Lexim011/Compliance huggingface dataset:
CCI-002776 (policy): Defines the personnel or roles to whom the organization-level; mission/business process-level; and/or system-level incident response policy is disseminated.
References: NIST: NIST SP 800-53 Revision 4 (v4): IR-1 a 1 NIST: NIST SP 800-53 Revision 5 (v5): IR-1 a 1 (a)
CCI-002777 (policy): Defines the personnel or roles to whom the incident response procedures are disseminated.
References: NIST: NIST SP 800-53 Revision 4 (v4): IR-1 a 2 NIST: NIST SP 800-53 Revision 5 (v5): IR-1 a 2
CCI-004109 (policy): Develop and document an organization-level; mission/business process-level; and/or system-level incident response policy that is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines.
References: NIST: NIST SP 800-53 Revision 5 (v5): IR-1 a 1 (b)
CCI-004110 (policy): Designate an organization-defined official to manage the incident response policy.
References: NIST: NIST SP 800-53 Revision 5 (v5): IR-1 b
CCI-004111 (policy): Designate an organization-defined official to manage the incident response procedures.
References: NIST: NIST SP 800-53 Revision 5 (v5): IR-1 b
CCI-004112 (policy): Defines the official designated to manage the incident response policy and procedures.
References: NIST: NIST SP 800-53 Revision 5 (v5): IR-1 b
CCI-000807 (policy): Review and update the current incident response policy in accordance with organization-defined frequency.
References: NIST: NIST SP 800-53 (v3): IR-1 a NIST: NIST SP 800-53 Revision 4 (v4): IR-1 b 1 NIST: NIST SP 800-53 Revision 5 (v5): IR-1 c 1 NIST: NIST SP 800-53A (v1): IR-1.2 (ii)
CCI-000808 (policy): Defines the frequency with which to review and update the current incident response policy.
References: NIST: NIST SP 800-53 (v3): IR-1 a NIST: NIST SP 800-53 Revision 4 (v4): IR-1 b 1 NIST: NIST SP 800-53 Revision 5 (v5): IR-1 c 1 NIST: NIST SP 800-53A (v1): IR-1.2 (i)
CCI-000811 (policy): Review and update the current incident response procedures in accordance with organization-defined frequency.
References: NIST: NIST SP 800-53 (v3): IR-1 b NIST: NIST SP 800-53 Revision 4 (v4): IR-1 b 2 NIST: NIST SP 800-53 Revision 5 (v5): IR-1 c 2 NIST: NIST SP 800-53A (v1): IR-1.2 (iv)
CCI-000812 (policy): Defines the frequency with which to review and update the current incident response procedures.
References: NIST: NIST SP 800-53 (v3): IR-1 b NIST: NIST SP 800-53 Revision 4 (v4): IR-1 b 2 NIST: NIST SP 800-53 Revision 5 (v5): IR-1 c 2 NIST: NIST SP 800-53A (v1): IR-1.2 (iii)
CCI-004113 (policy): Review and update the current incident response policy following organization-defined events.
References: NIST: NIST SP 800-53 Revision 5 (v5): IR-1 c 1
CCI-004114 (policy): Defines the events for reviewing and updating the current incident response policy.
References: NIST: NIST SP 800-53 Revision 5 (v5): IR-1 c 1
CCI-004115 (policy): Review and update the current incident response procedures following organization-defined events.
References: NIST: NIST SP 800-53 Revision 5 (v5): IR-1 c 2
CCI-004116 (policy): Defines the events for reviewing and updating the current incident response procedures.
References: NIST: NIST SP 800-53 Revision 5 (v5): IR-1 c 2
CCI-000813 (policy): Provide incident response training to system users consistent with assigned roles and responsibilities within an organization-defined time period of assuming an incident response role or responsibility.
References: NIST: NIST SP 800-53 (v3): IR-2 a NIST: NIST SP 800-53 Revision 4 (v4): IR-2 a NIST: NIST SP 800-53 Revision 5 (v5): IR-2 a 1 NIST: NIST SP 800-53A (v1): IR-2.1 (ii)
CCI-000814 (policy): Provide incident response training in accordance with organization-defined frequency.
References: NIST: NIST SP 800-53 (v3): IR-2 b NIST: NIST SP 800-53 Revision 4 (v4): IR-2 c NIST: NIST SP 800-53 Revision 5 (v5): IR-2 a 3 NIST: NIST SP 800-53A (v1): IR-2.1 (v)
CCI-002778 (policy): Defines the time period in which system users who assume an incident response role or responsibility receive incident response training.
References: NIST: NIST SP 800-53 Revision 4 (v4): IR-2 a NIST: NIST SP 800-53 Revision 5 (v5): IR-2 a 1
CCI-002779 (policy): Provide incident response training to system users consistent with assigned roles and responsibilities when required by system changes.
References: NIST: NIST SP 800-53 Revision 4 (v4): IR-2 b NIST: NIST SP 800-53 Revision 5 (v5): IR-2 a 2
CCI-000815 (policy): Defines a frequency for incident response training.
References: NIST: NIST SP 800-53 (v3): IR-2 b NIST: NIST SP 800-53 Revision 4 (v4): IR-2 c NIST: NIST SP 800-53 Revision 5 (v5): IR-2 c NIST: NIST SP 800-53A (v1): IR-2.1 (iv)
CCI-000816 (policy): Incorporate simulated events into incident response training to facilitate effective response by personnel in crisis situations.
References: NIST: NIST SP 800-53 (v3): IR-2 (1) NIST: NIST SP 800-53 Revision 4 (v4): IR-2 (1) NIST: NIST SP 800-53 Revision 5 (v5): IR-2 (1) NIST: NIST SP 800-53A (v1): IR-2 (1).1
CCI-000817 (policy): Provide an incident response training environment using organization-defined automated mechanisms.
References: NIST: NIST SP 800-53 (v3): IR-2 (2) NIST: NIST SP 800-53 Revision 4 (v4): IR-2 (2) NIST: NIST SP 800-53 Revision 5 (v5): IR-2 (2) NIST: NIST SP 800-53A (v1): IR-2 (2).1
CCI-004117 (policy): Defines the automated mechanisms to provide an incident response training environment.
References: NIST: NIST SP 800-53 Revision 5 (v5): IR-2 (2)
CCI-004118 (policy): Provide incident response training on how to identify and respond to a breach, including the organization's process for reporting a breach.
References: NIST: NIST SP 800-53 Revision 5 (v5): IR-2 (3)
CCI-000818 (policy): Test the effectiveness of the incident response capability for the system on an organization-defined frequency using organization-defined tests.
References: NIST: NIST SP 800-53 (v3): IR-3 NIST: NIST SP 800-53 Revision 4 (v4): IR-3 NIST: NIST SP 800-53 Revision 5 (v5): IR-3 NIST: NIST SP 800-53A (v1): IR-3.1 (iii) (v)
CCI-000819 (policy): Defines a frequency for incident response tests.
