Revision 4 (v4): IA-9 (2)
CCI-002030 (policy): The organization defines the services between which authentication decisions are to be transmitted.
References: NIST: NIST SP 800-53 Revision 4 (v4): IA-9 (2)
CCI-002031 (policy): The organization ensures that identification decisions are transmitted between organization-defined services consistent with organizational policies.
References: NIST: NIST SP 800-53 Revision 4 (v4): IA-9 (2)
CCI-002032 (policy): The organization ensures that authentication decisions are transmitted between organization-defined services consistent with organizational policies.
References: NIST: NIST SP 800-53 Revision 4 (v4): IA-9 (2)
CCI-002037 (policy): The organization defines the circumstances or situations under which devices will be required to reauthenticate.
References: NIST: NIST SP 800-53 Revision 4 (v4): IA-11
CCI-002038 (technical): The organization requires users to reauthenticate upon organization-defined circumstances or situations requiring reauthentication.
References: NIST: NIST SP 800-53 Revision 4 (v4): IA-11
CCI-002039 (technical): The organization requires devices to reauthenticate upon organization-defined circumstances or situations requiring reauthentication.
References: NIST: NIST SP 800-53 Revision 4 (v4): IA-11
CCI-002040 (policy): The organization requires that the registration process to receive an individual identifier includes supervisor authorization.
References: NIST: NIST SP 800-53 Revision 4 (v4): IA-4 (2)
CCI-002041 (technical): The information system allows the use of a temporary password for system logons with an immediate change to a permanent password.
References: NIST: NIST SP 800-53 Revision 4 (v4): IA-5 (1) (f)
CCI-002043 (policy): The organization uses only FICAM-approved path discovery and validation products and services.
References: NIST: NIST SP 800-53 Revision 4 (v4): IA-5 (15)
CCI-002046 (technical): The information system synchronizes the internal system clocks to the authoritative time source when the time difference is greater than the organization-defined time period.
References: NIST: NIST SP 800-53 Revision 4 (v4): AU-8 (1) (b)
CCI-002053 (policy): The organization provides training to its personnel on organization-defined indicators of malicious code to recognize suspicious communications and anomalous behavior in organizational information systems.
References: NIST: NIST SP 800-53 Revision 4 (v4): AT-3 (4)
CCI-002054 (policy): The organization defines indicators of malicious code to recognize suspicious communications and anomalous behavior in organizational information systems.
References: NIST: NIST SP 800-53 Revision 4 (v4): AT-3 (4)
CCI-002060 (policy): The organization develops and documents a security assessment and authorization policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.
References: NIST: NIST SP 800-53 Revision 4 (v4): CA-1 a 1