References: NIST: NIST SP 800-53 (v3): IR-3 NIST: NIST SP 800-53 Revision 4 (v4): IR-3 NIST: NIST SP 800-53 Revision 5 (v5): IR-3 NIST: NIST SP 800-53A (v1): IR-3.1 (ii)
CCI-000820 (policy): Defines tests for incident response.
References: NIST: NIST SP 800-53 (v3): IR-3 NIST: NIST SP 800-53 Revision 4 (v4): IR-3 NIST: NIST SP 800-53 Revision 5 (v5): IR-3 NIST: NIST SP 800-53A (v1): IR-3.1 (i)
CCI-000821 (policy): Test the incident response capability using organization-defined automated mechanisms.
References: NIST: NIST SP 800-53 (v3): IR-3 (1) NIST: NIST SP 800-53 Revision 4 (v4): IR-3 (1) NIST: NIST SP 800-53 Revision 5 (v5): IR-3 (1) NIST: NIST SP 800-53A (v1): IR-3 (1).1
CCI-004119 (policy): Defines the automated mechanisms to test the incident response capability.
References: NIST: NIST SP 800-53 Revision 5 (v5): IR-3 (1)
CCI-002780 (policy): Coordinate incident response testing with organizational elements responsible for related plans.
References: NIST: NIST SP 800-53 Revision 4 (v4): IR-3 (2) NIST: NIST SP 800-53 Revision 5 (v5): IR-3 (2)
CCI-004120 (policy): Use qualitative data from testing to determine the effectiveness of incident response processes.
References: NIST: NIST SP 800-53 Revision 5 (v5): IR-3 (3) (a)
CCI-004121 (policy): Use quantitative data from testing to determine the effectiveness of incident response processes.
References: NIST: NIST SP 800-53 Revision 5 (v5): IR-3 (3) (a)
CCI-004122 (policy): Use qualitative data from testing to continuously improve incident response processes.
References: NIST: NIST SP 800-53 Revision 5 (v5): IR-3 (3) (b)
CCI-004123 (policy): Use quantitative data from testing to continuously improve incident response processes.
References: NIST: NIST SP 800-53 Revision 5 (v5): IR-3 (3) (b)
CCI-004124 (policy): Use qualitative data from testing to provide incident response measures and metrics that are accurate.
References: NIST: NIST SP 800-53 Revision 5 (v5): IR-3 (3) (c)
CCI-004125 (policy): Use quantitative data from testing to provide incident response measures and metrics that are accurate.
References: NIST: NIST SP 800-53 Revision 5 (v5): IR-3 (3) (c)
CCI-004126 (policy): Use qualitative data from testing to provide incident response measures and metrics that are consistent.
References: NIST: NIST SP 800-53 Revision 5 (v5): IR-3 (3) (c)
CCI-004127 (policy): Use quantitative data from testing to provide incident response measures and metrics that are consistent.
References: NIST: NIST SP 800-53 Revision 5 (v5): IR-3 (3) (c)
CCI-004128 (policy): Use qualitative data from testing to provide incident response measures and metrics that are in a reproducible format.
References: NIST: NIST SP 800-53 Revision 5 (v5): IR-3 (3) (c)
CCI-004129 (policy): Use quantitative data from testing to provide incident response measures and metrics that are in a reproducible format.
References: NIST: NIST SP 800-53 Revision 5 (v5): IR-3 (3) (c)
CCI-000822 (policy): Implement an incident handling capability for incidents that is consistent with the incident response plan and includes preparation, detection and analysis, containment, eradication, and recovery.
References: NIST: NIST SP 800-53 (v3): IR-4 a NIST: NIST SP 800-53 Revision 4 (v4): IR-4 a NIST: NIST SP 800-53 Revision 5 (v5): IR-4 a NIST: NIST SP 800-53A (v1): IR-4.1 (i)
CCI-000823 (policy): Coordinate incident handling activities with contingency planning activities.
References: NIST: NIST SP 800-53 (v3): IR-4 b NIST: NIST SP 800-53 Revision 4 (v4): IR-4 b NIST: NIST SP 800-53 Revision 5 (v5): IR-4 b NIST: NIST SP 800-53A (v1): IR-4.1 (ii)
CCI-001625 (policy): Implement the resulting incident handling activity changes to incident response procedures, training, and testing accordingly.
References: NIST: NIST SP 800-53 (v3): IR-4 c NIST: NIST SP 800-53 Revision 4 (v4): IR-4 c NIST: NIST SP 800-53 Revision 5 (v5): IR-4 c NIST: NIST SP 800-53A (v1): IR-4.1 (iv)
CCI-004130 (policy): Incorporate lessons learned from ongoing incident handling activities into incident response procedures.
References: NIST: NIST SP 800-53 Revision 5 (v5): IR-4 c
CCI-004131 (policy): Incorporate lessons learned from ongoing incident handling activities into incident response training.
References: NIST: NIST SP 800-53 Revision 5 (v5): IR-4 c
CCI-004132 (policy): Incorporate lessons learned from ongoing incident handling activities into incident response testing.
References: NIST: NIST SP 800-53 Revision 5 (v5): IR-4 c
CCI-004133 (policy): Ensure the rigor of incident handling activities are comparable and predictable across the organization.
References: NIST: NIST SP 800-53 Revision 5 (v5): IR-4 d
CCI-004134 (policy): Ensure the intensity of incident handling activities are comparable and predictable across the organization.
References: NIST: NIST SP 800-53 Revision 5 (v5): IR-4 d
CCI-004135 (policy): Ensure the scope of incident handling activities are comparable and predictable across the organization.
References: NIST: NIST SP 800-53 Revision 5 (v5): IR-4 d
CCI-004136 (policy): Ensure the results of incident handling activities are comparable and predictable across the organization.
References: NIST: NIST SP 800-53 Revision 5 (v5): IR-4 d
CCI-000825 (policy): Support the incident handling process using organization-defined automated mechanisms.
References: NIST: NIST SP 800-53 (v3): IR-4 (1) NIST: NIST SP 800-53 Revision 4 (v4): IR-4 (1) NIST: NIST SP 800-53 Revision 5 (v5): IR-4 (1) NIST: NIST SP 800-53A (v1): IR-4 (1).1
CCI-004137 (policy): Defines the automated mechanisms for supporting the incident handling process.
References: NIST: NIST SP 800-53 Revision 5 (v5): IR-4 (1)
CCI-000826 (policy): Include organization-defined types of dynamic reconfiguration for organization-defined system components as part of the incident response capability.
References: NIST: NIST SP 800-53 (v3): IR-4 (2) NIST: NIST SP 800-53 Revision 4 (v4): IR-4 (2) NIST: NIST SP 800-53 Revision 5 (v5): IR-4 (2) NIST: NIST SP 800-53A (v1): IR-4 (2).1
CCI-002781 (policy): Defines the system components for dynamic reconfiguration as part of the incident response capability.
References: NIST: NIST SP 800-53 Revision 4 (v4): IR-4 (2) NIST: NIST SP 800-53 Revision 5 (v5): IR-4 (2)
CCI-004138 (policy): Defines the types of dynamic reconfiguration for system components.
References: NIST: NIST SP 800-53 Revision 5 (v5): IR-4 (2)
CCI-000827 (policy): Identify organization-defined classes of incidents for which organization-defined actions are to be taken to ensure continuation of organizational mission and business functions.
References: NIST: NIST SP 800-53 (v3): IR-4 (3) NIST: NIST SP 800-53 Revision 4 (v4): IR-4 (3) NIST: NIST SP 800-53 Revision 5 (v5): IR-4 (3) NIST: NIST SP 800-53A (v1): IR-4 (3).1 (i)
CCI-000828 (policy): Identify actions to take in response to organization-defined classes of incidents to ensure continuation of organizational missions and business functions.
References: NIST: NIST SP 800-53 (v3): IR-4 (3) NIST: NIST SP 800-53 Revision 4 (v4): IR-4 (3) NIST: NIST SP 800-53 Revision 5 (v5): IR-4 (3) NIST: NIST SP 800-53A (v1): IR-4 (3).1 (ii)
CCI-004139 (policy): Defines the classes of incidents to identify actions in response to those incidents.
References: NIST: NIST SP 800-53 Revision 5 (v5): IR-4 (3)
CCI-004140 (policy): Defines the actions to take in response to organization-defined classes of incidents to ensure continuation of organizational mission and business functions.
References: NIST: NIST SP 800-53 Revision 5 (v5): IR-4 (3)
CCI-000829 (policy): Correlate incident information and individual incident responses to achieve an organization-wide perspective on incident awareness and response.
References: NIST: NIST SP 800-53 (v3): IR-4 (4) NIST: NIST SP 800-53 Revision 4 (v4): IR-4 (4) NIST: NIST SP 800-53 Revision 5 (v5): IR-4 (4) NIST: NIST SP 800-53A (v1): IR-4 (4).1
CCI-000830 (policy): Defines security violations that, if detected, initiate a configurable capability to automatically disable the system.
References: NIST: NIST SP 800-53 (v3): IR-4 (5) NIST: NIST SP 800-53 Revision 4 (v4): IR-4 (5) NIST: NIST SP 800-53 Revision 5 (v5): IR-4 (5) NIST: NIST SP 800-53A (v1): IR-4 (5).1 (i)
CCI-000831 (technical): Implement a configurable capability to automatically disable the system if organization-defined security violations are detected.
References: NIST: NIST SP 800-53 (v3): IR-4 (5) NIST: NIST SP 800-53 Revision 4 (v4): IR-4 (5) NIST: NIST SP 800-53 Revision 5 (v5): IR-4 (5) NIST: NIST SP 800-53A (v1): IR-4 (5).1 (ii)
CCI-002782 (policy): Implement an incident handling capability for incidents involving insider threats.
References: NIST: NIST SP 800-53 Revision 4 (v4): IR-4 (6) NIST: NIST SP 800-53 Revision 5 (v5): IR-4 (6)
CCI-004141 (policy): Coordinate an incident handling capability for insider threats that includes organization-defined entities.
References: NIST: NIST SP 800-53 Revision 5 (v5): IR-4 (7)
CCI-004142 (policy): Defines the organizational entities for coordinating an incident handling capability for insider threats.
References: NIST: NIST SP 800-53 Revision 5 (v5): IR-4 (7)
CCI-002785 (policy): Coordinate with organization-defined external organizations to correlate and share organization-defined incident information to achieve a cross-organization perspective on incident awareness and more effective incident responses.
References: NIST: NIST SP 800-53 Revision 4 (v4): IR-4 (8) NIST: NIST SP 800-53 Revision 5 (v5): IR-4 (8)
CCI-002786 (policy): Defines external organizations with which to correlate and share organization-defined incident information.
References: NIST: NIST SP 800-53 Revision 4 (v4): IR-4 (8) NIST: NIST SP 800-53 Revision 5 (v5): IR-4 (8)
CCI-002787 (policy): Defines incident information to correlate and share with organization-defined external organizations.
References: NIST: NIST SP 800-53 Revision 4 (v4): IR-4 (8) NIST: NIST SP 800-53 Revision 5 (v5): IR-4 (8)
CCI-002788 (policy): Employ organization-defined dynamic response capabilities to effectively respond to incidents.
References: NIST: NIST SP 800-53 Revision 4 (v4): IR-4 (9) NIST: NIST SP 800-53 Revision 5 (v5): IR-4 (9)
CCI-002789 (policy): Defines dynamic response capabilities to effectively respond to incidents.
References: NIST: NIST SP 800-53 Revision 4 (v4): IR-4 (9) NIST: NIST SP 800-53 Revision 5 (v5): IR-4 (9)
CCI-002790 (policy): Coordinate incident handling activities involving supply chain events with other organizations involved in the supply chain.
References: NIST: NIST SP 800-53 Revision 4 (v4): IR-4 (10) NIST: NIST SP 800-53 Revision 5 (v5): IR-4 (10)
CCI-004143 (policy): Establish and maintain an integrated incident response team that can be deployed to any location identified by the organization in an organization-defined time period.
References: NIST: NIST SP 800-53 Revision 5 (v5): IR-4 (11)
CCI-004144 (policy): Defines the time period for establishing and maintaining an integrated incident response team that can be deployed to any location identified by the organization.
References: NIST: NIST SP 800-53 Revision 5 (v5): IR-4 (11)
CCI-004145 (policy): Analyze malicious code and/or other residual artifacts remaining in the system after the incident.
References: NIST: NIST SP 800-53 Revision 5 (v5): IR-4 (12)
CCI-004146 (policy): Analyze anomalous or suspected adversarial behavior in or related to organization-defined environments or resources.
References: NIST: NIST SP 800-53 Revision 5 (v5): IR-4 (13)
CCI-004147 (policy): Defines the environments or resources for analyzing anomalous or suspected adversarial behavior.
References: NIST: NIST SP 800-53 Revision 5 (v5): IR-4 (13)
CCI-004148 (policy, technical): Establish and maintain a security operations center.
References: NIST: NIST SP 800-53 Revision 5 (v5): IR-4 (14)
CCI-004149 (policy): Manage public relations associated with an incident.
References: NIST: NIST SP 800-53 Revision 5 (v5): IR-4 (15) (a)
CCI-004150 (policy): Employ measures to repair the reputation of the organization.
References: NIST: NIST SP 800-53 Revision 5 (v5): IR-4 (15) (b)
CCI-000832 (policy): Track and document incidents.
References: NIST: NIST SP 800-53 (v3): IR-5 NIST: NIST SP 800-53 Revision 4 (v4): IR-5 NIST: NIST SP 800-53 Revision 5 (v5): IR-5 NIST: NIST SP 800-53A (v1): IR-5.1
CCI-004151 (policy): Track incidents using organization-defined automated mechanisms.
References: NIST: NIST SP 800-53 Revision 5 (v5): IR-5 (1)
CCI-004152 (policy): Collect incident information using organization-defined automated mechanisms.
References: NIST: NIST SP 800-53 Revision 5 (v5): IR-5 (1)
CCI-004153 (policy): Analyze incident information using organization-defined automated mechanisms.
References: NIST: NIST SP 800-53 Revision 5 (v5): IR-5 (1)
CCI-004154 (policy): Defines the automated mechanisms to track, collect, and analyze incident information.
References: NIST: NIST SP 800-53 Revision 5 (v5): IR-5 (1)
CCI-000834 (policy): Defines a time period for personnel to report suspected incidents to the organizational incident response capability.
References: NIST: NIST SP 800-53 (v3): IR-6 a NIST: NIST SP 800-53 Revision 4 (v4): IR-6 a NIST: NIST SP 800-53 Revision 5 (v5): IR-6 a NIST: NIST SP 800-53A (v1): IR-6.1 (i)
CCI-000835 (policy): Require personnel to report suspected incidents to the organizational incident response capability within the organization-defined time period.
References: NIST: NIST SP 800-53 (v3): IR-6 a NIST: NIST SP 800-53 Revision 4 (v4): IR-6 a NIST: NIST SP 800-53 Revision 5 (v5): IR-6 a NIST: NIST SP 800-53A (v1): IR-6.1 (ii)
CCI-000836 (policy): Report incident information to organization-defined authorities.
References: NIST: NIST SP 800-53 (v3): IR-6 b NIST: NIST SP 800-53 Revision 4 (v4): IR-6 b NIST: NIST SP 800-53 Revision 5 (v5): IR-6 b NIST: NIST SP 800-53A (v1): IR-6.1 (iii)
CCI-002791 (policy): Defines authorities to whom incident information is reported.
References: NIST: NIST SP 800-53 Revision 4 (v4): IR-6 b NIST: NIST SP 800-53 Revision 5 (v5): IR-6 b
CCI-000837 (policy): Report incidents using organization-defined automated mechanisms.
References: NIST: NIST SP 800-53 (v3): IR-6 (1) NIST: NIST SP 800-53 Revision 4 (v4): IR-6 (1) NIST: NIST SP 800-53 Revision 5 (v5): IR-6 (1) NIST: NIST SP 800-53A (v1): IR-6 (1).1
CCI-004155 (policy): Defines the automated mechanisms for reporting incidents.
References: NIST: NIST SP 800-53 Revision 5 (v5): IR-6 (1)
CCI-000838 (policy): Report system vulnerabilities associated with reported incidents to organization-defined personnel or roles.
References: NIST: NIST SP 800-53 (v3): IR-6 (2) NIST: NIST SP 800-53 Revision 4 (v4): IR-6 (2) NIST: NIST SP 800-53 Revision 5 (v5): IR-6 (2) NIST: NIST SP 800-53A (v1): IR-6 (2).1
CCI-002792 (policy): Defines personnel or roles to whom system vulnerabilities associated with reported incident information are reported.
References: NIST: NIST SP 800-53 Revision 4 (v4): IR-6 (2) NIST: NIST SP 800-53 Revision 5 (v5): IR-6 (2)
CCI-002793 (policy): Provide incident information to other organizations involved in the supply chain or supply chain governance for systems or system components related to the incident.
References: NIST: NIST SP 800-53 Revision 4 (v4): IR-6 (3) NIST: NIST SP 800-53 Revision 5 (v5): IR-6 (3)
CCI-004156 (policy): Provide incident information to the provider of the product or service.
References: NIST: NIST SP 800-53 Revision 5 (v5): IR-6 (3)
CCI-000839 (policy): Provide an incident response support resource, integral to the organizational incident response capability, that offers advice and assistance to users of the system for the handling and reporting of incidents.
References: NIST: NIST SP 800-53 (v3): IR-7 NIST: NIST SP 800-53 Revision 4 (v4): IR-7 NIST: NIST SP 800-53 Revision 5 (v5): IR-7 NIST: NIST SP 800-53A (v1): IR-7.1 (i) (ii)
CCI-000841 (policy): Establish a direct, cooperative relationship between its incident response capability and external providers of system protection capability.
References: NIST: NIST SP 800-53 (v3): IR-7 (2) (a) NIST: NIST SP 800-53 Revision 4 (v4): IR-7 (2) (a) NIST: NIST SP 800-53 Revision 5 (v5): IR-7 (2) (a) NIST: NIST SP 800-53A (v1): IR-7 (2).1 (i)
CCI-000842 (policy): Identify organizational incident response team members to the external providers.
References: NIST: NIST SP 800-53 (v3): IR-7 (2) (b) NIST: NIST SP 800-53 Revision 4 (v4): IR-7 (2) (b) NIST: NIST SP 800-53 Revision 5 (v5): IR-7 (2) (b) NIST: NIST SP 800-53A (v1): IR-7 (2).1 (ii)
CCI-000844 (policy): Develop an incident response plan that is reviewed and approved by organization-defined personnel or roles on an organization-defined frequency.
References: NIST: NIST SP 800-53 (v3): IR-8 a NIST: NIST SP 800-53 Revision 4 (v4): IR-8 a 8 NIST: NIST SP 800-53 Revision 5 (v5): IR-8 a 9 NIST: NIST SP 800-53A (v1): IR-8.1
CCI-002794 (policy): Develop an incident response plan.
References: NIST: NIST SP 800-53 Revision 4 (v4): IR-8 a NIST: NIST SP 800-53 Revision 5 (v5): IR-8 a
CCI-002795 (policy): Develop an incident response plan that provides the organization with a roadmap for implementing its incident response capability.
References: NIST: NIST SP 800-53 Revision 4 (v4): IR-8 a 1 NIST: NIST SP 800-53 Revision 5 (v5): IR-8 a 1
CCI-002796 (policy): Develop an incident response plan that describes the structure and organization of the incident response capability.
References: NIST: NIST SP 800-53 Revision 4 (v4): IR-8 a 2 NIST: NIST SP 800-53 Revision 5 (v5): IR-8 a 2
CCI-002797 (policy): Develop an incident response plan that provides a high-level approach for how the incident response capability fits into the overall organization.
References: NIST: NIST SP 800-53 Revision 4 (v4): IR-8 a 3 NIST: NIST SP 800-53 Revision 5 (v5): IR-8 a 3
CCI-002798 (policy): Develop an incident response plan that meets the unique requirements of the organization, which relate to mission, size, structure, and functions.
References: NIST: NIST SP 800-53 Revision 4 (v4): IR-8 a 4 NIST: NIST SP 800-53 Revision 5 (v5): IR-8 a 4
CCI-002799 (policy): Develop an incident response plan that defines reportable incidents.
References: NIST: NIST SP 800-53 Revision 4 (v4): IR-8 a 5 NIST: NIST SP 800-53 Revision 5 (v5): IR-8 a 5
CCI-002800 (policy): Develop an incident response plan that provides metrics for measuring the incident response capability within the organization.
References: NIST: NIST SP 800-53 Revision 4 (v4): IR-8 a 6 NIST: NIST SP 800-53 Revision 5 (v5): IR-8 a 6
CCI-002801 (policy): Develop an incident response plan that defines the resources and management support needed to effectively maintain and mature an incident response capability.
References: NIST: NIST SP 800-53 Revision 4 (v4): IR-8 a 7 NIST: NIST SP 800-53 Revision 5 (v5): IR-8 a 7
CCI-002802 (policy): Defines personnel or roles to review and approve the incident response plan.
References: NIST: NIST SP 800-53 Revision 4 (v4): IR-8 a 8 NIST: NIST SP 800-53 Revision 5 (v5): IR-8 a 9
CCI-004157 (policy): Develop an incident response plan that addresses the sharing of incident information.
References: NIST: NIST SP 800-53 Revision 5 (v5): IR-8 a 8
CCI-004158 (policy): Defines the frequency organization-defined personnel or roles will review and approve the incident response plan.
References: NIST: NIST SP 800-53 Revision 5 (v5): IR-8 a 9
CCI-004159 (policy): Develop an incident response plan that explicitly designates responsibility for incident response to organization-defined entities, personnel, or roles.
References: NIST: NIST SP 800-53 Revision 5 (v5): IR-8 a 10
CCI-000845 (policy): Defines incident response personnel (identified by name and/or by role) and organizational elements to whom copies of the incident response plan are distributed.
References: NIST: NIST SP 800-53 (v3): IR-8 b NIST: NIST SP 800-53 Revision 4 (v4): IR-8 b NIST: NIST SP 800-53 Revision 5 (v5): IR-8 b NIST: NIST SP 800-53A (v1): IR-8.2 (i)
CCI-000846 (policy): Distributes copies of the incident response plan to organization-defined incident response personnel (identified by name and/or by role) and organizational elements.
References: NIST: NIST SP 800-53 (v3): IR-8 b NIST: NIST SP 800-53 Revision 4 (v4): IR-8 b NIST: NIST SP 800-53 Revision 5 (v5): IR-8 b NIST: NIST SP 800-53A (v1): IR-8.2 (ii)
CCI-000849 (policy): Update the incident response plan to address system and organizational changes or problems encountered during plan implementation, execution, or testing.
References: NIST: NIST SP 800-53 (v3): IR-8 d NIST: NIST SP 800-53 Revision 4 (v4): IR-8 d NIST: NIST SP 800-53 Revision 5 (v5): IR-8 c NIST: NIST SP 800-53A (v1): IR-8.2 (v)
CCI-000850 (policy): Communicate incident response plan changes to organization-defined incident response personnel (identified by name and/or by role) and organizational elements.
References: NIST: NIST SP 800-53 (v3): IR-8 e NIST: NIST SP 800-53 Revision 4 (v4): IR-8 e NIST: NIST SP 800-53 Revision 5 (v5): IR-8 d NIST: NIST SP 800-53A (v1): IR-8.2 (vi)
CCI-002803 (policy): Defines incident response personnel (identified by name and/or by role) and organizational elements to whom incident response plan changes will be communicated.
References: NIST: NIST SP 800-53 Revision 4 (v4): IR-8 e NIST: NIST SP 800-53 Revision 5 (v5): IR-8 d
CCI-002804 (policy): Protect the incident response plan from unauthorized disclosure and modification.
References: NIST: NIST SP 800-53 Revision 4 (v4): IR-8 f NIST: NIST SP 800-53 Revision 5 (v5): IR-8 e
CCI-004160 (policy): Include a process to determine if notice to individuals or other organizations, including oversight organizations, is needed, in the Incident Response Plan for breaches involving Personally Identifiable Information.
References: NIST: NIST SP 800-53 Revision 5 (v5): IR-8 (1) (a)
CCI-004161 (policy): Include an assessment process to determine the extent of the harm, embarrassment, inconvenience, or unfairness to affected individuals and any mechanisms to mitigate such harms in the Incident Response Plan for breaches involving Personally Identifiable Information.
References: NIST: NIST SP 800-53 Revision 5 (v5): IR-8 (1) (b)
CCI-004162 (policy): Include identification of applicable privacy requirements in the Incident Response Plan for breaches involving Personally Identifiable Information.
References: NIST: NIST SP 800-53 Revision 5 (v5): IR-8 (1) (c)
CCI-004163 (policy): Respond to information spills by assigning organization-defined personnel or roles with responsibility for responding to information spills.
References: NIST: NIST SP 800-53 Revision 5 (v5): IR-9 a
CCI-004164 (policy): Defines the personnel or roles who will respond to information spills.
References: NIST: NIST SP 800-53 Revision 5 (v5): IR-9 a
CCI-002805 (policy): Respond to information spills by identifying the specific information involved in the system contamination.
References: NIST: NIST SP 800-53 Revision 4 (v4): IR-9 a NIST: NIST SP 800-53 Revision 5 (v5): IR-9 b
CCI-002806 (policy): Respond to information spills by alerting organization-defined personnel or roles of the information spill using a method of communication not associated with the spill.
References: NIST: NIST SP 800-53 Revision 4 (v4): IR-9 b NIST: NIST SP 800-53 Revision 5 (v5): IR-9 c
CCI-002807 (policy): Defines the personnel or roles to be alerted of information spills using a method of communication not associated with the spill.
References: NIST: NIST SP 800-53 Revision 4 (v4): IR-9 b NIST: NIST SP 800-53 Revision 5 (v5): IR-9 c
CCI-002808 (policy): Respond to information spills by isolating the contaminated system or system component.
References: NIST: NIST SP 800-53 Revision 4 (v4): IR-9 c NIST: NIST SP 800-53 Revision 5 (v5): IR-9 d
CCI-002809 (policy): Respond to information spills by eradicating the information from the contaminated system or component.
References: NIST: NIST SP 800-53 Revision 4 (v4): IR-9 d NIST: NIST SP 800-53 Revision 5 (v5): IR-9 e
CCI-002810 (policy): Respond to information spills by identifying other systems or system components that may have been subsequently contaminated.
References: NIST: NIST SP 800-53 Revision 4 (v4): IR-9 e NIST: NIST SP 800-53 Revision 5 (v5): IR-9 f
CCI-002811 (policy): Respond to information spills by performing additional organization-defined actions.
References: NIST: NIST SP 800-53 Revision 4 (v4): IR-9 f NIST: NIST SP 800-53 Revision 5 (v5): IR-9 g
CCI-002812 (policy): Defines additional actions required to respond to information spills.
References: NIST: NIST SP 800-53 Revision 4 (v4): IR-9 f NIST: NIST SP 800-53 Revision 5 (v5): IR-9 g
CCI-002816 (policy): Provide information spillage response training according to an organization-defined frequency.
References: NIST: NIST SP 800-53 Revision 4 (v4): IR-9 (2) NIST: NIST SP 800-53 Revision 5 (v5): IR-9 (2)
CCI-002817 (policy): Defines the frequency with which to provide information spillage response training.
References: NIST: NIST SP 800-53 Revision 4 (v4): IR-9 (2) NIST: NIST SP 800-53 Revision 5 (v5): IR-9 (2)
CCI-002818 (policy): Implement organization-defined procedures to ensure that organizational personnel impacted by information spills can continue to carry out assigned tasks while contaminated systems are undergoing corrective actions.
References: NIST: NIST SP 800-53 Revision 4 (v4): IR-9 (3) NIST: NIST SP 800-53 Revision 5 (v5): IR-9 (3)
CCI-002819 (policy): Defines the procedures to be implemented to ensure that organizational personnel impacted by information spills can continue to carry out assigned tasks while contaminated systems are undergoing corrective actions.
References: NIST: NIST SP 800-53 Revision 4 (v4): IR-9 (3) NIST: NIST SP 800-53 Revision 5 (v5): IR-9 (3)
CCI-002820 (policy): Employ organization-defined controls for personnel exposed to information not within assigned access authorizations.
References: NIST: NIST SP 800-53 Revision 4 (v4): IR-9 (4) NIST: NIST SP 800-53 Revision 5 (v5): IR-9 (4)
CCI-002821 (policy): Defines the controls to be employed for personnel exposed to information not within assigned access authorizations.
References: NIST: NIST SP 800-53 Revision 4 (v4): IR-9 (4) NIST: NIST SP 800-53 Revision 5 (v5): IR-9 (4)
CCI-000852 (policy): Develop and document an organization-level; mission/business process-level; and/or system-level maintenance policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.
References: NIST: NIST SP 800-53 (v3): MA-1 a NIST: NIST SP 800-53 Revision 4 (v4): MA-1 a 1 NIST: NIST SP 800-53 Revision 5 (v5): MA-1 a 1 (a) NIST: NIST SP 800-53A (v1): MA-1.1 (i and ii)
CCI-000853 (policy): Disseminate an organization-level; mission/business process-level; and/or system-level maintenance policy to organization-defined personnel or roles.
References: NIST: NIST SP 800-53 (v3): MA-1 a NIST: NIST SP 800-53 Revision 4 (v4): MA-1 a 1 NIST: NIST SP 800-53 Revision 5 (v5): MA-1 a 1 NIST: NIST SP 800-53A (v1): MA-1.1 (iii)
CCI-000855 (policy): Develop and document procedures to facilitate the implementation of the system maintenance policy and associated system maintenance controls.
References: NIST: NIST SP 800-53 (v3): MA-1 b NIST: NIST SP 800-53 Revision 4 (v4): MA-1 a 2 NIST: NIST SP 800-53 Revision 5 (v5): MA-1 a 2 NIST: NIST SP 800-53A (v1): MA-1.1 (iv and v)
CCI-000856 (policy): Disseminate procedures to facilitate the implementation of the system maintenance policy and associated system maintenance controls to organization-defined personnel or roles.
References: NIST: NIST SP 800-53 (v3): MA-1 b NIST: NIST SP 800-53 Revision 4 (v4): MA-1 a 2 NIST: NIST SP 800-53 Revision 5 (v5): MA-1 a 2 NIST: NIST SP 800-53A (v1): MA-1.1 (vi)
CCI-002861 (policy): Defines the personnel or roles to whom an organization-level; mission/business process-level; and/or system-level maintenance policy is disseminated.
References: NIST: NIST SP 800-53 Revision 4 (v4): MA-1 a 1 NIST: NIST SP 800-53 Revision 5 (v5): MA-1 a 1 (a)
CCI-002862 (policy): Defines the personnel or roles to whom system maintenance procedures are to be disseminated.
References: NIST: NIST SP 800-53 Revision 4 (v4): MA-1 a 2 NIST: NIST SP 800-53 Revision 5 (v5): MA-1 a 2
CCI-004165 (policy): Develop and document an organization-level; mission/business process-level; and/or system-level maintenance policy that is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines.
References: NIST: NIST SP 800-53 Revision 5 (v5): MA-1 a 1 (b)
CCI-004166 (policy): Designate an organization-defined official to manage the development, documentation, and dissemination of the maintenance policy.
References: NIST: NIST SP 800-53 Revision 5 (v5): MA-1 b
CCI-004167 (policy): Designate an organization-defined official to manage the development, documentation, and dissemination of the maintenance procedures.
References: NIST: NIST SP 800-53 Revision 5 (v5): MA-1 b
CCI-004168 (policy): Defines the official who will manage the development, documentation, and dissemination of the maintenance policy.
References: NIST: NIST SP 800-53 Revision 5 (v5): MA-1 b
CCI-004169 (policy): Defines the official who will manage the development, documentation, and dissemination of the maintenance procedures.
References: NIST: NIST SP 800-53 Revision 5 (v5): MA-1 b
CCI-000851 (policy): Defines the frequency with which to review and update the current system maintenance policy.
References: NIST: NIST SP 800-53 (v3): MA-1 NIST: NIST SP 800-53 Revision 4 (v4): MA-1 b 1 NIST: NIST SP 800-53 Revision 5 (v5): MA-1 c 1 NIST: NIST SP 800-53A (v1): MA-1.2 (i)
CCI-000854 (policy): Review and update the current maintenance policy in accordance with organization-defined frequency.
References: NIST: NIST SP 800-53 (v3): MA-1 a NIST: NIST SP 800-53 Revision 4 (v4): MA-1 b 1 NIST: NIST SP 800-53 Revision 5 (v5): MA-1 c 1 NIST: NIST SP 800-53A (v1): MA-1.2 (ii)
CCI-000857 (policy): Review and update the current maintenance procedures in accordance with organization-defined frequency.
References: NIST: NIST SP 800-53 (v3): MA-1 b NIST: NIST SP 800-53 Revision 4 (v4): MA-1 b 2 NIST: NIST SP 800-53 Revision 5 (v5): MA-1 c 2 NIST: NIST SP 800-53A (v1): MA-1.2 (iv)
CCI-001628 (policy): Defines a frequency with which to review and update the current maintenance procedures.
References: NIST: NIST SP 800-53 (v3): MA-1 NIST: NIST SP 800-53 Revision 4 (v4): MA-1 b 2 NIST: NIST SP 800-53 Revision 5 (v5): MA-1 c 2 NIST: NIST SP 800-53A (v1): MA-1.2 (iii)
CCI-004170 (policy): Review and update the current maintenance policy following organization-defined events.
References: NIST: NIST SP 800-53 Revision 5 (v5): MA-1 c 1
CCI-004171 (policy): Defines the events following reviewing and updating the current maintenance policy.
References: NIST: NIST SP 800-53 Revision 5 (v5): MA-1 c 1
CCI-004172 (policy): Review and update the current maintenance procedures following organization-defined events.
References: NIST: NIST SP 800-53 Revision 5 (v5): MA-1 c 2
CCI-004173 (policy): Defines the events following reviewing and updating the current maintenance procedures.
References: NIST: NIST SP 800-53 Revision 5 (v5): MA-1 c 2
CCI-002866 (policy): Schedule maintenance on system components in accordance with manufacturer or vendor specifications and/or organizational requirements.
References: NIST: NIST SP 800-53 Revision 4 (v4): MA-2 a NIST: NIST SP 800-53 Revision 5 (v5): MA-2 a
CCI-002868 (policy): Document records of maintenance on system components in accordance with manufacturer or vendor specifications and/or organizational requirements.
References: NIST: NIST SP 800-53 Revision 4 (v4): MA-2 a NIST: NIST SP 800-53 Revision 5 (v5): MA-2 a
CCI-002869 (policy): Review records of maintenance on system components in accordance with manufacturer or vendor specifications and/or organizational requirements.
References: NIST: NIST SP 800-53 Revision 4 (v4): MA-2 a NIST: NIST SP 800-53 Revision 5 (v5): MA-2 a
CCI-002870 (policy): Schedule repair on system components in accordance with manufacturer or vendor specifications and/or organizational requirements.
References: NIST: NIST SP 800-53 Revision 4 (v4): MA-2 a NIST: NIST SP 800-53 Revision 5 (v5): MA-2 a
CCI-002872 (policy): Document repair on system components in accordance with manufacturer or vendor specifications and/or organizational requirements.
References: NIST: NIST SP 800-53 Revision 4 (v4): MA-2 a NIST: NIST SP 800-53 Revision 5 (v5): MA-2 a
CCI-002873 (policy): Review records of repairs on system components in accordance with manufacturer or vendor specifications and/or organizational requirements.
References: NIST: NIST SP 800-53 Revision 4 (v4): MA-2 a NIST: NIST SP 800-53 Revision 5 (v5): MA-2 a
CCI-004174 (policy): Schedule replacement on system components in accordance with manufacturer or vendor specifications and/or organizational requirements.
References: NIST: NIST SP 800-53 Revision 5 (v5): MA-2 a
CCI-004175 (policy): Document replacement on system components in accordance with manufacturer or vendor specifications and/or organizational requirements.
References: NIST: NIST SP 800-53 Revision 5 (v5): MA-2 a
CCI-004176 (policy): Review records of replacement on system components in accordance with manufacturer or vendor specifications and/or organizational requirements.
References: NIST: NIST SP 800-53 Revision 5 (v5): MA-2 a
CCI-004177 (policy): Approve all maintenance activities, whether performed on site or remotely.
References: NIST: NIST SP 800-53 Revision 5 (v5): MA-2 b
CCI-004178 (policy): Monitor all maintenance activities, whether performed on site or remotely.
References: NIST: NIST SP 800-53 Revision 5 (v5): MA-2 b
CCI-004179 (policy): Approve all maintenance activities, whether the system or system components are serviced on site or removed to another location.
References: NIST: NIST SP 800-53 Revision 5 (v5): MA-2 b
CCI-004180 (policy): Monitor all maintenance activities, whether the system or system components are serviced on site or removed to another location.
References: NIST: NIST SP 800-53 Revision 5 (v5): MA-2 b
CCI-000860 (policy): Require that organization-defines personnel or roles explicitly approve the removal of the system or system components from organizational facilities for off-site maintenance, repair, or replacement.
References: NIST: NIST SP 800-53 (v3): MA-2 c NIST: NIST SP 800-53 Revision 4 (v4): MA-2 c NIST: NIST SP 800-53 Revision 5 (v5): MA-2 c NIST: NIST SP 800-53A (v1): MA-2.1 (iii)
CCI-002874 (policy): Defines the personnel or roles who can explicitly approve the removal of the system or system components from organizational facilities for off-site maintenance, repairs or replacement.
References: NIST: NIST SP 800-53 Revision 4 (v4): MA-2 c NIST: NIST SP 800-53 Revision 5 (v5): MA-2 c
CCI-000861 (policy): Sanitize equipment to remove organization-defined information from associated media prior to removal from organizational facilities for off-site maintenance, repairs or replacement.
References: NIST: NIST SP 800-53 (v3): MA-2 d NIST: NIST SP 800-53 Revision 4 (v4): MA-2 d NIST: NIST SP 800-53 Revision 5 (v5): MA-2 d NIST: NIST SP 800-53A (v1): MA-2.1 (iv)
CCI-004181 (policy): Defines the information to be removed from associated media.
References: NIST: NIST SP 800-53 Revision 5 (v5): MA-2 d
CCI-000862 (policy): Check all potentially impacted controls to verify that the controls are still functioning properly following maintenance, repair or replacement actions.
References: NIST: NIST SP 800-53 (v3): MA-2 e NIST: NIST SP 800-53 Revision 4 (v4): MA-2 e NIST: NIST SP 800-53 Revision 5 (v5): MA-2 e NIST: NIST SP 800-53A (v1): MA-2.1 (v)
CCI-002875 (policy): Include organization-defined information in organizational maintenance records.
References: NIST: NIST SP 800-53 Revision 4 (v4): MA-2 f NIST: NIST SP 800-53 Revision 5 (v5): MA-2 f
CCI-002876 (policy): Defines the information to include in organizational maintenance records.
References: NIST: NIST SP 800-53 Revision 4 (v4): MA-2 f NIST: NIST SP 800-53 Revision 5 (v5): MA-2 f
CCI-004182 (policy): Schedule maintenance, repair, and replacement actions for the system using organization-defined automated mechanisms.
References: NIST: NIST SP 800-53 Revision 5 (v5): MA-2 (2) (a)
CCI-004183 (policy): Conduct maintenance, repair, and replacement actions for the system using organization-defined automated mechanisms.
References: NIST: NIST SP 800-53 Revision 5 (v5): MA-2 (2) (a)
CCI-004184 (policy): Document maintenance, repair, and replacement actions for the system using organization-defined automated mechanisms.
References: NIST: NIST SP 800-53 Revision 5 (v5): MA-2 (2) (a)
CCI-002864 (policy): Produce up-to date, accurate, and complete records of all maintenance requested, scheduled, in process, and completed.
References: NIST: NIST SP 800-53 Revision 4 (v4): MA-2 (2) (b) NIST: NIST SP 800-53 Revision 5 (v5): MA-2 (2) (b)
CCI-002865 (policy): Produce up-to date, accurate, and complete records of all repair actions requested, scheduled, in process, and completed.
References: NIST: NIST SP 800-53 Revision 4 (v4): MA-2 (2) (b) NIST: NIST SP 800-53 Revision 5 (v5): MA-2 (2) (b)
CCI-004185 (policy): Produce up-to date, accurate, and complete records of all replacement actions requested, scheduled, in process, and completed.
References: NIST: NIST SP 800-53 Revision 5 (v5): MA-2 (2) (b)
CCI-000865 (policy): Approve the use of system maintenance tools.
References: NIST: NIST SP 800-53 (v3): MA-3 NIST: NIST SP 800-53 Revision 4 (v4): MA-3 NIST: NIST SP 800-53 Revision 5 (v5): MA-3 a NIST: NIST SP 800-53A (v1): MA-3.1 (i)
CCI-000866 (policy): Control the use of system maintenance tools.
References: NIST: NIST SP 800-53 (v3): MA-3 NIST: NIST SP 800-53 Revision 4 (v4): MA-3 NIST: NIST SP 800-53 Revision 5 (v5): MA-3 a NIST: NIST SP 800-53A (v1): MA-3.1 (i)
CCI-000867 (policy): Monitor the use of system maintenance tools.
References: NIST: NIST SP 800-53 (v3): MA-3 NIST: NIST SP 800-53 Revision 4 (v4): MA-3 NIST: NIST SP 800-53 Revision 5 (v5): MA-3 a NIST: NIST SP 800-53A (v1): MA-3.1 (i)
CCI-004186 (policy): Review previously approved system maintenance tools on an organization-defined frequency.
References: NIST: NIST SP 800-53 Revision 5 (v5): MA-3 b
CCI-004187 (policy): Defines the frequency for reviewing previously approved system maintenance tools.
References: NIST: NIST SP 800-53 Revision 5 (v5): MA-3 b
CCI-000869 (policy): Inspect the maintenance tools used by maintenance personnel for improper or unauthorized modifications.
References: NIST: NIST SP 800-53 (v3): MA-3 (1) NIST: NIST SP 800-53 Revision 4 (v4): MA-3 (1) NIST: NIST SP 800-53 Revision 5 (v5): MA-3 (1) NIST: NIST SP 800-53A (v1): MA-3 (1).1
CCI-000870 (policy, technical): Check media containing diagnostic and test programs for malicious code before the media are used in the system.
References: NIST: NIST SP 800-53 (v3): MA-3 (2) NIST: NIST SP 800-53 Revision 4 (v4): MA-3 (2) NIST: NIST SP 800-53 Revision 5 (v5): MA-3 (2) NIST: NIST SP 800-53A (v1): MA-3 (2).1
CCI-000871 (policy): Prevent the unauthorized removal of maintenance equipment containing organizational information by: (a) verifying that there is no organizational information contained on the equipment; (b) sanitizing or destroying the equipment; (c) retaining the equipment within the facility; or (d) obtaining an exemption from organization-defined personnel or roles explicitly authorizing removal of the equipment from the facility.
References: NIST: NIST SP 800-53 (v3): MA-3 (3) NIST: NIST SP 800-53 Revision 4 (v4): MA-3 (3) NIST: NIST SP 800-53 Revision 5 (v5): MA-3 (3) NIST: NIST SP 800-53A (v1): MA-3 (3).1
CCI-002882 (policy): Defines the personnel or roles who can provide an exemption that explicitly authorizes removal of equipment from the facility.
References: NIST: NIST SP 800-53 Revision 4 (v4): MA-3 (3) (d) NIST: NIST SP 800-53 Revision 5 (v5): MA-3 (3) (d)
CCI-002883 (technical): Restrict the use of maintenance tools to authorized personnel only.
References: NIST: NIST SP 800-53 Revision 4 (v4): MA-3 (4) NIST: NIST SP 800-53 Revision 5 (v5): MA-3 (4)
CCI-004188 (policy, technical): Monitor the use of maintenance tools that execute with increased privilege.
References: NIST: NIST SP 800-53 Revision 5 (v5): MA-3 (5)
CCI-004189 (policy, technical): Inspect the maintenance tools to ensure the latest software updates and patches are installed.
References: NIST: NIST SP 800-53 Revision 5 (v5): MA-3 (6)
CCI-000873 (policy): Approve nonlocal maintenance and diagnostic activities.
References: NIST: NIST SP 800-53 (v3): MA-4 a NIST: NIST SP 800-53 Revision 4 (v4): MA-4 a NIST: NIST SP 800-53 Revision 5 (v5): MA-4 a NIST: NIST SP 800-53A (v1): MA-4.1 (i)
CCI-000874 (policy): Monitor nonlocal maintenance and diagnostic activities.
References: NIST: NIST SP 800-53 (v3): MA-4 a NIST: NIST SP 800-53 Revision 4 (v4): MA-4 a NIST: NIST SP 800-53 Revision 5 (v5): MA-4 a NIST: NIST SP 800-53A (v1): MA-4.1 (i)
CCI-000876 (policy): Allow the use of nonlocal maintenance and diagnostic tools only as consistent with organizational policy and documented in the security plan for the information system.
References: NIST: NIST SP 800-53 (v3): MA-4 b NIST: NIST SP 800-53 Revision 4 (v4): MA-4 b NIST: NIST SP 800-53 Revision 5 (v5): MA-4 b NIST: NIST SP 800-53A (v1): MA-4.1 (iii)
CCI-000877 (technical): Employ strong authentication in the establishment of nonlocal maintenance and diagnostic sessions.
References: NIST: NIST SP 800-53 (v3): MA-4 c NIST: NIST SP 800-53 Revision 4 (v4): MA-4 c NIST: NIST SP 800-53 Revision 5 (v5): MA-4 c NIST: NIST SP 800-53A (v1): MA-4.1 (iv)
CCI-000878 (policy): Maintain records for nonlocal maintenance and diagnostic activities.
References: NIST: NIST SP 800-53 (v3): MA-4 d NIST: NIST SP 800-53 Revision 4 (v4): MA-4 d NIST: NIST SP 800-53 Revision 5 (v5): MA-4 d NIST: NIST SP 800-53A (v1): MA-4.1 (v)
CCI-004190 (policy): Terminate session when nonlocal maintenance is completed.
References: NIST: NIST SP 800-53 Revision 5 (v5): MA-4 e
CCI-004191 (policy): Terminate network connection when nonlocal maintenance is completed.
References: NIST: NIST SP 800-53 Revision 5 (v5): MA-4 e
CCI-002884 (technical): Log organization-defined audit events for nonlocal maintenance and diagnostic sessions.
References: NIST: NIST SP 800-53 Revision 4 (v4): MA-4 (1) (a) NIST: NIST SP 800-53 Revision 5 (v5): MA-4 (1) (a)
CCI-002885 (policy): Defines the audit events for logged for nonlocal maintenance and diagnostic sessions.
References: NIST: NIST SP 800-53 Revision 4 (v4): MA-4 (1) (a) NIST: NIST SP 800-53 Revision 5 (v5): MA-4 (1) (a)